Exclusive: Cookie Deception Sparks Tension Between Buy and Sell Side in IAB Tech Lab

Buy-side tech platforms are accusing publishers and the tech firms they work with of using deceptive practices to identify audiences in discussions happening within the IAB Tech Lab over the past month, ADWEEK can exclusively report.

These tactics, spurred by signal loss, can obscure digital marketing efficacy, making techniques like conversion tracking and frequency capping more difficult for marketers.

In digital advertising, demand-side platforms (DSPs) decide which audiences they want to buy on behalf of their brand clients using third-party cookies, which identify users across the web.

Other ways of identifying users have emerged as web browsers like Safari, Firefox, and soon Chrome, have deprecated third-party cookies. Sell-side platforms are using some of these techniques without the buy side knowing, the DSPs allege, according to six sources.

“This is literally an exchange applying some technology they never told anybody,” said one DSP executive, who requested anonymity to discuss sensitive industry relations. “It’s manipulating the contents of a bid request in abnormal ways whenever you feel like. It’s a really alarming precedent.”

As signal loss continues, due to browser crack-down and privacy-preserving regulation, sell-side partners are looking for ways to identify audiences to keep marketer budgets flowing. But the extent of how shady these practices are depends on the transparency between the DSP and supply-side platforms (SSPs).

Deceptive?

These allegedly clandestine targeting mechanisms often take the form of probabilistic identifiers, which use machine learning to guess who a reader of a website might be. This includes ID bridging, a technique where an ad-tech firm approximates who a user might be in a cookieless environment like Safari by linking the user to their identity on Chrome. And because the buy side does not know the exact method the sell side is using instead of cookies, some equate this to outright fraud.

Sell-side platforms and publisher networks have not necessarily denied that they engage in ID bridging and other probabilistic techniques in IAB Tech Lab conversations. But some reject that these practices are being done deceptively, arguing DSPs have ways of knowing what’s going on, two sources said.

This smells to me as a desperate way to recover some of that revenue.

—Anonymous DSP exec

These techniques in question are often used in cookieless environments and became more apparent in early February, a month after Google Chrome deprecated cookies for 1% of web traffic, which is when the conversations in the IAB Tech Lab began.

“We are aware of and have addressed this practice within the Programmatic Supply Chain Working Group, where we are actively exploring methods and updates to Open RTB to ensure transparency and full disclosure,” said Anthony Katsur, CEO of IAB Tech Lab. “We are actively engaged with industry stakeholders to gather proposals and collaborate on developing industry-wide standards that address these concerns.”

Whether this type of ID bridging is deceptive depends on whether DSPs had any reason to know that the sell-side was using these techniques. Not everyone at a DSP might know the structure of their deals with the sell-side, said Paul Bannister, chief strategy officer at Raptive.

“There is missing communication between business teams and technical teams on the buy side,” Bannister said.

Not precise or privacy-safe

Buyers are particularly concerned the techniques the sell-side is using instead of cookies—particularly in cookieless environments—are not always precise or privacy-safe.

Often mentioned was ID bridging, where the ad-tech firm tries to link a user in a cookieless environment like Safari with who they might be on Chrome, by using a signal like an IP address or email to match the user. Not only are the privacy ethics of this practice debated, but it’s a technique that won’t work once Chrome fully deprecates third-party cookies.

“This smells to me as a desperate way to recover some of that revenue,” that came from cookies, said the DSP executive. “It is very myopic. What happens when the cookiepacoplyse comes? This is no longer possible.”

Publishers and their tech partners might use other probabilistic techniques to guess who a user might be without cookies, said Peter Day, chief technology officer at DSP Quantcast.

“What’s the probability that the person I saw on this website is on this other website or has this other email address?” Day said, noting the kinds of calculations these identifiers might make. “Probabilistic methods are fine as long as you know they’re probabilistic.”

Legit alternatives

Not all the ways the sell-side might identify audiences without cookies are based on soon-to-disappear or shaky evidence.

An SSP executive, who requested anonymity to discuss sensitive industry relations, said their company only works with identifiers that have some legitimate method to identify users in cookieless environments, like email addresses, and rejects vendors with weaker privacy controls or questionable data sources.

“On one side [are solutions that] sound great and then you’ve got people who are inserting IDs that have no connection whatsoever … that are completely fraudulent and completely should not be allowed,” said Bannister. “Then you got a ton of stuff in between. The important thing is where is the line. What is good? What is consistent with how buyers want to buy and what crosses that line?”

Identifying the problem

The anonymous DSP executive learned of the scope of the problem through their own forensics.

“My way of determining this is to examine and compare the ID received in the bid request, told to us by the exchange, to the ID we see directly in our cookie when we serve the ad,” the DSP source said. “So I’m looking at the rate at which the ID is consistent from the bid request to the ad delivery.”

I haven’t heard a single DSP, say, ‘Yeah, I knew that was happening’

—Anonymous exec

Using a cookie, the ID in the bid request should be consistent with the ID attached to the resulting ad. When there are discrepancies, it’s likely the SSP or publisher is using another kind of ID or technique.

According to the DSP source’s bidstream data, the consistency rate for one SSP was only 36%, meaning it was hard to verify that the user targeted was the one receiving the ad. This affects an estimated 5%-10% of the impressions this DSP runs, making conversion tracking and frequency capping more difficult.

Many DSPs first learned that their sell-side partners were ID bridging or using probabilistic techniques instead of cookies to identify users at the IAB Tech Lab conversations in February.

“I haven’t heard a single DSP, say, ‘Yeah, I knew that was happening,’” said a source familiar with IAB tech lab conversations.

Day, however, said he first noticed these identification techniques in 2018-2019 when Quantcast launched cookieless measurement.

“When we started to develop our first cookieless measurement, there was a lot of smoke and mirrors,” Day said.