Analysis
What is Real Time Bidding?
January 15, 2025 |

Real Time Bidding (RTB) is an online advertising auction that uses sensitive personal information to facilitate the process to determine which digital ad will be displayed to a user on a given website or application. It happens 178 trillion times every year across the U.S. and Europe.
The Players
There are three types of platforms involved in an RTB auction: Supply Side Platforms (SSPs), Advertising Exchanges, and Demand Side Platforms (DSPs). SSPs primarily work with website or app publishers to help them participate in the RTB process. DSPs primarily work with advertisers to help them evaluate the value of user impressions and optimize the bid prices they put forth. Large companies often offer both seller and buyer-side products. In fact, many times Advertising Exchanges are incorporated into SSPs. Listed below are major players in the RTB ecosystem:
- Google
- Advertising Exchange: Google AdX
- SSP: Google AdManager
- DSP: Display & Video 360
- OpenX
- Describes itself as an SSP
- Offers both “OpenX Ad Exchange” & “OpenX Bidder”
- Xandr (Microsoft)
- Advertising Exchange
- SSP: Xandr Curate
- DSP: Xandr Invest
- Magnite (Rubicon Project)
- SSP: DV+
- Index Exchange
- Advertising Exchange: The Index Exchange Platform
- Amazon
- SSP: Amazon Publisher Services
- DSP: Amazon DSP
The Process
Nearly every time a person loads a page on a website or an app, an RTB auction takes place, largely unknown to the person. This auction broadcasts private information about the person to facilitate the bidding process to determine which ad will be shown to the person.
After a user loads a website or app, an SSP will send user data to Advertising Exchanges in a process known as an “RTB bid request.” The user data, often referred to as “bidstream data,” contains information like device identifiers, IP address, zip/postal code, GPS location, browsing history, location data, and more. After receiving the bidstream data, an Advertising Exchange will broadcast the data to several DSPs. The DSPs will then examine the broadcasted data to determine whether to make a bid on behalf of their client.
Ultimately, if the DSP wins the bid, its client’s advertisement will appear to the user. Since most RTB auctions are held on the server/exchange side, instead of the client/browser side, the user only actually sees the winner of the auction and would not be aware of the DSPs who bid and lost. But even the losing DSPs still benefit because they also receive and collect the user data broadcasted during the RTB auction process. This information can be added to existing dossiers DSPs have on a user. The prospect of obtaining bidstream data drives many companies to participate in the auction process even if they have no intention of ever placing an advertisement. Moreover, after data is broadcast, there is no way to know how entities will handle the data.
The Harms
- Tracking and profiling consumer behavior online is harmful. The practice of collecting, using, disclosing, and retaining users’ personal information online violates their privacy and undermines their autonomy.
- The FTC has highlighted potential concerns from RTB: ad auctions incentivize invasive data-sharing; ad auctions can send sensitive data across geographic borders; and ad auctions are designed to broadcast sensitive data widely and can shelter bad actors who exploit the data.
- Lawmakers have explained the potential harms from sharing consumers’ precise location information and data about their online behaviors to adversarial parties. These bad actors can then exploit users’ sensitive information.
- Consumers’ privacy is violated when entities disclose their information without authorization or in ways that thwart their expectations. While RTB remains invisible to most consumers, the FTC has explained that “some popular ad exchanges can handle tens of billions of auctions per day. Each auction involves a broadcast of consumer data being sent to potentially dozens of bidders simultaneously, despite only one of those parties—the winning bidder—actually using that data to serve a targeted ad.” There are few, if any, technical and administrative controls to safeguard consumer data from being used by those parties in unintended ways. This transferring of personal information contradicts user expectations because a user would not expect their sensitive personal information to be broadcast to potentially bad actors, even when an unrelated entity placed the ad that the user ultimately saw.
- There are no technical safeguards to ensure the restriction of RTB data once it has been broadcast. There are myriad harms resulting from the RTB system and widespread access to RTB data. The Irish Council for Civil Liberties has highlighted examples of these harms. Data brokers used RTB to profile Black Lives Matter protestors; the U.S. Department of Homeland Security and other agencies used it for warrantless phone tracking. It was implicated in the outing of a gay Catholic priest. ICCL uncovered the sale of RTB data revealing likely survivors of sexual abuse.

Support Our Work
EPIC's work is funded by the support of individuals like you, who allow us to continue to protect privacy, open government, and democratic values in the information age.
Donate