Programmatic advertising, explained by following one impression

Programmatic advertising is buying and selling ad space through software instead of by email and insertion order. When a web page or app loads, its ad slot is offered to buyers' systems, which decide on their own whether to bid and how much — usually in an auction that ends before the page has finished loading.

Most explanations stop at a diagram of boxes and arrows. This one follows a single impression through the whole chain instead, because almost every step leaves something behind that you can open and read: a public file, a field in a bid request, an encoded consent string, an ad tag. Where that is true, there is a link to a free tool on this site that reads it for you.

Who is involved

Following one impression, step by step

Say someone opens a news article. There is one 300×250 slot on the page. Here is what happens to it.

1. The slot is put up for sale

The page calls the publisher's ad server, which hands the slot to one or more SSPs. Each SSP now has to describe the slot to buyers in a format every DSP understands. That format is OpenRTB, published by the IAB Tech Lab — the current version is 2.6.

2. The SSP writes a bid request

The bid request is a block of JSON sent to every DSP the SSP works with. The parts that matter most:

• imp — the slot itself: its sizes, the minimum price (bidfloor, as a CPM) and the currency of that minimum (bidfloorcur).
• site or app — where the ad will appear. A request carries one or the other, never both.
• device and user — what is known about the screen and the person in front of it.
• regs — which privacy laws apply.
• source.schain — the list of every company that has handled this impression so far.
• tmax — how many milliseconds the SSP will wait for an answer.

Every field is described on the OpenRTB BidRequest reference, with an example request.

3. Consent travels with it

If the person is in Europe, regs.gdpr is set to 1 and user.consent carries a TCF consent string: a compact code recording which companies the person agreed to and for what purposes. Every buyer reads it before using any personal data. You can paste one into the consent string decoder to see what it says — including the cases where a string is technically valid but buyers will still treat it as no consent.

4. The buyer checks the seller is real

Before bidding, a careful DSP checks that the SSP is actually allowed to sell this publisher's inventory. Three public pieces have to line up:

1. The publisher's ads.txt file, at the root of its domain, lists every company authorised to sell its ads and the account ID each one uses. Check any site with the ads.txt checker.
2. The SSP's sellers.json file says who owns that account ID — the publisher itself or a reseller. Look one up with the sellers.json lookup.
3. The schain in the bid request lists the same companies and IDs in the order they handled this impression. If it is marked incomplete, many buyers stop here.

If these disagree, the impression may be resold, mislabelled or fraudulent — and a buyer that cares will simply not bid.

5. The DSP decides whether and how much to bid

The DSP compares the impression with every live campaign: does the audience, site, size and location match, is the campaign under its frequency cap, and is it spending on schedule? It then picks a price and answers within tmax. A bid that arrives late is thrown away with no error message, which is the most common reason a campaign's win rate looks low for no visible reason.

6. The auction

The SSP collects the bids, drops any under the floor, and picks a winner. The bid request's at field says which rules apply: 1 means first price, where the winner pays what it bid, and 2 means second price, where it pays just above the runner-up. The spec still defaults to 2, but most major exchanges have moved to first-price auctions, which is why buyers now shade their own bids down.

7. The ad is delivered

The winning DSP's response already contains the ad — HTML for a banner, or a VAST tag for video. VAST tags often point to another VAST tag, which points to another; each hop is a chance to fail. The VAST validator follows the chain hop by hop and names the error at each one.

8. Everyone counts it — differently

The publisher's ad server, the SSP, the DSP and often a third-party verification vendor each count the impression with their own rules and timing. Their numbers never match exactly, and a gap of a few percent is normal. Billing is usually on a CPM — the price per thousand impressions — so the CPM calculator turns a spend and an impression count into the rate you actually paid.

Each company in the chain also takes a share of the money. If you buy or resell media, the margin calculator shows how much of the price each layer keeps — and why a 30% markup is not a 30% margin.

The four ways to buy

All four use the same bid requests. What changes is who is allowed to bid and whether the price is fixed. Deals appear inside imp.pmp, each with its own deal ID — when a deal is not delivering, that is the first place to look.

Where it goes wrong in practice

From the trafficking side, most “programmatic isn't delivering” problems come down to a short list:

• Bids arriving after tmax. They vanish without an error. Compare response time to tmax before touching price.
• A floor in a different currency. bidfloor is in bidfloorcur, which defaults to USD. A floor of 2.00 means something very different in yen.
• The seller is missing from ads.txt. The impression is offered, and buyers that check quietly decline it.
• A consent string that decodes but does not count. Buyers treat the user as non-consented and bid low or not at all.
• A broken video chain. One bad wrapper hop and the whole ad fails with a VAST error code — see the VAST error code reference.

Common questions