Inside the ad machine: how an ad finds you

The auction from the previous lesson does not happen in one place. On the open web it is the last step of a supply chain with several companies between the advertiser's money and the publisher's page, each running software, each taking a cut.

The cast, in plain terms:

• Advertiser wants to reach people.
• Demand-side platform (DSP) is the software the advertiser uses to buy, bidding on their behalf across many sources.
• Ad exchange is the marketplace where the auction actually runs.
• Supply-side platform (SSP) is the software a publisher uses to sell its slots into that marketplace.
• Publisher owns the page and the audience.

So money flows advertiser to DSP to exchange to SSP to publisher, and an ad flows back the other way. Walled gardens like the big social platforms collapse this chain inside one company, but the open web is this relay, and its length is the reason it behaves the way it does.

The mechanism that runs the open web is real-time bidding, RTB: a fresh auction for a single impression, triggered the instant a page begins to load.

The sequence, all inside roughly 100 milliseconds:

1. You open a page. The publisher's SSP creates a bid request describing the opportunity: the site, the ad size, rough location, device, and whatever identifiers exist for the user.
2. The exchange broadcasts that request to many DSPs at once.
3. Each DSP decides, in a few milliseconds, whether this impression matches a campaign and what it is worth, and returns a bid.
4. The auction picks a winner.
5. The winning ad is fetched and rendered, all before the page finishes painting.

The thing to hold onto: the product being auctioned is a description of you, assembled and sold in the time it takes a page to appear. The advertiser is not buying a slot on a site so much as buying this impression, for this user, right now.

Publishers used to sell leftover inventory in a waterfall: offer it to the best-paying partner first, and if they declined, cascade down to the next, and the next. Each step added delay, and the order was based on historical averages, so a buyer who would have paid more further down the chain never got the chance.

The fix, header bidding, flips it: the publisher asks many demand sources to bid simultaneously, before the page even calls its own ad server, then sends the highest real bid to compete. Parallel instead of sequential.

The general pattern is worth naming: a sequential process ranked by averages leaves money on the table, and forcing everything to compete at once recovers it. It is the same insight as ranking ads by expected value rather than serving them in a fixed order.

A bid is only worth making if the DSP knows who it is bidding on. Targeting is how a person becomes a set of attributes an advertiser can buy. There are three broad kinds, and they differ sharply in how much they need to know about you.

• Contextual. Target the page, not the person: show running shoes next to a marathon article. Needs nothing about the user. Old, and quietly resurgent because it survives privacy changes.
• Behavioural. Target the person based on past activity: sites visited, things searched, videos watched, assembled into interest segments.
• Audience-based. Target a list: your own customers uploaded and matched, or a lookalike audience the platform builds by finding users statistically similar to your best customers.

Lookalikes are where machine learning enters advertising directly. You supply examples of people who converted; the platform finds more of them. It is the recommender problem from the algorithms path, pointed at ads: given these positive examples, retrieve similar users.

Behavioural and audience targeting both need one hard thing: recognising that the person on this page is the same person seen elsewhere. That recognition runs on identifiers.

• A third-party cookie was the classic web identifier: a tag one company could read across many different sites, which is exactly what let an advertiser follow you around the web.
• A mobile advertising ID did the same job inside phone apps.
• First-party data is what a site knows about you from your own activity on it, a login, a purchase, and it does not depend on cross-site tracking at all.

The entire behavioural-targeting apparatus rests on cross-site and cross-app identifiers being available and stable. They are now neither, by deliberate design of browsers and phone platforms, which is the subject of the next lesson.

Hold the distinction clearly, because it decides everything downstream: first-party identity is something you have a direct relationship for; third-party identity is something inferred by watching you across places you never connected. The second is the one going away.

Every company in the relay takes a fee, and because there are several, the total is large and was for years hard to see. Advertisers could not account for where a meaningful share of their money went.

The most-cited measurement is the ISBA/PwC Programmatic Supply Chain Transparency Study. Its 2020 report found that only about 51 percent of advertiser spend reached publishers, with roughly 15 percent an unattributable 'unknown delta', money that vanished into the chain and could not be traced at all. The follow-up study reported in January 2023 found improvement: publishers' share up to about 57 percent and the unknown delta down to around 3 percent.

Read those numbers as a health check on a supply chain, not a scandal. Roughly two-fifths of spend going to intermediation is what a long automated relay costs, and a large untraceable slice is what happens when many parties hold different fragments of the record.

The structural lesson: the more hops between payer and payee, the more that leaks and the harder it is to audit. It is exactly why advertisers push toward shorter paths, direct deals, and walled gardens where the chain is one company.

That fee structure explains the biggest split in the industry. A walled garden, a large social or search platform, owns the whole chain: it is the exchange, the buying tool, the audience data, and the inventory, all in one company.

The trade is stark. The open web offers control, competition and portability, at the cost of complexity and leakage. The walled garden offers simplicity, durable logged-in identity, and strong performance, at the cost of independent verification, you largely trust the platform's own numbers, on inventory it also sells.

As third-party identifiers disappear, the walled gardens' logged-in identity becomes even more valuable, which is why privacy changes, meant to protect users, have also tended to concentrate advertising inside the largest platforms.

A page load becomes a bid request describing the user, broadcast to many buyers, auctioned, and answered with an ad, with fees taken at each hop on the open web.