What is real-time bidding (RTB) — the 100-millisecond ad auction that broadcasts your data to thousands
Real-time bidding (RTB) is the automated auction that sells an ad slot in roughly a tenth of a second each time a web page or app loads. The seller sends a bid request describing the slot, device and user to many bidding platforms at once, and the highest bidder's ad appears — but every participant receives the user data, win or lose. The Irish Council for Civil Liberties estimated in 2022 that a US user's data is broadcast 747 times a day. In October 2026, Citizen Lab showed the same pipeline delivering spyware.
The three lines
- Mechanics — page loads, bid request broadcast, platforms bid, top bid's ad renders, ~100 ms
- Data — ad ID, IP, device, location and interests ride along; losing bidders still get them
- Risk — October 2026 AdFection case used ad auctions to send spyware to chosen devices
Key questions
- What is real-time bidding in advertising
- **An automated auction that sells one ad impression the moment a screen loads.** | Player | Role | |---|---| | Publisher (site or app) | Offers the slot | | SSP (supply-side platform) | Auctions it for the publisher | | Ad exchange | Runs the auction | | DSP (demand-side platform) | Bids automatically for advertisers | | Advertiser | Sets budget and targeting |
- What data is in an RTB bid request
- **Slot details plus data that can identify the user.** | Data | Example | |---|---| | Advertising ID | iOS IDFA, Android advertising ID | | Network | IP address | | Device | Model, OS, browser | | Location | GPS or IP-based (if permitted) | | Context | Site or app, content category | | Segments | Inferred interests, age band, gender |
- RTB privacy concerns
- **Every bidder gets the data, whether or not it wins.** | Figure | ICCL (2022) | |---|---| | Daily broadcasts per person | 747 (US), 376 (Europe) | | Annual total | 178 trillion (US + Europe) | | Firms able to receive US data via Google RTB | 4,698 | These are advocacy-group estimates.
Real-time bidding (RTB) is the auction behind most online ads. When you open an article, the ad slot on that page is sold in roughly a tenth of a second while the page renders, and the winner's ad appears. Algorithms price each individual impression instead of humans buying placements in bulk.
The convenience has a cost. To run the auction, the seller must tell bidders who will see the ad, and that description can identify you. On October 15, 2026, Citizen Lab showed the same pipeline being used to push spyware to chosen devices — the AdFection case — turning an RTB privacy problem into a security one.
1. What happens in 100 milliseconds
| Step | Event | Actor |
|---|---|---|
| 1 | User opens a page or app | User |
| 2 | Publisher hands the slot to a supply-side platform (SSP) | Publisher |
| 3 | SSP sends a bid request — slot, device, user data — to an exchange | SSP |
| 4 | Exchange broadcasts the request to many demand-side platforms (DSPs) at once | Exchange |
| 5 | Each DSP matches it against advertiser criteria and bids | DSP |
| 6 | Winner chosen; ad code is delivered to the device | Exchange |
| 7 | Ad renders | Device |
Step 4 is the crux. The request goes to every eligible bidder simultaneously. Only one wins, but all receive the user data — what the industry calls "bidstream data."
2. What's in a bid request
| Category | Fields | Identifying? |
|---|---|---|
| Advertising ID | iOS IDFA, Android ad ID | Persistent device-level tracking |
| Network | IP address (sometimes truncated) | Household or office |
| Device | Model, OS version, browser | Fingerprinting when combined |
| Location | GPS or IP-based (if permitted) | Daily movement patterns |
| Context | Site or app, content category | Interests and leanings |
| Segments | Interest, age and gender estimates | Profile-linkable |
Individually these look anonymous; combined, they can point to a person. The Irish Council for Civil Liberties estimated in 2022 that a US user's data is broadcast 747 times a day (376 in Europe), 178 trillion times a year across both, and that 4,698 companies could receive US user data via Google's RTB. ICCL called RTB "the largest data breach ever"; the industry disputes the methodology.
3. How it became a spyware channel — AdFection
| Step | Normal advertising | AdFection (Discover-Tech) |
|---|---|---|
| Target | Audience segments | One person's ad ID, cookie ID or IP |
| Bid | On matching inventory | Whenever the target's bid request appears |
| Creative | Same ad for everyone | Clean ad to the exchange; malicious script only to the target |
| Outcome | Impression | Zero-click infection attempt |
| Scale (Mar-Jun 2026) | — | 3.77B bids, ~442M wins |
The advertising ID in the bid request became the target's address, and the ad delivery step became the payload channel. Some $109,000 bought over 400 million impressions with zero revenue — profiling at scale, with infection attempts reserved for selected devices. Confirmed victims include at least 45 Al Jazeera devices.
4. Sending less of your data
| Step | Effect | How |
|---|---|---|
| Reset or disable ad ID | Cuts long-term device tracking | iPhone: Settings > Privacy & Security > Tracking off; Android: Settings > Privacy > Ads > Delete advertising ID |
| Limit location | GPS stays out of bid requests | Per-app location "While Using" or "Never" |
| Browser tracking protection | Fewer third-party cookies and fingerprints | Safari, Firefox, Brave defaults |
| Ad blocker | No auction at all | Extensions or content blockers |
| High-risk mode | Shrinks unknown attack paths | iPhone Lockdown Mode, Android Advanced Protection |
Blocking ads hurts publishers that rely on them; for most people, deleting the ad ID and tightening location permissions sharply reduce what bid requests carry. For journalists and officials, Citizen Lab's researchers recommend blocking ads outright.
5. FAQ
| Question | Answer |
|---|---|
| Is RTB the same as programmatic? | RTB is the auction subset; programmatic also includes fixed-price private deals |
| Are names or phone numbers sent? | Not in standard requests, but some firms link ad IDs to phone numbers (Citizen Lab has a follow-up report pending) |
| Doesn't GDPR stop this? | Consent pop-ups (TCF) are used, but Belgium's regulator ruled in 2022 that IAB Europe's framework breached GDPR |
| Does every ad-supported site use RTB? | Most do |
6. What remains open
- Current figures: ICCL's numbers date from 2022.
- Rule changes: Google expelled Discover-Tech but announced no reduction in bid-request data.
- Follow-up: Citizen Lab's report on actors linking ad IDs to phone numbers is pending.