Every time a display ad is auctioned in milliseconds, one open protocol usually carries the bid request and the response. OpenRTB is that common language: an IAB Tech Lab standard that lets demand-side platforms bid into dozens of exchanges without building a custom integration for each.
What actually happens in a bid
The seller’s SSP or exchange turns an ad call into a bid request, posts it over HTTP as JSON, and gives buyers a short window. Only two fields are strictly required: an exchange-assigned ID and an impression array. Everything else—site, app, device, user, regs and source—adds context.
Each impression object lists the formats for sale, a bid floor in CPM and currency, private marketplace deal IDs, and block lists. The at attribute tells bidders whether the auction is first-price or second-price plus. The tmax field sets the timeout in milliseconds. Google’s Authorized Buyers documentation puts that window at 80 to 1,000 milliseconds, depending on format and auction type.
A bidder either passes with an empty 204 response or returns a bid response with seat, impression ID, price, advertiser domain, creative markup, and win or billing notice URLs. Macros such as ${AUCTION_PRICE} are replaced with the clearing price when those notices fire.
Why the plumbing matters for performance teams
This is not back-office trivia. The fields a publisher or SSP fills decide what a DSP can target, price and verify. Missing or poorly populated signals can remove inventory from your campaigns or make optimisation less reliable.
- OpenRTB is voluntary: nobody certifies that a request is actually compliant.
- Most platforms still run versions 2.5 or 2.6, with dated releases such as 2.6-202606 adding live content and discount macros.
- The ext extension is exchange-specific, so the same signal can sit in different places depending on the seller.
The biggest interoperability shift came when Google retired its proprietary Authorized Buyers protocol on May 1, 2025, making OpenRTB the default for many more bid streams.
The catch: compliance and privacy
A HUMAN Security diagnostic in November 2023 found 79% of requests included a SupplyChain object, but only 42% of those objects passed full validation. That gap means buyers cannot always trust the chain-of-custody data they see.
Privacy pressure is the sharper edge. Each request can include IP address, device ID, location and page URL to every invited bidder, whether it wins or not. A January 2025 complaint from EPIC and ICCL said Google’s bidding system broadcast data about US individuals roughly 31 billion times a day. A resulting US settlement, approved in March 2026, requires Google to offer a control that strips encrypted identifiers, advertising IDs and IP addresses from bid requests.
The transaction ID dispute shows the standard’s limits. Prebid made the ID bidder-specific in August 2025, arguing it reduced cross-seller data stitching; IAB Tech Lab said that materially violated OpenRTB. Both sides have a point: one ID improves measurement and deduplication, while the other protects publisher yield data.
What to watch next
IAB Tech Lab is moving its reference specs to GitHub Markdown, mapping OpenRTB to Protocol Buffers and gRPC, and testing agentic frameworks that let partner code alter a bid request in flight. For marketers, the practical move is simpler: ask your DSP or ad ops team which OpenRTB version your key inventory uses, and which fields sellers actually fill before you trust custom reporting.
Source: PPC Land
