Identity, data and measurement from someone who runs it.
Two questions this week, both about what's behind the data you buy. A crawler that labels itself a bot visited hundreds of thousands of websites, and 17 of 18 major ID providers gave it an identity anyway. The MRC confirmed that no one accredits identity providers to catch that. And the FTC asked nine companies, including three big retail media owners, whether they use your customers' data to set prices.
The two that matter
1. A bot announced itself. Almost every ID provider gave it an identity anyway.
What happened
Researchers at Indiana University and NJIT, working with Adalytics and DeepSee.io, studied 145 million header bidding requests sent from 616,539 websites to six SSPs (Magnite, Amazon, Index Exchange, Sonobi, GumGum and Yieldmo) between January 2022 and May 2025. The traffic came from the HTTP Archive's crawler, which labels itself as a bot in its user agent and runs from Google Cloud IP addresses. It never logs in.
They looked at the 18 identity providers that account for more than 99% of the IDs in the data. What they found:
- 17 of 18 did not flag the bot. Only Flashtalking returned an ID value of "Bot." The rest sent IDs into the auction as if a person were there.
- One visit, several IDs. When a provider's ID went to more than one SSP on the same visit, it sent different IDs 18% of the time. Rates varied widely: ID5 about 32%, Audigent about 32%, LiveIntent about 24%, Criteo about 21%, The Trade Desk under 1%.
- IDs that link devices with nothing in common. About 27% of the IDs that persisted across visits were attached to both the mobile and desktop crawls. Those crawls share no login or cookies, only, at most, a cloud IP address.
- Consent. 16 of the 18 sent IDs on websites with EU or UK domains, where the crawler never consented.
The Media Rating Council told Jack Neff the organization does not currently audit or accredit identity providers or audience targeting.
Two cautions. The researchers can't decrypt the IDs, so they can't say whether a given ID points to a real person in a vendor's graph; some press coverage goes further than the paper does. And the data ends in May 2025, so practices may have changed. Adalytics is a commercial research firm, and the MRC has disputed one of its earlier bot reports.
What it changes
An ID in a bid request is treated as evidence that a person is there. Bids, frequency caps, audience sizes and match rates all assume it. This study says that assumption fails on the easiest possible case: a bot that tells you it's a bot.
The bigger point is the gap the MRC confirmed. Your verification vendor is accredited to filter invalid traffic. Your identity vendor isn't accredited for anything. If an ID is assigned before the bot is filtered, the ID can end up in your audience counts, your reach reports and your match rates, and no audit is designed to catch it.
Flashtalking flagged the bot, and The Trade Desk almost never sent conflicting IDs, so better behavior is possible. The fair question isn't whether identity is broken. It's which of your vendors behave like those two, and how you'd know.
The Semcasting view (my company's perspective): Semcasting is an identity and audience data company. We weren't among the 18 providers studied, which isn't the same as passing. The accreditation gap applies to us too. Ask us the questions below.
What to do this week
- Ask each ID or audience vendor: what does your system return when the visitor is a declared bot? Ask for the documented value, not a description.
- Ask whether your vendor assigns IDs before or after invalid traffic filtering, and who does the filtering.
- Ask what share of the IDs in your audiences come from a login or other deterministic signal, and what share are inferred from IP and device signals. The researchers recommend the industry disclose exactly this.
- If you have log-level data, check how often one impression carries more than one ID from the same provider.
Sources: The paper (ACM IMC '26) · AdExchanger roundup, Oct 30 · MRC statement on Adalytics, April 2025
2. The FTC asks how the same data that targets ads sets prices
What happened
On Oct 28 the FTC voted 2-0 to send Section 6(b) orders to nine companies: Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target and Walmart. The orders ask whether prices, and for gig workers pay, vary from person to person based on personal data such as loyalty program activity. The companies have 45 days to respond, so answers are due around mid-December.
This is a study, not a complaint. The FTC hasn't accused anyone of breaking the law. Delta, Instacart, Walmart and Target have all said publicly they don't use personal data to set individual prices. It's the agency's second round: in July 2024 it sent similar orders to eight vendors that sell pricing tools. In August it also proposed a policy that would require companies to disclose personalized pricing and the data behind it.
A day later, on Oct 29, FTC staff sent warning letters to 25 companies that market or generate leads for ACA Marketplace plans and other health products during open enrollment. The letters warn against misstating a plan's benefits, costs or coverage, and point to past FTC cases against lead generators, including Assurance IQ and MediaAlpha. The recipients aren't named and the letters don't allege wrongdoing. Staff sent a similar round to 21 companies in December 2024.
What it changes
The pricing study matters to advertisers for one reason. Three of the nine (Walmart, Target and Instacart) run large retail media businesses on shopper data. The FTC is now asking them, in writing and under compulsion, how that kind of data is used beyond ads. Whatever they answer becomes part of a public study that state legislators are already waiting for.
The lead-gen letters are a narrower, more immediate risk. If you're a health plan or a healthcare advertiser that buys leads or runs affiliates, a partner's misleading ad is still your problem. This is the second year in a row the FTC has sent these letters during open enrollment, which tells you where it's looking.
What to do this week
- Healthcare advertisers: list every lead generator and affiliate running ACA or supplemental plan offers for you, and ask each for its current ad copy and landing pages.
- Check those ads against the FTC's list: benefits, costs, whether a limited plan is presented as comprehensive coverage, and any promise of free cash or gifts.
- Retail media buyers: ask your retail partners whether the shopper data behind your audiences is also used in pricing or offers, and whether their answer to the FTC will change any terms.
Sources: FTC, Oct 28 · AP via ABC News, Oct 28 · FTC staff on lead generators, Oct 29 · National Law Review
Quick hits
Amazon says most of its on-store display impressions never reach a screen. From Jan 1, 2027, Amazon will count DVA display impressions on its own store (homepage, product pages, search results and order pages) only once the ad appears on screen. Today it counts them when the ad starts downloading, below the begin-to-render minimum the industry set in 2017. Amazon expects counts on those placements to drop about 63% on average, more for placements lower on the page. It says advertisers in testing saw higher ROAS and lower CPA, without saying how big the test was. The notice doesn't say whether billing moves to the new count. If it doesn't, reported CPMs could rise about 2.7 times with nothing else changing. This comes from an undated advertiser notice posted on LinkedIn by Elevate33's Saul Jacobs; Amazon hasn't announced it publicly. Before Jan 1, ask your Amazon rep whether invoices use the new count, and save December CPM, CTR and view-through baselines so your year-over-year comparisons don't break. PPC Land
Grocery retail media is consolidating. On Oct 29 DoorDash agreed to buy Instacart for $65 a share, about $17 billion, with closing expected at the end of 2027 or the first half of 2028 after antitrust review. Instacart's advertising and other revenue was $331 million in Q3, up 23%. Separately, Walmart opened more than 3,000 shopper segments to advertisers on Vibe, the self-serve CTV platform it bought this year, with no contract required. For CPG buyers: fewer, larger owners of purchase data, and up to 18 months of uncertainty before the Instacart deal closes. Supermarket News · AP via WAFB · Adweek
The industry's answer to Safari: move identity to the server. ID5's CEO told Digiday the company is moving identity functions server-side and testing with selected publishers. Large publishers could do it in days; smaller ones will struggle. IAB Tech Lab's COO called Trusted Server the only practical industrywide response, while conceding it lacks production evidence and that routing through a first-party server doesn't make cross-site identity resolution first-party. That concession is the part to remember. Server-side changes where the ID is resolved, not whether the person agreed. Adoption of iOS 27 is still low, so expect more discussion than measured impact for now. Digiday · PPC Land
Meta Pixel change, 8 days out. Reminder from last week: Meta's on-device conversion matching is reported to start counting on Nov 12, and it's on unless you turn it off in Events Manager. Meta still hasn't published a help page confirming the details. Either way, record your Meta-reported conversions and your own order or lead counts now, so a jump after Nov 12 isn't mistaken for performance. PPC Land
The explainer: who checks that an ID is a person?
Independent checks stop at traffic and measurement. Identity and audiences sit outside them.
Three rules of thumb:
- Accreditation is specific. A vendor being "MRC accredited" tells you about the metrics named in the accreditation, nothing else.
- Order matters. If an ID is assigned before a bot is filtered, the bot can be counted in your audience size and match rate even if the impression is later removed.
- Ask for documented values, not descriptions. "We filter bots" is a description. "We return the value Bot" is something you can check in your own logs.
A question worth asking this week
"Our audience vendor says its match rate is 70%. How much of that is people?"
Start by splitting the number. Ask what share of matched records came from a deterministic signal, such as a login or a verified address, and what share was inferred from IP, device or browser signals. Those are different products with different error rates, and a single match rate hides the difference.
Then ask about filtering. Did they remove invalid traffic before counting the match, or only later at the impression level? If the vendor can't say, assume the match rate includes some traffic that isn't human.
Finally, test it. Run a holdout on a campaign with a hard outcome, like sales or qualified leads, and compare the matched audience against a control. A match rate is a claim; a lift result is evidence.
My bias: Semcasting reports match rates too. These questions apply to us.
That's Issue #6. If you've asked an identity vendor what it does with bot traffic, hit reply and tell me what it said. I'll share the answers, anonymized, in a future issue.
Geetha
Match Rate is written by Geetha Neelakantiah, SVP Business Development, Marketing & Operations at Semcasting. The views are my own. Sections labeled "The Semcasting view" or "My bias" reflect my company's perspective. Nothing here is legal advice.
