Identity, data and measurement from someone who runs it.
Two questions this week, both about what's behind the data you buy. A crawler that labels itself a bot visited hundreds of thousands of websites, and 17 of 18 major ID providers gave it an identity anyway. The MRC confirmed that no one accredits identity providers to catch that. And the FTC asked nine companies, including three big retail media owners, whether they use your customers' data to set prices.
What happened
Researchers at Indiana University and NJIT, working with Adalytics and DeepSee.io, studied 145 million header bidding requests sent from 616,539 websites to six SSPs (Magnite, Amazon, Index Exchange, Sonobi, GumGum and Yieldmo) between January 2022 and May 2025. The traffic came from the HTTP Archive's crawler, which labels itself as a bot in its user agent and runs from Google Cloud IP addresses. It never logs in.
They looked at the 18 identity providers that account for more than 99% of the IDs in the data. What they found:
The Media Rating Council told Jack Neff the organization does not currently audit or accredit identity providers or audience targeting.
Two cautions. The researchers can't decrypt the IDs, so they can't say whether a given ID points to a real person in a vendor's graph; some press coverage goes further than the paper does. And the data ends in May 2025, so practices may have changed. Adalytics is a commercial research firm, and the MRC has disputed one of its earlier bot reports.
What it changes
An ID in a bid request is treated as evidence that a person is there. Bids, frequency caps, audience sizes and match rates all assume it. This study says that assumption fails on the easiest possible case: a bot that tells you it's a bot.
The bigger point is the gap the MRC confirmed. Your verification vendor is accredited to filter invalid traffic. Your identity vendor isn't accredited for anything. If an ID is assigned before the bot is filtered, the ID can end up in your audience counts, your reach reports and your match rates, and no audit is designed to catch it.
Flashtalking flagged the bot, and The Trade Desk almost never sent conflicting IDs, so better behavior is possible. The fair question isn't whether identity is broken. It's which of your vendors behave like those two, and how you'd know.
The Semcasting view (my company's perspective): Semcasting is an identity and audience data company. We weren't among the 18 providers studied, which isn't the same as passing. The accreditation gap applies to us too. Ask us the questions below.
What to do this week
Sources: The paper (ACM IMC '26) · AdExchanger roundup, Oct 30 · MRC statement on Adalytics, April 2025
What happened
On Oct 28 the FTC voted 2-0 to send Section 6(b) orders to nine companies: Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target and Walmart. The orders ask whether prices, and for gig workers pay, vary from person to person based on personal data such as loyalty program activity. The companies have 45 days to respond, so answers are due around mid-December.
This is a study, not a complaint. The FTC hasn't accused anyone of breaking the law. Delta, Instacart, Walmart and Target have all said publicly they don't use personal data to set individual prices. It's the agency's second round: in July 2024 it sent similar orders to eight vendors that sell pricing tools. In August it also proposed a policy that would require companies to disclose personalized pricing and the data behind it.
A day later, on Oct 29, FTC staff sent warning letters to 25 companies that market or generate leads for ACA Marketplace plans and other health products during open enrollment. The letters warn against misstating a plan's benefits, costs or coverage, and point to past FTC cases against lead generators, including Assurance IQ and MediaAlpha. The recipients aren't named and the letters don't allege wrongdoing. Staff sent a similar round to 21 companies in December 2024.
What it changes
The pricing study matters to advertisers for one reason. Three of the nine (Walmart, Target and Instacart) run large retail media businesses on shopper data. The FTC is now asking them, in writing and under compulsion, how that kind of data is used beyond ads. Whatever they answer becomes part of a public study that state legislators are already waiting for.
The lead-gen letters are a narrower, more immediate risk. If you're a health plan or a healthcare advertiser that buys leads or runs affiliates, a partner's misleading ad is still your problem. This is the second year in a row the FTC has sent these letters during open enrollment, which tells you where it's looking.
What to do this week
Sources: FTC, Oct 28 · AP via ABC News, Oct 28 · FTC staff on lead generators, Oct 29 · National Law Review
Amazon says most of its on-store display impressions never reach a screen. From Jan 1, 2027, Amazon will count DVA display impressions on its own store (homepage, product pages, search results and order pages) only once the ad appears on screen. Today it counts them when the ad starts downloading, below the begin-to-render minimum the industry set in 2017. Amazon expects counts on those placements to drop about 63% on average, more for placements lower on the page. It says advertisers in testing saw higher ROAS and lower CPA, without saying how big the test was. The notice doesn't say whether billing moves to the new count. If it doesn't, reported CPMs could rise about 2.7 times with nothing else changing. This comes from an undated advertiser notice posted on LinkedIn by Elevate33's Saul Jacobs; Amazon hasn't announced it publicly. Before Jan 1, ask your Amazon rep whether invoices use the new count, and save December CPM, CTR and view-through baselines so your year-over-year comparisons don't break. PPC Land
Grocery retail media is consolidating. On Oct 29 DoorDash agreed to buy Instacart for $65 a share, about $17 billion, with closing expected at the end of 2027 or the first half of 2028 after antitrust review. Instacart's advertising and other revenue was $331 million in Q3, up 23%. Separately, Walmart opened more than 3,000 shopper segments to advertisers on Vibe, the self-serve CTV platform it bought this year, with no contract required. For CPG buyers: fewer, larger owners of purchase data, and up to 18 months of uncertainty before the Instacart deal closes. Supermarket News · AP via WAFB · Adweek
The industry's answer to Safari: move identity to the server. ID5's CEO told Digiday the company is moving identity functions server-side and testing with selected publishers. Large publishers could do it in days; smaller ones will struggle. IAB Tech Lab's COO called Trusted Server the only practical industrywide response, while conceding it lacks production evidence and that routing through a first-party server doesn't make cross-site identity resolution first-party. That concession is the part to remember. Server-side changes where the ID is resolved, not whether the person agreed. Adoption of iOS 27 is still low, so expect more discussion than measured impact for now. Digiday · PPC Land
Meta Pixel change, 8 days out. Reminder from last week: Meta's on-device conversion matching is reported to start counting on Nov 12, and it's on unless you turn it off in Events Manager. Meta still hasn't published a help page confirming the details. Either way, record your Meta-reported conversions and your own order or lead counts now, so a jump after Nov 12 isn't mistaken for performance. PPC Land
Independent checks stop at traffic and measurement. Identity and audiences sit outside them.
Three rules of thumb:
"Our audience vendor says its match rate is 70%. How much of that is people?"
Start by splitting the number. Ask what share of matched records came from a deterministic signal, such as a login or a verified address, and what share was inferred from IP, device or browser signals. Those are different products with different error rates, and a single match rate hides the difference.
Then ask about filtering. Did they remove invalid traffic before counting the match, or only later at the impression level? If the vendor can't say, assume the match rate includes some traffic that isn't human.
Finally, test it. Run a holdout on a campaign with a hard outcome, like sales or qualified leads, and compare the matched audience against a control. A match rate is a claim; a lift result is evidence.
My bias: Semcasting reports match rates too. These questions apply to us.
That's Issue #6. If you've asked an identity vendor what it does with bot traffic, hit reply and tell me what it said. I'll share the answers, anonymized, in a future issue.
Geetha
Match Rate is written by Geetha Neelakantiah, SVP Business Development, Marketing & Operations at Semcasting. The views are my own. Sections labeled "The Semcasting view" or "My bias" reflect my company's perspective. Nothing here is legal advice.