Every time a programmatic ad loads, a real-time bidding auction fires. The winning bidder serves the impression. But the losing bidders (dozens, sometimes hundreds) also received the bid request, which can include what the user is viewing, their location, device data, and app context. That broadcast is the privacy problem, and it's been baked into ad tech's plumbing for over a decade.
ICCL estimates 178 trillion RTB broadcasts per year in the U.S. and Europe. That's bid requests, not unique people, but it's a measure of how many times user-related signals get sprayed across a supply chain where most recipients have no obligation to serve the ad and, in many cases, limited contractual guardrails on what they do with the data afterward.
The Consent Chain Is Breaking Under Scrutiny
For years, the industry assumed the publisher or app collected consent and everyone downstream could ride on it. That assumption took a direct hit when Norway's data protection authority fined Xandr (owned by Microsoft) NOK 92 million (about €8.6 million) for RTB-related processing tied to Grindr users. The regulator treated Xandr as a joint controller, not a passive processor, and rejected the argument that Xandr could rely on consent Grindr had collected.
The reasoning matters for ops teams: a bid request from a dating app that implies sexual orientation isn't "just another impression." If the consent your vendor relies on turns out to be invalid, that's your liability surface too.
In the U.S., the FTC finalized an order against Mobilewalla for collecting sensitive location data from ad auctions it didn't even win. The FTC alleged that roughly 60% of Mobilewalla's dataset of more than one billion unique advertising IDs came from RTB. Bid-stream data, repurposed far beyond bidding. That's an enforcement action with a named company and a public record.
Cookie Syncing Multiplies the Exposure You Can't See
RTB broadcasts are only half the story. Cookie syncing, the mechanism that links identifiers across different companies, amplifies tracking reach in ways most marketing ops teams never audit. A 2019 study of 850 mobile users found 97% encountered cookie synchronization, and tracking domains increased by a factor of 6.75 through syncing. One identifier shared with one partner becomes recognizable across nearly seven times as many domains.
A separate 2021 study reported third-party ID synchronization on 24% of sites even when the user took no consent action at all, and 26% after a user clicked "Reject All." Those are study-specific figures, not universal rates, but the pattern should concern anyone who assumes consent mechanisms are working as designed.
Private Litigation Is Filling the Gap Congress Left
There's still no federal privacy law in the U.S. But according to Müge Fazlioglu, a principal researcher at the IAPP, more than 10,000 data privacy cases have been filed in U.S. courts since 2022, with 3,414 in 2025 alone. The cumulative settlement tab: roughly $7 billion.
"Privacy litigation is no longer a minor risk," Fazlioglu told AdExchanger. "It's now become a major source of legal and financial exposure for organizations."
Plaintiff attorneys are reaching for statutes written decades before programmatic advertising existed. The Video Privacy Protection Act, designed to protect VHS rental records in 1988, now applies to pixels that track video viewing behavior. The California Invasion of Privacy Act, enacted in 1967 to combat wiretapping, gets stretched to cover session replay tools and tracking scripts. Courts are treating vendors as extensions of the business, which means your analytics provider's data practices can create your liability.
Fazlioglu's point on consent is worth sitting with: "Companies can't rely on consent that a third party obtained on their behalf, because it might not be sufficient." That echoes the Xandr decision in Europe almost exactly. Two different legal systems, same conclusion.
What This Means for Your Programmatic Stack
RTB is how most display and mobile advertising gets bought. Turning it off isn't an option for most B2B teams running programmatic. But the risk isn't the auction itself; it's the uncontrolled broadcast of bid-request data to participants who lose the auction and face limited accountability for what they do with the signal.
Three questions worth running through your vendor stack this quarter:
- Which bid-request fields do your DSP and exchange partners actually populate, and can any be suppressed without breaking targeting?
- What contractual controls exist on bid-stream data retention for non-winning bidders?
- Can your partners demonstrate how consent signals (TCF strings, for example) are enforced downstream, not just passed along?
If your vendors can't answer those with specifics, you're carrying risk you haven't sized. And the enforcement trend, from Datatilsynet in Norway to the FTC in the U.S. to California's privacy agency pursuing data brokers under the Delete Act, is moving in one direction.
The irony: the protocol that made programmatic advertising efficient is the same architecture that makes privacy exposure structural. RTB didn't create a data leak. It was designed as a broadcast. The industry just never reckoned with what happens when every losing bidder keeps the signal.
