Real-time bidding (RTB) is the automated auction that runs in under 100 milliseconds every time a webpage loads, deciding which ad you see. It is the dominant mechanism behind approximately 91% of display advertising globally, generating an estimated 178 trillion bid requests annually — each one transmitting a packet of user data to dozens or hundreds of companies that bid on the impression. RTB made modern digital advertising financially viable by letting advertisers price each impression individually based on the user viewing it. But the same mechanism is also the root cause of most major privacy problems in digital advertising. This guide explains exactly how RTB works, who the players are, why it creates structural privacy risks, and what better alternatives look like.
What Is Real-Time Bidding in One Sentence?
Real-time bidding is an automated auction where advertisers bid on individual ad impressions (a specific ad slot on a specific page for a specific user) in the fraction of a second between when the page starts loading and when the ad is rendered.
How Does RTB Work Step by Step?
A single RTB auction runs through eight stages in roughly 100 milliseconds:
- User opens a webpage. The browser starts requesting the page.
- Page contains an ad slot. The slot is managed by an SSP (supply-side platform) like Google Ad Manager, Magnite, or PubMatic.
- SSP generates a bid request. The request includes the page URL, ad slot dimensions, user identifier (cookie or alternative ID), approximate user location, device type, and often behavioral data from data brokers.
- SSP sends bid request to multiple DSPs. Demand-side platforms (The Trade Desk, DV360, Amazon DSP) receive the request on behalf of their advertiser clients.
- DSPs decide whether to bid and at what price. Each DSP runs the bid request against advertiser campaign rules in roughly 50ms.
- DSPs submit bids. Winning bid price, creative ID, and tracking pixels are returned.
- SSP picks the winning bid. Typically highest price, with adjustments for ad quality and floor prices.
- Winning ad is rendered. Total elapsed time: 50-200 milliseconds.
For the fuller context on where RTB sits in the broader stack, see What Is Ad Tech? and How Programmatic Advertising Works.
Who Are the Major Players in RTB?
| Role | Major players (2026) | What they do |
|---|---|---|
| SSPs | Google Ad Manager, Magnite, PubMatic, Index Exchange, OpenX | Represent publishers, run auctions |
| DSPs | The Trade Desk, DV360, Amazon DSP, Xandr, Yahoo DSP | Represent advertisers, submit bids |
| Ad Exchanges | Google AdX, Xandr Marketplace, Magnite Exchange | Connect SSPs and DSPs, facilitate matches |
| Data Management Platforms (DMPs) | Adobe Audience Manager, Salesforce DMP, Oracle BlueKai | Enrich bid requests with audience data |
| Identity Providers | LiveRamp, ID5, The Trade Desk UID 2.0 | Provide cross-site user identifiers |
| Verification Vendors | DoubleVerify, IAS, Moat | Confirm impressions were real and brand-safe |
What Makes RTB So Fast?
RTB's sub-100ms latency is achieved through three engineering strategies. First, geographically distributed infrastructure — major SSPs and DSPs maintain data centers in every major region so round-trip latency is minimized. Second, pre-computed bid prices for most routine inventory, updated continuously in the background rather than on-demand. Third, aggressive timeouts — any DSP that doesn't respond within a hard deadline is simply excluded from that specific auction, ensuring the auction completes regardless of slow participants.
Why Is RTB a Privacy Problem?
The structural privacy issue is that every single bid request broadcasts user data to hundreds of companies, most of which will not win the auction but keep the data anyway. A 2022 investigation by the Irish Council for Civil Liberties found that the Google-run portion of RTB alone generated 71 trillion broadcasts per year in the US, each containing location data, browsing context, and unique identifiers. The resulting dataset is then widely available for resale by the losing bidders, who paid nothing to receive it.
This data broadcast pattern is the root cause of most modern ad-tech privacy complaints. GDPR enforcement has specifically targeted it — the €1.2 billion Meta fine in 2023 and multiple IAB Europe enforcement actions both focused on RTB's structural data-sharing model. For broader regulatory context, see GDPR, CCPA, and Beyond.
What Happens to the Losing Bidders' Data?
When a DSP loses a bid, it has already received the bid request containing user data. The data is typically retained for:
- Modeling and machine learning. Training future bidding algorithms.
- Audience building. Identifying users who match advertiser profiles for future targeting.
- Cross-device matching. Associating the user's current device with other devices they use.
- Resale to data brokers (in jurisdictions where this is legal).
None of these uses require winning the auction. The data itself is the valuable output of RTB, with the auction as a thin justification for collecting it.
What Are the Alternatives to Traditional RTB?
Four alternatives address the structural issues of RTB while preserving the value of automated advertising:
1. Private Marketplace (PMP) deals. Pre-negotiated direct deals between publishers and specific advertisers, executed through programmatic pipes but without the open broadcast. Approximately 35% of programmatic spend now flows through PMPs in 2026.
2. Contextual bidding. RTB auctions where the bid request contains only page-level context — not user-level identifiers. Contextual RTB preserves the speed and automation of RTB while eliminating the data broadcast. See Contextual vs Behavioral Advertising.
3. On-device matching. Move the matching decision inside the user's browser. No bid request ever leaves the device. See How On-Device Ad Matching Works.
4. DePIN advertising networks. Fully decentralized networks where the matching, verification, and reward layers all run on user-owned infrastructure. See What Is DePIN Advertising?
How Does Adreva Avoid RTB's Structural Problems?
Adreva does not participate in traditional RTB. Instead of broadcasting user data to dozens of DSPs, the matching decision runs entirely on the user's device using only the publicly visible page context. Advertiser campaigns are loaded into the extension as a set of creative and targeting rules; the extension selects which ad to render locally. No bid request is sent to Adreva's servers, and no user data is transmitted during ad selection. The only data that leaves the device is a cryptographically-signed impression attestation for reward accounting — and that attestation contains no browsing history, identifier, or behavioral data.
Frequently Asked Questions
How many bid requests happen per day globally?
Approximately 488 billion per day, or roughly 178 trillion per year. This is the fundamental scale statistic for understanding RTB's privacy footprint — even a tiny per-request privacy cost compounds enormously at that volume.
Is RTB the same as programmatic advertising?
RTB is one type of programmatic advertising. Programmatic encompasses all automated ad buying, including RTB, PMP deals, and programmatic guaranteed. RTB is the specific auction-based subset. See How Programmatic Advertising Works for the full picture.
How much does an ad impression cost in RTB?
CPMs (cost per thousand impressions) range from roughly $0.50 on long-tail inventory to $30+ on premium video placements. The median US display CPM in 2026 is approximately $4-6.
Can RTB work without tracking individual users?
Yes. Contextual RTB — where bid requests contain only page-level signals, no user identifier — preserves most of RTB's performance benefits while eliminating individual tracking. Adoption is growing as cookie-based identifiers decline.
What is the future of RTB?
The trajectory through 2028 is for RTB to continue but shrink as a share of total ad spend, with PMPs, contextual auctions, and DePIN networks capturing growth. Regulatory pressure and browser-level privacy changes will continue compressing the data-rich variant of RTB in favor of its privacy-safe successors.