Five preprints. Four measure the documents and the traffic: how much of the OpenRTB specification a validator can enforce even in principle, what client-side header-bidding traffic actually sends against those tables, whether structural validation is cheap enough to sit inside a live bid pipeline, and how much of IAB privacy signaling a receiver can check versus what a check decides. The fifth measures why CTV fraud keeps working once the buyer’s observation point is gone. All five publish their datasets and their code. All five are free to read here, with no account.
One GPP string across hops. Syntax classes apply to the IAB artifacts. Meaning stays with the CMP, the OS, or the stitcher. ACR does not consult the chain.
IAB Tech Lab's privacy stack (GPP, TCF, US Privacy, OpenRTB regs / user / device, and VAST privacy macros) is built to carry consumer choice across the bid. This paper asks how much of that stack a receiver can check, and what a check decides. IAB privacy signaling is a transport: the checkable layer is string shape, not a person-fact. 221 normative-keyword sentences from pinned GPP, TCF, US Privacy, and OpenRTB 2.6-202606 privacy texts screen to 162 conformance statements. Reliability is a delayed same-author recode. Web header-bidding traffic from the companion measurement paper is the control: 20,226 requests, 165 sites, one US vantage. Connected TV is the stress test for meaning.
What it found
IAB privacy signaling is a transport: the checkable layer is string shape, not a person-fact
221 keyword sentences screen to 162 conformance statements; delayed same-author recode matches syntax on 19 of 19 sampled rows from the GPP string spec, US Privacy, and OpenRTB privacy fields; six of eight disagreements are TCF process sentences
Of 26 GPP-string conformance statements, 16 (61.5%) are S1 or S2 and 20 (76.9%) are M0
The TCF document is the opposite mix: 60 of 89 conformance statements (67.4%) are S0
On Sample A, 40 of 79 sites carry GPP, 29 of 79 still send deprecated US Privacy under regs.ext, and 38 of 79 still send leftover regs.ext.gdpr; Media.net is 26 sites and zero of these fields; TCF Europe is 0 of 20,226 requests
A receiver can reject a malformed GPP header or a missing gpp_sid, and can warn on leftover regs.ext.gdpr; that is not consent, not COPPA, and not a bound on ACR
@misc{sekowski2026iabprivacysignaling,
title = {How Machine-Checkable Is IAB Privacy Signaling?: Syntax versus Meaning on the Wire},
author = {Sekowski, Aleksander},
year = {2026},
month = aug,
howpublished = {Preprint},
doi = {10.13140/RG.2.2.24242.16320},
url = {https://openadtech.org/papers/how-machine-checkable-is-iab-privacy-signaling-sekowski-2026.pdf}
}
A Verifiability Analysis of the Connected TV Supply Chain
Aleksander Sekowski, Independent Researcher
Server-side ad insertion removes the buyer's client-side observation point. What remains in the bid request is a declaration about a session the receiver cannot see.
Connected TV advertising fraud is treated as a detection problem and priced as an unavoidable tax. This paper measures it as a verification architecture. A Verifiability Index classifies every OpenRTB 2.6 and VAST 4.3 field that makes a claim about the world as attested, cross-referenceable, or self-declared, from the receiver's vantage at or after transaction time. Server-side ad insertion removes the buyer's client-side observation point, which is the assumption every web anti-fraud mechanism was built on. The OpenRTB field inventory is extracted from RTBlint's object catalog.
What it found
91.5% of pricing-relevant claims a buyer receives about a CTV server-side impression are self-declared, against 70.0% for the same claims on web display; no scored OpenRTB field on either path is attested
22 of 27 checkable pricing-relevant web request-side fields (81%) depend on observing the render, so ground truth arrives only after the auction has cleared
On a strict registry-only tier, web is 94.4% self-declared and CTV stays at 91.5%; restricted to fields both channels carry the comparison is a tie at 94.3%
16 of 17 named CTV fraud schemes (2018 to 2026) falsified at least one self-declared field; 12 of 17 on fields the discoverer stated explicitly
Full adoption of ads.txt, app-ads.txt, sellers.json, schain, and ads.cert 2.0 rejects 12 of 17 on the app identity each scheme declared, and 0 of 17 if the same fabrication is pointed at apps the operator owns
A uniform-random crawl of the Roku channel store (n=400 of 31,647) finds the app-ads.txt walk cannot start for 89.0% of channels and completes for 8.8%
@misc{sekowski2026ctvverificationgap,
title = {Why CTV Ad Fraud Keeps Working: A Verifiability Analysis of the Connected TV Supply Chain},
author = {Sekowski, Aleksander},
year = {2026},
month = aug,
howpublished = {Preprint},
url = {https://openadtech.org/papers/why-ctv-ad-fraud-keeps-working-sekowski-2026.pdf}
}
Measuring OpenRTB Dialects in Client-Side Header Bidding
Aleksander Sekowski, Independent Researcher
Bid-request invalid rate under two readings, with site-clustered 95 percent confidence intervals. Strict drops unknown non-ext fields and moved fields. Sample A is a random draw of header-bidding sites; Sample B is purposive majors.
A browser can observe OpenRTB only where header-bidding libraries solicit demand client-side. This paper measures that slice: Prebid.js bid requests and responses from one US residential vantage, 10,457 first-contact payloads from 164 sites. It is not server-to-server OpenRTB, and it is not a census of programmatic traffic. Payloads are scored against the IAB object tables with a pinned linter. The paper reports two readings (strict type, enum, and required-field checks versus inclusive unknown and moved fields), splits request-side findings by adapter versus publisher origin, and tests whether flagged requests lose fill.
What it found
42.0% of bid requests on a random header-bidding sample are flagged on type, enumerated-value, or required-field checks, 95% CI [36.0, 47.2]; major publishers sit at 40.4% [35.8, 45.0]; the intervals overlap
Including unknown and moved fields raises those rates to 69.4% and 55.4%; that 14-point gap is dialect and GDPR-path hangover, not type or required-field divergence
Publishers write about 2% of request-side findings and select the rest by which adapters they enable; 76 of 79 Sample A sites already have a 0% strict endpoint on the page
After stratifying by endpoint, the Sample A bid-rate association is +1.4 points, 95% CI [-9.0, +13.4], too wide to rule out a large fill penalty or none
Corpus is 10,457 first-contact payloads from 164 sites; 16,368 PII-free findings are released with the capture and analysis code
Classifying the Normative Content of the Protocol That Clears Real-Time Advertising
Aleksander Sekowski, Independent Researcher
Enforceability class shares of conformance statements in OpenRTB 2.6-202606 and OpenRTB 3.0.
OpenRTB is the wire protocol of open programmatic advertising, and it has no reference validator, no conformance test suite, and no formal normative language conventions. Neither OpenRTB 2.6 nor 3.0 references RFC 2119. This paper asks a question that had not been answered quantitatively: how much of the specification can any validator, of any design, actually enforce? It extracts every normative-keyword sentence from both specifications, screens them to genuine conformance statements, and hand-classifies each into four enforceability classes.
What it found
417 normative sentences extracted from OpenRTB 2.6-202606 and 3.0, screened to 288 conformance statements and hand-coded into four enforceability classes
OpenRTB 2.6 is 53.5% statically checkable and 26% not machine-decidable at all; deduplicating repeated clauses shifts that to 45.7% and 31.8%
OpenRTB 3.0 inverts the profile: 50% of its conformance content is runtime behavior, only 27.3% is statically checkable
Across 16 releases from 2012 to 2026 the field surface grew from 167 to 417 while the required core grew from 16 to 22, leaving 94.7% of the protocol as optional surface settled bilaterally, off the wire
Two of the nine example payloads embedded in the 2.6 specification violate the document's own object tables, and have done so in every release since October 2022
A blind recoding of a 60-statement sample agrees with the author's labels at Cohen's kappa 0.77 to 0.79
@misc{sekowski2026openrtbcheckability,
title = {How Machine-Checkable Is OpenRTB?: Classifying the Normative Content of the Protocol That Clears Real-Time Advertising},
author = {Sekowski, Aleksander},
year = {2026},
month = jul,
howpublished = {Preprint},
doi = {10.13140/RG.2.2.27937.57448},
url = {https://openadtech.org/papers/how-machine-checkable-is-openrtb-sekowski-2026.pdf}
}
Latency Analysis and Integration Patterns for Programmatic Video Pipelines
Aleksander Sekowski, Independent Researcher
Per-bid validation latency: vastlint vs XSD. Both bars fit below the 10 ms creative selection budget. XSD findings are entirely false positives; vastlint findings are actionable.
Malformed VAST XML is a well-documented but structurally unaddressed source of impression loss in programmatic video. OpenRTB defines the protocol for real-time bidding but imposes no requirement on the structural validity of the VAST markup delivered in the bid response. This paper benchmarks whether structural validation can run inline inside a bid pipeline without material latency cost, compares the results against the IAB's own XSD schema validation, and analyses four integration points where it changes the economics.
What it found
A 17 KB CTV tag validates in 350 microseconds, 0.35% of a 100 ms bid window; a 44 KB tag in 2.1 ms, inside a typical creative-selection budget
16,236 validations per second sustained on 10 cores, exceeding a mid-tier exchange's throughput on a single instance
XSD validation against the IAB's own VAST 4.2 schema is faster at 72 microseconds per tag, but its findings are entirely false positives: element ordering and VAST macro rejection that do not correspond to playback failures
Four integration patterns analysed: SSP bid response, DSP creative ingestion, SSAI stitch time, and an async observability sidecar
Concludes that inline structural validation is computationally feasible and its absence is a recoverable source of revenue loss
@misc{sekowski2026vastbidtime,
title = {VAST XML Validation at Bid-Time Scale: Latency Analysis and Integration Patterns for Programmatic Video Pipelines},
author = {Sekowski, Aleksander},
year = {2026},
month = apr,
howpublished = {Preprint},
doi = {10.13140/RG.2.2.11404.27520},
url = {https://openadtech.org/papers/vast-xml-validation-at-bid-time-scale-sekowski-2026.pdf}
}
On the numbers in these papers. Each is a dated artifact and reports the tool as it stood at the time of writing. The April 2026 VAST paper describes a 108-rule catalog; the shipping catalog is larger now. That drift is expected and the papers are not retro-edited, because a benchmark that quietly changes after publication is not a benchmark. For what ships today, see the tool pages.
