Can web users trust ad tech’s server-side shift?
“Trust” is one of those words that gets thrown around a lot in ad tech circles. But it’s going to become even more important if ad tech completes its server-side shift. In response to Apple’s identity resolution crackdown, the online ad industry has rallied around server-side ways to sidestep browser-based controls. IAB Tech Lab’s Trusted Server is the biggest example of this. Not only does the open-source software promise publishers faster page-load speeds, it enables publishers to better control their ad tech stacks and minimize their exposure to browser-based blockades. Trusted Server originated at a time when third-party cookies were under siege and signal loss was a major concern. “When this initiative first started, it was pretty clear that it was time for publishers to start thinking about not continuing to keep everything within the browser itself,” said Rowena Lam, senior director of product, privacy and data at IAB Tech Lab, on the latest Digiday Podcast episode. Taking ad calls out of the browser, however, has the effect of taking them out of users’ sights. A browser can see – and block – the calls a web page asks it to make. Once the calls run on a publisher’s server, though, users have to trust the publisher to a greater degree. For example, Trusted Server introduces the edge cookie, which is a server-side identifier that websites use for users. The edge cookie is created, in part, by hashing a user’s IP address via a secret key specific to the domain the user is visiting. The downside of this from a user privacy control perspective is the edge cookie can be used as a persistent identifier. A person can clear their browsers’ cookies, but if they visit that website again while connected to the same IP address and the website uses the same secret key, a new edge cookie would be created that can be matched to the previous edge cookie, effectively undoing the user’s cookie-clearing. And if the website passes on that edge cookie via server-side calls to ad tech firms and others, those companies would be similarly positioned to use the edge cookie effectively as a persistent identifier connected to whatever other identifiers they have in place, all beyond the user’s visibility. And this is where the trust in Trusted Server really matters. “That doesn’t mean that the edge cookie itself automatically makes it to any of the downstream vendors the publisher engages with. And actually this is where the publisher does have more control. [The publisher] would have to proactively decide that this edge cookie gets sent to anyone. Nobody downstream would automatically receive an edge cookie,” Lam said. Lam also noted that Trusted Server was designed from the start to support integration with consent management platforms. That would give websites a way to share a user’s consent status across the programmatic supply chain. But of course, that requires the user blindly trusting the site to do so.
