OpenRTB

What is OpenRTB?

OpenRTB (Open Real-Time Bidding) is the globally standardized, open-source communication protocol, API specification, and technical framework created and governed by the Interactive Advertising Bureau (IAB) Technology Laboratory that enables automated, programmatic real-time bidding for digital advertising inventory. Operating across programmatic ad exchanges, Supply-Side Platforms (SSPs), Demand-Side Platforms (DSPs), and ad servers, OpenRTB defines the universal language, JSON data structures, and transactional protocols that allow disparate advertising technologies to communicate and execute ad auctions in under one hundred milliseconds.

Prior to OpenRTB's standardization, the programmatic digital advertising ecosystem was fragmented into dozens of proprietary, incompatible communication protocols. Each individual ad exchange and advertising network maintained custom API specifications, forcing software engineering teams to author and maintain hundreds of bespoke custom integrations. Introduced in 2010 by a consortium of digital media pioneers, OpenRTB unified the global programmatic marketplace. By establishing standardized data formats for impression objects, device telemetry, user identifiers, regulatory privacy flags, and bid response payloads, OpenRTB catalyzed the multi-billion-dollar global programmatic advertising revolution.

The OpenRTB architectural ecosystem and communication flow

The OpenRTB protocol orchestrates communication between the sell-side of the advertising market (publishers, media owners, SSPs) and the buy-side (advertisers, agencies, DSPs). The transactional sequence unfolds through a standardized bidirectional API exchange:

• The Bid Request (SSP to DSP): When a user accesses digital media, the SSP compiles a standardized JSON payload detailing the available advertising opportunity. The bid request object encapsulates comprehensive contextual parameters: the impression object (ad dimensions, placement position, supported creative formats), site/app metadata (domain, category tags), device parameters (IP address, operating system, carrier, screen resolution), and privacy consent strings (GDPR TCF consent, CCPA flags).
• DSP Algorithmic Ingestion and Bid Generation: The DSP receives the standardized OpenRTB bid request via high-throughput HTTP POST connections. Bidding engines parse the JSON payload in under twenty milliseconds, cross-referencing user and contextual attributes against active advertiser campaigns and frequency caps.
• The Bid Response (DSP to SSP): If the DSP elects to bid, it returns a standardized JSON bid response payload containing the bid price (expressed in Cost Per Mille CPM), the unique impression ID, the advertiser domain (`adomain`), and the creative markup or creative asset URLs. If the DSP declines to bid, it returns an HTTP 204 "No Content" response to minimize bandwidth consumption.
• Auction Clearing and Win Notices: The SSP adjudicates competing bids, selects the winning buyer, and executes the transaction, dispatching an automated Win Notice (`nurl`) and billing notification back to the winning DSP.

Evolution of the protocol: From OpenRTB 2.x to OpenRTB 3.0

The OpenRTB protocol has undergone significant architectural evolution to accommodate emerging digital media channels, mobile app environments, Connected TV (CTV), and stringent data privacy regulations:

• OpenRTB 2.x Architecture (The Commercial Workhorse): OpenRTB 2.5 remains the most widely deployed, production-grade protocol version across the global programmatic ecosystem. Version 2.x introduced native advertising specifications, specialized video objects (linear in-stream, outstream, companion banners), private marketplace (PMP) deal IDs, and mobile in-app location attributes. Its modular JSON structure provides extraordinary backwards compatibility and operational stability.
• OpenRTB 3.0 and the AdCOM Layer: In 2018, the IAB Tech Lab introduced a fundamental architectural overhaul: OpenRTB 3.0. Recognizing that version 2.x had become overloaded, OpenRTB 3.0 completely separated the transactional communication layer from the media content layer by introducing AdCOM (Advertising Common Object Model). AdCOM serves as a standardized, independent taxonomy for defining creative formats, product categories, and media environments, enabling rapid protocol expansion into Connected TV, digital audio podcasts, and digital out-of-home (DOOH) screens without disrupting underlying auction mechanics.

Cryptographic security, transparency, and ads.cert

As programmatic trading expanded globally, the open nature of RTB exchanges exposed the ecosystem to sophisticated ad fraud, unauthorized domain spoofing, and auction manipulation. In traditional OpenRTB 2.x pipelines, intermediary ad exchanges could intercept and modify bid request parameters—such as altering the reporting domain to masquerade a low-value MFA site as a premium news publication—without detection.

To establish cryptographic trust and traceability, the IAB Tech Lab deployed two complementary security standards integrated with OpenRTB:

• Ads.cert and Cryptographic Signatures: Built into OpenRTB 3.0, ads.cert utilizes public-key cryptography to digitally sign bid requests at the publisher source. Every intermediary along the programmatic supply chain can verify the cryptographic signature, mathematically proving that the website domain, ad placement dimensions, and user IP parameters were not tampered with or fabricated during transit.
• Sellers.json and SupplyChain Object (schain): Standardized OpenRTB objects that provide complete supply-chain transparency. The `schain` node embedded within a bid request records every entity (publisher, SSP, exchange reseller) that participated in passing the impression opportunity, allowing buyers to identify direct supply paths and eliminate exploitative programmatic intermediaries (Supply Path Optimization - SPO).

Privacy frameworks: Navigating GDPR, CCPA, and Global Privacy Platform

Modern OpenRTB implementations operate under intense global data privacy governance. In contemporary programmatic auctions, bid requests cannot broadcast raw user data indiscriminately across thousands of ad tech vendors without explicit consumer consent.

OpenRTB incorporates standardized privacy signal extensions:

• IAB Europe Transparency and Consent Framework (TCF): Standardized strings encoded within the `regs.ext.gdpr` and `user.ext.consent` fields that communicate whether a European consumer granted explicit consent for specific advertising processing purposes and authorized vendors.
• US Privacy and GPP (Global Privacy Platform): Standardized consent strings communicating opt-out directives under state-level privacy regulations like the California Consumer Privacy Act (CCPA).
• Device Identifier Masking: In response to Apple's App Tracking Transparency (ATT) and the deprecation of universal device IDs, OpenRTB objects increasingly utilize privacy-safe cohort identifiers, contextual content signals, and platform privacy tokens (such as Apple's SKAdNetwork metadata) to execute private ad measurement.

Strategic framework for OpenRTB infrastructure optimization

For advertising technology companies, media publishers, and enterprise brands managing proprietary bidding infrastructure, optimizing OpenRTB pipelines is an engineering discipline centered around network latency, throughput efficiency, and yield optimization:

• Throughput and QPS Management: Enterprise DSPs process millions of incoming Queries Per Second (QPS) over OpenRTB connections. Engineering teams utilize intelligent SSP pre-filtering (traffic shaping) to listen only for relevant impression inventory, slashing cloud computing and bandwidth infrastructure costs.
• Latency Optimization and Microsecond Timeouts: In high-speed header bidding auctions, DSPs must parse bid requests, execute machine learning pricing models, and return bid responses within a strict 50-to-80 millisecond timeout window. Network latency optimization and geographically distributed edge computing servers are mandatory.
• Bid Response Hygiene and Adomain Validation: Advertisers must ensure bid responses feature accurate, clean advertiser domain (`adomain`) tags and secure HTTPS creative markup, preventing ad exchanges from programmatically rejecting bids for compliance violations.

Related terms

• Programmatic advertising: The automated, algorithmic buying and selling of digital advertising inventory in real time.
• Real-time bidding: The millisecond algorithmic auction process where digital ad impressions are bought and sold per impression.
• Supply-side platform: Software used by publishers to automate, manage, and optimize the sale of their digital ad inventory.
• Demand-side platform: Software that enables automated, programmatic purchasing of digital advertising inventory across ad exchanges.
• Open auction: The public programmatic ad exchange where inventory is auctioned to all eligible buyers simultaneously.