Every fortnight or so we’ll bring you some technical updates that we hope you’ll find useful.
Today’s topics are a look at Transparency standards in relation to the recent ACCC Report, the ads.cert v2 release & and look at how forthcoming changes to Chrome browser extensions could dramatically limit ad-blockers.
ads.cert 2.0
The most recent working group at IAB Tech Lab is the Cryptographic Security Foundations Working Group. This group has just upgraded the ads.cert framework to enable full authentication through cryptography of the user, the device, the publisher, any ad tech intermediaries, and the buyer so as to fully guarantee the integrity of a transaction.
These standards are initially focused on SSAI (Server-Side Ad Insertion) transactions specifically as recent security research has highlighted schemes where parties have attempted to impersonate SSAI platforms. These schemes are challenging to identify, as traffic appears to originate from the same cloud platforms and hosting providers that service genuine SSAI businesses.
Due to the multi-pronged set of requirements, there are several protocols wrapped into this release, so we’ll break them down one-by-one for you:
Call Signs protocol – allows a company to accurately identify other companies involved in a specific ad transaction, thanks to Domain Name System records.
Authenticated Connections protocol – gives both advertisers and publishers confidence in the authenticity of the origin of any requests, thereby preventing interference in server-to-server requests.
Authenticated Delivery protocol – authenticates the data in a given bid request, allowing buyers and sellers to see if the price or location of a given bid has been tampered with.
Authenticated Devices protocol – attests to the legitimacy of the device on which a given ad is being served.
IAB Tech Lab has specifically recommended that all SSAI providers immediately implement the Authenticated Connections protocol in particular – and advises both buyers and sellers to start insisting upon this protocol for any CTV transactions as soon as it becomes available to them.
For the full set of specifications for ads.cert 2.0 simply click here
ACCC Report
Last week we saw the publication of the final report of the ACCC’s digital advertising services inquiry, as a key element of its inquiry into the markets for the supply of ad tech services and ad agency services. On that same day we immediately published an initial statement and then, later that week, a fuller overview with some core considerations for the industry.
A key aspect of both the report and our initial response is in relation to the expressed demand for improved transparency throughout the programmatic eco-system, including any related fees and take-rates for services rendered in the delivery, verification and reporting of these transactions.
The standards for the majority of the core requirements as stated by the ACCC already exist, for both the buy-side and the sell-side – and can provide complete transparency for all programmatic participants for those adopting and competently utilising these tools. The challenge is now in their adoption, competent usage & enforcement and how we can build upon these to incorporate the ACCC’s requirements.
For a reminder of the now well-established supply-chain standards (courtesy of Google) see below:
- Publisher sends a bid request.
- Buyer receives bid request and data from the SupplyChain object.
- Buyer looks up the identities of all intermediaries who resell inventory.
- Buyer crawls and verifies vendors authorized to sell inventory.
The requirements for the buy-side are reciprocated in terms of the transparency standards to enable full transparency across the demand chain in the recently finalised IAB Tech Lab’s buy-side programmatic standards. These, in conjunction with the sell-side standards and tools will give full transparency throughout the programmatic eco-system.
For a summary of the buy-side programmatic standards, simply click here
As previously mentioned, we’ll now look to work with the industry (through our relevant councils) and collaboratively develop an industry wide approach through an extension to the existing technical standards, that can also enable transparency in the flow of money related to all transactions through both the programmatic supply and demand chains.
We want to ensure that the approach is:
- Collaborative across all parts of the industry, including all the key local industry bodies (i.e. MFA and AANA) and IAB Tech Lab.
- Seamless in terms of any resulting day-to-day processes and able to strike a balance between enabling transparency and not creating unnecessary friction and/or additional costs. Any manual auditing processes and reconciliation of bills and log-level data must be avoided.
- Value-adding in terms of the insights surfaced to better enable SPO & DPO and be fully consistent and workable for the industry globally – so as to ensure that Australia is not suddenly ‘too hard to work with’ moving forwards.
This is an opportunity for Australia is to take the lead on an issue that is global and leverage the work of the ACCC to help evolve the standards to become ubiquitous, genuinely transparent, meaningful and workable for all involved.
To access the ACCC’s full final report (198 pages) simply click here
In the meantime – what else can we do now?
We highly recommend working with the standards currently in-place for both buyers and sellers.
Publishers can sign up now for IAB Tech Lab’s Supply Chain Validation Service. As part of this service publishers will receive email notifications for errors and alerts on your supply-chain setup. They are also able to fix errors and approve alerts.
Sellers can check alerts and errors in the IAB Tech Lab’s Transparency Center. By subscribing to the APIs therein you can receive aggregated validated results of any ads.txt, app-ads.txt and sellers.json files. Then use the notification codes to work with their publisher partners to correct errors and update their sellers.json files.
Buyers can check alerts and errors in the Transparency Center. Subscribe to the APIs to receive aggregated validated results of ads.txt, app-ads.txt and sellers.json files. Then use the Supply Chain Validation notification codes to create actionable policies for your programmatic buys.
For a related blog article simply click here
Chrome & Ad-Blockers
Google recently announced that any extensions for its Chrome browser that are still being written under its Manifest V2 specs will no longer function from January 2023. This will disable many popular add-ons such as ad-blockers in the process – unless the relevant developers can look to revise their extensions to fit the more secure Manifest V3 specs.
This is currently looking more difficult and potentially unlikely, given the current feedback from the developers of the most popular ad blocking extensions (as initially reported by The Register back in 2019).
Now that these changes are to be enforced (see the Google timeline below) we’ll be keeping an eye on the related impacts as the deadline nears.
For more information on these forthcoming changes simply click here