A bid request is the message an ad exchange or supply-side platform (SSP) sends to prospective buyers when an advertising slot becomes available, inviting them to bid for it. It describes what is for sale - the placement, the page or app, the device, the user and the legal signals attached - and sets the auction rules: minimum price, currency, blocked advertisers and how long the seller will wait. It exists so that machines can read and price a single impression in a fraction of a second. Almost all such messages today follow OpenRTB, the protocol maintained by IAB Tech Lab, the standards arm of the Interactive Advertising Bureau (IAB).

Where it sits in the transaction

The sequence starts with an ad request: a browser, app, connected television (CTV) player or digital screen calls an ad server or SSP asking for an ad. The SSP converts that call into bid requests and posts them to each connected demand-side platform (DSP) whose filters match. According to the OpenRTB 2.6 specification, bid requests must travel by HTTP POST, which allows larger payloads and binary formats. JSON is the suggested format, and HTTPS is "strongly recommended" but not technically required.

Each DSP then has a choice. It can answer with a bid response, or decline, either by returning HTTP 204 with an empty body or by sending a response carrying a no-bid reason code. The exchange ranks the bids, notifies the winner and serves the ad. All of this is real-time bidding, completed while the page loads.

Anatomy of the request

Only two attributes are strictly required by the specification: id, a unique identifier the exchange assigns to the auction, and imp, an array holding at least one impression. IAB Tech Lab concedes that a request with only those fields "does not supply any context about what is being bid on", and the market expects far more. Most requests carry seven blocks.

Imp. Each impression has its own id and declares the formats on offer: banner, video, audio or native. It sets bidfloor, the minimum price in cost per thousand impressions (CPM), with bidfloorcur defaulting to US dollars. Other fields flag an interstitial (instl), a rewarded ad (rwdd), secure creative (secure) and server-side ad insertion (ssai). A pmp object carries private marketplace deals, and tagid names the placement that triggered the auction.

Site, app or dooh. Exactly one describes where the ad will appear. Site carries the domain, page URL, referrer and content categories; app carries the bundle, the application's store ID; dooh describes a digital out-of-home screen.

Device. This block holds the user agent string (ua) and, since 2.6, a structured version (sua) built from browser client hints. It also carries the IP address, operating system, model, connection type, carrier and, in apps, ifa, the advertising identifier the operating system issues. A geo sub-object can include latitude and longitude, with a type field saying whether they came from GPS or an IP lookup.

User. The id field is the exchange's own user identifier, usually read from its cookie. buyeruid is the DSP's identifier for the same person, mapped through cookie syncing. Audience segments ride in data objects, the Transparency and Consent Framework string in consent, and identifiers from third-party identity providers in eids. Year of birth and gender were deprecated in 2.6.

Source. This names who makes the final decision (fd), a transaction ID (tid) meant to be common to every copy of the same opportunity, and schain, the SupplyChain object listing each paid intermediary.

Regs. Legal flags: coppa for the US children's privacy rule, gdpr, us_privacy and the Global Privacy Platform string in gpp.

Auction rules. At the top level, at declares the auction type (1 for first price, 2 for second price plus, the default), tmax the deadline in milliseconds, cur the accepted currencies, and bcat, badv and bapp block advertiser categories, advertiser domains and apps. Any object can also hold ext, an exchange-defined extension.

Size, speed and volume

Amazon Web Services' pricing examples for RTB Fabric, its dedicated bidding network launched on October 23, 2025, assume average request sizes of 3,048 and 3,800 bytes. Compression is optional and must be agreed between exchange and bidder; Index Exchange says gzip can cut DSP bandwidth use by 20% to 30%.

According to Google's Authorized Buyers documentation, the deadline carried in tmax "typically ranges from 80 to 1000 ms", including network transit, and Google requires 85% of responses to arrive within it. The specification's own video example uses 120 milliseconds, and DSPs typically get 100 to 150 milliseconds to answer.

PubMatic handles about 2.7 trillion bid requests a day, and since April 16, 2026 it has charged publishers $0.001 CPM for traffic above their caps. Very few requests turn into ads: DataBeat put the fill rate of conventional programmatic requests at about 0.183% in May 2026, roughly two impressions per 1,000 requests, as the bidstream explainer records.

A worked example

A news app shows a full-screen ad between articles. The SSP builds a request with id "a91f", one imp with instl set to 1, a 320x480 banner and bidfloor 1.50 in EUR. App carries the bundle and store URL; device carries the operating system, ifa and IP address; regs sets gdpr to 1, and user carries the consent string. Source holds a tid and a two-node schain: the publisher's SSP and one reseller. The request sets at to 1 and tmax to 200. A DSP that recognises the ifa bids 2.40; one that cannot read the consent string returns 204. At first price, the impression clears at 2.40.

Origin and evolution

OpenRTB started in November 2010 as a pilot between three DSPs, DataXu, MediaMath and Turn, and three sell-side platforms, Admeld, PubMatic and The Rubicon Project, according to the specification's history section. A mobile subcommittee led by Nexage produced OpenRTB Mobile 1.0 in February 2011, and version 2.0 unified display, mobile and video in June 2011. The IAB adopted it as a standard with 2.1 in January 2012.

The request grew with the market: 2.2 formalised private deals, 2.3 added native, 2.4 audio, and 2.5, in December 2016, the Source object for header bidding. Version 2.6, published in April 2022, added CTV ad pods, the structured user agent and formal homes for schain and eids. Since November 2022 releases carry date suffixes rather than new numbers: 2.6-202211 added the dooh object, 2.6-202303 replaced video placement with plcmt, 2.6-202409 added inserter and matcher fields to record who added an identifier and how it was matched. The June 2026 release added realtime and firstbroadcast to the content object to separate a live broadcast from a replay.

Why it matters

The request is the only information a DSP has when deciding whether to buy, so targeting, frequency capping, brand safety and price all depend on which fields the seller fills. Gaps are common, which is why IAB Spain published a guide ranking CTV bid request parameters into critical and additional tiers on January 27, 2026. Amazon Publisher Services extended Signal IQ to benchmark which OpenRTB fields publishers pass in May 2026.

Duplication is the other cost. One impression reaching a buyer through several SSPs and resellers arrives as several requests. DataBeat's June 11, 2026 report found a 46% duplicated-domain rate among established SSPs.

Limitations and disputes

Compliance is voluntary and uneven. A HUMAN Security diagnostic in November 2023 found that 79% of requests carried a SupplyChain object but only 42% of those passed full validation.

The transaction ID is contested. The specification says tid must be common across all participants. On August 27, 2025, Prebid, the open-source header bidding framework, made it bidder-specific after publishers argued it let buyers stitch data across sellers; IAB Tech Lab called the change a material violation of OpenRTB.

Privacy is the most persistent criticism, because a request reaches every invited bidder whether or not it bids. A January 2025 complaint by the Electronic Privacy Information Center and the Irish Council for Civil Liberties estimated that Google's system broadcast data about US individuals about 31 billion times a day. A suit filed on February 19, 2026 alleges that Google's bid requests sent page URLs, IP addresses and identifiers to partners affiliated with ByteDance, Baidu and Temu; Google had not responded publicly when PPC Land reported it. The request carries consent signals but cannot enforce them.

Not the same as

Ad request. The call from a page, app or player to an ad server or SSP. One ad request can generate many bid requests.

Bid response. The buyer's reply, echoing the request id and carrying a price, creative and win notice URL. A request offers; a response prices.

Bidstream. The aggregate flow of bid requests and the data they carry, especially when collected or resold. A bid request is one message; the bidstream is all of them.

Callout. Google's term for a bid request sent to Authorized Buyers bidders, used in its Callout Quota System. The object is the same.

Recent developments

Amazon Ads donated its Dynamic Traffic Engine to IAB Tech Lab on April 15, 2026, letting buyers tell SSPs which requests to drop. Under a US settlement approved on March 26, 2026, Google must offer users a control that strips identifiers, IP addresses and cookie-matching data from its bid requests. The Agentic RTB Framework, final since August 12, 2026, lets containerised partner code propose mutations to a live request, such as adding audience segments. Programmatic Best Practices 1.0, released for comment on September 16, 2026 with a deadline of October 16, asks sellers to send each partner one request per opportunity and to include schain in every request.

Timeline

  • November 2010: OpenRTB pilot begins between DataXu, MediaMath, Turn, Admeld, PubMatic and The Rubicon Project
  • February 2011: OpenRTB Mobile 1.0 released after a Nexage proposal
  • June 2011: OpenRTB 2.0 unifies display, mobile and video bid requests
  • January 2012: The IAB adopts OpenRTB as a standard with version 2.1
  • December 2016: OpenRTB 2.5 adds the Source object for header bidding
  • June 2019: The UK Information Commissioner's Office reports that bid requests can involve special category data
  • April 2022: OpenRTB 2.6 adds ad pods, structured user agent and formal schain and eids fields
  • November 2022: Dated releases begin with 2.6-202211, adding the dooh object
  • November 1, 2023: HUMAN Security finds only 42% of SupplyChain objects pass validation
  • January 2025: EPIC and ICCL complaint estimates 31 billion daily Google broadcasts about US individuals
  • August 27, 2025: Prebid makes transaction IDs bidder-specific
  • October 23, 2025: AWS launches RTB Fabric
  • January 27, 2026: IAB Spain publishes its CTV bid request parameter guide
  • February 19, 2026: McGrath v. Google filed over bid request data sent to Chinese-affiliated partners
  • March 26, 2026: Court approves Google RTB settlement with a bid request data control
  • April 15, 2026: Amazon donates the Dynamic Traffic Engine to IAB Tech Lab
  • April 16, 2026: PubMatic's excess inventory fee takes effect
  • June 2026: OpenRTB 2.6-202606 adds realtime and firstbroadcast
  • August 12, 2026: Agentic RTB Framework 1.0 declared final
  • September 16, 2026: Programmatic Best Practices 1.0 released for comment until October 16

Summary

Who. Ad exchanges and SSPs such as PubMatic, Magnite and Index Exchange build bid requests; DSPs such as The Trade Desk, Display & Video 360 and Amazon DSP receive and price them. IAB Tech Lab maintains the format through OpenRTB.

What. A structured message, usually JSON over HTTP POST, offering one or more impressions for auction and describing the placement, site or app, device, user, supply chain, legal signals and auction rules.

When. The common format dates to the OpenRTB pilot of November 2010 and version 2.0 in June 2011; the current 2.6 line began in April 2022 and was last updated in June 2026.

Where. In server-to-server connections between sellers and buyers across web, app, CTV, audio and digital out-of-home inventory, typically within a deadline of 80 to 1,000 milliseconds.

Why. A shared description of a single impression lets any buyer price any seller's inventory automatically. The same design sends personal data to every invited bidder and multiplies infrastructure costs, which drives the current push for fewer, leaner requests.