The bidstream is the continuous flow of bid requests that ad exchanges and supply-side platforms (SSPs) send to prospective buyers during real-time bidding (RTB), together with the data those requests carry. Each time a page or app with programmatic advertising loads, the seller describes the impression, the content, the device and whatever it knows about the person, then sends that description to every bidder connected to the auction. Bidstream data refers to the contents of those messages as collected, stored or resold by the companies receiving them.

The arrangement exists because an impression cannot be priced without being described, and the description has to go out before anyone knows who will win. Most recipients will not buy. All of them see the request.

The word is trade shorthand. It does not appear in the OpenRTB 2.6 specification from IAB Tech Lab, the Interactive Advertising Bureau's standards arm, which says only that bid requests are broadcast to bidders. Tony Katsur, its chief executive, said in November 2025 that companies needed to better "enrich, inform and analyze programmatic trading, or the bid stream itself."

How a request moves through the stream

A transaction begins when a browser or app calls a publisher's ad server or a header bidding wrapper such as Prebid.js. The SSP or exchange builds a BidRequest object and posts it over HTTP, as JSON by default, to each connected demand-side platform (DSP). Only two elements are required: an exchange-assigned id and an imp array describing the impressions. The tmax attribute sets the milliseconds allowed for bids; the specification's example uses 120.

Bidders return a price and creative, or an empty HTTP 204 response as a no-bid. The exchange runs the auction, calls the winner's notice URL with the clearing price in the AUCTION_PRICE macro, and may send loss notices. Nothing in that sequence retrieves the request from the losers.

The payload is organised into objects. Site or App carries the page URL, referrer and store bundle ID. Device carries the user agent, the IP address closest to the device, make, model, carrier, ifa (the mobile advertising identifier) and a limit ad tracking flag. Its Geo object can hold latitude and longitude, a type field recording whether the fix came from GPS, an IP lookup or the user, accuracy in metres and the seconds since the fix. User carries an exchange cookie ID, a buyeruid from cookie syncing, an eids array of third-party identifiers, data segments and the Transparency and Consent Framework (TCF) consent string. Regs flags the EU General Data Protection Regulation (GDPR), the US Children's Online Privacy Protection Act (COPPA) and Global Privacy Platform strings. Source carries tid, a transaction ID meant to be common across every participant, and schain, the list of paid intermediaries.

Version 2.6 deprecated year of birth and gender, and states that labelling a field "recommended" reflects market norms, not advice to send it. Implementations differ. Google's legacy Authorized Buyers protocol passed only the first three bytes of an IPv4 address, and its programme guidelines call the payload callout data: a buyer that does not win may not use it to build user lists or profiles or combine it with third-party data, and retention is capped at 18 months.

Who operates it, and at what volume

Publishers originate impressions; SSPs, exchanges, wrappers and resellers route them; DSPs and attached data vendors receive them. Volume dwarfs spend. DataBeat put conventional programmatic fill for May 2026 at 0.183%, roughly two impressions per thousand bid requests. Jounce Media found the average RTB-enabled publisher integrated with 24.5 SSPs as of March 2025, with rebroadcasting paths behind 37% of display auctions, and DataBeat measured a 46% duplicated-domain rate at established SSPs in June 2026. A Trade Desk executive cited one Roku device generating 1.7 million bid requests in a day.

Buyers respond with traffic shaping, discarding requests unread, while exchanges cap queries per second (QPS). Amazon donated its Dynamic Traffic Engine to IAB Tech Lab on April 15, 2026, letting DSPs tell SSPs what not to send.

The Irish Council for Civil Liberties (ICCL) estimated in May 2022 that RTB shares data 178 trillion times a year across the US and Europe, 747 times a day per US user, and that Google allowed 4,698 companies to receive data about people in the US, according to the ICCL. A January 2025 complaint by the ICCL and the Electronic Privacy Information Center (EPIC) put Google's broadcasts about US individuals at about 31 billion a day.

Origin and evolution

Exchanges such as Right Media and AppNexus auctioned single impressions through proprietary interfaces by the late 2000s. OpenRTB began in November 2010 as a pilot among three DSPs and three SSPs, reached a unified version 2.0 in June 2011 and became an IAB standard as version 2.1 in January 2012. Version 2.5, opened for comment on November 16, 2016, added a header bidding signal and loss notifications, according to IAB Tech Lab. Version 2.6 followed in April 2022 with ad pods for streaming television.

The word's passage into policy language can be traced. On September 12, 2018, Johnny Ryan, then at Brave, filed GDPR complaints in Ireland while Jim Killock of Open Rights Group and Michael Veale filed in the UK, according to the ICCL. The UK Information Commissioner's Office (ICO) found in June 2019 that bid requests could involve special category data such as health or politics, and that relying on contracts to govern onward sharing did not seem appropriate. In April 2021 six US senators, among them Ron Wyden and Mark Warner, asked Google, Magnite, OpenX, PubMatic and Index Exchange, among others, to name foreign firms that had received US "bidstream" data, according to Vice. The quotation marks survived to December 2024, when a Federal Trade Commission (FTC) statement in the Federal Register called its Mobilewalla case the agency's first action against such data.

Why it matters

Open-web targeting, frequency capping and attribution depend on identifiers carried in bid requests. Under the Google RTB privacy settlement given final approval on March 26, 2026, users can activate an RTB Control that strips Google user IDs, IP addresses, device IDs and cookie-matching data.

Browser alternatives did not displace that flow. Google kept third-party cookies in April 2025 and retired most Privacy Sandbox technologies on October 17, 2025, leaving identifier-based buying tied to what travels in bid requests.

The stream is also where supply-path fights happen. Prebid.org made transaction IDs bidder-specific on August 27, 2025, stopping buyers recognising one impression arriving through several exchanges; IAB Tech Lab said the change materially violated OpenRTB, while publishers argued shared IDs let buyers stitch requests across sellers. The Trade Desk answered with OpenAds, reporting prior transaction ID coverage of 59% of browser ads.

Limitations, criticisms and disputes

A request sent to hundreds of recipients cannot be recalled, and limits on what losing bidders do with it are contractual. The FTC alleged that Mobilewalla gathered more than 500 million advertising identifiers paired with precise location between January 2018 and June 2020, keeping data even from auctions it lost, according to the FTC. The order finalised in January 2025 bars it from collecting exchange data except to take part in auctions. Commissioner Melissa Holyoak dissented, arguing that a breach of contract between businesses is not automatically an unfair practice; Andrew Ferguson supported the RTB count. Check My Ads later urged the Media Rating Council to make exchanges stop losing bidders collecting and storing auction data.

European enforcement has been uneven. Belgium's data protection authority fined IAB Europe 250,000 euros over the TCF in February 2022, but the Belgian Market Court on May 14, 2025 confined IAB Europe's joint controllership to consent strings rather than downstream OpenRTB processing.

The evidence is contested too. The ICCL's 2022 figures rest on industry data from a source it did not name, according to TechCrunch, which makes them hard to test. Buyers doubt the data from another angle: Tom Swierczewski of Goodway Group called bidstream data "deeply flawed" as a basis for autonomous buying. Security claims have reached court, with a February 2026 class action alleging Google's RTB system passed US browsing data to units of ByteDance and Baidu and to Temu's operator.

Not the same as

Bid request. One message offering one auction; the bidstream is the aggregate flow.

SDK location data. Gathered by software development kits (SDKs), code embedded in apps, and sold through aggregators rather than received in auctions. US Customs and Border Protection believed data bought from Venntel came from both sources, according to Vice.

Log-level data. Post-auction records of impressions a party transacted, delivered after the event. The bidstream is the pre-auction offer, including everything nobody bought.

Data stream. In Google Analytics 4, a feed of events from a website or app into a property, unrelated to auctions.

Recent developments

Investment is moving toward processing the bidstream at its source. Amazon Publisher Services extended Signal IQ to the full OpenRTB bidstream on May 28, 2026. PubMatic's Decision Fabric hosts partner models inside its auction, trained on samples of more than 60 OpenRTB fields with personal data hashed. IAB Tech Lab's Agentic RTB Framework, which lets containers propose changes to bid requests, was declared final on August 12, 2026.

Scrutiny continues. The ICCL's representative action against Microsoft's RTB system, permitted by Ireland's High Court in May 2025, opened with a three-day Commercial Court hearing on June 15, 2026, according to ICCL Enforce. On September 9, 2026, BidSwitch opened opt-in bidstream analysis from Adalytics to its supply partners at no cost, with BidSwitch reviewing the research before any recommendation reaches a partner.

Timeline

  • Late 2000s: Right Media, DoubleClick AdX and AppNexus auction impressions individually through proprietary interfaces
  • November 2010: OpenRTB pilot begins among three DSPs and three SSPs
  • June 2011: OpenRTB 2.0 unifies display, mobile and video bid requests
  • January 2012: OpenRTB 2.1 becomes a formal IAB standard
  • November 16, 2016: OpenRTB 2.5 opens for public comment with header bidding signals and loss notifications
  • September 12, 2018: Johnny Ryan, Jim Killock and Michael Veale file GDPR complaints over RTB in Ireland and the UK
  • June 20, 2019: The ICO publishes its update report into adtech and real-time bidding
  • April 2021: Six US senators ask exchanges to name foreign recipients of US bidstream data
  • February 2, 2022: Belgium's data protection authority fines IAB Europe 250,000 euros over the TCF
  • April 2022: OpenRTB 2.6 is released, deprecating year of birth and gender
  • May 16, 2022: The ICCL publishes its estimate of 178 trillion annual RTB broadcasts in the US and Europe
  • June 2022: A community extension for per-impression transaction IDs is approved
  • December 3, 2024: The FTC announces its Mobilewalla case, its first action over bidstream data collection
  • January 2025: The FTC finalises the Mobilewalla order
  • January 16, 2025: EPIC and the ICCL file a complaint with the FTC over Google's RTB broadcasts
  • February 15, 2025: Google sunsets its proprietary Authorized Buyers bidding protocol in favour of OpenRTB
  • May 14, 2025: The Belgian Market Court limits IAB Europe's joint controllership to consent strings
  • May 26, 2025: Ireland's High Court permits the ICCL's class action against Microsoft's RTB system
  • August 27, 2025: Prebid.org introduces bidder-specific transaction IDs; IAB Tech Lab calls the change a violation of OpenRTB
  • October 17, 2025: Google retires most Privacy Sandbox technologies
  • November 13, 2025: IAB Tech Lab releases the Agentic RTB Framework for public comment
  • February 19, 2026: McGrath v. Google LLC is filed over RTB data transfers to ByteDance, Baidu and Temu units
  • March 26, 2026: Final approval is granted to the Google RTB privacy settlement
  • April 15, 2026: Amazon donates its Dynamic Traffic Engine to IAB Tech Lab
  • May 2026: Google introduces the partner ad setting implementing the RTB Control
  • May 28, 2026: Amazon Publisher Services extends Signal IQ to the full OpenRTB bidstream
  • June 2026: PubMatic announces Decision Fabric
  • June 11, 2026: DataBeat reports a 46% duplicated-domain rate at established SSPs
  • June 15, 2026: The ICCL v Microsoft hearing opens in the Irish Commercial Court
  • August 12, 2026: The Agentic RTB Framework version 1.0 is declared final
  • September 9, 2026: BidSwitch discloses opt-in bidstream analytics from Adalytics for supply partners

Summary

Who. Publishers, SSPs, exchanges and header bidding wrappers generate and route the bidstream; DSPs, bidders and data vendors receive it. IAB Tech Lab defines its format through OpenRTB, Google sets its own rules for Authorized Buyers, and regulators including the ICO, Belgium's data protection authority and the FTC, alongside campaigners such as the ICCL, have challenged how its data is used.

What. The flow of bid requests broadcast to prospective buyers in real-time auctions, and the data inside them: page or app details, device identifiers, IP address, location, user identifiers, audience segments, consent signals, transaction IDs and supply chain records. Every connected bidder receives each request whether or not it wins.

When. The flow emerged with ad exchanges in the late 2000s, was standardised through OpenRTB from 2010 onward, and became a regulatory term between the GDPR complaints of September 2018 and the FTC's Mobilewalla action of December 2024. Litigation, settlement controls and in-auction processing reshaped it through 2025 and 2026.

Where. Between publisher-side systems and buyer-side bidders across web, mobile app and connected television inventory, in data centres operated by exchanges and DSPs, and increasingly inside exchange infrastructure where partner containers and models now run.

Why. Buyers cannot price individual impressions without descriptions of them, so sellers describe every opportunity to every potential buyer. The same design that makes per-impression pricing possible distributes personal data far beyond the winning bidder, generates billions of requests that are never bought, and leaves enforcement dependent on contracts that recipients can breach.