The first ten days of May 2026 produced a week-long rearrangement of who holds power in digital advertising and who pays the cost when it changes hands. Four demand-side platforms ended the period controlling roughly 85% of global programmatic spend. Google pushed checkout out of an experimental surface and into mainstream search results. The Dutch privacy regulator levied a 100 million euro fine against the parent company of a ride-hailing app. Researchers found more than 5,000 unsecured AI-built applications leaking advertising strategy documents and customer chatbot logs onto the open web. And Microsoft published the most technically candid statement it has made in years about why its search index is being rebuilt for AI grounding rather than the link economy.

Each event would, in a quieter week, anchor a full briefing. Together they describe a platform economy whose contours are firming up rapidly, with the consequences for independent operators, publishers, and small advertisers becoming harder to dispute.

The DSP market is now a four-firm club

A new dataset from Guideline, the ad intelligence firm that tracks holding company and large independent agency budgets, reached the public on May 6 via the Media Unfiltered Podcast. The numbers are blunt. Google's DV360, The Trade Desk, Yahoo, and Amazon together commanded around 85% of global programmatic ad spend in Q1 2026, up from approximately 75% in calendar year 2022. The "remaining" category covering every other DSP collapsed from 21% in 2022 to 5% in Q1 2026. Roughly 45% of smaller DSPs have lost market share over four years to one of the four dominant players.

Within that group, the trajectory is not symmetrical. Sean Wright, chief insights and analytics officer at Guideline, told podcast host Justin Lebbon that Amazon went from under 10% of share in the dataset to just under 20% in roughly fifteen months. Google DV360 climbed from 34% in 2022 to 41% in Q1 2026. The Trade Desk grew from 22% to 31% over the same period, but Wright described its current pace as "essentially growing at exactly the market rate," meaning it is holding share rather than gaining. Geographic detail sharpens the picture: globally The Trade Desk grew approximately 13% in Q1 2026, but in the United States, by far the largest single programmatic market, growth has fallen to "pretty low single digit" levels.

The competitive mechanics of Amazon's rise are documented and direct. The company charges a 1% fee for open web publisher ads through its DSP and zero fees for programmatic guaranteed deals on its own owned-and-operated media. The Trade Desk's reported take rate sits near 21.6%, a figure CEO Jeff Green confirmed earlier this year. The Trade Desk reported $689 million in Q1 2026 revenue on May 7, up 12% year over year, and shares fell 15% in after-hours trading. CEO Jeff Green warned of macroeconomic headwinds and a cautious advertiser environment.

Wright's discussion also addressed Meta. Looking back over fifteen years of data, he found that Meta's quarterly revenue grew an average of 21% in the quarter following major scandals, with agency spend through Guideline showing 17% growth across the same scandal-period quarters. The recent slowdown Guideline is detecting in Meta agency spend, in his read, is not driven by ethics concerns. It reflects sophisticated buyers reporting that AI-driven Advantage+ tools "drive up costs, not necessarily giving the return on ad spend that a lot of these big brands expected to see from Meta." Smaller advertisers, who can run a campaign with a prompt and a click, embrace the same tools.

The structural picture extends beyond DSPs into linear-to-streaming migration. Linear television in the United States still accounts for approximately 89% of available ad impressions, but 35% to 38% of TV ad budgets have already moved to streaming. Of every dollar leaving linear, only about 25 cents reaches streaming on the same broadcaster's side; the rest leaks to YouTube and other large platforms. OTT video CPMs have fallen approximately 40% in the last eighteen months, partly because of subscription services entering the ad-supported tier and partly because of Amazon's pricing.

Digiday formalised the receiving end of this concentration on May 8 in a WTF explainer on the unified advertising platform, tracking how Nexxen, Adform, Epsilon, and Microsoft's Xandr are bundling buy-side and sell-side functions inside a single stack. Match rates between unrelated DSPs and SSPs can fall to 50%, according to commentary from Nexxen chief commercial officer Chance Johnson. With shared data layers, that match rate holds at close to 100%. The acronym UAP has not entered every glossary yet, but the architecture it describes is what the four-firm concentration looks like from the publisher seat.

Google moves UCP checkout into main search results

On May 5, SERP researcher Brodie Clark documented something that had been telegraphed for months but not yet observed in production: a Google Search result for a sofa bed couch query showed a Wayfair listing with a working Buy button in the main results section, not in AI Mode. Barry Schwartz of Search Engine Roundtable independently replicated the finding, and PPC Land tracked the broader implications on May 10.

The button is Google's Universal Commerce Protocol checkout, an open standard announced January 11, 2026 at the National Retail Federation conference. UCP defines technical specifications for AI agents to discover products, negotiate checkout, link customer identities, and manage post-purchase events. It supports REST and JSON-RPC transport layers and is compatible with Agent Payments Protocol for cryptographic transaction authorisation, Agent2Agent for multi-agent collaboration, and Model Context Protocol for tool calling. Co-developers included Shopify, Etsy, Wayfair, Target, and Walmart. On April 24, Amazon, Meta, Microsoft, Salesforce, and Stripe joined the UCP Tech Council.

The mechanics: a shopper clicks Buy, billing and shipping load from Google Wallet, payment processes through Google Pay, the transaction completes inside the search results page. Eligible listings require the native_commerce product attribute in Merchant Center, a Funding Primary Account Number stored in Google Wallet, and a payment service provider configured for Google's payment token exchange system. Google's Merchant Center help page explaining all of this only reached publication on March 2, 2026, two months after the protocol's launch.

The expansion of the Buy button into standard search results is structurally significant because AI Mode, where UCP checkout had been confined since launch, reaches roughly 75 million daily active users. Standard search results reach an order of magnitude more. Clark's screenshot also showed sponsored ads appearing directly above the free listings carrying the Buy button, which represents a third surface to receive grid-format paid placements after AI Mode and the Shopping tab.

Google paired the UCP development with a separate announcement the day after, May 6. Hema Budaraju, Vice President of Product Management for Search, introduced five new outbound link features for AI Mode and AI Overviews: an "explore new angles" section linking to in-depth articles at the end of responses; subscription label integration that flags articles from publications a user already pays for; a dedicated first-hand perspectives section pulling from forums and social posts; inline links positioned next to the relevant text in a response; and desktop hover previews showing site name and page title. Google said early testing of the subscription label produced significantly higher click rates on labelled links.

The link features arrived against research findings that have not been kind to publishers. Ahrefs updated its AI Overviews study in February 2026, finding the click-through reduction had grown from 34.5% in April 2025 to 58% across 300,000 keywords. A Pew Research Center study from July 2025 found users clicked on AI Overview source links in just 1% of visits to pages. Datos's Q1 2026 state of search report, published in late April, recorded a counter-trend: zero-click searches falling from 24.5% in December 2025 to 22.4% in March 2026 in the United States. The picture is contested.

Microsoft's Bing team contributed a separate technical statement on May 6. In a post titled "Evolving role of the index: From ranking pages to supporting answers," Krishna Madhavan, Knut Risvik, and Meenaz Merchant of Microsoft AI argued that an index built for AI grounding diverges from one built for web search across five dimensions: factual fidelity, source attribution quality, freshness, coverage of high-value facts, and contradiction handling. Their final observation was the most candid: "We have decades of practice measuring search quality. We are still learning what it means to measure grounding quality rigorously." Microsoft has been building publisher-facing infrastructure to match. The AI Performance dashboard in Bing Webmaster Tools entered public preview February 10, 2026; the data-nosnippet attribute reached production in October 2025.

Yango, Yandex, and the limits of pseudonymisation

The Dutch Data Protection Authority imposed a 100 million euro fine on MLU B.V., the Netherlands-registered parent of ride-hailing app Yango, on April 1, 2026. The decision became public on May 8, with the case centring on transfers of Finnish and Norwegian user data to two Russian entities, Yandex.Taxi LLC and Yandex LLC, without adequate safeguards under Articles 44 and 46 of the GDPR.

The technical findings deserve attention from any organisation routing personal data through multi-jurisdictional pipelines. Until November 27, 2023, Ridetech International B.V., Yango's EEA operating entity, stored Finnish and Norwegian user data on servers in Russia, with the encryption keys held on those same Russian servers. The data could be decrypted on the spot, rendering the encryption practically meaningless. The arrangement also breached Ridetech's own September 2021 standard contractual clauses. From November 27, 2023, Ridetech moved the encrypted data and keys to Amazon Web Services in Frankfurt, but encrypted personal data continued to flow onward to Russian recipients.

The AP rejected Ridetech's argument that pseudonymisation and EU-held encryption keys were sufficient. The single most significant finding turns on shared executive control. The same individual served as director of both Yandex.Taxi LLC in Russia and MLU B.V. in the Netherlands from at least September 15, 2020 through May 31, 2024. Because that director held authority over both ends of the transfer, the AP concluded re-identification of EEA users would not require significant cost or effort by the Russian recipient. The technical encryption became governance theatre.

A separate ground concerned the wrong template. Ridetech applied controller-to-processor SCCs, but the AP found Yandex.Taxi LLC was a joint controller, since it co-determined the purposes and means of processing through software it owned and could modify. The correct instrument would have been controller-to-controller SCCs.

Russian law produced the third leg of the analysis. Both Yandex.Taxi LLC and Yandex LLC are registered as Internet Communications Organisers under the 2006 information law and are obliged under the Yarovaya Law from 2016 to provide information to Russian security services and surrender encryption keys upon request. They must install SORM hardware. The Russian Taxi Law, in force since September 1, 2023, requires taxi providers to retain ride logbooks for at least six months and provide system access to security authorities. The AP also concluded Russia's data protection regulator Roskomnadzor cannot be considered an independent authority within the meaning of Article 45(2) GDPR, since it is hierarchically subordinate to the Ministry of Digital Development and is required to enforce surveillance legislation that conflicts with privacy interests.

The fine calculation followed the EDPB's Guidelines 04/2022. The relevant economic entity was treated as the entire Consortium.First group, including IPJSC YANDEX listed on the Moscow Stock Exchange, which reported 1.094 trillion rubles in 2024 revenue, equivalent to roughly 12.08 billion euros. The 4% statutory ceiling came to 483.2 million euros. The AP set the base amount at 100 million, with no aggravating or mitigating adjustments.

MLU has six weeks from April 1 to file an objection and intends to challenge the fine. The Dutch DPA had previously imposed a 290 million euro penalty on Uber for unlawful data transfers to the United States. The Yango decision adds shared directorship to the doctrinal toolbox enforcement authorities can use against transfer arrangements that look compliant on paper.

Vibe-coded apps and the new perimeter problem

On May 7, WIRED published research from cybersecurity firm RedAccess documenting more than 5,000 web applications built with AI coding tools left publicly accessible with no authentication or security controls. Around 2,000 of those apps appeared to expose genuinely private data. The four platforms named in the research are Lovable, Replit, Base44, and Netlify.

Among the categories of data WIRED says it observed in the screenshots: a hospital's internal work assignment records with doctor personally identifiable information, a company's detailed advertising purchase data, what appeared to be another firm's go-to-market strategy presentation, a retailer's full chatbot conversation logs containing customer names and contact details, a shipping company's cargo records, and various sales and financial files. Some of the apps would have allowed an outside visitor to gain administrative privileges on backend systems. RedAccess also found phishing sites impersonating Bank of America, Costco, FedEx, Trader Joe's, and McDonald's hosted on Lovable's own domain.

The methodology was simple. Lovable, Replit, Base44, and Netlify all let users host applications on their own subdomains by default. RedAccess searched Google and Bing for those subdomains combined with additional terms. Thousands of apps surfaced almost immediately.

The platform responses sorted into a familiar pattern. Replit CEO Amjad Masad acknowledged that some users had published apps that should have been private but framed public accessibility as expected behaviour for apps users choose to make public. Lovable said it was treating the matter as ongoing and emphasised that configuration is the creator's responsibility. Base44, owned by Wix, argued that any exposed apps reflected deliberate user configuration choices rather than platform vulnerabilities, and questioned whether RedAccess's examples contained real user data.

For marketing teams the implication is direct. Account managers, strategists, and media planners have adopted vibe-coding tools to build internal dashboards, reporting tools, and client-facing portals without filing engineering tickets. These applications bypass the engineering security review processes that exist precisely to catch this category of exposure. Advertising purchase data, campaign budgets, audience targeting parameters, and seasonal flight schedules are competitive intelligence inside most organisations. Chatbot logs containing customer names and contact details could constitute a personal data breach under GDPR.

Security researcher Joel Margolis, who recently uncovered a separate case where an AI chat toy left 50,000 children's conversations on a publicly accessible website, framed the issue as a default-configuration problem. AI coding tools "do what you ask them to do. And unless you ask them to do it securely, they're not going to go out of their way to do that." The historical analogue Dor Zvi of RedAccess offered is the Amazon S3 misconfiguration wave that exposed data from Verizon and World Wrestling Entertainment in earlier years, where default settings made misconfiguration the path of least resistance.

A separate Firefox vulnerability disclosed on May 10 reinforced the broader perimeter point: an IndexedDB flaw allowed websites to fingerprint users in private browsing sessions and persist tracking through Tor's New Identity resets. Mozilla patched it on April 21 in Firefox 150 and ESR 140.10.

OpenAI moves to performance pricing, expands hiring

OpenAI launched its self-serve Ads Manager in beta to all US advertisers on May 5, accessible at ads.openai.com after verification. The interface introduced cost-per-click bidding alongside the existing $60 cost-per-mille model, with recommended starting bids between $3 and $5 per click. A Conversions API and pixel-based measurement tools accompanied the launch. The minimum spend requirement that gated the original pilot, which had been $50,000 per advertiser at the February 9, 2026 pilot launch, was dropped. Asad Awan, OpenAI's ads and monetisation lead, briefed Digiday the same day and flagged third-party measurement and cost-per-action bidding as work in progress without partners or a timeline.

The pixel infrastructure took an additional two days to reach mid-market deployment. Utku Gulden, an analytics and measurement professional, published a Google Tag Manager community template for the OpenAI Ads Measurement Pixel on May 7. The template, gtm-openai-ads-pixel v1.0.0, is licensed under Apache 2.0 and was submitted to the GTM Community Template Gallery pending Google approval. Without it, advertisers had to deploy custom HTML tags, with no field validation, no version control structure, and developer involvement at every change.

OpenAI's update to its US privacy policy on April 30, reported by PPC Land on May 1, formally disclosed that the company receives purchase data from advertisers and their partners to measure ad effectiveness, shares user information with marketing partners for third-party targeting, and uses personal data to promote its own products. Search and shopping providers were added to the list of recipients.

The company is hiring at scale. PPC Land documented 19 open ads-related roles spanning San Francisco, New York, London, Tokyo, Seoul, Sydney, and Sao Paulo on May 6. The geographic distribution implies paid search competition extending well beyond the US market.

Google's pre-GML push and other infrastructure

Google's pre-Google Marketing Live announcement on May 5 covered three measurement products. Data Manager Map View provides a visual interface mapping connected data sources across Salesforce, HubSpot, BigQuery, and Ads Data Hub, with expanded API support for store sales signals. Meridian GeoX, an experimental design layer on top of the open-source Meridian marketing-mix-modelling framework, will begin testing later in 2026. Meridian Studio, a Google Cloud-powered enterprise platform, targets sophisticated teams managing high-volume models. The post was authored by Gaurav Bhaya, VP and GM of Buying, Analytics and Measurement, with Ginny Marvin sharing supporting detail on LinkedIn. Google Marketing Live 2026 streams May 20.

The same week Google removed the back button trigger for AdSense vignette ads, with the change taking effect June 15, 2026 to align with the new search penalty for back button hijacking. Vignette ads can still appear at other moments in a user's browsing flow. Separately, Google launched a partner ad opt-out reportedly under settlement deadline pressure, with researchers describing the rollout as rushed and lacking full integration into core ad settings. The opt-out lets users disable personalised ads on partner sites and apps that serve Google ads.

The UK ad market grew 6.4% in 2025 according to WARC data published May 7, but two of every three pounds went to Google, Meta, or Amazon. WARC's chart projected Meta and Alphabet each capturing more than $80 billion in incremental ad revenue between 2025 and 2027.

Australians spend approximately 21 hours per week streaming, according to Ipsos iris and IAB Australia's March 2026 Digital Landscape Report. The 22.66 million online Australians measured break down by age, with the 45-64 cohort leading at 21.9 hours per week. The data feeds into ad-buying decisions across the AVOD and FAST tier.

Earnings, retail, and the small-business pushback

Optimove's 2026 Summer Shopping Report, published May 6, found that 52% of 648 US consumers surveyed plan to spend more on summer shopping in 2026 than in prior years, with more than 80% of consumers wanting promotional communications before or during May. The early-season pattern echoes 2025 holiday shopping, when 34% of consumers began in October or earlier.

Shopify analysed Core Web Vitals across its merchant base on May 6 and found a 3.5% drop in conversion rate for every 100 milliseconds of additional Interaction to Next Paint latency. The analysis covered the entire merchant network and quantified what front-end engineers have long argued: store performance is conversion infrastructure.

Amazon confirmed Prime Day 2026 for June, PPC Land reported on May 10. FBA inventory must be received by May 27, lightning deals must be submitted by May 26, and the Amazon Warehousing and Distribution window closes the same day.

Criteo's Q1 2026 results published May 6 showed retail media spend continuing to outpace overall market growth, but overall results disappointed with media spend hitting $1 billion while retail media losses dragged the quarter. Criteo's integration with OpenAI as a formal ad tech partner since March 2026 frames the strategic shift the company is attempting.

Taboola reported $466 million in Q1 2026 revenue, complemented by a $77 million legal settlement payment. Bumble's paying users fell 21% but profits rose 165% in the same quarter, illustrating how subscription economics in the consumer apps category are reorienting around higher ARPU rather than user growth.

Lunio launched affiliate fraud detection on May 6, citing $2.8 billion in click fraud losses across 2025. Microsoft Monetize linked LinkedIn data to Amazon DSP CTV inventory on May 7, a survival-bet positioning for what was previously the Microsoft Invest DSP infrastructure.

On the policy side, Internet for Growth issued a media advisory on May 6 ahead of a Capitol Hill fly-in, releasing the "Main Street's Digital Mandate" polling report from Echelon Insights. The survey of 1,030 likely voters, conducted September 5-7, 2025, with a 3.4 point margin of error, found 91% saying personalised ads help them find local businesses and 85% warning that restrictions could cut access to free content. The fly-in lands as Congress debates the SECURE Data Act, H.R. 8413, introduced April 21, 2026, which would replace all existing US state privacy laws with a single federal standard.

Brussels overnight negotiations on the EU AI Act collapsed early in May, as PPC Land reported. The August 2, 2026 compliance deadline under Regulation (EU) 2024/1689 remains intact. The Digital Omnibus package introduced November 19, 2025 had been expected to amend AI Act timelines; the failure of the Brussels talks means no postponement has been granted. Article 50 transparency obligations covering AI disclosure, synthetic content marking, and notification of emotion recognition or biometric categorisation also activate August 2.

What this week confirms

The week's stories share a structural argument. Concentration accelerates when the dominant players control infrastructure that smaller competitors cannot replicate, whether that infrastructure is first-party retail data, owned-and-operated inventory, payment rails embedded in search results, or a self-serve advertising platform spun up in five months from a privacy policy update to a CPC interface. Each enforcement action against the periphery, whether a 100 million euro fine on a Russia-linked data flow or thousands of accidentally exposed marketing applications, illustrates the cost of not having those resources. And each platform announcement, from UCP checkout in standard Search to Microsoft's grounded-index thesis to Google's outbound link expansion, redraws who decides what users see, what they buy, and on whose terms.

The May 20 Google Marketing Live livestream is the next set-piece event. By then, OpenAI's CPC bidding will have a fortnight of running history. By then, MLU's window to file objections to the Yango fine will be near closing. By then, the UCP checkout may sit on more than one retailer's listings.

Timeline

Share this article
The link has been copied!