Open source is software distributed under a license granting anyone the right to run the program, read its source code, change that code and pass the result on. The label describes legal permissions, not price and not visibility. Code posted publicly on GitHub under restrictive terms is not open source; code sold on a disc under the GNU General Public License is. The Open Source Initiative, a California nonprofit, has maintained the reference test since 1998 and decides which licenses pass it.

In advertising the term attaches to load-bearing components. Prebid.js runs the header bidding auction on a large share of the ad-supported web, and Prebid Server does the same job on the sell side's own machines. The Model Context Protocol servers that let AI agents query campaign data ship as open code. This is not peripheral tooling. It is the layer the transaction passes through.

What the license actually grants

The Open Source Definition sets ten criteria a license must satisfy. Free redistribution. Source code included and not deliberately obfuscated. Permission to create derived works under the same terms. No discrimination against persons or groups, which is point 5. No restriction on fields of endeavor, which is point 6. The rights travel with the code to everyone who receives a copy. A tenth clause was added in 2004 to handle click-wrap distribution.

Points 5 and 6 do most of the practical work, because they are what a vendor trips over when it wants to publish code while stopping competitors from using it.

Licenses split into two families. Permissive licenses, among them MIT, BSD and Apache 2.0, allow the code to be folded into proprietary products with attribution and little else. Apache 2.0 adds an explicit patent grant, which is why corporate legal teams tend to prefer it. Copyleft licenses, principally the GNU General Public License, require derivative works to carry the same terms, so a modification cannot be closed.

Prebid's projects use Apache 2.0. The LICENSE file in the Prebid.js repository carries a 2017 copyright notice for Prebid.org, Inc. That choice explains why supply-side platforms with commercial products can build on the wrapper, and why The Trade Desk was able to fork it outright in 2025 without asking permission.

How a project actually runs

The mechanics are worth stating precisely. A repository holds the code. Contributors copy it, a fork, then submit changes as a pull request. Maintainers review and merge or reject, with automated checks running on every proposal. Merged code enters a release, which downstream users pull as a versioned package.

The Prebid.js repository was created on July 19, 2015. As of August 30, 2026 it carried 2,397 forks, 428 contributors with named GitHub accounts, 1,939 contributor entries once email-only commits are counted, and 156 open issues, with the most recent commit landing the previous day. Those numbers describe a dependency: an advertising business whose revenue passes through code maintained by people it does not employ.

A single change shows the process at working scale. Pull request 15356, opened in mid-July 2026 as a proposal to expose auctions, events and time-to-live values to debugging agents, merged into the Prebid.js master branch on August 5 or 6, 2026 with 19 commits, 15 changed files and 109 passing checks.

Governance sits above the code. Prebid.org, formed in September 2017, is funded by dues-paying members, runs development through Product Management Committees and binds members to a code of conduct covering wrapper mechanics, data and transparency. Prebid Mobile now operates in more than 2,000 apps, and the organization takes no cut of the revenue that flows through it.

Origin and evolution

The document underneath everything came from Debian. Bruce Perens drafted the Debian Free Software Guidelines through a month of mailing list discussion in mid-1997, and they were ratified as part of the Debian Social Contract on July 5, 1997.

Netscape announced on January 29, 1998 that it would publish its browser source. On February 3, a group met in Palo Alto to find language that would sell collaborative development to businesses without Richard Stallman's moral framing. Christine Peterson of the Foresight Institute proposed "open source." Perens adapted the Debian guidelines by stripping the Debian-specific references, and the definition was announced on February 9 and 10, 1998. Perens and Eric S. Raymond founded the Open Source Initiative later that month. The first list of approved licenses followed in October 1999.

Advertising arrived seventeen years later. Matt Kendall and Paul Yang at AppNexus, working with Nick Jacob of the publisher Aplus, built Prebid.js in early 2015 to make header bidding implementable without in-house engineering teams. AppNexus and Rubicon Project launched Prebid.org on September 11, 2017, on the stated reasoning that the code had become too important for one company to own. At formation the project counted 81 demand partners, five analytics vendors and 191 individual contributors. Version 1.0 shipped with universal ad unit support for native, video and banner. By its fifth anniversary the project reported 20,000 live implementations, more than 650 engineering contributors and over 250 approved bid adapters. The Trade Desk joined as a leader member with co-founder David Pickles taking a board seat. Google never joined, building Exchange Bidding instead.

The definition then stretched to cover machine learning. The Open Source Initiative published the Open Source AI Definition 1.0 on October 28, 2024, requiring training code under an approved license, freely modifiable weights, and enough detail about training data to reconstruct the system.

Why it matters for buyers and sellers

The commercial argument is arithmetic. A proprietary mediation layer charges a fee on every impression it handles; an open wrapper does not. Dominance follows: IAB Spain's first supply-side platform guide, published in April 2026, describes Prebid as the dominant open-source wrapper for header bidding, and integrations are written against it rather than the reverse. Amazon shipped a Prebid adapter to a public repository in January 2026 for the same reason.

The second argument is inspection. A publisher can read what a bid adapter sends. In a closed exchange the auction logic is a claim rather than a file.

Scale of dependency is now documented. Google Open Source published its 2025 retrospective on August 3, 2026, reporting that roughly 10% of Alphabet's workforce contributed to open projects and that more than 20,000 unaffiliated accounts committed to Alphabet repositories. The same document records more than 15,000 public repositories created over fifteen years against more than 5,000 still maintained, a ratio that matters when selecting a dependency.

Where it breaks

Forking is a right, and exercising it fragments the market. After Prebid made transaction identifiers bidder-specific on August 27, 2025, The Trade Desk launched OpenAds on October 2 running forked Prebid code that preserved the original behavior. Two incompatible auction paths now exist because the license let a disagreement be settled in code.

Governance conflicts have no arbiter. The IAB Tech Lab declared on August 27, 2025 that Prebid's implementation materially violated the OpenRTB specification, with chief executive Anthony Katsur saying the approach "risks undermining the integrity and consistency of open technical standards". A standards body can publish a specification; it cannot compel an independent project to implement it.

Free infrastructure can be withdrawn. Microsoft announced on December 12, 2025 that it would shut down the public Prebid Cache on April 30, 2026, an endpoint inherited from AppNexus through the Xandr acquisition and configured on more than 60% of Prebid cache deployments. Patrick McCann estimated replacement caching at between $50,000 and $250,000 monthly for high-volume video publishers. Primis concluded the cache was already redundant after logging that bidders returned full VAST payloads in browser memory.

Maintenance is underfunded relative to reliance. Google's retrospective reports $2 million directed to more than 40 projects in 2025, against a dependency base the same document describes as foundational. Its CodeMender agent upstreamed 72 security fixes in six months, and companion tools scan PyPI, npm and Crates.io for tampering. Consent, tag management and measurement libraries reach live pages through those registries.

The label itself is contested. The Open Source Initiative holds that Meta's Llama community licenses fail points 5 and 6, and has called the company's usage open washing. Meta continues to describe Llama as open source.

Adjacent terms it is not

An open standard is a specification, not code. OpenRTB and ads.txt are published by the IAB Tech Lab for anyone to implement; the implementations may be proprietary.

Open weights means downloadable model parameters, a subset of what the Open Source AI Definition requires, since that also covers training code and data information. Source-available describes code that can be read but carries use restrictions, which fails the definition outright.

The open web and the open auction use "open" to mean unrestricted access to inventory, unrelated to software licensing.

Recent developments

Agentic infrastructure is being routed through the same governance model. Prebid.org took stewardship of an open-source sales agent on January 29, 2026, after incubation at AgenticAdvertising.org, and devoted a public webinar on May 14 to the Ad Context Protocol layer around it. Google's Ads API team had already released an open-source Model Context Protocol server on October 7, 2025.

Leadership changed in May 2026, when president Mike Racic, chairman Garett McGrath and product director Christian Janelli left. Joel Meyer, chief technology officer at OpenX, became chairman and said in an interview published on August 24, 2026 that there had been no rupture behind the scenes. The Prebid Summit meets in New York on October 13, 2026.

Model licensing has become a procurement question. Google released Gemma 4 under Apache 2.0 in 2026, replacing custom terms. In July 2026, 77 firms signed a letter amid accusations that leading laboratories wanted open-weight competition curtailed. Mark Zuckerberg's AI letter of August 10, 2026 used the phrase "open source" 16 times and the word "advertising" not once.

Timeline

  • July 5, 1997: Debian ratifies the Debian Free Software Guidelines, drafted by Bruce Perens
  • January 29, 1998: Netscape announces it will publish its browser source code
  • February 3, 1998: Christine Peterson proposes the term "open source" at a Palo Alto meeting
  • February 9 and 10, 1998: The Open Source Definition is announced publicly
  • Late February 1998: Bruce Perens and Eric S. Raymond found the Open Source Initiative
  • October 1999: The Open Source Initiative publishes its first list of approved licenses
  • 2004: Clause 10 added to the Open Source Definition
  • Early 2015: Matt Kendall and Paul Yang of AppNexus build Prebid.js with Nick Jacob of Aplus
  • July 19, 2015: The Prebid.js repository is created
  • September 11, 2017: AppNexus and Rubicon Project launch Prebid.org
  • October 28, 2024: The Open Source Initiative publishes the Open Source AI Definition 1.0
  • August 27, 2025: Prebid makes transaction identifiers bidder-specific; the IAB Tech Lab declares the change a specification violation
  • October 2, 2025: The Trade Desk launches OpenAds on forked Prebid code
  • October 7, 2025: Google releases an open-source Model Context Protocol server for the Ads API
  • December 12, 2025: Microsoft announces the shutdown of the public Prebid Cache
  • January 29, 2026: Prebid.org takes stewardship of the Prebid Sales Agent
  • April 30, 2026: The public Prebid Cache is retired
  • May 2026: Prebid's president, chairman and product director depart
  • August 3, 2026: Google Open Source publishes its 2025 retrospective
  • August 5 or 6, 2026: The DevTools MCP module merges into Prebid.js
  • October 13, 2026: Prebid Summit scheduled in New York

Summary

Who: The Open Source Initiative defines and certifies the licenses. In advertising, Prebid.org maintains the largest shared codebase, funded by dues-paying members including supply-side platforms and demand-side platforms. Google, Meta, Amazon and Microsoft are simultaneously among the largest contributors to and the largest dependencies of the surrounding code layer.

What: Software released under terms permitting anyone to use, study, modify and redistribute it, tested against the ten criteria of the Open Source Definition and, for AI systems, the Open Source AI Definition 1.0.

When: The definition dates to February 1998, derived from Debian guidelines ratified in July 1997. Prebid.js was written in early 2015 and placed under independent stewardship in September 2017. The AI definition arrived on October 28, 2024.

Where: Across the header bidding wrapper running in browsers, the server-side auction infrastructure behind it, the mobile SDKs in more than 2,000 apps, the Model Context Protocol servers connecting agents to ad platforms, and the model weights some vendors run in-house.

Why: Shared code removed a per-impression toll and gave publishers something inspectable in a market where auction logic is otherwise a vendor claim. The costs are structural rather than incidental: forks fragment the market, no body can arbitrate governance disputes, donated infrastructure can be withdrawn on four months' notice, funding lags reliance, and the label itself is now contested by companies that find it useful.