Quick Answer: Programmatic advertising is the automated buying and selling of digital ad space through software instead of manual deals. In an RTB workflow, when someone opens a web page or app, the publisher's supply-side platform (SSP) offers that ad slot to buyers, advertisers' demand-side platforms (DSPs) decide in real time whether to bid and how much (this auction is called real-time bidding, or RTB), and the winning ad is shown, all in a fraction of a second. It scales well, but the long chain of intermediaries also creates openings for fraud: spoofed domains, bots, hidden ads, and low-quality sites. To stay safe, buy through authorized sellers (check ads.txt and sellers.json), use allowlists and curated deals for important spend, run pre-bid and post-bid verification, and compare clicks and impressions with real engagement and conversions.
What is programmatic advertising?
Programmatic advertising uses technology and data to buy and sell ad impressions automatically. Instead of an advertiser negotiating with each publisher and sending an insertion order, software makes the decision impression by impression, based on who the user is likely to be, where the ad will appear, and what the advertiser is willing to pay.
Programmatic is a method of buying, not a channel. It can be used for display banners, video, native ads, audio, mobile apps, and connected TV (CTV).
How does programmatic advertising work, step by step?
- A user opens a page or app. The page has an ad slot.
- The publisher's ad server and SSP register the opportunity, and the SSP packages information about it.
- A bid request goes out to an ad exchange and to the DSPs connected to it. The request describes the impression: the site or app, the ad size, the device type, the location, and often an identifier or contextual signals.
- Each DSP evaluates the request. It checks the advertiser's targeting, budget, frequency caps, and brand safety rules, then decides whether to bid and how much.
- The auction runs. The exchange or SSP compares the bids, and a winner is chosen. Most exchanges today run first-price auctions, where the winner pays what it bid, though rules differ by platform.
- The winning ad is delivered and displayed on the page.
- Tracking and reporting. Impressions, clicks, and conversions are recorded, and verification vendors may check viewability, brand safety, and invalid traffic.
All of this typically happens in a fraction of a second, while the page is loading.
Who are the main players in the programmatic ecosystem?
| Player | Who they serve | What they do |
|---|---|---|
| Advertiser / agency | Themselves or clients | Sets goals, budget, creative, and targeting |
| DSP (demand-side platform) | Advertisers and agencies | Buys impressions across many sources through one interface, using bidding and targeting algorithms |
| SSP (supply-side platform) | Publishers | Sells publisher inventory to many buyers and manages floors and demand |
| Ad exchange | Both sides | The marketplace where bid requests meet bids |
| Publisher | Their audience | Owns the site or app and the ad slots |
| Ad server | Publishers and advertisers | Chooses and delivers the ad, and counts impressions and clicks |
| DMP / CDP | Advertisers and publishers | Stores and organizes audience data used for targeting |
| Verification vendors | Mostly advertisers | Measure viewability, brand safety, and invalid traffic |
| Trading desk | Agencies | Runs programmatic buying on behalf of clients, often with a DSP |
Think of the DSP as the buyer's control center, the SSP as the seller's control center, and the exchange as the marketplace between them. Some platforms combine several of these roles.
What is RTB (real-time bidding)?
RTB is the auction process in which impressions are sold one at a time, in real time. It is the best-known form of programmatic buying, but not the only one.
The industry standard for how bid requests and bids are formatted is OpenRTB, maintained by IAB Tech Lab. A bid request commonly carries details such as:
- The domain or app where the ad will appear
- The ad format and size
- Device and operating system
- Approximate location
- An identifier or contextual signals
- The seller and supply chain information
- A price floor
The buyer's decision is only as good as this information. If a request describes the impression falsely, the buyer pays for something it did not intend to buy. That is the root of several fraud types below.
What are the different ways to buy programmatically?
| Deal type | How it works | Typical use |
|---|---|---|
| Open auction (open RTB) | Any approved buyer can bid on available impressions | Broad reach, testing, lower-cost scale |
| Private marketplace (PMP) | A publisher invites selected buyers to bid on defined inventory | More control over where ads appear |
| Preferred deal | A fixed price agreed ahead of time for first look at inventory | Priority access to specific placements |
| Programmatic guaranteed | A fixed volume and price booked in advance, delivered through programmatic tools | Reserved premium inventory with automation |
As a rule, the more open the auction, the more variety in quality. The more curated the path, the easier it is to verify what you bought.
Why is fraud a bigger risk in programmatic?
Programmatic works at huge scale with many intermediaries, and buyers often bid on impressions they never see beforehand. Several things combine:
- Automation moves fast. Bad inventory can be bought before anyone reviews it.
- Long supply chains. Each reseller makes it harder to see who is actually selling.
- Claims are self-declared. Much of a bid request is information supplied by the seller, and it is not always independently checked.
- Rewards are high. A fake or low-quality site can earn money from real ad budgets.
This does not mean programmatic is unsafe by default. It means buyers should verify what they are paying for.
What types of fraud and waste affect programmatic ads?
The table describes each type conceptually so you can recognize it and defend against it.
| Type | What it is | Where it enters | Main defenses |
|---|---|---|---|
| Domain spoofing | The request claims a premium domain, but the ad runs elsewhere | Bid request | ads.txt, sellers.json, supply chain object checks, post-bid domain verification |
| App spoofing | A rogue app pretends to be a known app in a store listing | Bid request (mobile and CTV) | app-ads.txt, bundle ID checks, app store verification |
| Bot traffic (non-human traffic) | Automated scripts load pages or click ads | Page or app traffic | Pre-bid filtering, post-bid detection, traffic quality monitoring |
| Ad stacking | Several ads layered in one slot so only the top one is visible, while all count as impressions | Page rendering | Viewability and verification measurement |
| Pixel stuffing | Ads shrunk to a tiny size so they count but cannot be seen | Page rendering | Viewability measurement, minimum size rules |
| Click spamming or injection (mobile) | Fake or hijacked clicks claim credit for installs | Attribution layer | Attribution fraud tools, click-to-install analysis |
| Device farms | Many real devices operated to generate impressions and installs at scale | App or device traffic | Behavior analysis, device and IP pattern checks |
| CTV spoofing | Fake streaming devices or server-side ad calls imitate living-room TV impressions | CTV supply path | Supply chain verification, CTV-specific verification |
| Made-for-advertising (MFA) sites | Sites built mainly to sell ads, often with low-value content and aggressive ad density | Publisher inventory | Allowlists, curated lists, placement review, engagement checks |
| Click fraud | Fake or invalid clicks on paid ads, by bots or people | Click layer | Click-level analysis, IP and device blocking, protection tools |
Some of these (like domain spoofing) are direct fraud. Others (like MFA sites) can be technically legitimate but still waste budget.
What is the difference between pre-bid and post-bid protection?
- Pre-bid tools check an impression before you bid on it. They can block known bad domains, apps, and sources so the money is never spent.
- Post-bid tools measure what happened after the ad ran: where it appeared, whether it was viewable, and whether the traffic was valid. They support reporting, refunds, and optimization.
Use both. Pre-bid reduces exposure, and post-bid catches what slipped through. Neither is perfect, so keep your own checks on top of vendor reports.
How can advertisers protect themselves in programmatic?
- Buy from authorized sellers. Check that the selling SSP or exchange and the correct seller account ID appear in the publisher's
ads.txt, and look atsellers.jsonand the supply chain object to see who is reselling. - Shorten the path. Prefer direct or curated routes (PMPs, preferred deals, programmatic guaranteed) for your most important campaigns.
- Use allowlists, not just blocklists. An allowlist of approved sites and apps limits exposure to unknown inventory. Blocklists only catch what is already known to be bad.
- Review placement reports. Look for unfamiliar domains and apps, very high click rates with no conversions, and sudden changes in where ads run.
- Add independent verification. Use third-party measurement for viewability, brand safety, and invalid traffic, rather than relying only on a single platform's own reporting.
- Control frequency and geography. Unusual spikes outside your target market are a warning sign.
- Compare clicks and impressions with real behavior. In analytics, check sessions, engagement, and conversions by source. Traffic that never engages deserves investigation.
- Ask your partners direct questions. Which sources are included, who the sellers are, what fees apply, and how invalid traffic is handled and credited.
- Document and dispute. Keep logs and screenshots, and raise problems with the platform and the seller to request credits where your contract allows.
What should publishers do?
- Publish and maintain
ads.txt(andapp-ads.txtfor apps), and remove partners you no longer use. - Work with a limited set of reputable SSPs and keep your supply chain clear.
- Monitor your own traffic for bots and strange spikes, because fake traffic hurts your reputation and your demand.
- Check ad quality: block malicious or misleading creatives, and avoid excessive ad density.
- Keep your site and ad code secure so no one can inject or hijack ad calls.
What metrics should you watch?
| Metric | What it can reveal |
|---|---|
| Viewability rate | Whether ads could actually be seen |
| Invalid traffic rate | Share of traffic flagged as invalid by your vendors or platforms |
| CTR vs. engaged sessions | Clicks that do not turn into real visits |
| Conversion rate and cost per conversion | Whether traffic produces business results |
| Placement and domain mix | Unknown, low-quality, or repetitive sources |
| Geography, device, and hour distribution | Odd patterns that suggest bots or farms |
| Effective cost per thousand impressions (eCPM) vs. results | Cheap inventory that does not perform |
Very cheap impressions are not always a bargain. If the cost per outcome is higher, the cheap inventory is expensive.
Common beginner mistakes
- Treating the DSP's default settings as complete protection.
- Buying in open auctions without allowlists or placement review.
- Judging success by impressions and clicks alone.
- Never checking where ads actually appeared.
- Ignoring the supply chain: who sells the inventory, and through how many hands.
- Comparing programmatic CTRs with search CTRs.
- Not asking partners about fees, transparency, and invalid traffic credits.
- Assuming that a recognizable domain name in a report means the ad actually ran there.
Beginner's checklist
- Campaign goal defined by business outcome, not just reach or clicks
- DSP chosen, with clear reporting and fraud controls understood
- Deal type chosen to match the level of control you need
- Seller authorization checked through
ads.txtandsellers.json - Allowlist or curated list set up for important spend
- Pre-bid and post-bid verification in place
- Placement report reviewed weekly
- Clicks and impressions compared with sessions and conversions
- Partner questions about fees and invalid traffic answered in writing
- Process for documenting and disputing bad traffic
FAQ
What is programmatic advertising in simple terms?
It is buying and selling ad space automatically through software. It includes real-time auctions as well as automated deals with agreed prices or reserved inventory.
What is the difference between a DSP and an SSP?
A DSP is used by advertisers to buy ad impressions from many sources. An SSP is used by publishers to sell their ad inventory to many buyers. They meet in the exchange.
What does RTB stand for?
RTB stands for real-time bidding: the auction in which an ad impression is sold in the moments before a page or app screen loads.
Is programmatic the same as RTB?
No. RTB is one way of buying programmatically. Programmatic also includes private marketplaces, preferred deals, and programmatic guaranteed.
What is an ad exchange?
An ad exchange is a digital marketplace where publishers' inventory (through SSPs) and advertisers' demand (through DSPs) are matched and auctioned.
What is domain spoofing?
Domain spoofing is when a bid request falsely claims that an impression comes from a reputable site, so buyers pay for inventory that is not what it was described to be. ads.txt and verification help prevent it.
How common is ad fraud in programmatic advertising?
It varies widely by channel, region, and how carefully buyers select inventory. Estimates differ between vendors and methods, so rely on your own measurement and independent verification instead of a single number.
Can a DSP protect me from fraud?
DSPs usually offer fraud and brand safety tools, but they are not a guarantee. Add independent verification, allowlists, and your own checks on engagement and conversions.
What is an MFA site?
MFA stands for made-for-advertising. These are sites built mainly to generate ad revenue rather than serve audiences, often with thin content and heavy ad density. They are not always fraudulent, but they can waste budget.
What is the supply chain object (schain)?
It is information passed along with a bid request that lists the parties involved in selling the impression. Buyers can compare it with sellers.json to see who is reselling.
How do I know if my programmatic traffic is real?
Compare impressions and clicks with analytics sessions, engagement, and conversions by source. Review placements, geographies, and hours for odd patterns, and use independent verification and click-level analysis for deeper checks.
What is a good first programmatic strategy for a small budget?
Start with a narrow, well-defined audience, a curated or allowlisted set of placements, tight frequency caps, and clear conversion tracking. Review results weekly and expand only what performs.
Next Steps
Programmatic advertising turns ad buying into an automated marketplace: SSPs offer impressions, DSPs bid on them through RTB, and software delivers the winner in a fraction of a second. That speed and scale are its strength and its risk. The more automated and open the path, the more you need to verify who is selling, where ads appear, and whether the traffic is real.
Start simple: pick clear goals, use authorized and curated inventory, add independent verification, and judge everything by real engagement and conversions rather than impressions and clicks alone.
Compare native advertising formats with other inventory types. Our SIVT guide explains why seller authorization alone cannot establish traffic quality.
Investigate Your Paid-Click Quality
JuicyTraffic helps advertisers investigate landing-page click quality by campaign, source and placement using a tracking link and an on-site probe. Compare its per-click evidence with ad-platform reports and business outcomes. It does not replace malware protection, a website firewall, impression verification or an A/B testing platform.
References
Related Articles
- What Is Native Advertising? Examples, Formats and Traffic Quality Risks
- SIVT (Sophisticated Invalid Traffic): What It Is, How It Differs From GIVT, and How to Spot It in Your Own Data
- Search Ads vs Display Ads: Which Has More Invalid Traffic?
About the Author
Dylan Dan is the founder of JuicyTraffic. He has spent 15 years specializing in adult advertising and ad-fraud prevention, helping advertisers assess traffic quality, identify invalid clicks and protect media budgets across dedicated ad networks.