You tap a headline. The page starts to paint. Somewhere in the half-second before the article settles into place, a banner slot fills with an ad for running shoes, or a hotel, or a savings account. It feels like nothing. It is one of the most complicated transactions you will take part in all day, and you were not consulted.
In the time it took the page to load, roughly a dozen separate companies were notified that a slot was open, were handed a description of you and the page, calculated what your attention was worth to their clients, and competed in a sealed auction to win it. The whole thing finished before your eye reached the first sentence. This is programmatic advertising, and the part that runs the auction is called real-time bidding. Here is exactly what happens, in order, named system by named system.
Origin: how the auction got into the page
For the first decade of web advertising, ads were sold the way magazine pages were sold. A salesperson agreed a price, a quantity, and a date, and an ad server delivered the creative to fill the order. The ad and the page were booked together, in advance, by people.
The shift to per-impression auctions came from a practical problem. Publishers could never sell every slot directly, and the leftover inventory, the long tail of pages with no booked advertiser, was worth almost nothing sold by hand. An auction that could clear a single impression in the moment it was created turned that leftover into a market.
Google made it real at scale. After buying the ad-serving company DoubleClick in 2007, it relaunched the DoubleClick Ad Exchange in 2009 with real-time bidding built in. From that point a slot on a web page was no longer a booking. It was an item to be auctioned in the gap between a page request and a page render. The buy side built demand-side platforms to bid across many exchanges from one console. The sell side built supply-side platforms to manage publisher yield. And in November 2010, a consortium of three DSPs and three SSPs formed to write a shared protocol, OpenRTB, so any exchange and any bidder could speak the same language. The first version shipped within months, and the standard is now stewarded by the IAB Tech Lab. That protocol is why the rest of this story is possible. Without it, every exchange would talk to every bidder in a private dialect, and the market would not connect.
Present: the trip an impression takes
Walk through one impression. A real one. The clock starts when your browser asks for the page.
The slot is detected. The page HTML loads, and inside it sits an ad slot: a div with a defined size, say 300 by 250 pixels, wired to the publisher's ad setup. A piece of JavaScript on the page sees the slot and knows it needs filling. On most modern publishers this code is a header bidding wrapper, and we will come back to what that means. For now, treat it as the starting gun.
The ad request goes out. The page calls the publisher's ad server, the system of record for what is allowed to run where. Google's Ad Manager is the dominant one. The ad server, or the wrapper sitting in front of it, decides this impression should go to auction and hands it to one or more supply-side platforms. The SSP is the publisher's selling agent. Magnite, PubMatic, and Index Exchange are large independent ones.
The bid request is packaged. This is the heart of it. The SSP builds a structured message, an OpenRTB bid request, describing the thing for sale. It is a JSON object, and it answers the questions a buyer needs answered. What is the page, and what is it about. How big is the slot, and is it video or display. What device is this, what browser, what operating system. Where is the user, roughly, usually a city-level guess from the IP address. And, critically, who is this user, expressed not as a name but as an advertising identifier: a cookie ID, a mobile advertising ID, or one of the newer email-derived IDs, plus whatever audience signals are attached to it. The request also carries privacy flags, the consent strings that say what the user has and has not agreed to. That bundle is the impression's resume.
The request fans out. The SSP passes the bid request to an ad exchange, and the exchange broadcasts it. Not to one buyer. To many demand-side platforms at once, every DSP with a standing connection and a plausible reason to be interested. The Trade Desk, Google's Display & Video 360, and Amazon DSP are the large ones. A single impression can be offered to dozens of bidders in the same instant. The exchange is the auctioneer; the DSPs are the bidders in the room.
Each DSP decides, fast. Now every DSP that received the request has to answer two questions: do I want this, and what is it worth. It checks the impression against every active campaign it runs. Does the page match a campaign's targeting. Does the user's identifier sit in an audience an advertiser bought, or match a list of people who visited an advertiser's site. Does the campaign have budget left, and has this user already seen the ad too many times today. For the campaigns that fit, the DSP predicts how likely this impression is to produce a click or a sale, and sets a price in line with the campaign's goal, whether that is a target cost per acquisition or a flat cost per thousand impressions. All of it, the lookup, the prediction, the pricing, runs in a few milliseconds. A DSP that thinks too long is simply not counted.
The auction clears. The DSPs send their bids back to the exchange, and the exchange picks a winner. How the winner pays has changed, and the change matters. The old model was a second-price auction: the highest bidder won but paid only a cent above the second-highest bid. It borrowed from the auction designs Google had used for search ads, and the appeal was that a bidder could enter its true value without fear of overpaying, since the price was set by someone else's bid. The industry has since moved to first-price auctions, where the winner pays exactly what it bid. Exchanges including OpenX, Rubicon Project, and Index Exchange shifted starting around 2017, and Google, the last big holdout, announced its own move in March 2019 and finished the rollout by year end. The reason was honesty under complexity. As a single impression began passing through layered auctions across header bidding, a Google product manager noted that one ad could run through more than ten different auctions with different rules before a price was set, and second-price math stopped producing sensible outcomes. First-price is simpler to reason about: you pay your bid. It also created a new job for DSPs, called bid shading, which estimates the lowest price likely to still win so the advertiser does not overpay in a market where overpaying is now possible.
The creative is fetched and rendered. The winning DSP returns the location of the ad to show. The actual image or video file is almost never sent through the auction. It lives on a content delivery network, a CDN, a global set of servers that hold the file close to users so it loads fast. The browser pulls the creative from the nearest CDN node and paints it into the slot. The shoe ad appears.
The pixels fire. The job is not done when the ad renders. The creative carries measurement and verification tags, small bits of code that report back. An impression pixel tells the advertiser the ad served. Verification tags from firms such as DoubleVerify and Integral Ad Science check whether the ad was actually viewable, whether the traffic looks human, and whether the page was brand-safe. The industry standard they measure against, set by the IAB and the Media Rating Council, is blunt: a display ad counts as viewable only if at least half its pixels were on screen for at least one continuous second. If the user scrolls past too fast, the ad served but did not count.
All of that, from the slot being detected to the pixels firing, runs inside a budget of roughly 100 milliseconds. The number is not a guess. The OpenRTB bid request carries a field called tmax, the maximum time in milliseconds the exchange will wait for bids, network travel included. Miss it and your bid is discarded, no appeal. The budget is short because the user is waiting, and a page that stalls to run an ad auction is a page people leave.
One piece needs naming on its own: header bidding. Before it, publishers offered inventory to demand sources one at a time in a ranked sequence, the waterfall, which often handed the impression to a partner before a higher bidder ever saw it. Header bidding, run through the open-source framework Prebid, flips that. The wrapper in the page asks many demand sources for bids at the same time, before the ad server makes its call, so the ad server chooses from real competing prices rather than a guess. It is why the modern auction is genuinely an auction. If you want the fuller picture of where every box sits, we cover it in the ad tech stack explainer, and header bidding has its own piece.
This machinery is enormous. Programmatic now handles the overwhelming majority of digital display buying, with US programmatic display spending approaching 180 billion dollars in 2025 per eMarketer, and on track to clear 200 billion in 2026. Every dollar of it moves through some version of the hundred-millisecond auction above.
Future and impact: the auction under pressure
The auction described here was built on an assumption that is now shaky: that each impression arrives with a stable identifier attached, so a DSP can know who it is bidding on.
That assumption is decaying. Apple's Safari has blocked third-party cookies by default since 2020, Firefox does the same, and Apple's mobile platform forces apps to ask permission before tracking. Regulators have gone further: in 2022 the Belgian data protection authority ruled that the consent framework underpinning real-time bidding breached the GDPR, because broadcasting a description of a person to dozens of companies is hard to square with rules built on tight, specific consent. Google walked back its plan to remove third-party cookies from Chrome, first in 2024 and again in 2025, so the cookie did not die, but the signal is still draining. The bid request keeps arriving. It just describes the user less precisely than it used to, which makes every DSP's pricing decision harder.
The second pressure is AI, and it cuts the other way. The hundred-millisecond decision was always an algorithmic one, but it is getting sharper. Generative AI already sets bids, builds audiences, and generates creative variants. The newer move is agentic: software that takes a campaign goal and plans, buys, and optimizes without a human approving each step. PubMatic launched AgenticOS, a stack of buy-side agents, in January 2026, and eMarketer expects generative AI to run most of programmatic through 2026 with agentic systems close behind. The auction itself, the sealed competition cleared in milliseconds, is not going away. What is changing is the intelligence on both sides of it and how thin the targeting data feeding it has become.
The honest summary: the pipe still works, billions of times a second, exactly as walked through above. The fuel it runs on, a precise read of who is on the other end, is getting harder to come by, and the machines bidding are getting much smarter at working with less.
Council summary
The post argues that a programmatic ad impression is a real auction, not a metaphor for one, and it earns that claim by tracing a single impression through every named system it touches: the header bidding wrapper, the SSP, the exchange, the competing DSPs, the OpenRTB bid request with its tmax clock, and the verification pixels that decide whether the ad even counted. A marketer should come away understanding why the auction shifted from second-price to first-price, why bid shading exists, and why the whole sequence must clear inside roughly 100 milliseconds. The closing point is the one worth keeping: the auction pipe still works billions of times a second, but the identity signal that feeds it is thinning under cookie loss and regulation, while the bidding intelligence on both sides turns agentic. Read it to stop treating "programmatic" as a black box and start seeing the moving parts you are actually buying through.
Comments