Real-time bidding (RTB) is the automated auction used to sell many digital ad impressions. When a page or app has an advert slot, an exchange can send details about the opportunity—and sometimes about the person or device likely to see it—to many prospective buyers. Bids arrive in milliseconds, one buyer wins the impression, and the ad is served. The privacy risk is that the bid request may have been broadcast to numerous companies, including bidders that lose and never display an ad.
The exact data and recipients vary by auction. A request can contain location, app or site information, device or mobile identifiers, and other attributes. Precise location can reveal visits to sensitive places, while long-term retention or combination with other datasets can make an apparently short-lived auction consequential. RTB is an advertising mechanism, not a single database or company, so the legal position depends on the jurisdiction, participants, purposes, consent and retention practices involved.
As an Amazon Associate I earn from qualifying purchases.
What is real-time bidding?
RTB is a set of programmatic-advertising technologies that lets advertisers compete automatically for one impression at a time. An impression is the opportunity to show an advert to a particular visitor in a particular page view or app session. Instead of a publisher selecting an advertiser in advance, software coordinates an auction while the page or app is loading.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The auction sequence
- A publisher makes an impression available. A news site, app or other digital service has an ad slot to fill and connects it to an ad server or exchange.
- An exchange creates a bid request. The request describes the impression and may include information associated with the person or device that could receive the ad. The fields are not identical in every auction.
- Potential buyers receive the request. Advertisers, agencies, demand-side platforms and other intermediaries can use the information to decide whether to bid and how much.
- Bids are returned. The exchange evaluates bids in the short interval before the ad appears. The Federal Trade Commission describes this process as taking milliseconds.
- A winner is selected and the ad is delivered. The winning buyer gets the opportunity to serve its creative. Other bidders may still have received the bid-request data even though they did not win.
RTB should be distinguished from the broader set of tracking and advertising operations around it. Cookies, mobile advertising identifiers, account data, analytics, device fingerprinting and post-impression measurement may be used before or after an auction. A bid request is one important point at which information can be distributed; it is not necessarily the whole data flow.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Who participates?
- Publisher: supplies the ad space and may pass information about the page, app, content category or device context.
- Supply-side platform or exchange: packages the impression, sends bid requests, receives bids and selects a winner.
- Demand-side platform, agency or advertiser: evaluates opportunities against targeting rules and submits bids.
- Data and measurement companies: may help identify audiences, measure delivery or prevent fraud, depending on the transaction.
- Ad server: delivers the winning creative and can trigger measurement or verification calls.
The number of parties differs between implementations. A simple diagram with one publisher, one exchange and one advertiser therefore understates the possible distribution of a real bid request.
How can a bid request expose personal data?
Information that may be included
The FTC’s December 2024 discussion of its Mobilewalla case identifies location and personal characteristics as examples of information that can be sent or used in ad auctions. It also discusses precise location, app names and unique mobile identifiers as sensitive information companies may collect or use. These are possibilities, not a checklist for every request: a particular auction may contain fewer fields, different identifiers or no sensitive attribute.
Depending on the implementation, a request can describe:
- an approximate or precise location signal;
- the app or website where the impression is available;
- device type, operating system, language, screen or connection details;
- a cookie, advertising ID or another pseudonymous identifier;
- audience segments or personal characteristics used for targeting;
- the ad slot, content category, time and technical information needed to deliver an advert.
A pseudonymous identifier is not automatically anonymous. If a recipient can link it to an account, previous activity or another dataset, the request can become information about an identifiable person or household. Conversely, the presence of a field does not prove that a recipient knows a person’s name or that every recipient can make the same inference.
Broadcasting is the central privacy issue
In a conventional purchase, one seller might disclose information to one buyer. RTB can work differently. The FTC says an auction can broadcast user data to potentially dozens of bidders even though only one party wins the chance to show the ad. Every recipient may therefore learn something about the impression opportunity, and a losing bidder may receive data without serving anything to the user.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
The FTC describes the timing problem this way:
“These broadcasts occur over the milliseconds it takes an ad to populate on a person’s screen, making it hard to comprehend exactly how much data gets collected in that instant, and the number of players to which that data gets routed.”
That distribution creates several separate risks:
- Unclear audience: a person may be unable to identify all companies that received a request.
- Purpose expansion: data supplied to decide one bid might later be used for analytics, audience building or another purpose.
- Non-winning access: a company can receive the request without winning or displaying an advert.
- Retention: recipients may store logs, identifiers or location-derived records beyond the instant of the auction.
- Linkage: repeated identifiers can allow records from separate auctions, apps or sites to be combined.
Why precise location is especially revealing
Location data can reveal or suggest visits to healthcare facilities, churches, labor unions, military installations and other sensitive places. A pattern of coordinates may support an inference about a person’s interests, circumstances or affiliations. It does not, by itself, prove a person’s diagnosis, religious belief, employment, identity or intent. Accuracy, frequency, time of day and the recipient’s other data all affect what can reasonably be inferred.
For example, one coordinate near a clinic may be ambiguous. Repeated overnight locations, a regular route and a stable mobile identifier can create a much more informative profile. That is why a request that looks like a technical signal can have consequences beyond showing one advert.
What happens to data after the auction?
Whether data is deleted immediately, retained for a period or combined with other information is a critical question, but it is not answered by the auction mechanism itself. Contracts, platform settings, internal policies and law determine what participants claim they may do; actual practices require verification.
The Mobilewalla enforcement example
The FTC’s December 2024 article discusses allegations that Mobilewalla collected and retained auction-derived information, including data from auctions it lost. This is an enforcement example concerning the conduct alleged by the FTC; it is not a finding that every exchange or bidder follows the same practice. The example illustrates why “the ad was not shown” does not necessarily mean “no data was received” or “no record was kept.”
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
When assessing an RTB implementation, ask separately:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Which fields leave the publisher or app?
- Which companies receive them, including service providers and losing bidders?
- Are precise coordinates transformed, shortened or removed?
- What identifiers permit records to be linked?
- How long are request, bid, impression and audit logs retained?
- Can a recipient reuse the data for profiling, measurement or a different customer?
- What deletion, access and objection processes exist?
Who may receive data when you see a targeted ad?
| Participant | Possible access | Why it matters |
|---|---|---|
| Publisher or app | Page or app context, technical details and any audience information it chooses to pass | The publisher controls the initial ad-space integration and disclosures. |
| Exchange or supply-side platform | The bid request, incoming bids, winning event and often delivery or fraud signals | It can route the request to multiple buyers and keep transaction logs. |
| Demand-side platform or agency | Request fields and identifiers needed to decide whether to bid | It may compare the opportunity with audience segments or campaign rules. |
| Advertiser | Information delivered by its buying partners and performance results | The advertiser may not be the only party that saw the original request. |
| Measurement, verification or data providers | Selected identifiers, context, delivery events or audience signals | Additional recipients can widen the chain and complicate accountability. |
This table describes possible roles, not a universal list for every impression. Some auctions have fewer participants; others involve several intermediaries. A privacy notice should make the actual recipients and purposes understandable rather than relying on a generic statement that “partners” may receive data.
Why regulators have raised concerns
The ICO’s 2019 RTB findings
In its June 2019 update report on adtech and RTB, the UK’s Information Commissioner’s Office raised concerns about transparency, consent and the nature of fields used in RTB protocols. The report said some fields could constitute special-category data under the GDPR analysis presented at that time, making explicit consent especially important where that classification applied. Those findings are historical and should be read as the ICO’s stated 2019 position, not as a current worldwide rule.
The ICO’s 2019 fact-finding forum also recorded a practical governance problem: participants said publishers using an industry framework could not realistically validate the operations and processing of every vendor listed in it. The forum was held under the Chatham House Rule, so those comments are not attributable to named individuals or a current audit of any particular framework.
The same forum summary reported a Harris-commissioned survey of 2,300 participants. Fifty-four percent said they would rather see relevant adverts, and 63% said it was acceptable for adverts to fund content. After receiving a simple explanation of RTB, 36% agreed that RTB was acceptable, compared with the earlier response about relevant advertising. These are dated, before-and-after survey results—not current estimates of all consumers or every country.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
A suggestion at the forum that there could be more than a billion bid-request broadcasts per day should be treated only as a forum suggestion, not as a measured ICO statistic.
Current UK guidance
The ICO’s online-advertising guidance, accessed in October 2026, says that storage and access technologies used for online advertising require consent under the UK’s rules. It also says people should be told who data will be shared with, why it will be shared and how they can exercise control. The guidance describes consent as applying to third-party sharing across the advertising chain where that is the relevant processing.
This UK guidance does not automatically govern a publisher, user or processing operation elsewhere. Jurisdiction, the technology used, the type of information and the specific purpose all matter. A consent banner that mentions advertising in general may not, by itself, explain the number of recipients or the purposes involved.
GDPR legal bases and industry frameworks
The European Data Protection Board lists six GDPR legal bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. The list is not a decision that any one basis works for every RTB flow. The appropriate basis depends on the processing context, the data, the purpose and the organization’s obligations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An official European Union case summary concerning IAB Europe’s Transparency and Consent Framework (TCF) and OpenRTB discusses real-time profile auctions in the GDPR context. The existence or adoption of a framework does not establish that every participant’s processing is lawful. Organizations still need to identify their own purposes, recipients, legal basis, information duties, retention limits and user controls.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is every RTB request personal data?
No single answer covers every request. Data can be personal when it relates to an identified or identifiable person, directly or through information a recipient is reasonably able to use. A random, non-linkable technical value may present a different risk from a stable advertising identifier paired with precise location and a detailed audience segment.
The practical question is not only “Does this request contain a name?” It is also:
- Can the identifier be linked to a person, account, household or device?
- Can repeated requests reveal a pattern of movement or interest?
- Can the recipient combine the signal with its own records?
- Does the information reveal or suggest a sensitive characteristic or place?
Those questions should be answered for each participant and purpose. Calling a field “anonymous” does not settle the issue if the surrounding system permits re-identification or persistent linkage.
Recommended Free Tools
RTB compared with contextual or non-personalised advertising
Contextual advertising can choose an advert from the content or setting of the page without building a profile about the visitor. “Non-personalised” does not always mean that no data leaves the device, however; technical delivery, measurement and fraud controls may still involve information. The comparison below identifies the privacy questions that distinguish approaches without claiming that one always performs better.
| Question | RTB | Contextual or non-personalised approach |
|---|---|---|
| Profile use | May use audience segments, identifiers or observed behaviour | Can select based primarily on page, app or content context |
| Attributes in the request | May include location, app name, device data or personal characteristics; exact fields vary | May need only contextual and technical delivery information, depending on design |
| Recipients | May be broadcast to multiple prospective bidders, including losers | Can involve fewer recipients, but the actual chain must be checked |
| Retention question | Ask how request, bid and identifier logs are retained by every participant | Ask whether contextual, delivery or measurement logs are retained |
| Consent and controls | Must be assessed against the jurisdiction and all third-party purposes | Still depends on storage, access, identifiers and other processing used |
| Cross-site or cross-app observation | May support it when persistent identifiers or shared segments are used | Can avoid it if the design does not track people across services |
What users can do
No single purchase or setting can be assumed to eliminate exposure to RTB data sharing. User choices depend on the site, app, device and jurisdiction. Practical steps include:
- Read the advertising choice screen. Look for the purposes, named or categorized partners, and whether consent covers sharing with third parties rather than only the publisher.
- Reject optional advertising uses where available. A refusal may reduce some processing, but check whether the service offers separate controls for measurement, personalization and storage technologies.
- Review app and device permissions. Location access and advertising-identifier settings can affect what an app is able to provide, although changing them does not control every server-side data source.
- Use the service’s privacy controls. Record the date of a request or objection and follow the publisher’s stated process for access, deletion or withdrawal where those rights apply.
- Limit sensitive signals in apps and sites. Avoid granting precise location to services that do not need it, and consider whether an app’s advertising model fits the information you are comfortable sharing.
These steps can reduce some data flows, but they cannot guarantee that every intermediary has deleted historical records or that another service has not received a separate request.
What publishers and adtech teams should verify
Organizations implementing RTB should map the complete path from impression creation to deletion, rather than documenting only the winning ad. A useful review includes:
Free tools Windows power users keep installed
One-click scans. No signup required.
- an inventory of every field sent in each bid-request type;
- a recipient list covering exchanges, bidders, measurement vendors and fraud services;
- tests showing what happens when consent is absent, withdrawn or limited;
- rules preventing sensitive or precise data from being sent where it is unnecessary;
- retention periods for winning and losing auctions, plus deletion evidence;
- contracts that restrict reuse, onward sharing and combining datasets;
- clear notices naming purposes, recipient categories and user controls;
- an assessment of the legal basis for each processing purpose in each jurisdiction;
- incident procedures for unauthorized broadcasts, misdirected identifiers or excessive retention.
Framework participation can help standardize signals, but it does not replace this analysis. The organization that decides to send or use a field remains responsible for understanding its own processing and explaining it to people.
The key takeaway
RTB turns one ad impression into a rapid data exchange. The winning advert is visible for only one moment, yet the bid request may have reached many companies before that moment and may contain location, identifiers or other attributes about the person or device. Privacy risk therefore depends on the entire chain: what is sent, who receives it, what can be inferred, how long records remain and whether consent and other legal requirements were met. Regulators’ concerns focus less on the speed of the auction than on the lack of visibility and control surrounding those broadcasts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
