Three things about the advertising supply chain can be read from the outside without being a buyer or a seller. A publisher declares who may sell its inventory in ads.txt (for apps, app-ads.txt on the developer's site). An ad system declares whom it pays in sellers.json. And where the auction runs in the browser — client-side header bidding, in practice Prebid.js — the bids themselves are visible to a script on the page. Together they are the observable ad graph: which parties are authorised to sell a site's ad space, which parties say they represent it, and which parties actually bid on it when your crawler shows up.

This page is about measuring that graph, not about the ad-tech business it describes. It is the mechanism behind a family of 2019–2026 papers that ask who funds misinformation, whether “authorised seller” lists are honoured, whether privacy signals change what advertisers pay, and how low-quality publishers launder inventory by pooling it under someone else's seller ID. It is not about identifier exchange between parties — that is Cookie syncing, and two papers ([1Cook, John; Nithyanand, Rishab; Shafiq, Zubair (2020): "Inferring Tracker-Advertiser Relationships in the Online Advertising Ecosystem using Header Bidding", in: Proceedings on Privacy Enhancing Technologies. (DOI)], [2Musa, Maaz Bin; Nithyanand, Rishab (2022): "ATOM: Ad-network Tomography", in: Proceedings on Privacy Enhancing Technologies. (DOI)]) appear on both pages for different reasons: there because bids are an ad-semantics way to infer that data was shared, here because bids are the observable.

• A Longitudinal Analysis of the ads.txt Standard [3Bashir, Muhammad Ahmad; Arshad, Sajjad; Kirda, Engin; Robertson, William K.; Wilson, Christo (2019): "A Longitudinal Analysis of the ads.txt Standard", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], IMC 2019 — the reference measurement of the standard itself: 26 crawls of the Alexa Top-100K over 15 months, the record-error taxonomy, and the only compliance test in these venues that matched declarations against observed ad traffic (135M RTB inclusion chains). Read Section 3 for the crawl, Section 5 for why compliance cannot be tested without becoming a publisher, and Section 8 for the caveats you will be quoting.
• The Inventory is Dark and Full of Misinformation [5Vekaria, Yash; Nithyanand, Rishab; Shafiq, Zubair (2024): "The Inventory is Dark and Full of Misinformation: Understanding Ad Inventory Pooling in the Ad-Tech Supply Chain", in: Proceedings of the IEEE Symposium on Security and Privacy. Not in the site's publication corpus (screened out at abstract stage); cited from the arXiv version 2210.06654v3 (DOI)], IEEE S&P 2024 — the paper that turned ads.txt and sellers.json from an adoption question into a fraud-detection instrument. It names the misrepresentation classes, defines dark pooling (unrelated publishers sharing one seller ID), and is the only paper anywhere in this literature that parsed the OpenRTB SupplyChain object from captured bid requests. It is not in the corpus behind this site — the screening model labelled it neither a security nor a privacy measurement — so nothing in Use in Publications counts it. Read it from the arXiv version.
• Welcome to the Dark Side [6Papadogiannakis, Emmanouil; Kourtellis, Nicolas; Papadopoulos, Panagiotis; Markatos, Evangelos P. (2025): "Welcome to the Dark Side: Analyzing the Revenue Flows of Fraud in the Online Ad Ecosystem", in: Proceedings of the ACM Web Conference. (DOI)], TheWebConf 2025 — the scale study: ads.txt from 456,971 of ~7M Tranco domains, sellers.json from 2,682 ad systems, 185,535 seller-ID pools, ~15,000 of them dark. Released crawlers and a public monitoring service. Read it for what a 2023-era pipeline looks like end to end, and for the sellers.json confidentiality figures.
• No More Chasing Waterfalls [7Pachilakis, Michalis; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2019): "No More Chasing Waterfalls: A Measurement Study of the Header Bidding Ad-Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], IMC 2019 — the header-bidding reference: how to detect an auction from DOM events and requests, the client/server/hybrid split (server-side was already 48% of HB sites in 2019), and latency. Its tool link is dead (see Tools, datasets and services that already exist).
• Inferring Tracker-Advertiser Relationships … using Header Bidding [1Cook, John; Nithyanand, Rishab; Shafiq, Zubair (2020): "Inferring Tracker-Advertiser Relationships in the Online Advertising Ecosystem using Header Bidding", in: Proceedings on Privacy Enhancing Technologies. (DOI)], PoPETs 2020 — the paper that made bids a dependent variable: call getBidResponses(), change one thing about the persona, watch who bids more. Every PETS paper since that uses bids as evidence of data use ([2Musa, Maaz Bin; Nithyanand, Rishab (2022): "ATOM: Ad-network Tomography", in: Proceedings on Privacy Enhancing Technologies. (DOI)], [8Iqbal, Umar; Bahrami, Pouneh Nikkhah; Trimananda, Rahmadi; Cui, Hao; Gamero-Garrido, Alexander; Dubois, Daniel J.; Choffnes, David R.; Markopoulou, Athina; Roesner, Franziska; Shafiq, Zubair (2023): "Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], [9Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)], [10Liu, Zengrui; Dani, Jimmy; Cao, Yinzhi; Wu, Shujiang; Saxena, Nitesh (2025): "The First Early Evidence of the Use of Browser Fingerprinting for Online Tracking", in: Proceedings of the ACM Web Conference. (DOI)]) is a descendant.

The minimum a measurement needs to know about each file is where it lives, who wrote it, and what one record asserts. Everything else is in the IAB Tech Lab specifications¹⁾ and does not belong here.

Two things follow. First, ads.txt and sellers.json are declarations: cheap to fetch at Internet scale, and exactly as truthful as their authors. Second, header bidding is an observation, but of a shrinking and self-selected slice — the sites that still run the auction in the browser, for the persona your crawler presents.

Published figures in this area are not comparable across rows. Each is right for its own unit and denominator; none is “the adoption rate of ads.txt”.

Three consequences. The 2019 “20%” and the 2023 “456,971” are not two points on one adoption curve; one is a share of a top list, the other a count over a seven-million-domain tail. A bid from a stateless crawler is a price for nobody, and more than a hundred times lower than what real users' browsers received two years later — not because prices rose. And every sellers.json figure has a hidden denominator: whatever share of that exchange's sellers is confidential.

Sixteen papers in the corpus read one of the three observables or observe bids (see Use in Publications for how the set was built). One more measures ownership by a sibling method without touching ads.txt, and is the last row.

• ads.txt alone as evidence of a relationship. Bashir et al. could only test declarations against traffic. Since [12Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2023): "Who Funds Misinformation? A Systematic Analysis of the Ad-related Profit Routines of Fake News Sites", in: Proceedings of the ACM Web Conference. (DOI)] the intersection with sellers.json is the norm, and the 2025 papers treat a DIRECT line the exchange does not confirm as unverified, not as a relationship. If you can only fetch one file, you have measured declarations, and the title of your figure should say so.
• Alexa as the sampling frame. 8 of the 16 measuring papers drew from Alexa; the list no longer exists, and the two 2019 reference studies are therefore unrepeatable as designed. See Website selection.
• Assuming the Prebid global is called pbjs. It is only the default: the build option globalVarName renames it and defineGlobal: false removes it.⁵⁾ [9Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)] says explicitly that it did “not consider personalized custom API labels (i.e., other than pbjs)”, so its 5,421 is a lower bound. Detect the auction from its events and bidder requests as well [7Pachilakis, Michalis; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2019): "No More Chasing Waterfalls: A Measurement Study of the Header Bidding Ad-Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], or accept and state the undercount.
• OWNERDOMAIN and MANAGERDOMAIN (ads.txt 1.1, August 2022) exist precisely to make pooling legible — the owner of a pooled site and its exclusive monetiser are meant to be declared. No paper, in or out of the corpus, has measured their adoption; both 2025 studies still infer ownership from WHOIS. This is the cheapest open measurement on the page.
• The SupplyChain object has one measurement, outside the seven venues, from 2022: present in 20.5% of bid requests, always one node [5Vekaria, Yash; Nithyanand, Rishab; Shafiq, Zubair (2024): "The Inventory is Dark and Full of Misinformation: Understanding Ad Inventory Pooling in the Ad-Tech Supply Chain", in: Proceedings of the IEEE Symposium on Security and Privacy. Not in the site's publication corpus (screened out at abstract stage); cited from the arXiv version 2210.06654v3 (DOI)]. buyers.json and ads.cert have none.
• app-ads.txt has none in these venues. The two CCS papers that name it are about app-side fraud detected from an ad network's own bidding logs and treat the file as background.
• The client/server header-bidding split has not been re-measured since February 2019. Every bids-as-instrument result since is conditioned on the sites that still expose the auction, and none of them reports what fraction of its candidate list that was.
• LLM-based methods: none. The classification steps in this literature — ad system name folding, brand extraction from landing pages, misinformation labels — are regex, curated lists and hand review, and the 2025–2026 slice does not change that.

• Root domain, not hostname. The file is authoritative for the public-suffix-plus-one domain; a crawl keyed on www. hostnames or on subdomains double-counts and misses. Follow redirects only within that root domain — the specification makes an off-domain redirect non-authoritative, and the IAB reference crawler implements that rule.⁶⁾
• Validate before you count. 56.4% of the 2,381 seller domains ever named in Alexa Top-100K files failed WHOIS/DNS validation [3Bashir, Muhammad Ahmad; Arshad, Sajjad; Kirda, Engin; Robertson, William K.; Wilson, Christo (2019): "A Longitudinal Analysis of the ads.txt Standard", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]; 10% of publishers had at least one syntactically invalid record. Report records that follow the specification and say how many you dropped.
• A User-Agent that looks like a browser. The 2025 scale crawl kept the IAB crawler “as-is and only change the user-agent header so that we are not blocked by websites” [6Papadogiannakis, Emmanouil; Kourtellis, Nicolas; Papadopoulos, Panagiotis; Markatos, Evangelos P. (2025): "Welcome to the Dark Side: Analyzing the Revenue Flows of Fraud in the Online Ad Ecosystem", in: Proceedings of the ACM Web Conference. (DOI)]. And follow redirects: Google's canonical sellers.json URL is a 302 to a Cloud Storage object, and a fetcher that stops at the first response records a 0-byte file — which the first revision of this page mistook for an empty body.
• Fold the ad-system names before you rank them. google.com, doubleclick.net and friends are one seller; Bashir et al. mapped 101 domains to 28 parents with WhoTracksMe and call the clustering “not perfect”. Print the residue. Use the entity maps on Existing datasets rather than writing your own alias list.
• sellers.json is a graph crawl. Start from the ad-system domains your ads.txt corpus names, fetch each /sellers.json, then recurse into every INTERMEDIARY / BOTH domain listed [5Vekaria, Yash; Nithyanand, Rishab; Shafiq, Zubair (2024): "The Inventory is Dark and Full of Misinformation: Understanding Ad Inventory Pooling in the Ad-Tech Supply Chain", in: Proceedings of the IEEE Symposium on Security and Privacy. Not in the site's publication corpus (screened out at abstract stage); cited from the arXiv version 2210.06654v3 (DOI)], [6Papadogiannakis, Emmanouil; Kourtellis, Nicolas; Papadopoulos, Panagiotis; Markatos, Evangelos P. (2025): "Welcome to the Dark Side: Analyzing the Revenue Flows of Fraud in the Online Ad Ecosystem", in: Proceedings of the ACM Web Conference. (DOI)]. Expect non-standard locations for the biggest systems — Google's is not at google.com/sellers.json — and expect copies: 28 domains served a copy of Google's file [6Papadogiannakis, Emmanouil; Kourtellis, Nicolas; Papadopoulos, Panagiotis; Markatos, Evangelos P. (2025): "Welcome to the Dark Side: Analyzing the Revenue Flows of Fraud in the Online Ad Ecosystem", in: Proceedings of the ACM Web Conference. (DOI)].
• Time-stamp everything and keep the raw files. Relationships churn: 39 of 470 exchanges de-listed at least one misinformation site between October 2021 and February 2022, and one dropped ~87% of its domains in a month [5Vekaria, Yash; Nithyanand, Rishab; Shafiq, Zubair (2024): "The Inventory is Dark and Full of Misinformation: Understanding Ad Inventory Pooling in the Ad-Tech Supply Chain", in: Proceedings of the IEEE Symposium on Security and Privacy. Not in the site's publication corpus (screened out at abstract stage); cited from the arXiv version 2210.06654v3 (DOI)]; Google, Lijit and Amazon dropped 51%, 43% and 37% of their misinformation-site relationships between December 2021 and January 2024 [4Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2025): "Before & After: The Effect of EU's 2022 Code of Practice on Disinformation", in: Proceedings of the ACM Web Conference. (DOI)]. A single snapshot is a date, not a fact about the ecosystem. Rate: one request per domain per month was judged enough [6Papadogiannakis, Emmanouil; Kourtellis, Nicolas; Papadopoulos, Panagiotis; Markatos, Evangelos P. (2025): "Welcome to the Dark Side: Analyzing the Revenue Flows of Fraud in the Online Ad Ecosystem", in: Proceedings of the ACM Web Conference. (DOI)].
• Ownership evidence is the bottleneck of every pooling claim. WHOIS is redacted for most domains (owner recovered for 3,981 sites out of 185,535 pools' members [6Papadogiannakis, Emmanouil; Kourtellis, Nicolas; Papadopoulos, Panagiotis; Markatos, Evangelos P. (2025): "Welcome to the Dark Side: Analyzing the Revenue Flows of Fraud in the Online Ad Ecosystem", in: Proceedings of the ACM Web Conference. (DOI)]); Google publisher IDs cover only Google-monetised sites [15Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2022): "Leveraging Google's Publisher-Specific IDs to Detect Website Administration", in: Proceedings of the ACM Web Conference. (DOI)]; hand review does not scale. Report the share of pools for which ownership could not be established, as [5Vekaria, Yash; Nithyanand, Rishab; Shafiq, Zubair (2024): "The Inventory is Dark and Full of Misinformation: Understanding Ad Inventory Pooling in the Ad-Tech Supply Chain", in: Proceedings of the IEEE Symposium on Security and Privacy. Not in the site's publication corpus (screened out at abstract stage); cited from the arXiv version 2210.06654v3 (DOI)]'s Table 6 does.

• Detect, then read, then wait. The pattern used by every instrumenting paper since 2020: probe pbjs.version (or hook the auction events) to find Prebid sites, then call pbjs.getBidResponses() — and requestBids() yourself if no auction ran [9Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. The documented response object carries bidder, cpm, currency, adUnitCode, timeToRespond and mediaType.⁷⁾ Auctions are slow: median 600 ms, 4% of sites over 5 s [7Pachilakis, Michalis; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2019): "No More Chasing Waterfalls: A Measurement Study of the Header Bidding Ad-Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]; a crawler that leaves at load has no bids.
• A bid is not a rendered ad, and a rendered ad is not a paid one. [11Zeng, Eric; McAmis, Rachel; Kohno, Tadayoshi; Roesner, Franziska (2022): "What Factors Affect Targeting and Bids in Online Advertising? A Field Measurement Study", in: Proceedings of the ACM Internet Measurement Conference, pp. 210-229. (DOI)] distinguishes getBidResponses() (all bids), getAllWinningBids() (rendered) and getAllPrebidWinningBids() (won the auction, then lost to the ad server's waterfall) and analyses only the 7,117 rendered winners of 25,764. Choose one and name it.
• Your persona is the price. A stateless clean browser is a baseline nobody targets: 0.031 CPM median in 2019 [7Pachilakis, Michalis; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2019): "No More Chasing Waterfalls: A Measurement Study of the Header Bidding Ad-Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] against $4.16 from real users in 2021 [11Zeng, Eric; McAmis, Rachel; Kohno, Tadayoshi; Roesner, Franziska (2022): "What Factors Affect Targeting and Bids in Online Advertising? A Field Measurement Study", in: Proceedings of the ACM Internet Measurement Conference, pp. 210-229. (DOI)]. Every treatment design in the table above runs a control persona alongside, from the same IP range, on the same day; [9Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)] ran 17 personas per jurisdiction from Frankfurt and Northern California and visited each site nine times. Fewer repetitions than that and day-of-week and slot effects swamp the treatment [8Iqbal, Umar; Bahrami, Pouneh Nikkhah; Trimananda, Rahmadi; Cui, Hao; Gamero-Garrido, Alexander; Dubois, Daniel J.; Choffnes, David R.; Markopoulou, Athina; Roesner, Franziska; Shafiq, Zubair (2023): "Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)].
• Zero bids are data. 22% of all bids in [1Cook, John; Nithyanand, Rishab; Shafiq, Zubair (2020): "Inferring Tracker-Advertiser Relationships in the Online Advertising Ecosystem using Header Bidding", in: Proceedings on Privacy Enhancing Technologies. (DOI)] were zero, and the paper cannot say whether that is misconfiguration or intent. Do not drop them silently.
• Consent and vantage change who bids. A European vantage brings a banner into the path, and 352 of the Alexa top-100K had both a CMP and Prebid — that intersection, not the 5,421 Prebid sites, is the auditable population for a consent study [9Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. See Consent and Crawling location. Of the 16 measuring papers, 11 state a vantage location; 6 of those are the United States.
• Ad blockers and filter lists. Prebid endpoints are on EasyList; a crawler with a blocking extension, or a Firefox profile with tracking protection on, sees no auction. [2Musa, Maaz Bin; Nithyanand, Rishab (2022): "ATOM: Ad-network Tomography", in: Proceedings on Privacy Enhancing Technologies. (DOI)] disabled tracking protection in OpenWPM and says so; [1Cook, John; Nithyanand, Rishab; Shafiq, Zubair (2020): "Inferring Tracker-Advertiser Relationships in the Online Advertising Ecosystem using Header Bidding", in: Proceedings on Privacy Enhancing Technologies. (DOI)] only notes browsers' default protections as a caveat — see Browser protection.
• Real users beat crawlers here more than anywhere else on this site. The only field study [11Zeng, Eric; McAmis, Rachel; Kohno, Tadayoshi; Roesner, Franziska (2022): "What Factors Affect Targeting and Bids in Online Advertising? A Field Measurement Study", in: Proceedings of the ACM Internet Measurement Conference, pp. 210-229. (DOI)] — a browser extension in 286 Prolific participants' own browsers — is the one bid dataset that is about people. Its cost is ten fixed sites and an eleven-day window before Christmas.

Checked on 2026-09-02; the check is logged on ads_txt. A dead link in a 2019 paper is not a dead method, but you should not cite the link.

All figures below come from the publication corpus — seven venues, 2010–2026, 5,869 papers with readable full text. The full query log, the report script and its unedited output are on ads_txt.

None of the three observables is a field in the extraction schema, so reach is measured from the text, whitespace-collapsed. Denominator: 5,869 papers with full text.

This is a small literature in these venues: 41 papers ever name one of the observables and 18 do so substantively. The first mention of any of them is in 2017; there is nothing in 2010–2016 because ads.txt did not exist until June 2017.

Denominator: that venue's own papers with full text.

Three venues hold it. Four of the five ads.txt / sellers.json papers are at IMC or TheWebConf; three of the seven papers that use bids as a privacy instrument are at PoPETs. The IEEE S&P row is the one to notice: the venue's single mention is a passing one, and the venue's actual ads.txt paper — [5Vekaria, Yash; Nithyanand, Rishab; Shafiq, Zubair (2024): "The Inventory is Dark and Full of Misinformation: Understanding Ad Inventory Pooling in the Ad-Tech Supply Chain", in: Proceedings of the IEEE Symposium on Security and Privacy. Not in the site's publication corpus (screened out at abstract stage); cited from the arXiv version 2210.06654v3 (DOI)] — is not in the corpus because abstract screening rejected it. That is a fact about the funnel, not about IEEE S&P.

Papers mentioning any core term, per year, against that year's corpus size. This measures attention, not prevalence. 2025 is thin at the edges and 2026 is provisional — CCS 2026 and IMC 2026 have not been held and IEEE S&P 2026 and TheWebConf 2026 are incompletely indexed — so the last two rows are not evidence of anything.

The sellers.json column is the one methodological signal in this table: one paper in 2019 (Bashir, naming it as forthcoming), one in 2023, three in 2025. The intersection method is a 2023–2025 development in these venues.

The 18 papers with five or more core mentions, plus two forced in by hand (the 2017 RTB-price paper and the 2022 publisher-ID paper), were read and labelled. 16 measure — read one of the files or observe bids — 1 is a related method and 3 only cite. Zero were left unlabelled; the 21 papers with one to four mentions were not read and are listed on the provenance page.

Of the 16, 13 have a crawl-configuration record; the other three are a browser extension in real users' browsers, a passive proxy, and industrial bidding logs. Among the 13: statefulness 6 stateless, 5 stateful, 1 both, 1 not stated; consent action 5 no-interaction, 2 accept-all, 1 accept-and-reject, 1 CMP-specific, 1 not applicable, 3 not stated; interaction depth 4 landing page only, 4 landing plus subpages, 3 single target page, 2 not stated; headless mode not stated by 10 of 13. Population sources named, paper-counted after a short alias fold: Alexa 8, Tranco 5, MediaBias/FactCheck 3, NextDNS piracy list 2, Prolific 1, BuiltWith 1, with 30 unmapped source strings printed on the provenance page. 10 of 16 release a public artifact, 4 mention none, 2 promised one.

The paper this whole literature cites for dark pooling is not in it, and neither is anything from EuroS&P, where its 2026 follow-up on notifying the ecosystem appeared,⁸⁾ nor the advertising-economics literature that measures Prebid configurations at panel scale.⁹⁾ Industry measurement of ads.txt adoption exists but publishes headline percentages without a stated denominator or method, and none of it is cited on this page. Any count above is a count over CCS, IMC, NDSS, PoPETs, USENIX Security, TheWebConf and IEEE S&P, 2010–2026. See Corpus.

For a reviewer to accept an ad-supply-chain figure, the methodology section needs, in this order:

1. Which relationship: declared, confirmed, observed or paid — and for confirmed, whether a sellers.json domain mismatch counted as unconfirmed.
2. The file population: how many root domains were requested, how many returned a file, how many files parsed under the specification, how many records were dropped as invalid, and the dates of every snapshot.
3. The ad-system fold: the alias list that turned seller domains into organisations, and its residue.
4. For sellers.json: which ad systems' files you fetched, whether you recursed into intermediaries, and the share of the relevant entries that were confidential — that share is the ceiling on what you could confirm.
5. For pooling: how ownership was established (WHOIS, publisher IDs, hand review) and for what share of pool members it could not be.
6. For header bidding: how Prebid sites were detected (global name, events, or both), which API (getBidResponses vs winning vs rendered), the wait after load, the persona and control design, the vantage, the consent action, and the browser's protection state.
7. What fraction of your candidate sites exposed a client-side auction at all — the number every bids paper since 2019 has omitted.

• Has the client-side share of header bidding fallen since 2019? 17.3% client-only, 34.7% hybrid, 48% server-side is the only measurement. Every bids-as-instrument paper depends on the answer.
• How widely are OWNERDOMAIN and MANAGERDOMAIN declared, and do they match sellers.json? Two fields, three years old, no measurement. A weekend with the IAB crawler would settle it.
• What does app-ads.txt look like? Bashir et al. asked for “a separate study” in 2019; none has appeared in these venues.
• Do confirmed relationships predict served ads? [4Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2025): "Before & After: The Effect of EU's 2022 Code of Practice on Disinformation", in: Proceedings of the ACM Web Conference. (DOI)] ran both an intersection crawl and an ad-clicking crawl on the same sites; nobody has published the join.
• Is dark pooling declining after notification? The 2026 EuroS&P notification study says notifications to ad networks work; a re-measurement of the 2023 pool census would show whether the ecosystem moved.

• The regex is not the population. The candidate set is “five or more mentions of ads.txt, app-ads.txt, sellers.json, header bidding, Prebid, OpenRTB or the SupplyChain object, summed”, plus two papers forced in by hand. Three papers with 1–4 mentions happened to be read during the run and turned out to mention the terms only in passing; the other 18 were not read. A paper that measured bids without ever writing “header bidding” or “Prebid” would be missed.
• Counts are of papers, never tuples, and sentinels are reported as sentinels. Every crawl-configuration figure above says how many of the 13 crawling papers did not state the value.
• Sixteen is a small set. The family table's “first / most recent” years are facts about 16 papers, and the 2025–2026 venue-years are provisional. No percentage on this page is a prevalence of anything in the world; the prevalence figures are the papers' own, with the papers' own denominators.
• The most-cited paper on the topic is missing from the corpus for a reason unrelated to relevance (abstract screening), and this page cites it from an arXiv version dated October 2023, not from the IEEE camera-ready.
• Quotes behind the figures were checked against the papers' own full text; the list, the report script report_ads_txt.mjs and its unedited output, the alias folds and their residue, the external checks and their rejections, and the reviewers' findings are on ads_txt.

• Cookie syncing — the other half of the ad graph: whether two parties' identifiers met. Cook 2020 and ATOM sit on both pages.
• Requests and Filter lists — EasyList is how every paper here found the ads, and blocks the auction if left on.
• Consent and TCF consent strings — the CMP-and-Prebid intersection is the population for a consent-and-bids study.
• Privacy Sandbox — the Protected Audience auction was the would-be successor to header bidding; it is being withdrawn.
• Website selection — Alexa's retirement is why the 2019 reference studies cannot be repeated as designed.
• Existing datasets — entity maps (WhoTracksMe, Tracker Radar) for folding seller domains into organisations.
• Notifying websites — the 2026 notification study of dark pooling belongs to that literature.

[1]

Cook, John; Nithyanand, Rishab; Shafiq, Zubair (2020): "Inferring Tracker-Advertiser Relationships in the Online Advertising Ecosystem using Header Bidding", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[2]

Musa, Maaz Bin; Nithyanand, Rishab (2022): "ATOM: Ad-network Tomography", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[3]

Bashir, Muhammad Ahmad; Arshad, Sajjad; Kirda, Engin; Robertson, William K.; Wilson, Christo (2019): "A Longitudinal Analysis of the ads.txt Standard", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[4]

Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2025): "Before & After: The Effect of EU's 2022 Code of Practice on Disinformation", in: Proceedings of the ACM Web Conference. (DOI)

[5]

Vekaria, Yash; Nithyanand, Rishab; Shafiq, Zubair (2024): "The Inventory is Dark and Full of Misinformation: Understanding Ad Inventory Pooling in the Ad-Tech Supply Chain", in: Proceedings of the IEEE Symposium on Security and Privacy. Not in the site's publication corpus (screened out at abstract stage); cited from the arXiv version 2210.06654v3 (DOI)

[6]

Papadogiannakis, Emmanouil; Kourtellis, Nicolas; Papadopoulos, Panagiotis; Markatos, Evangelos P. (2025): "Welcome to the Dark Side: Analyzing the Revenue Flows of Fraud in the Online Ad Ecosystem", in: Proceedings of the ACM Web Conference. (DOI)

[7]

Pachilakis, Michalis; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2019): "No More Chasing Waterfalls: A Measurement Study of the Header Bidding Ad-Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[8]

Iqbal, Umar; Bahrami, Pouneh Nikkhah; Trimananda, Rahmadi; Cui, Hao; Gamero-Garrido, Alexander; Dubois, Daniel J.; Choffnes, David R.; Markopoulou, Athina; Roesner, Franziska; Shafiq, Zubair (2023): "Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[9]

Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[10]

Liu, Zengrui; Dani, Jimmy; Cao, Yinzhi; Wu, Shujiang; Saxena, Nitesh (2025): "The First Early Evidence of the Use of Browser Fingerprinting for Online Tracking", in: Proceedings of the ACM Web Conference. (DOI)

[11]

Zeng, Eric; McAmis, Rachel; Kohno, Tadayoshi; Roesner, Franziska (2022): "What Factors Affect Targeting and Bids in Online Advertising? A Field Measurement Study", in: Proceedings of the ACM Internet Measurement Conference, pp. 210-229. (DOI)

[12]

Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2023): "Who Funds Misinformation? A Systematic Analysis of the Ad-related Profit Routines of Fake News Sites", in: Proceedings of the ACM Web Conference. (DOI)

[13]

Sheaib, Hussein; Feldmann, Anja; Dao, Ha (2025): "Unmasking the Shadows: A Cross-Country Study of Online Tracking in Illegal Movie Streaming Services", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[14]

Zhang, Jiang; Psounis, Konstantinos; Haroon, Muhammad; Shafiq, Zubair (2022): "HARPO: Learning to Subvert Online Behavioral Advertising", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[15]

Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2022): "Leveraging Google's Publisher-Specific IDs to Detect Website Administration", in: Proceedings of the ACM Web Conference. (DOI)

[16]

Lukić, Karlo; Papadopoulos, Lazaros (2026): "Privacy vs. Profit: The Impact of Google's Manifest Version 3 (MV3) Update on Ad Blocker Effectiveness", in: Proceedings on Privacy Enhancing Technologies. (Link)

[17]

Papadopoulos, Panagiotis; Rodríguez, Pablo Rodríguez; Kourtellis, Nicolas; Laoutaris, Nikolaos (2017): "If you are not paying for it, you are the product: how much do advertisers pay to reach you?", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[18]

Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2018): "The Cost of Digital Advertisement: Comparing User and Advertiser Views", in: Proceedings of the ACM Web Conference. (DOI)