Strategy
Part of Reading programmatic advertising with a sceptical eye
Programmatic advertising best practices in practice
Programmatic advertising best practices for managing privacy signals, reconciling invoices, setting stop rules, assigning owners, and documenting decisions.
What to take away
- Best practice is an owned operating routine with evidence and authority.
- Privacy protocols do not decide whether a specific data use is lawful or appropriate.
- Reconcile invoices with reporting under documented definitions and tolerances.
Programmatic advertising best practices make each material decision explainable and reversible. Start with a defined customer and business job, eligible inventory, supported creative, controlled data use, meaningful outcome, full-cost boundary, named owner, and stop rule.
Map the buying stack before launch: identify the DSP, SSP, publisher ad server, and verification provider, along with who owns each setting and report. Examples include Google Display & Video 360, The Trade Desk, and Amazon DSP for buying; Magnite and PubMatic for supply; Google Ad Manager for ad serving; and Integral Ad Science (IAS) or DoubleVerify for verification. Treat these as examples to document, not endorsements.
Choose the deal type explicitly: open auction, private marketplace (PMP), preferred deal, or programmatic guaranteed. Record access, priority, pricing basis, fees, and delivery commitments, then verify that the deal’s actual delivery matches the agreed terms.
Check publisher authorization against ads.txt and sellers.json, and inspect the OpenRTB SupplyChain Object to identify intermediaries in the bid path. Use ads.cert authentication where both parties support it. Apply supply path optimization (SPO) by comparing equivalent inventory paths with log-level data, including seller IDs, fees, auctions, and outcomes; do not assume fewer intermediaries automatically means a better path.
Use privacy signals within a broader program
IAB Tech Lab's privacy standards and specifications page groups technical initiatives for communicating privacy, consent, deletion, and related signals across advertising systems. Technical support does not itself establish notice, permission, legality, fairness, data accuracy, or compliance. Obtain current legal and privacy review for the actual market and use.
Match the consent or choice signal to the market and integration: IAB Europe’s Transparency & Consent Framework (TCF), IAB’s Global Privacy Platform (GPP), and, where a legacy integration still uses it, the IAB US Privacy (USP) string. For California opt-outs, test Global Privacy Control (GPC) and applicable CCPA/CPRA handling end to end; transmitting a signal does not prove compliance.
Ask counsel to identify applicable requirements, including the General Data Protection Regulation (GDPR) where its territorial scope applies, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and the Federal Trade Commission Act’s prohibitions on unfair or deceptive acts or practices. Test that opt-outs and deletion requests reach downstream partners, and retain evidence of how each partner handled them.
Seven Control Areas
- Decision controlbrief, offer, budget, stop rule
- Supply controlpublisher, seller, deal, fees
- Creative controlclaims, rights, formats, expiry
- Data controlorigin, permission, retention, deletion
- Measurement controlunits, bases, outcomes, limits
- Access controlaccounts, roles, logs, offboarding
- Commercial controlparties, costs, audits, exit
| Practice | Owned evidence and sample cadence |
|---|---|
| Decision control | Brief, customer, offer, outcome, budget, risk, approval, and stop rule. Cadence: daily stop check, monthly brief |
| Supply control | Publisher, app, seller, nodes, deal, context, fees, exclusions, and samples. Cadence: weekly seller review, monthly exclusions |
| Creative control | Claims, rights, disclosure, formats, destination, feed, version, and expiry. Cadence: weekly claims check |
| Data control | Origin, purpose, permission, fields, identity, sharing, retention, correction, and deletion. Cadence: daily intake check, monthly retention |
| Measurement control | Units, counts, bases, filters, outcomes, maturity, experiments, and limits. Cadence: weekly read, monthly restatement |
| Access control | Accounts, roles, authentication, integrations, logs, recovery, and offboarding. Cadence: weekly access check, monthly role review |
| Commercial control | Legal parties, status, costs, invoices, credits, audits, incidents, and exit. Cadence: monthly reconciliation, weekly credits |
Use stable identifiers across brief, platform, creative, deal, and page. Do the same for event, report, invoice, and experiment.
Preserve mappings after migrations, agency changes; without lineage, teams may confuse naming differences with performance differences or lose evidence needed for a dispute. Identifiers pay off only when a programmatic advertising checklist maps each one to the decision it supports and the record that holds it.
Set brand-safety exclusions for unsuitable content separately from brand-suitability controls tailored to the advertiser. Measure viewability against Media Rating Council (MRC) standards, apply pre-bid and post-bid invalid traffic (IVT) controls, and review placement-level results rather than relying only on vendor labels.
Set frequency caps and document the source, permitted purpose, retention, and opt-out handling for audience or identity data. Where direct identity use is unnecessary, test contextual targeting. Data clean rooms can support controlled matching or measurement under agreed permissions, but do not make a data use automatically lawful.
Reconcile money without hiding differences
Google's guide to comparing Display & Video 360 invoices with reporting describes report selection, billable-cost fields, date ranges, time-zone considerations, and reasons differences can occur in that product. Apply the live contract and finance records; do not force unlike reporting and billing units to match.
Reconcile each applicable billed line, not just media: DSP or platform, exchange or SSP, ad serving, data, verification, measurement, and agency charges. Keep gross and net media, fees, credits, currency, and report-versus-invoice definitions distinct, and explain each material variance against the contract before judging delivery.
Reconcile Money Without Forcing Matches
- Select reports and billable-cost fields
- Align date ranges and time zones
- Apply live contract and finance records
- Sample supply and creative delivery
- Review exceptions with named owners
- Record scale, stop, change, or test
Reconciliation example. Pull the report for 1 to 31 March in the account time zone. The invoice period sits in the partner billing time zone, so align the windows first.
Sample variance line: report Billable Cost 10,000.00 USD against invoice 10,050.00 USD, a 50.00 USD gap, or 0.5 percent. Impressions: report 1,000,000 against invoice 1,008,000, a 0.8 percent gap.
Set the tolerance at the greater of 2 percent of billable cost or 500 impressions, and escalate above it before the dispute window closes.
- Publish counts, denominators, methods, missingness, and maturity
- Read complaints, cancellations, returns, and service load beside conversion reports
- Test pause, correction, access recovery, data deletion, export, and replacement
- Restate decisions when material evidence changes
A mature review ends with action. Record what will scale, stop, change, or remain under test. Name the owner.
Worked example. Stop rule: pause the deal line when cost per approved lead runs 25 percent above target across any rolling 7 days with 20 or more leads. Reversal trigger: restart when 7 straight days land at or below target and the sales record confirms lead quality.
Retire rules and partners that no longer serve a documented purpose. When consulting programmatic advertising benchmarks, name the metric, denominator, period, and fee lines before treating a comparison as actionable.
Counts: impressions, viewable impressions, clicks, completed views, conversions. Bases: served impressions, viewable impressions, unique users, sessions.
Fees: platform fee as a percentage of media, data and verification fees as CPMs, agency commission. Typical platform fees run about 10 to 20 percent of media spend.
Assign the practice
The NIST Privacy Framework starting guide guides a voluntary process for identifying and managing privacy risk. Use it to assign data and response owners, and to name owners by role and title rather than by person, for example 'Programmatic manager, demand team'.
The CISA business-system logging guidance explains how event records support security review, which is the pattern for access, change, and correction logs.
Give each control area an owner, a cadence from the table, an input, an output, an acceptance test, and a correction path. Map each role to a backup, an escalation path, and its system permissions.
Observe the work during a normal reporting cycle and during one controlled failure. Keep the result with the metric definition and decision record. A written policy has little value when access changes, source defects, and disputed conclusions leave no trace that another reviewer can follow.
For programmatic advertising best practices, keep the evidence record beside the decision so a reviewer can reproduce the reasoning without relying on memory.
Common questions
Are industry protocols enough for privacy compliance?
No. Protocols can carry signals, but the organization remains responsible for its actual notices, permissions, uses, partners, rights, security, and legal duties.
How often should invoices be reconciled?
Set a cadence that fits spend and billing timing, and investigate material variance before the dispute window closes.
What is the most important best practice?
Keep the business able to understand, authorize, monitor, correct, pause, and exit every material part of the program.
