By the Time You Finished Reading This Headline — You'd Already Been Sold

It’s called Real-Time Bidding — RTB. Bidding in real time. And it’s arguably the largest invisible market in human history.

• Not metaphorically. Literally. Over the last few seconds, while you were scrolling your feed, several dozen auctions took place. In each one, companies bid for the right to show you an ad. They knew who you were. They knew where you were. They knew what you were watching last night. And the entire process took less time than the blink of an eye.

It’s called Real-Time Bidding — RTB. Bidding in real time. And it’s arguably the largest invisible market in human history.

I want to break it down from the inside — no marketing brochures, no righteous outrage. Just a look at how it’s built — who earns money, who sells, who buys, and why.

First, the scale. Before diving into the mechanics, you need to grasp the size we’re talking about.

The global RTB market was valued at $21.18 billion in 2024. For comparison — that’s half of Estonia’s GDP. And that’s just the bidding infrastructure itself, not counting the advertising budgets that flow through it.

According to the Irish Council for Civil Liberties (ICCL), RTB tracks and broadcasts data about what people browse online and their real-world location 178 trillion times a year across the US and Europe combined. On average, one American’s data is broadcast through the RTB system 747 times a day. In Europe — 376 times a day.

376 times a day. Every day. While you drink your coffee, commute to work, read the news — the system methodically broadcasts information about you to hundreds of companies around the world.

Google allows 4,698 companies to receive RTB data on American users. European and American data flows out to firms all over the world, including Russia and China, with no mechanisms whatsoever to control what happens to it afterward.

This isn’t a data breach in the usual sense of the word — a hacker breaking into a database and stealing files. It’s an architectural decision. The system is designed exactly this way: your data is broadcast to hundreds of participants simultaneously, because that’s how an auction works.

How it works from the inside — from your click to the banner

Imagine: you open a news site. The moment the page starts loading, a process begins that you know nothing about.

• Step one — collecting data about you. The site you opened works with a Supply-Side Platform, an SSP. Within the first one to two milliseconds, JavaScript code collects data: device type, operating system, screen size, geolocation, page URL, content category, keywords. To this is added data from your cookies — browsing history, behavioral patterns, interest categories that advertising systems have already assigned you based on previous visits.
• Step two — forming the bid request. The SSP packages all of this into a standardized data packet — a bid request. This request is simultaneously broadcast to a multitude of DSPs — Demand-Side Platforms — within a few milliseconds. The request contains: who you are (more precisely, your identifier), where you are, what you’re viewing, the ad slot’s format, and the minimum price per impression.

The key point here is the word “simultaneously.” Your data doesn’t go to a single buyer — it goes to dozens and hundreds at once. Even DSPs that lose the auction receive and can retain data about you — it arrived in their system along with the request to participate in bidding. Once the data has been broadcast, there are no technical mechanisms that limit how it can be used.

• Step three — evaluation and bidding. Each DSP, upon receiving the request, decides within a few milliseconds whether to participate in the auction, and if so, how much to offer. This involves matching your profile against active ad campaigns, checking available budget, and calculating the expected value of the impression — sometimes calling on a machine-learning algorithm that predicts the likelihood of conversion. The entire evaluation — from receiving the request to sending the bid — takes 3 to 7 milliseconds.
• Step four — the auction and the winner. The exchange collects all the bids, selects a winner, and notifies them. The entire process — from the moment the user opened the page to the moment the banner appeared on screen — takes less than 100 milliseconds. That’s roughly a third of the time it takes to blink.

While you were still waiting for the page to load, you had already been sold, bought, and shown the result of the transaction in the form of an ad banner.

Who’s behind this market, and how it sells itself to clients

Now for the business mechanics — the part almost no one explains publicly.

RTB market participants can be divided into several tiers, and each has its own logic for attracting clients.

Exchanges and major platforms — Google Ad Manager, Amazon Advertising, Microsoft Xandr, The Trade Desk. This is the infrastructure layer. They don’t sell you advertising directly — they provide the technology that everyone else runs through. Google, for example, dominates online advertising: its RTB system operates on 33.7 million sites, in 92% of Android apps, and in 77% of iOS apps. Most of Google’s $237.9 billion in ad revenue comes precisely from RTB.

Their clients aren’t end advertisers. Their clients are DSPs and agencies that buy access to the infrastructure.

DSPs — Demand-Side Platforms — are what advertisers and agencies work with directly. The Trade Desk, DV360 (Google), Amazon DSP, Criteo. They sell themselves through direct sales: account managers approach the marketing departments of major companies — retailers, banks, automakers, pharmaceutical companies — and explain the value of targeted advertising.

In 2024, programmatic purchases made up 91.3% of all digital display advertising in the US. That means practically any company buying online ad banners does so through RTB — whether it realizes it or not.

How do they find clients? Standard B2B tactics: industry conferences (Cannes Lions, Advertising Week, dmexco), direct sales via LinkedIn, product demos promising measurable ROI. The main pitch from DSP salespeople is precision. “We’ll show your ad to exactly the people already searching for your product.” For a marketer who has to report on ad-budget effectiveness, that’s a very compelling argument.

SSPs — Supply-Side Platforms — work with publishers: news sites, apps, blogs, video platforms. Their pitch is the mirror image: “We’ll help you monetize your audience as effectively as possible — we’ll sell every ad impression to whoever’s willing to pay the most for it.” For a small news site looking for a revenue source, that’s compelling too.

Data Management Platforms (DMPs) are intermediaries that aggregate data from various sources and sell audience segments. This is where things get most interesting from a business-model standpoint.

Where the data about you comes from, and what you’re worth

The data used in RTB auctions comes from a multitude of sources.

The first and most obvious is your browser behavior. Cookies that sites set on your device record which pages you visited, for how long, what you clicked. This data gets aggregated and turned into a behavioral profile: “interested in cars,” “shopping for a mortgage,” “recently browsed children’s products.”

The second source is mobile apps. Most free apps monetize precisely through advertising. Every app that shows you banners transmits data about you into the RTB system. This happens in the background, regardless of which ad you ultimately end up seeing.

The third source is real-world data. Your geolocation from your mobile device. Companies that buy location data from carriers can build a physical map of your movements: you live in this neighborhood, you work in that office building, you’re at this shopping center every Friday, you sometimes visit a doctor at this particular clinic. This allows inferences about income, lifestyle, and health status.

The fourth source is partner data. Supermarket loyalty cards, bank-card purchase data, public registries, census data — all of this gets aggregated and enriches profiles.

What are you worth in this system? Typical price ranges per thousand impressions (CPM) look like this: display advertising — $1–3, mobile in-app advertising — $2–5, video — $6–12, audio — $4–8, Connected TV — $20 and up. These are baseline rates. If you fall into a valuable segment — say, “woman, 35–44, high income, interested in premium cars” — the price for showing an ad specifically to you can be several times higher.

In other words, showing you one ad costs anywhere from a fraction of a cent to a few cents. Multiply that by 376 times a day, and you get a rough sense of how much is earned off your data every single day.

The scandalous detail the industry never advertised

Here’s the part of RTB’s mechanics that finally changed how I see this system — and that remains almost unknown to the broader public.

When your data goes out in a bid request and is broadcast to hundreds of DSPs, only one wins the auction. But data about you is received by everyone who took part in the bidding. And potentially, by everyone who’s simply connected to the system.

Many companies participate in the bidding process specifically to obtain bidstream data — without ever intending to place an ad at all. The prospect of obtaining user data motivates companies to plug into the system, even if they never win a single auction.

This means RTB infrastructure has become a parallel surveillance market, embedded inside the advertising market. Companies pay to connect to the system — not to advertise products, but to collect data on billions of people. This data is then resold, aggregated with other sources, and passed on to government bodies.

Among the documented consequences of this system: profiling of Black Lives Matter protest participants using RTB data; use of RTB by the US Department of Homeland Security and other agencies to track phones without a warrant.

RTB has become surveillance infrastructure with an advertising interface.

Why the GDPR didn’t solve the problem.

When the GDPR came into force in 2018, its principles formally applied to RTB: user consent was required for processing, transparency was required, purpose limitation was required. The industry responded by creating the “Transparency & Consent Framework” (TCF) — an IAB Europe standard meant to ensure compliance.

The problem is that the TCF itself turned out to be a violator of the GDPR. In 2022, the Belgian data protection authority ruled the TCF unlawful — because the consent it collected was neither freely given, nor informed, nor specific. That “accept cookies” banner we all see on every website was the industry’s attempt to create the appearance of compliance without changing the actual mechanics.

The ICCL, the organization that conducted the most detailed study of RTB, called this system “the largest data breach ever recorded” — because it tracks and broadcasts people’s location and online-activity data 178 trillion times a year.

Regulators understand this. But they’re moving slowly — because RTB is embedded in the financial foundation of the entire free internet. Remove RTB, and publishers’ revenues collapse, the content economy that keeps news sites, blogs, and apps afloat disappears. This is a genuine tension with no easy solution.

One last question worth asking: what’s all this for, ultimately?

The surface-level answer is: to sell you products. That’s true, but it’s only the first layer.

The deeper goal is to predict behavior. Not just to know what you bought, but to know what you’ll buy next. Not just to know where you were, but to know where you’re going. A system that knows your patterns well enough can predict your decisions before you’re even aware of them yourself.

In 2024, more than 85% of all digital display advertising in the world runs through programmatic platforms. Behind every banner you see is a chain of several companies, each of which knows something about you and earns something from it.

You aren’t a user of the advertising system. You’re its raw material. Accept it as it is.

• Understanding this is already something. At the very least, it’s more honest than believing an algorithm simply “guessed your interests.”