The Players and Their Incentives — The Supply Side

Publishers, SSPs, and the business of selling attention

By Luca Passani, @Scientia_CTO, May 2026

Note: this article assumes that you are familiar with certain programmatic/ad tech concepts, such as SSPs and DSPs. If not, please refer to the first installment of this article series. The previous article can be found here.

If you are good at a game, any game, you’ll know that there are legal moves that decent players simply won’t make. Splitting two kings in Blackjack is a legal move, but almost everyone will agree it’s a bad idea (hint: you’d be giving away a near-certain win for two big risks).

The point here is that in any game, there are rules and there are strategies. Learning the rules is the easy part. Learning the strategy takes a lot of practice and experience. Ad Tech and programmatic are no exception.

The previous article explained the rules: OpenRTB, Prebid.js, and auction protocols are documented, standardized, and publicly available. Now it’s time to look at the strategies — what each player’s goals are and how they actually pursue their interests within those rules. There are also situations where those interests collide. And then there is fraud, which I will touch upon. 

To understand why programmatic looks the way it does — including the parts that seem inefficient or “broken” — looking at the JSON might not be as useful as looking at the KPIs. Every architectural decision in this industry is a response to a conflict of interest.

A community of “frenemies”. 

I have heard the expression “frenemy” thrown around more than once when talking to people in the programmatic world. I imagine that being in an industry where Google, Meta, and Amazon are taking the biggest chunk of the advertising pie forces everyone else to cooperate. Yet, at the end of the day, companies are also competing, leading to a place where everyone is a friend and a competitor at the same time.  

In this installment, we’ll see how the ecosystem makes sense as a human system rather than a technical one, focusing on the supply side of ad tech. The next article will focus on the demand side. We’ll look at the main actors and their respective incentives. What is each player measured on? What are they trying to optimize? What might tempt them to push the envelope to extract more value than they should? In other words, we will look at incentives, disincentives, and, where applicable, the temptation to cheat. 

We, the Audience: Get the Content and Run

If you are surprised to find yourself dragged into the programmatic family picture, don’t be. Users have their own incentive structure, and it is simpler than everyone else’s: get the content, avoid the friction, and pay as little as possible — ideally, nothing.

That’s not a moral failing. It’s rational behavior. If a website offers free access to journalism, entertainment, or tools in exchange for showing ads, most users will take that deal — and then install an ad blocker. If a publisher asks them to register, most will provide a secondary email address they never check. If a subscription is required, most will find a workaround before reaching for their wallet.

One way to look at it is that users are the goods that the two tribes are trading — publishers are selling people’s attention, and advertisers are buying it. But people are people, and the goods analogy is bound to be far from perfect. 

Firstly, there is the regulatory dimension. GDPR, CCPA, and a growing body of privacy legislation exist precisely because users — or at least their elected representatives — pushed back against an ecosystem that was harvesting behavioral data at scale without meaningful consent. Whether that pushback has produced meaningful protection is a separate question, and one I’ll address in detail in a later installment.

Secondly, there are people’s behaviors to account for. What we click, what we skip, how long we stay, and whether we block ads — these are signals that flow through the bid stream. A user who installs an ad blocker doesn’t just stop seeing ads. They remove themselves from the addressable inventory entirely, shrinking the pool that publishers can monetize. Multiply that across millions of users, and it becomes a structural force that every player in the ecosystem has to account for.

Because of this, I regard the user as a player in the programmatic ecosystem and assess their role under the incentives, disincentives, and temptations framing that I will apply to all other programmatic stakeholders.

The user isn’t a villain in this story. But they’re not a passive bystander either. They are participants with their own incentives — and those incentives don’t always align with the system that’s funding the content consumed for free.

User’s incentives and disincentives summary:

The Consent Management Platform (CMPs): The Architect of Compliance Theater

Privacy regulations — EU’s GDPR notably — demand that users explicitly express their consent before their personal information is shared with any third parties, and the behavioral advertising machinery can kick in. This is a fundamental aspect of the ad tech industry that will warrant one of the heftiest future articles in this series.

If you want to see a masterclass in hostile user-interface design, look no further than the Consent Management Platform (CMP). When GDPR passed, publishers faced a terrifying dilemma: they legally had to ask users for permission to track them, but if users actually said No, the publisher’s programmatic revenue would collapse. That’s how the CMP was born. Depending on your PoV, we are either talking about a fair way to inform the user about what they are about to sign off on regarding the use of their personal information, or about software designed to extract consent from users one way or another.

Note: Before you pass harsh judgment on the open web ecosystem, consider the unfair playing field. The tech giants don’t have this problem — by virtue of their massive first-party data vaults and logged-in users, players like Google, Meta, and Amazon completely bypass the cookie ban and the ‘ad tech tax’ — the cumulative fees taken by each intermediary in the programmatic stack — entirely. The irony of modern privacy regulations like GDPR is that by penalizing the movement of data between independent players, they accidentally built a multi-billion-dollar compliance moat around the world’s largest monopolies — forcing independent publishers to adapt or face financial starvation.

Figure: Examples of CMP’s “dark patterns” to compel users to give their consent. 

Popular CMPs include OneTrust, Didomi, Usercentrics, Sourcepoint, Iubenda, and Cookiebot (by Usercentrics). Whether you see them as legitimate privacy tools or sophisticated consent-extraction engines often depends on your point of view.

Exposing the Dark Patterns

You may not have heard it called that way before, but you probably have observed how manipulative those consent banners can be and the tactical psychology behind them:

• The “Visual Hierarchy” Hack: Making the “Accept All” button a bright, friendly green, while hiding the “Reject All” option inside a gray, boring “Manage Options” sub-menu that requires three extra clicks and a college degree to navigate.

• The Fatigue Strategy: Making the privacy settings page as long, tedious, and filled with legalese as possible. The CMP knows that a user who just wants to read a 300-word news article will eventually capitulate out of sheer click-fatigue.

CMP’s incentives and disincentives summary:

The Publisher: The Pursuit of Yield

Publishers have a website, a streaming app, a mobile app, a newsletter, a podcast — something people come to read, watch, or listen to. Inside that content, they’ve carved out ad slots. Empty rectangles on a webpage, mid-roll breaks in a video stream, sponsor reads in a podcast. All spaces waiting to be filled with someone else’s message. The publisher’s job is to extract maximum revenue from their advertising space without making their product so unpleasant that people stop coming. That tension — monetize aggressively vs. protect the experience — defines everything a publisher does.

Note:  Referring to publishers as a single category is a bit of a stretch. A reputable publisher — say the New York Times — shouldn’t be equated to “clickbaity” sites so loaded with ads as to be virtually unusable. Those sites are known in advertising as MFA (Made for Advertising), though it’s hard to draw a rigid line since publishers exist along a spectrum. MFA sites prioritize ad revenue over user experience, often with low-quality or recycled content designed purely to generate impressions.

Their primary metric is yield: total revenue per thousand page views. Not CPM on individual impressions — yield across the whole page, the whole session, the whole month. A publisher who fills every slot at low CPMs might earn less than one who leaves some slots empty but commands premium prices on the rest. 

Note: A few yield optimization plays worth knowing:

• Smart floor pricing is the practice of setting dynamic minimum CPMs per impression rather than a single blanket floor across all inventory. A publisher might set a $1.00 floor for a verified iPhone user on a premium article page, a $0.60 floor for anonymous mobile traffic on a sidebar slot, and a $0.35 floor for remnant inventory late at night. The goal is to avoid giving away premium impressions at commodity prices while not leaving slots unfilled by pricing out the only available bidder. Setting floors too high leaves inventory unsold. Setting them too low gives away value. Getting it right requires knowing what your inventory is actually worth, which depends on the accuracy of the signals in your bid requests.
  

• Inventory packaging is the practice of grouping ad slots by quality, audience, or context and offering them to buyers as a curated product rather than individual impressions. A publisher might package “premium mobile inventory with viewability above 70% and a verified tech audience” as a Private Marketplace deal at a negotiated CPM, rather than throwing the same impressions into the open auction where they’d compete on price alone. Packaging shifts the conversation from “how cheap is this?” to “what specifically am I getting?”, which is a better conversation for the publisher to be having.
  

• Audience development is the longer-term play: building a known, loyal readership whose characteristics can be described to buyers with confidence. A publisher who can say “our readers are verified IT decision-makers in enterprise companies” has inventory that commands a premium regardless of the auction dynamics on any given day. Audience development is the only yield optimization play that doesn’t depend on the programmatic stack — it starts with editorial strategy, not ad tech configuration.

Yield isn’t just about the highest bid — it’s about net yield. If an SSP offers a $0.50 CPM but takes a 30% cut, and another offers $0.45 but only takes 10%, the frenemy dynamic shifts instantly toward the partner that puts more actual cash in the publisher’s bank account. Publishers who don’t track this distinction are routinely leaving money on the table.

Note: Most publishers — especially mid-tier ones — can’t navigate all this complexity alone. That’s where Publisher Ad Monetization platforms (aka Yield Optimization partners) come in: companies like Freestar, Raptive, Playwire, and Mediavine that manage a publisher’s programmatic stack in exchange for a share of revenue. I’ll cover yield partners in more detail shortly.

Publishers have some natural enemies in the ecosystem. Some traditional and some new.
Buyers might deprioritize a publisher’s inventory because the signals in their bid requests are weak, incomplete, or untrustworthy. A publisher can have a genuinely great audience and still get commodity CPMs because the ecosystem can’t verify what they’re claiming to have. The quality of the signal is the quality of the business.

But a new nightmare has materialized over the past couple of years. AI companies are crawling publisher content at scale, training large language models on it, and serving the results directly to users — without sending traffic back to the publisher, without paying licensing fees, and without running a single ad impression. If users get answers from AI instead of clicking through to publisher pages, addressable inventory shrinks, and programmatic revenue shrinks with it. Whether this constitutes theft is being litigated in courts on both sides of the Atlantic. It will not be resolved quickly.

Publisher’s incentives and disincentives summary:

The Identity Provider: Replacing the Cookie with Something Stickier

When a user consents through a CMP, that consent signal travels downstream — but on its own it doesn’t tell DSPs who the user actually is. That’s where identity providers come in. Companies like The Trade Desk (UID2), LiveRamp (RampID), and ID5 replace the third-party cookie with a persistent identifier built on a more durable signal — typically a hashed email address captured when a user logs into a publisher’s site. That identifier travels in the bid request, allowing DSPs to recognize the user across sites and sessions without depending on a cookie.

Note: There is a certain irony in the cookieless transition. For years, privacy advocates campaigned against the third-party cookie — a tracking mechanism that at least had the decency to expire, could be deleted by the user, and reset itself every time someone cleared their browser. What replaced it, in many cases, is a persistent identifier built on a hashed email address that follows you across every site where you’ve ever logged in (and also those you haven’t logged into, courtesy of probabilistic matching), doesn’t reset when you clear your cookies, and is considerably harder to escape. The industry got rid of the cookie and replaced it with something stickier. Good job privacy advocates.

For publishers, implementing an identity provider means authenticated traffic can command higher CPMs — a DSP bidding on a known user is willing to pay more than one bidding on an anonymous signal. For DSPs, it means audience targeting and frequency capping survive cookie deprecation. Identity providers make money when both sides adopt their standard, which gives them a strong incentive to sign up as many publishers and DSPs as possible. The privacy implications of building a persistent cross-site identifier on top of a consent framework are, to put it mildly, worth examining carefully. That examination comes in a later installment.

Note: As this article goes to press in May 2026, Publicis — one of the world’s largest advertising agency groups — has announced the acquisition of LiveRamp for $2.2 billion. LiveRamp operates RampID, one of the three dominant identity graph standards in programmatic advertising. Publicis now owns the identity infrastructure that its own advertiser clients, and their competitors’ clients, depend on for cookieless targeting. While it might not be immediately clear just yet, this creates an obvious conflict of interest. We’ll unpack exactly how that conflict plays out once we’ve covered how DSPs use these IDs to bid in a later article.

Identity Provider’s incentives and disincentives summary:

The SSP: Caught Between Publishers and DSPs

The SSP exists to serve the publisher. It connects publisher inventory to DSP demand, runs the auction machinery, and takes a percentage of whatever transacts. In theory, perfectly aligned with the publisher. In practice, the alignment has limits.

The major SSPs you will encounter in any serious programmatic conversation are, on the independent side: Magnite (formerly Rubicon Project, the largest, with particular strength in CTV), PubMatic, Index Exchange, OpenX, Equativ, Sovrn, Sharethrough (now part of Equativ), and Teads. Google Ad Manager and AdX occupy a category of their own — part ad server, part exchange, dominant by almost any measure, and the subject of ongoing antitrust proceedings for exactly that reason. Amazon Publisher Services sits in a third category: technically an SSP, but one that brings unique retail advertiser demand that no independent can replicate. Xandr, now part of Microsoft Advertising, rounds out the tier of platforms that matter in most enterprise conversations. The landscape has consolidated significantly through acquisitions — Magnite absorbed SpotX and SpringServe, for example — and the direction of travel is fewer but larger players. 

SSPs are a volume business. More impressions transacted means more fees collected. That creates a structural incentive to send as much inventory as possible to as many DSPs as possible — not out of laziness or bad faith, but because the business model rewards throughput. The SSP that fills more slots earns more. Simple.

The problem is that DSPs don’t want everything. They want the right things. When SSPs sent everything, DSPs responded by ignoring most of it, which is how the QPS crisis mentioned in Article 1 happened. SSPs are incentivized to send more, while DSPs are demanding less “goods” but with better quality. This tension is the central engineering problem in the programmatic supply chain, which has forced SSPs to build traffic-shaping models. I will cover QPS and traffic shaping in more detail in one of the next articles.

The SSP position sits between two parties with opposite incentives and controls the information flowing in both directions. Publishers don’t have full visibility into what SSPs tell DSPs about their inventory. DSPs don’t have full visibility into how SSPs select and filter what they send. That position of structural opacity creates temptations that I will expand in the rest of the series.

Some SSPs apply lenient invalid-traffic filtering because stricter enforcement means fewer impressions and lower fees — even if the impressions they’re passing are partially bot-generated. Some report viewability rates based on their own measurement rather than independent verification. Some have been slow to enforce ads.txt and sellers.json compliance, allowing unauthorized or resold inventory to flow through their pipes while presenting it to DSPs as direct publisher supply. 

Note: ads.txt and sellers.json are IAB Tech Lab supply chain transparency standards. A publisher places an ads.txt file at the root of their domain declaring which SSPs are authorized to sell their inventory. sellers.json is the SSP-side complement — published by the SSP itself, it declares who their sellers actually are. Together, they allow a DSP to verify that the impression it’s bidding on is being sold through a legitimate, authorized path rather than an undisclosed reseller or spoofed domain. They are the programmatic equivalent of a chain of custody. I’ll cover them in more detail in a later article. 

None of these practices requires explicit dishonesty. They require only a selective approach to transparency in a system where the party doing the selecting also sets the rules.

This is worth keeping in mind when SSPs talk about supply quality. The incentive to overstate it is structural, not exceptional.

SSP’s incentives and disincentives summary:

The Publisher Ad Monetization Platform: If a Publisher and an SSP Had a Baby

While large publishers have Ad Ops departments that can navigate the programmatic stack alone, small and mid-tier ones don’t have a chance. Too freaking complicated. 

Note: Ad Ops (AdOps) — short for advertising operations — is the discipline that handles the technical and operational side of programmatic: Prebid.js integration, floor pricing, campaign management, SSP relationships, GAM configuration. It spans both the supply and buy side. Good AdOps people are highly valued because they directly impact revenue. There are never enough of them.

For most publishing organizations, managing the complete ad tech stack is not realistic. Header bidding configuration, SSP relationships, floor pricing strategy, yield analytics, GDPR compliance, and viewability optimization — the list goes on, and each item on it is a specialist discipline. Doing all of them well simultaneously is easier said than done when your main business model is running a media outlet. 

Publisher Ad Monetization platforms — also called Yield Optimization platforms, or simply Yield Partners — exist to solve this problem. Companies like Freestar, Raptive, Playwire and Mediavine take over the technical and strategic complexity of a publisher’s programmatic stack in exchange for a share of revenue.

Note: I was tempted to use PMP as a shorthand to indicate the Publisher Monetization Partners, but in the ad tech industry that acronym is generally understood to mean Private Marketplace, i.e. an invite-only auction within programmatic advertising. A publisher invites select advertisers to bid on curated, high-quality inventory, usually with price floors. How that inventory is transacted is a story for another day.
There is no industry established acronym for Publisher Ad Monetization Platforms. Yield partner and monetization partner are the commonly used shorthand to refer to them. Google calls the role MCM (Multiple Customer Management).

Monetization Platforms emerged to help publishers manage the sheer complexity of having 20+ SSP partners. They act as a strategic layer, deciding which SSPs get to see which traffic to minimize latency while maximizing the chance of a high bid. Yield partners handle the Prebid.js build, negotiate SSP terms, set and adjust floor prices, monitor yield analytics, and flag underperforming demand sources. For the publisher, the relationship is straightforward: hand over the keys, share the upside, stop worrying about QPS caps.

What makes monetization platforms strategically interesting — and what distinguishes them from SSPs — is that their incentive is aligned with the publisher’s net yield, not with transaction volume. An SSP makes money when impressions transact. A yield partner makes money when the publisher makes money. That difference matters. A monetization platform has every reason to tell a publisher that a particular SSP’s fees are too high, or that a specific demand source is depressing floor prices, or that a traffic source is attracting bot traffic that’s damaging CPMs. An SSP would never volunteer that information about itself.

That alignment also gives yield optimization platforms unusual leverage in the ecosystem. A single relationship can represent hundreds of publishers simultaneously. When Freestar deploys a new Prebid.js module across its publisher base, it reaches that entire footprint at once. When Raptive changes its floor pricing strategy, it affects the auction dynamics for hundreds of sites simultaneously.

Yield Optimization Platform’s incentives and disincentives summary:

The Fraud Detection Company: The Ecosystem’s Internal Affairs

The whole point of advertising is to get human attention, and the reason is simple — bots and crawlers don’t have kids, wives, and secret lovers to buy presents for. This is why advertisers hate programmatic fraud. It’s theft in its purest form.

To the outsider, ad fraud looks like a simple crime: a greedy publisher faking numbers to steal from an advertiser. In reality, programmatic fraud is a parasitic ecosystem. While some bad-actor sites intentionally manufacture bot traffic, premium and legitimate publishers are routinely used as unwitting cloaking devices. Through compromised third-party code, desperate audience-buying tactics, and sophisticated domain spoofing, fraudsters weaponize the open web’s complexity to siphon off millions. The publisher might see their revenue go up, but they are often just the accidental beneficiary of a crime orchestrated right under their nose by players they didn’t even know existed.

In programmatic, the role of busting fraudsters belongs to fraud detection companies — HUMAN Security, DoubleVerify, Integral Ad Science (IAS), DataDome, and a handful of others whose entire business model is built on finding problems with inventory that SSPs certified as clean.

The scale of the IVT problem they’re addressing is significant. Invalid traffic — impressions generated by bots, data centers, device farms, and various forms of spoofing — represents a meaningful percentage of all programmatic impressions. Estimates vary, and the companies producing those estimates have a commercial interest in the numbers being high. But even conservative industry figures point to billions of dollars of wasted spend annually. The incentive to commit fraud is structural: if a CTV impression commands a $20 CPM and a bot farm can fake ten million of them per day, the economics are compelling.

Fraud detection companies sit in an unusual position in the ecosystem. They are paid by buyers — DSPs and advertisers — to audit the quality of inventory that SSPs are selling. This means their interests are explicitly adversarial to the sell side. When DoubleVerify finds that an SSP’s traffic contains 15% invalid impressions, that finding costs the SSP money and reputation. The SSP has every incentive to dispute the number. The fraud detection company has every incentive to stand behind it. Both have a financial stake in the outcome.

This structural tension produces a predictable pattern: fraud detection company estimates of IVT (Invalid Traffic) are systematically higher than SSP-reported figures. This is not necessarily because one side is lying. It is because they are measuring different things with different methodologies, from different positions in the stack, with different commercial incentives shaping what they emphasize. A practitioner who understands this dynamic reads IVT figures from any source with appropriate skepticism.

What fraud detection companies actually do is layered. At a basic level, they identify known bots, data-center traffic, and obvious domain spoofing. At a more sophisticated level, they analyze behavioral patterns — mouse movements, scroll behavior, session timing — to distinguish human from non-human traffic. At the cutting edge, they are developing device-level signals that check whether a claimed device is physically consistent with its behavioral fingerprint.

Fraud Detection Company’s incentives and disincentives summary:

The Supporting Cast

Not every player in programmatic has a seat at the main table, but several are worth knowing — either because they shaped how the ecosystem got here, or because you’ll encounter the terminology in industry conversations.

The Ad Server: The Final Word

I mentioned ad servers with enough information to make sense in the previous two chapters, but I have not provided a full explanation of what they are. Before programmatic existed, publishers needed a system to manage, schedule, and deliver ads on their websites. That system is the ad server. Think of it as the publisher’s central traffic controller: it decides which ad to show in which slot at any given moment, tracks how many times each ad has been shown, enforces campaign caps and scheduling rules, and reports on delivery.

What makes the ad server strategically significant is its position in the stack. The ad server sits above the programmatic auction. When Prebid.js delivers a winning bid, it doesn’t automatically serve the ad. It passes the result to the ad server, which weighs it against direct deals, guaranteed campaigns, and house ads before making the final call. The ad server has the last word on every impression.

The dominant ad server by a wide margin is Google Ad Manager (GAM). Formerly, its name was DoubleClick for Publishers (and Dart for Publishers before that), which is why you can hear practitioners call it DFP without anyone flinching still today. Its market position is so entrenched that Prebid.js was effectively built on the assumption that most publishers would use GAM. That position gives Google a structural advantage that goes beyond the auction itself: whoever controls the ad server controls the most important chokepoint in the ecosystem. I touched on the implications in Article 2 with the “last look” discussion. The DOJ antitrust case against Google is, to a large extent, about exactly this — Google’s ad server space directly integrates AdX, Google’s Ad Exchange. Sheer coincidence? I don’t think so.

The Ad Exchange: The Stock Market Nobody Sees

An ad exchange is the neutral marketplace where SSPs and DSPs meet to transact. Think of it as the stock exchange for impressions — a real-time matching system that accepts bid requests from SSPs and bid responses from DSPs and executes the transaction between them.

In practice, the line between ad exchange and SSP has blurred almost to the point of meaninglessness. Most major SSPs operate their own internal exchange, and the term “ad exchange” is increasingly used interchangeably with SSP in industry conversation. Google AdX — Google’s exchange, deeply integrated with GAM — is the dominant example and the one you’ll hear most often.

The distinction still matters in one specific context: when a DSP accesses multiple exchanges to reach the same publisher’s inventory, it’s paying multiple intermediaries for the same impression. This is the redundancy that Supply Path Optimization is designed to eliminate.

And now the demand side

Every architectural decision in programmatic makes sense once you understand the incentives behind it. Traffic shaping, curation, fraud detection, and Publisher Monetization Platforms — none of these emerged because the industry decided to improve itself. Each one is the rational response of a specific player to a specific pressure. The technology is complicated but learnable. The incentives are simple, and they explain almost everything.

In the next installment, we cross the mountain to the other side — the buyers, the agencies, and the advertisers holding the budget that makes all of this run.

Want to stay updated on future posts? Follow me on X @Scientia_CTO. Spotted any inaccuracies? Slide into my DMs @Scientia_CTO