OpenRTB 2.5 vs 2.6 vs 3.0: what changed, and which version the market actually uses

The table compares the three versions on the points that change code. Each row cites the specification text.

Sources for unlinked cells: the 2.5 to 2.6 change log in OpenRTB 2.6, Appendix B, the 2.5 locations as Prebid Server's conversion code names them (convert_down.go), and the AdCOM 1.0 object tables.

The fastest way to see the gap is to write the same impression three times. Each example below is a desktop visit to a business news page with one 300x250 slot. The publisher sells through two exchanges, GDPR applies and the user consented. Domains use the reserved .example name, the IP comes from a documentation range, and the consent string was generated for this page (see the appendix).

OpenRTB 2.5. Consent, supply chain and extended IDs all sit in ext objects, because 2.5 had no core fields for them.

OpenRTB 2.6. The same signals move into core fields, the category gets an explicit taxonomy, and a GPP string can travel next to the TC String.

OpenRTB 3.0. The transaction layer wraps everything. The impression becomes an item whose spec holds an AdCOM placement, and all context moves under context.

Every JSON block above parses as written. The field paths come from the OpenRTB 2.6 object tables, the OpenRTB 3.0 request example and AdCOM appendix C. To build or check your own payload, use the OpenRTB bid request builder.

Version 2.6 did three things. It gave CTV a real ad pod model, so a seller can offer a whole break and a buyer can bid on slots inside it. It moved signals that the industry had parked in ext objects into named fields: the SupplyChain object schain, plus eids, gdpr, consent and us_privacy. And it deleted its own enumerated lists, pointing every code value to AdCOM 1.0 instead (OpenRTB 2.6, Appendix B).

The dated releases then kept adding fields. Release 2.6-202211 added gpp and gpp_sid for the Global Privacy Protocol, 2.6-202303 replaced placement with plcmt, and 2.6-202606 added the live content flags realtime and firstbroadcast (release notes). Each field is explained in OpenRTB 2.6 explained, field by field, the pod fields in SSAI and CTV ad serving, and the consent fields in GPP and TCF implementation.

The pod fields matter most for streaming TV. A 2.5 request can describe one video slot; it cannot say that three slots form one 90-second break with a floor per second. Under 2.6, podid ties the slots together and mincpmpersec prices them by length, which is how pod bidding works in live sport and FAST channels.

OpenRTB 3.0 was a rebuild, not an update. It split the protocol into four layers: transport, format, transaction and domain. OpenRTB itself became only the transaction layer, and AdCOM became the default domain layer that describes the goods (OpenRTB 3.0, Protocol Layers). It made HTTPS mandatory, and it added fields for digitally signed requests under the ads.cert 1.0 scheme.

The new structure broke every parser. A 2.x bidder cannot read a 3.0 payload without new code, and PPC Land's reference entry describes 3.0 as not backward compatible (PPC Land, 29 September 2026). Media.net announced 3.0 adoption in early 2019, but the market stayed on 2.x, according to the same report. It also cites an April 2026 IAB Spain guide saying most platforms still run 2.5 or 2.6.

Four facts explain why 2.x kept the market:

1. 2.6 imported the parts people wanted. AdCOM lists, schain in the Source object and the structured user agent all reached 2.x. The 3.0 change log even records schain being added "to sync with 2.6" in March 2022 (3.0 Appendix B).
2. The signing feature moved elsewhere. The ads.cert 1.0 fields in 3.0 stayed in beta. IAB Tech Lab calls ads.cert 2.0 "a complete departure" from that 2018 design, and its Authenticated Connections protocol signs HTTP calls whatever the message format (IAB Tech Lab, ads.cert page, updated 14 February 2024).
3. 2.x became a living version. Since 2.6-202211, new fields ship as dated releases and partners must ignore what they do not know, so additive change no longer needs a major upgrade (openrtb2.x README).
4. The biggest exchange chose 2.x. Google retired its own protocol on 1 May 2025 and moved buyers to its OpenRTB implementation, documented against the 2.6 specification (Google release notes; Google OpenRTB guide).

Public documentation lets you check which fields real systems read. The table lists what we could verify on 9 November 2026.

The Prebid Server figure is our own count. We read every file in static/bidder-info at commit 361cd6c and separated adapters from aliases: 397 files, 281 adapters and 116 aliases. A missing openrtb.version means the server "will downgrade values back to their 2.5 ext locations" for that bidder, according to the Prebid Server developer guide. The conversion code moves schain, gdpr, consent, us_privacy and eids, and clears fields added after 2.5 (convert_down.go).

So the honest answer is "2.6 on the wire, 2.5 in many parsers". A Prebid Server host has to run both shapes, which the Prebid Server self-hosting guide covers. None of the systems above offers a 3.0 endpoint in its public documentation.

IAB Tech Lab has not published a notice that retires OpenRTB 3.0, and we found none on 9 November 2026. Its statements point the same way, though:

• The 2.x README says the version number moves only on breaking changes, so "OpenRTB 2.7 should be considered a distinct version" and releases follow a monthly cycle when there is approved work (openrtb2.x README).
• The OpenRTB page lists 2.6 releases up to September 2023 and says version history "is now fully maintained in Github". It dates 3.0 to September 2017, the year the framework was announced (IAB Tech Lab, OpenRTB page, updated 23 January 2024).
• The 3.0 repository says its master branch "contains the most recent release" and keeps branches for each 3.0 update; the newest is dated March 2022 (openrtb README).
• Programmatic Best Practices v1.0, drafted by IAB Tech Lab's Programmatic Governance Council, asks firms to support the most recent, widely deployed production version and to include an schain object in each request. Comments closed on 16 October 2026 (IAB Tech Lab press release, 16 September 2026).

AdCOM still changes. Its file received updates in June and July 2026, which flow into 2.6 because 2.6 reads AdCOM lists (AdCOM commit history). Trade press also reported that IAB Tech Lab made GitHub Markdown, not PDF, the reference text for its standards on 14 September 2026 (PPC Land).

1. Target the latest 2.6 release. Parse and emit 2.6-202606 field names. Send x-openrtb-version: 2.6 and ask each partner which dated release they test against.
2. Read both locations for moved fields. Accept schain, gdpr, consent, us_privacy and eids in core fields and in their 2.5 ext paths. Prefer the core field when both exist and disagree, and log the conflict.
3. Write what the partner reads. Keep a per-partner output profile. A 2.5-only bidder gets the ext paths, as Prebid Server does for adapters without a version flag.
4. Ignore unknown fields. The 2.6 policy requires tolerance of new fields and list values, so do not fail on them.
5. Treat 3.0 as a mapping job. Build it only for a partner that requires it, as a translation layer over your 2.6 model. The mapping table above lists the paths that change.

The request path and where this translation layer sits are drawn in RTB architecture explained. The engineering pages on this topic are collected in the RTB architecture hub.

1. Rejecting a request because of an unknown field. OpenRTB 2.6 requires bidders and exchanges to tolerate new fields and values. A strict schema that fails breaks every dated release.
2. Writing consent only to ext, or only to core. Google's exchange sends both user.consent and user.ext.consent; Prebid.js writes the ext form. Send both during migration and read both.
3. Sending schain in two places with different contents. If source.schain and source.ext.schain disagree, buyers cannot know which chain is true. Keep one source of truth and mirror it.
4. Assuming the version header tells you the release. Every 2.6 release sends 2.6. Agree the release in the integration contract, not in the header.
5. Mixing category lists. A 2.5 code such as IAB3 sent without cattax reads as Content Category Taxonomy 1.0, which AdCOM now marks deprecated. Set cattax whenever you send newer IDs.
6. Reading video.placement only. Release 2.6-202303 replaced it with plcmt. Read both while partners migrate.
7. Calling 3.0 "the next version of 2.6". It is a different payload with a different root object. Plan it as a new protocol, with its own tests.
8. Expecting signatures in a 2.6 request. The ds, dsmap and cert fields exist only in 3.0, and ads.cert 2.0 signs the HTTP call instead. The SupplyChain checks in schain, ads.txt and sellers.json together are what buyers use today.

1. IAB Tech Lab, "OpenRTB API Specification Version 2.6" (2.6.md, main branch, accessed 9 November 2026). https://github.com/InteractiveAdvertisingBureau/openrtb2.x/blob/main/2.6.md
2. IAB Tech Lab, openrtb2.x releases, 2.6-202210 (3 November 2022) to 2.6-202606 (11 June 2026), accessed 9 November 2026. https://github.com/InteractiveAdvertisingBureau/openrtb2.x/releases
3. IAB Tech Lab, openrtb2.x README (versioning policy and release process, accessed 9 November 2026). https://github.com/InteractiveAdvertisingBureau/openrtb2.x/blob/main/README.md
4. IAB Tech Lab, "OpenRTB API Specification Version 2.5" (December 2016). https://iabtechlab.com/wp-content/uploads/2016/07/OpenRTB-API-Specification-Version-2-5-FINAL.pdf
5. IAB Tech Lab, "OpenRTB Specification v3.0" (change log November 2018 to March 2022). https://github.com/InteractiveAdvertisingBureau/openrtb/blob/main/OpenRTB%20v3.0%20FINAL.md
6. IAB Tech Lab, openrtb repository README (OpenRTB 3.0). https://github.com/InteractiveAdvertisingBureau/openrtb/blob/main/README.md
7. IAB Tech Lab, "AdCOM Specification v1.0" (change log and OpenRTB interfaces, accessed 9 November 2026). https://github.com/InteractiveAdvertisingBureau/AdCOM/blob/main/AdCOM%20v1.0%20FINAL.md
8. IAB Tech Lab, OpenRTB standards page (last updated 23 January 2024). https://iabtechlab.com/standards/openrtb/
9. IAB Tech Lab, ads.cert page (last updated 14 February 2024). https://iabtechlab.com/ads-cert/
10. IAB Tech Lab, "IAB Tech Lab's Programmatic Standard Practices Available for Public Comment" (16 September 2026). https://iabtechlab.com/press-releases/iab-tech-labs-programmatic-standard-practices-available-for-public-comment/