Identity and Privacy

    RTB Display Ads in Email Newsletters: 2026 Benchmarks

    Published · Last updated
    Next scheduled review:

    Programmatic newsletter advertising connects an email placement with an ad decision and a measurement workflow. Email rendering, image requests and privacy protections affect what can be delivered and observed. Define the eligible inventory and reporting limits before comparing newsletter placements with web impressions or promising attribution to advertisers.

    Contents

    Key facts

    • Cookies stayed. On 22 April 2025 Google said it would "maintain our current approach to offering users third-party cookie choice in Chrome" and would not roll out a standalone prompt (Privacy Sandbox blog, 22 April 2025).
    • The APIs went. On 17 October 2025 Google retired ten Privacy Sandbox technologies "in light of their low levels of adoption", keeping CHIPS, FedCM and Private State Tokens (Privacy Sandbox blog, 17 October 2025).
    • Deprecation landed in Chrome 144, removal is set for Chrome 150. The blink-dev intent for Topics was filed on 7 November 2025 and approved on 12 November with a six-milestone window; a June 2026 update reported deprecation in Chrome 144, removal planned for Chrome 150 and usage at 4.9% of page loads (blink-dev, Intent to Deprecate and Remove: Topics API). Chrome 144 reached stable on 13 January 2026 and Chrome 150 on 30 June 2026 (Chromium Dash, M144; M150).
    • The UK regulator closed its case. The CMA released Google's Privacy Sandbox commitments on 17 October 2025, concluding its competition concerns no longer arise (CMA case page).
    • Two browsers already block. Safari has blocked all third-party cookies by default since 24 March 2020 (WebKit, 24 March 2020); Firefox has partitioned them by default since 14 June 2022 (Mozilla, 14 June 2022). Together they held 21.07% of worldwide browser share in September 2026 against Chrome's 66.36% (StatCounter, September 2026).
    • Consent strings are personal data. The CJEU ruled on 7 March 2024 that a TC String is personal data when it can be linked to an IP address (CJEU C-604/22), which frames every identity solution in this page.

    Definition

    Programmatic email display is the selection of an eligible image-based advertisement within a newsletter placement under the rendering and tracking limits of email clients.

    Evaluate the workflow

    Email newsletters used to be a simple direct-response channel: you sent a message, the subscriber opened it, and maybe they clicked. That is the old model.

    The new model is different. A newsletter can become a small, private media environment , with identity, ad serving, dynamic creative, first-party data, and omnichannel follow-up. That is where RTB-style display advertising inside email becomes genuinely powerful.

    Not because email suddenly behaves like a normal webpage. It does not. The power comes from a specific combination: known subscriber identity, newsletter trust, hashed email matching, dynamic image rendering, DMP segmentation, personalized landing pages, and omnichannel retargeting. Together they turn a single newsletter impression into the first step of a measurable customer journey.

    What Happens When Anna Opens the Email

    Imagine a subscriber named Anna. She receives a morning newsletter from a publisher she trusts. The email has editorial content, a few links, and one display ad slot.

    That ad slot is not a JavaScript tag like the ones on a website. Inside the email HTML it usually looks more like a link wrapped around an image:

    The <img> tag is the key. When Anna opens the email, her email client loads the image, and that image request travels to the ad server. In that moment, the ad server can evaluate a long list of signals: publisher ID, newsletter ID, placement ID, campaign eligibility, a hashed email or subscriber token, content category, region, device hints, time of open, and the frequency, suppression, and creative rules that apply.

    Why This Is Not Normal Web RTB

    On a website, the browser can run JavaScript. That unlocks GPT tags, Prebid.js, header bidding, cookie reads, client-side auctions, real-time script logic, viewability scripts, and complex rich media. Inside email, most of that simply does not work. The inbox is not a normal browser , email clients block or limit JavaScript, forms, cookies, scripts, and many interactive behaviors.

    So email RTB is not "classic browser RTB." It is closer to a clean, linear flow:

    That can still be programmatic. It can still use demand rules, private deals, campaign priority, and DMP segments , it just has to respect the technical reality of email. This is why platforms such as LiveIntent built newsletter ad serving around lightweight HTML tags (their "LiveTags") that are added once to a newsletter template. For the bidding side of the same decision in a full web stack, see DSP + DMP + External Data strategies.

    The Render: How the Banner Appears

    The render process is simple on the surface and sophisticated behind the scenes. It runs in five short steps.

    Where Hashed Email Becomes Powerful

    Email has one strategic advantage over many web environments: the publisher often knows the subscriber's email address. That does not mean the raw email should ever be exposed. Instead, systems use a hashed email , the address run through a hashing function so it becomes a fixed character string.

    Personalization That Is Useful, Not Creepy

    Good personalization in newsletter display does not mean announcing, "Hi Anna, we know exactly what you did." That is too aggressive , and it erodes the trust that made the inbox valuable in the first place. The better approach is broad, respectful relevance.

    Combine those and the ad server stops being a simple image renderer and becomes a decision layer. This is the same logic that powers modern banner personalization on the open web , see Dynamic Creative Optimization strategies for how those creative decisions are built.

    Omnichannel: Where the Conversion Lift Comes From

    The biggest mistake is treating newsletter display as one isolated impression. Its true value appears when it becomes part of an omnichannel sequence:

    1. The subscriber opens the newsletter
    2. The display ad renders with a relevant message
    3. The subscriber sees the brand in a trusted environment
    4. They click , or they do not
    5. Clickers land on a personalized landing page
    6. Non-click openers can enter allowed retargeting logic
    7. Web, email, SMS, push, or display continue the message
    8. The DMP updates the user's state
    9. The next ad or email uses the next best message

    That is where landing conversion improves , not because the banner itself is magic, but because the landing page is no longer cold. The user has already seen the brand, the message is familiar, the offer is consistent, and the next step feels natural.

    Three Worked Examples

    Retail: a grocery brand and the weather

    A grocery brand sponsors a local newsletter. The system sees: subscriber segment = household decision maker, weather = rain forecast, local delivery zone = active, and time = Thursday evening. The banner says, "Rainy evening? Get groceries delivered tonight." The click goes to a local delivery landing page, and the same user can later receive category retargeting, a coupon reminder, email recipe content, and an SMS delivery-window reminder. The creative is not just dynamic , it is contextual. The weather signal gives the message timing, the newsletter gives trust, and the landing page gives action.

    What Will Not Work Inside Email Banners

    Email is powerful because of identity and trust. It is weak as a runtime environment, and that matters. Here is what to avoid expecting from an inbox.

    Email Image Ads vs AMP vs HTML5

    These three formats are often confused, but they are not the same.

    FormatCompatibilityBest for
    Email image adMost compatible (works through <a><img>)Newsletter monetization, dynamic image rendering, click tracking
    AMP for EmailInteractive but limited to supported environmentsForms in email, selection flows, controlled dynamic content

    A Recommended Architecture

    A serious system has four layers, each with a clear job.

    That is how email display becomes infrastructure rather than a one-off banner. For the broader buy-side performance picture, see RTB Performance Strategies for First-Party Media Buyers, and for privacy-safe collaboration on identity, see Data Clean Rooms.

    The Final Strategic Point

    RTB display in email newsletters is not normal web RTB. It is more constrained technically, but it can be more powerful strategically , because the inbox has something the open web often lacks: identity, trust, habit, attention, a subscriber relationship, and first-party context. Connect that to hashed email, DMP segmentation, dynamic creative, and omnichannel continuation, and the newsletter ad becomes more than a banner. It becomes a trigger , for awareness, personalization, landing conversion, retargeting, and measurable customer movement.

    "The strongest advantage is not that the banner moves. It is that the system knows why this ad, this person, this newsletter, this offer, and this next step belong together. That is the future of newsletter advertising , not more impressions, but better decisions."

    Frequently Asked Questions

    How do display ads work inside an email newsletter?

    Most newsletter ads are rendered through a loaded image, not browser JavaScript. The slot is an <a> link wrapped around an <img> tag; opening the email loads that image from an ad server, which reads privacy-safe signals (publisher, newsletter, placement, hashed email, segment, context) and returns the most relevant banner. A click is tracked and redirects to the advertiser.

    Is email newsletter advertising the same as normal web RTB?

    No. Web RTB relies on JavaScript , GPT tags, Prebid.js, header bidding, cookies, and client-side auctions. Email blocks most of that, so newsletter advertising is usually image-rendered. It can still be programmatic with demand rules, private deals, priority, and DMP segments , within email's limits.

    Read the current references

    Read the identity and privacy guide for the broader decision framework.

    FAQ

    Is Google still getting rid of third-party cookies?
    No. On 22 April 2025 Google said Chrome would keep its current third-party cookie settings and would not introduce a standalone prompt (Privacy Sandbox blog, 22 April 2025). The CMA released Google's commitments on 17 October 2025 and closed its case (CMA). Incognito still blocks third-party cookies, and users can block them in settings.
    What Privacy Sandbox APIs still exist?
    CHIPS (partitioned cookies, Chrome 114+), FedCM (Chrome 108+) and Private State Tokens continue; the Storage Access API (Chrome 119+) is also supported. Topics, Protected Audience, Attribution Reporting, Private Aggregation, Shared Storage, SelectURL and Related Website Sets were retired on 17 October 2025, deprecated in Chrome 144 (13 January 2026) and set for removal in Chrome 150 (30 June 2026) (Privacy Sandbox status page, updated 14 August 2026; Chromium Dash).
    What is the difference between UID2 and EUID?
    Both are open-source frameworks that turn a hashed email or phone into a rotating token, and both have a public operator run by The Trade Desk plus a private-operator option. UID2's consent model follows US state law such as the CCPA; EUID's is "driven by the General Data Protection Regulation" and the IAB TCF, with a Transparency and Control Portal for opt-out, and it uses a separate namespace (EUID docs). EU and UK publishers use EUID.
    Is ID5 better than UID2?
    They are different tools. UID2 and EUID are deterministic and need an email or phone, so they work on authenticated traffic. ID5 links publisher signals and hashed emails where present with probabilistic methods, so it reaches unauthenticated pages; Sincera counted it on about 100,000 sites in January 2025, a vendor-selected figure (PPC Land, 22 August 2026). Most stacks pass both in user.eids and let the bidder weigh them.
    Do universal IDs comply with GDPR?
    They can, if the controller has a lawful basis for the hashed identifier and the token, passes a valid TCF signal, and can prove it. The CJEU held on 7 March 2024 that a consent string is itself personal data (CJEU C-604/22), and the Norwegian DPA's October 2026 Xandr decision found that a platform cannot rely on another party's consent (EDPB, 16 October 2026). Compliance is a property of your consent records and contracts, not of the ID format.

    How this works on owned infrastructure

    An email advertising evaluation of AdSovereign should preserve the constraints of the newsletter placement. Identify when an image request occurs, what the email client can render and which signals are actually available, then compare that flow with the architecture. Confirm the delivery interface and reporting scope during discovery rather than assuming a browser auction can be copied unchanged. Review recipient data and tracking boundaries through the security assessment. A deployment review should inspect rendering, fallback behavior and reconciled counts across representative clients. Keep proxy or cached image requests separate from claims about human attention, identity or advertiser outcomes.

    Component licensing, inclusions and payment terms are published on the pricing page.

    Sources

    1. Chromium Blog, "Building a more private web: A path towards making third party cookies obsolete" (14 January 2020). https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html
    2. Google, "An updated timeline for Privacy Sandbox milestones" (24 June 2021). https://blog.google/products/chrome/updated-timeline-privacy-sandbox-milestones/
    3. Google, "Expanding testing for the Privacy Sandbox for the Web" (27 July 2022). https://blog.google/products/chrome/update-testing-privacy-sandbox-web/
    4. Google, "The next step toward phasing out third-party cookies in Chrome" (14 December 2023). https://blog.google/products/chrome/privacy-sandbox-tracking-protection/
    5. Privacy Sandbox, "Update on the plan for phase-out of third-party cookies on Chrome" (23 April 2024). https://privacysandbox.google.com/blog/update-on-the-plan-for-phase-out-of-third-party-cookies-on-chrome
    6. Privacy Sandbox, "A new path for Privacy Sandbox on the web" (22 July 2024). https://privacysandbox.google.com/blog/privacy-sandbox-update
    7. Privacy Sandbox, "Next steps for Privacy Sandbox and tracking protections in Chrome" (22 April 2025). https://privacysandbox.google.com/blog/privacy-sandbox-next-steps
    8. Privacy Sandbox, "Update on Plans for Privacy Sandbox Technologies" (17 October 2025). https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies
    9. Privacy Sandbox, "Feature status" (last updated 14 August 2026). https://privacysandbox.google.com/overview/status
    10. blink-dev, "Intent to Deprecate and Remove: Topics API" (7 November 2025; LGTM 12 November 2025; status update 11 June 2026). https://groups.google.com/a/chromium.org/g/blink-dev/c/_R85yctz4Rs
    More sources (27)
    1. Chromium Dash, milestone schedule M144 (stable 13 January 2026). https://chromiumdash.appspot.com/fetch_milestone_schedule?mstone=144
    2. Chromium Dash, milestone schedule M150 (stable 30 June 2026). https://chromiumdash.appspot.com/fetch_milestone_schedule?mstone=150
    3. UK Competition and Markets Authority, "Investigation into Google's Privacy Sandbox browser changes" (case page; commitments released 17 October 2025). https://www.gov.uk/cma-cases/investigation-into-googles-privacy-sandbox-browser-changes
    4. PPC Land, "Chrome kills most Privacy Sandbox technologies after adoption fails" (18 October 2025). https://ppc.land/chrome-kills-most-privacy-sandbox-technologies-after-adoption-fails/
    5. WebKit, "Full Third-Party Cookie Blocking and More" (24 March 2020). https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/
    6. Mozilla, "Firefox rolls out Total Cookie Protection by default to all users worldwide" (14 June 2022). https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users/
    7. StatCounter, "Browser Market Share Worldwide" (September 2026). https://gs.statcounter.com/browser-market-share
    8. Apple Developer, "User Privacy and Data Use" (App Tracking Transparency). https://developer.apple.com/app-store/user-privacy-and-data-use/
    9. UID2 documentation, "Public and Private Operators". https://unifiedid.com/docs/ref-info/ref-operators-public-private
    10. UID2, homepage with partner announcements (2022 to 2025). https://unifiedid.com/
    11. EUID documentation, "EUID Overview" (last updated 12 October 2026). https://euid.eu/docs/intro
    12. EUID documentation, "Public and Private Operators". https://euid.eu/docs/ref-info/ref-operators-public-private
    13. The Current, "EUID adoption spreads across the programmatic supply chain" (25 November 2024). https://www.thecurrent.com/marketing/euid-adoption-programmatic-supply-chain-ssps-publishers
    14. AdExchanger, "Alternative Identity Provider ID5 Nabs $20 Million In Series B Funding" (9 April 2024). https://adexchanger.com/identity/alternative-identity-provider-id5-nabs-20-million-in-series-b-funding
    15. PPC Land, "Explaining ID5" (22 August 2026, clarified 5 September 2026). https://ppc.land/explaining-id5/
    16. Business Wire, "ID5's 2025 State of Digital Identity Report Finds Usage of Alternatives Growing" (29 September 2025; returned 403 to the fetcher, figures from search index). https://www.businesswire.com/news/home/20250929910958/en/
    17. PPC Land, "The Trade Desk integrates Utiq's telco identity signals across EMEA" (1 June 2026; Utiq figures as of 15 November 2025). https://ppc.land/the-trade-desk-integrates-utiqs-telco-identity-signals-across-emea/
    18. Mobile Marketing Magazine, "Utiq now reaches over 55 million people across Europe" (2025). https://mobilemarketingmagazine.com/utiq-now-reaches-over-55-million-people-across-europe/
    19. Utiq, homepage (consent description). https://utiq.com/
    20. CJEU, Case C-604/22, IAB Europe v Gegevensbeschermingsautoriteit (7 March 2024). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0604
    21. EDPB, "Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data" (16 October 2026; decision 2 October 2026). https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en
    22. EDPB, "EDPB: 'Consent or Pay' models should offer real choice" (17 April 2024; Opinion 08/2024). https://www.edpb.europa.eu/news/news/2024/edpb-consent-or-pay-models-should-offer-real-choice_en
    23. European Commission, "Commission finds Apple and Meta in breach of the Digital Markets Act" (23 April 2025). https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085
    24. IAB Europe, "TCF v2.2" (launched 16 May 2023; deadline 20 November 2023). https://iabeurope.eu/tcf-2-2/
    25. IAB Europe, "Transparency & Consent Framework" (v2.3 launched April 2025; deadline 28 February 2026). https://iabeurope.eu/transparency-consent-framework/
    26. IAB Tech Lab, press releases (GPP updates and DDRF v2, 23 October 2025; privacy standards portfolio update, 11 August 2026). https://iabtechlab.com/press-releases/
    27. IAB Tech Lab, OpenRTB 2.6 specification (user.eids). https://raw.githubusercontent.com/InteractiveAdvertisingBureau/openrtb2.x/main/2.6.md