AdSovereign logo

    In-House Programmatic

    DSP RFP Template: 60 Questions and a Scoring Sheet

    Published · Last updated
    Next scheduled review:

    By Art Kukharenko

    DSP RFP Template: 60 Questions and a Scoring Sheet

    This DSP RFP template gives you 60 questions in ten groups, each with why it matters and the answer that should worry you, plus a scoring sheet with group weights, a 1-to-5 scale and pass/fail gates. It is written for a Head of Programmatic running a platform selection with procurement, legal and security in the room.

    Key facts

    • Less than half of a programmatic dollar becomes a qualified impression. The ANA's 2023 study found "only 36 cents of every dollar that enters a demand-side platform (DSP) effectively reaches the consumer" (ANA, 5 December 2023); its Q2 2026 benchmark put the market at 45.1%, with 27.2% going to transaction costs (ANA Q2 2026 benchmark, 6 August 2026).
    • The gap between buyers is the RFP's job. In Q1 2026 higher-performing advertisers converted 54.0% of spend into qualified impressions against 32.1% for lower performers, a 21.9-point gap, and the ANA's conclusion was that "quality, not cost, is the primary differentiator" (ANA, 27 May 2026).
    • Fees are not uniform. Adalytics found one SSP charging a single publisher "anywhere from 7-42%" on the same site with the same buyer and DSP (ExchangeWire, 16 September 2026).
    • Platforms close. Microsoft announced on 14 May 2025 that Microsoft Invest would shut on 28 February 2026 (PPC Land, 22 June 2025).
    • Logs expire unless you say otherwise. DV360's Data Transfer files are delivered hourly and deleted after 60 days (Google, updated 14 October 2024); Amazon Marketing Cloud returns "only ... aggregated, anonymous outputs" (Amazon Ads, accessed 17 October 2026).
    • In the EU, exit terms have a legal floor. The Data Act caps the switching notice period at two months, sets a 30-day transition and prohibits switching charges from 12 January 2027 (Regulation (EU) 2023/2854, Articles 25 and 29).

    Definition

    DSP RFP (request for proposal): a structured questionnaire and scoring process an advertiser, agency or media owner uses to select a demand-side platform, covering commercial terms, data rights, log access, identity, supply, safety, measurement, decisioning, security and exit, so that the answers can be compared on the same scale and written into the contract.

    The template below is the questionnaire. The scoring sheet is the comparison. For where a DSP sits in the auction chain the questions refer to, see RTB architecture explained. The contract is where the winning answers go, which is why every question has a red-flag answer: a red flag is an answer you must not sign. For the fee mechanics behind many of the questions, see DSP pricing explained and the ad tech tax explained; for the context, the in-house programmatic hub.

    How to run the RFP

    1. Shortlist by model before you shortlist by vendor. Decide whether you are buying a managed seat, a white-label platform, a bidder-as-a-service or a self-hosted deployment; the questions in groups B, C and J read differently for each. Bidder-as-a-service vs white-label vs self-hosted DSP is the comparison.
    2. Send the questionnaire under NDA with a fixed answer format. One sheet, one row per question, free text capped, evidence links required. Vendors that answer in a deck are telling you how they will answer audit questions later.
    3. Score blind, then reconcile. Two scorers per group, scoring independently on the 1-to-5 scale below, then a reconciliation call. Pass/fail gates are applied before any weighting.
    4. Run the three proof tests on the top two. A log-level sample, a fee reconciliation and an exit drill (described below). An RFP answer is a claim; a proof test is evidence.
    5. Take references on the red flags, not the strengths. Ask the reference what happened at renewal, at an incident, and at exit.
    6. Write the scored answers into the contract. Fee schedule, log specification, retention, data ownership, sunset clause and export format are exhibits, not emails.

    How to use the scoring sheet

    Each question is scored 1 to 5. Each group has a weight, and the ten weights sum to 100. The group score is the mean of its six question scores divided by 5 and multiplied by the group weight; the total is the sum of group scores, out of 100. Six questions are pass/fail gates: a "fail" on any of them removes the vendor regardless of total. The threshold for a shortlist is 70; the threshold for a contract is 75 plus a clean proof test.

    Scale. 5: answered fully, with evidence, and the term is offered in writing. 4: answered fully, evidence provided, term negotiable. 3: answered, no evidence, or term available at extra cost. 2: partial or evasive answer. 1: refused, or the red-flag answer given.

    Weights.

    10 of 10 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    A. Commercials and fees

    15

    Transaction costs were 27.2% of spend in Q2 2026 (ANA Q2 2026 benchmark, 6 August 2026); this is the biggest controllable line

    B. Data ownership and portability

    15

    Everything in groups C, G and J depends on it

    C. Log-level data

    12

    The ANA's working-media findings exist only because 21 advertisers had log access (ANA, 5 December 2023)

    D. Identity

    8

    Addressability and consent; changes with regulation

    E. Inventory and supply path

    10

    Higher performers used about 19,000 fewer domains and apps than lower performers in Q2 2026 (ANA Q2 2026 benchmark, 6 August 2026)

    F. Brand safety and fraud

    8

    Non-viewable spend 10.1%, IVT 0.1%, MFA 1.1% are the baselines to beat (ANA Q2 2026 benchmark; ANA, 27 May 2026)

    G. Measurement

    10

    Without independent measurement, performance claims are the vendor's

    H. AI and bidding transparency

    7

    Growing: AI agents are in test at major sellers (Netflix, 13 May 2026)

    I. Security and compliance

    8

    Mostly pass/fail; weight reflects the residual

    J. Exit terms

    7

    Microsoft Invest gave buyers nine and a half months (PPC Land, 22 June 2025)

    Pass/fail gates: Q7 (data ownership), Q13 (log-level data available), Q49 (current SOC 2 Type II or ISO 27001), Q50 (DPA and subprocessor list), Q56 (sunset clause), Q57 (export at exit in documented formats).

    Worked example. A vendor scores a mean of 4.0 in group A (15 × 4.0 ÷ 5 = 12.0), 3.5 in group B (10.5), 2.5 in group C (6.0), 4.0 in D (6.4), 3.0 in E (6.0), 4.0 in F (6.4), 3.0 in G (6.0), 2.0 in H (2.8), 4.5 in I (7.2) and 3.0 in J (4.2): total 67.5, below the shortlist line, driven by logs and AI transparency. A second vendor with weaker commercials (3.0, 9.0) but logs at 4.5 (10.8) and the same elsewhere scores 69.3. Neither clears 70 without negotiation, which is the point: the sheet tells you what to negotiate.

    The 60 questions

    Paste the tables into your RFP as they stand, or download the CSV. Each row has the question, why it matters and the answer that should worry you.

    A. Commercials and fees

    6 of 6 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    1

    List every fee you charge us, by type (platform, data, measurement add-on, managed service, creative, API, seat) and by basis (percent of media, CPM, flat), with the counterparty for each.

    Transaction costs took about 29% of each programmatic dollar in the ANA's 2023 study and 27.2% in Q2 2026 (Katten on ANA, 7 December 2023; ANA Q2 2026 benchmark, 6 August 2026).

    "Our fee is X% all-in" with no line items.

    2

    Do you receive any payment, rebate, discount or data from supply partners, data partners or measurement partners that is linked to our spend? Disclose amount and basis.

    Undisclosed sell-side income changes which inventory the platform prefers.

    "We do not disclose partner arrangements."

    3

    Will each invoice show media cost, every fee line and the working-media ratio per campaign, reconcilable to logs?

    The ANA benchmark is built on exactly this reconciliation (ANA Q2 2026 benchmark, 6 August 2026).

    A single total per campaign.

    4

    State all minimum commitments, overage charges, escalators and auto-renewal terms.

    Minimums convert a usage fee into a fixed cost; escalators compound.

    Minimums with no pro-rata exit; auto-renewal with more than 60 days' notice.

    5

    What do you charge for log-level data, API access, additional seats and clean-room connectors?

    Add-ons are where "all-in" pricing leaks.

    Logs or API priced as a percentage of spend.

    6

    How do fees change when we bring our own data, our own supply deals, or our own measurement?

    A platform fee on your own deals is a toll on work you did.

    Fee applies to everything that flows through regardless of source.

    B. Data ownership and portability

    6 of 6 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    7 (pass/fail)

    Who owns (a) the data we upload, (b) the data our campaigns generate (bids, wins, impressions, clicks, conversions) and (c) the derived data (models, segments)?

    Ownership decides every later question about logs, exit and training.

    Platform owns or has unrestricted use of (b) or (c).

    8

    Can we export all audiences, conversions, deals and campaign settings in documented, machine-readable formats at any time, without a service request?

    Export on request is export on the vendor's timetable; Microsoft Invest gave nine and a half months (PPC Land, 22 June 2025).

    "Available on request within 90 days."

    9

    Do you use our data to train models, build benchmarks or create segments used by other clients? Is there an opt-out, and is it the default?

    Your outcomes become a competitor's optimization signal.

    Yes by default, no opt-out.

    10

    Where is our data stored and processed, by region, and can we require a single region (EU-only, US-only)?

    Residency obligations under GDPR and sector rules; see the ad tech compliance hub.

    "Global; we cannot commit to a region."

    11

    At termination, what is deleted, when, and do you certify deletion?

    Retained data is liability without benefit.

    No deletion timeline or certificate.

    12

    Can we keep raw event data in our own storage or clean room rather than yours?

    Keeps the primary copy under your control; see clean rooms vs CDP.

    Not supported.

    C. Log-level data

    6 of 6 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    13 (pass/fail)

    Do you provide impression-level logs covering bids, wins, losses, impressions, clicks and conversions, with auction price, fee, seller ID, supply path (schain) and deal ID?

    Only 21 of 67 advertisers who wanted to join the ANA study could supply log-level data (ANA, 5 December 2023).

    Aggregated reporting only, or logs restricted to an enterprise tier.

    14

    What are the delivery format, cadence and retention?

    DV360 delivers hourly and deletes after 60 days (Google, updated 14 October 2024); you need an archive before the window closes.

    Retention under 90 days with no archive option.

    15

    Do logs show the fee taken on each impression and the price paid to the seller, separately?

    Gross and net in one field hides the toll.

    One price field, labelled "gross".

    16

    Do logs include lost auctions, bid-shading adjustments and the reason a bid was not placed?

    Win-only logs cannot show what the algorithm did with your budget.

    Wins only.

    17

    Can logs be delivered to our cloud bucket or warehouse at no additional per-row or egress fee?

    Per-row fees make audit proportional to scale.

    Per-row or per-GB charges for your own data.

    18

    Are the logs billing-grade: can we reconcile them to the invoice at campaign and day level?

    Reconciliation is the only check on question 1.

    "Logs are indicative, not billing-grade."

    D. Identity

    6 of 6 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    19

    Which identifiers do you support for targeting and measurement: mobile advertising IDs, CTV device IDs, publisher first-party IDs, hashed email IDs, industry IDs and the OpenRTB eids array?

    OpenRTB 2.6 formalised extended identifiers and deprecated hashed device IDs (PPC Land, 29 September 2026).

    Cookie-centric, no CTV or publisher ID support.

    20

    Do you operate your own identity graph or license one? Define your match rate and its denominator.

    A match rate without a denominator is marketing.

    "Proprietary graph; match rates are confidential."

    21

    How do you read and enforce consent signals: IAB Europe TCF v2.3, GPP strings, Global Privacy Control?

    TCF v2.3 launched April 2025 with adoption by 28 February 2026 (IAB Europe); GPP carries US state strings (IAB Tech Lab).

    "We pass through whatever we receive" with no enforcement.

    22

    Can our first-party identifiers be matched and activated without the raw IDs leaving our environment?

    Clean-room matching keeps the primary data inside your perimeter.

    Upload-only.

    23

    What happens to addressability if an identity provider changes terms or shuts down?

    Dependence on one ID is the same risk as dependence on one DSP.

    No fallback described.

    24

    Do you support household and cross-device frequency capping, including CTV?

    Frequency is where waste hides; P&G's Pritchard named cross-media frequency capping as the next step (Beet.TV, 28 October 2024).

    Per-channel caps only.

    E. Inventory and supply-path optimization

    6 of 6 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    25

    List integrated exchanges and SSPs, and the share of our likely spend that would be direct versus resold.

    Resold paths add fees; Adalytics found 7–42% on one site (ExchangeWire, 16 September 2026).

    Cannot distinguish direct from resold.

    26

    Do you enforce ads.txt, app-ads.txt and sellers.json, and do you pass and store the SupplyChain object?

    Both standards were finalized on 31 July 2019 (IAB Tech Lab); non-enforcement is a choice.

    No enforcement, or enforcement "advisory".

    27

    What QPS do you accept from each exchange, how do you shape traffic, and which requests do we never see?

    DSPs cap QPS per SSP, typically 1 to 3 million in total (Index Exchange, accessed 17 October 2026); what is filtered out is invisible to you. See QPS, latency and bid performance.

    Cannot describe the policy.

    28

    Can we set and audit supply-path rules: preferred paths, fee caps, resold exclusion, made-for-advertising exclusion?

    MFA exposure was 1.1% of spend in Q1 2026 (ANA, 27 May 2026).

    "Optimization is proprietary."

    29

    Do you operate an SSP, exchange or direct publisher paths of your own, and how is that disclosed in reporting?

    A platform that owns both sides has a conflict it must disclose.

    Owned supply not flagged in reports.

    30

    Can we bring our own deal IDs and curated packages at no markup?

    Your deals are your work.

    Markup applied to your deals.

    F. Brand safety and fraud

    6 of 6 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    31

    Which pre-bid fraud and brand-safety vendors are integrated, at what cost, and can we bring our own?

    Pre-bid blocks waste before it is bought; a builder budgets $5,000–$10,000 a month for these vendors (Geomotiv, 5 May 2026).

    Post-bid only.

    32

    Do you report invalid traffic, viewability and MFA share by supply path and seller?

    The market baselines are 0.1% IVT and 10.1% non-viewable (ANA Q2 2026 benchmark, 6 August 2026); you need to know where you sit.

    Aggregated across all supply.

    33

    What is your made-for-advertising policy: list-based, classifier-based, or none?

    MFA is the largest avoidable loss the ANA identified.

    No policy.

    34

    Are IVT refunds automatic and shown on invoices?

    Credits-on-dispute means you pay for what you did not catch.

    Credits only on dispute.

    35

    How do you detect and discard duplicate bid requests for the same impression?

    SSPs send some traffic "three times" (AdExchanger, 17 January 2024).

    No deduplication.

    36

    Can we apply inclusion and exclusion lists at campaign and seat level, with change logs?

    Lists without logs cannot be audited.

    Seat level only, no history.

    G. Measurement

    6 of 6 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    37

    Which independent measurement, incrementality and MMM providers are supported natively, and at what cost?

    Independent measurement is the check on the platform's own attribution.

    Only the platform's attribution.

    38

    Do you support a server-side conversion API with our own keys and our own event schema?

    Server-side events are now standard on major sellers; Netflix launched its Conversion API on 4 March 2026 (PPC Land, 6 March 2026).

    Pixel-only.

    39

    Can we export exposure logs to our clean room for independent attribution?

    Amazon Marketing Cloud, for example, returns only aggregated outputs (Amazon Ads, accessed 17 October 2026); know what you will and will not get.

    Not supported.

    40

    Which reported metrics are accredited by the Media Rating Council, and which are not?

    Accreditation separates audited metrics from dashboards.

    None, and no roadmap.

    41

    How do you report reach and frequency across channels, including CTV, and against what panel or census source?

    Cross-media measurement is the industry's stated gap (Marketing Dive, 27 March 2026).

    Per-channel only.

    42

    How are discrepancies between your reporting and our ad server investigated and settled?

    Discrepancies are where fees hide.

    "Our numbers are the numbers."

    H. AI and bidding transparency

    6 of 6 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    43

    Describe the bid-price and bid-shading algorithm: inputs, objective, and whether it optimizes for our KPI or for platform margin.

    A bidder that answers in milliseconds still has an objective function; you are entitled to know it.

    "Proprietary; no detail."

    44

    Can we turn automated optimization off, set our own bid logic, or bring our own model?

    Bidder-as-a-service vendors accept customer agents with a 10 ms timeout (FreeWheel docs, updated 12 August 2026); managed DSPs should at least allow custom bidding.

    No.

    45

    Are automated bid adjustments logged per impression with the reason code?

    Without reason codes, optimization cannot be audited against question 16.

    Not logged.

    46

    For AI agents or autonomous buying features: what approvals, spend limits, guardrails and audit trails exist, and can we disable them?

    Netflix is testing AI agents to "manage, optimize, and purchase ads" (Netflix, 13 May 2026); one agency told Digiday it does not trust LLM-based agents with activations (Digiday, 9 February 2026).

    No human approval step; cannot be disabled.

    47

    Do you train shared models on our campaign data, and can we opt out without losing features?

    Repeats question 9 for the decisioning layer.

    Opt-out removes optimization.

    48

    How do you substantiate performance claims: holdouts, incrementality, or last-touch?

    Last-touch attributes outcomes the platform did not cause.

    Last-touch only.

    I. Security and compliance

    6 of 6 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    49 (pass/fail)

    Provide current SOC 2 Type II or ISO 27001 reports under NDA, with audit dates and scope.

    Enterprise minimum; see PCI, HIPAA and SOC 2 for ad tech.

    None, expired, or scope excludes the bidding platform.

    50 (pass/fail)

    Provide your GDPR Article 28 data processing agreement, subprocessor list and international transfer mechanism.

    Without a DPA you are the controller with no processor terms.

    No subprocessor list.

    51

    How do you handle sector-restricted data (health, financial, children's) and which controls apply?

    HIPAA, GLBA and state health-privacy laws reach ad tech; the compliance hub tracks them.

    "We do not process sensitive data" with no controls.

    52

    What are your incident-response SLA and breach-notification time to us?

    GDPR's 72-hour regulator clock starts with your awareness, which depends on theirs.

    More than 72 hours, or undefined.

    53

    Describe access controls: SSO, role-based permissions, audit logs for every change to campaigns and settings.

    Shared logins defeat question 36.

    Shared logins; no audit log.

    54

    What is your penetration-test cadence and vulnerability-disclosure process?

    A bidder is an internet-facing system taking millions of requests a second.

    None, or undisclosed.

    J. Exit terms

    6 of 6 rows

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    55

    What are the termination-for-convenience notice period and any termination fees?

    In the EU the Data Act caps the switching notice period at two months for data-processing services (Regulation (EU) 2023/2854, Article 25).

    Twelve-month lock-in with penalties.

    56 (pass/fail)

    If you discontinue the platform, what minimum notice do you commit to, and what export support is included?

    Microsoft Invest: announced 14 May 2025, closed 28 February 2026 (PPC Land, 22 June 2025). See life after Microsoft Invest.

    No sunset clause.

    57 (pass/fail)

    At exit, will you deliver full logs, audiences, settings, creatives and deals in documented formats within 30 days?

    The Data Act's mandatory transition period is 30 calendar days, extendable to seven months only if technically unfeasible (Regulation (EU) 2023/2854, Article 25).

    PDF reports; or "professional services required".

    58

    What switching, egress or export charges apply at exit?

    From 12 January 2027 EU providers of data-processing services may not impose switching charges; until then charges are capped at cost (Regulation (EU) 2023/2854, Article 29).

    Per-GB egress or unpriced "export services".

    59

    What are our rights on change of control: can we terminate without penalty, and do our data terms survive?

    Platforms are bought and sold; terms should not change with the owner.

    Assignment without consent.

    60

    For white-label or self-hosted deployments: is source code in escrow, and what triggers release?

    Continuity if the vendor fails; see how to build a DSP platform for what you would be taking over.

    No escrow.

    Three proof tests before you sign

    Log-level sample. Ask the top two vendors for seven days of impression-level logs from a test campaign, delivered to your storage. Check that questions 13 to 18 hold: price and fee separated, losses present, reason codes present, totals matching the invoice. A vendor that cannot do this in an evaluation will not do it under contract.

    Fee reconciliation. Take one month of a reference client's invoices (with the reference's consent) or your own test spend, and rebuild the fee stack from question 1 line by line. The number to compare is working media as the ANA defines it; the Q2 2026 market figure is 45.1% (ANA Q2 2026 benchmark, 6 August 2026).

    Exit drill. Request a full export as if terminating. Time it, open the files, load the audiences into a second platform or a warehouse. Question 57's 30 days is a legal floor in the EU (Regulation (EU) 2023/2854, Article 25); in an evaluation, five working days is a reasonable bar.

    What this template does not do

    It does not pick the model for you. A managed seat, a white-label platform, a bidder-as-a-service and a self-hosted deployment answer the same 60 questions very differently, and the right answer depends on spend, team and data constraints; bidder-as-a-service vs white-label vs self-hosted DSP and how to build a DSP platform cover that. It does not replace a security questionnaire; group I is the minimum, and your security team will have its own. And it does not tell you what the large advertisers did; what Netflix, Lego and P&G built in-house does, and the broader trend is in brands bringing programmatic in-house.

    FAQ

    What should a DSP RFP include? Ten groups: commercials and fees, data ownership and portability, log-level data, identity, inventory and supply path, brand safety and fraud, measurement, AI and bidding transparency, security and compliance, and exit terms. The groups with the highest weight in this template are fees and data ownership, because transaction costs were 27.2% of programmatic spend in Q2 2026 (ANA Q2 2026 benchmark, 6 August 2026) and every other group depends on who owns the data.

    How do you evaluate a DSP? Score each answer 1 to 5, apply pass/fail gates first, weight the groups, and then run proof tests on the top two: a log-level sample, a fee reconciliation and an exit drill. The ANA's Q1 2026 benchmark found a 21.9-point gap in qualified-impression share between higher- and lower-performing advertisers and concluded that "quality, not cost, is the primary differentiator" (ANA, 27 May 2026); the evaluation should measure quality the same way.

    What is log-level data and why ask for it in an RFP? Log-level data is the impression-by-impression record of what was bid, won, served and paid, including the price, the fee, the seller and the supply path. The ANA's finding that "only 36 cents of every dollar that enters a demand-side platform (DSP) effectively reaches the consumer" was built on log-level data from 21 advertisers, a subset of the 67 that wanted to take part (ANA, 5 December 2023). Large platforms set their own terms for it: DV360 delivers hourly files and deletes them after 60 days (Google, updated 14 October 2024). The RFP is where you set yours.

    How long should a DSP RFP take? Plan for eight to twelve weeks from questionnaire to signed contract: two weeks for vendor answers, two for blind scoring and reconciliation, three to four for proof tests and references, and the remainder for contract exhibits. The constraint that sets the outer bound is the exit of your current platform: Microsoft gave Invest customers from 14 May 2025 to 28 February 2026 (PPC Land, 22 June 2025), and a migration has to fit inside whatever window you are given.

    Should the RFP ask about AI bidding? Yes, and group H is where. Every DSP already optimizes bids with models; the new questions are about autonomous agents that plan and buy. Netflix said in May 2026 it is testing AI agents to "manage, optimize, and purchase ads" (Netflix, 13 May 2026), and at least one agency told Digiday it does not trust LLM-based agents with programmatic activations (Digiday, 9 February 2026). Ask for approvals, spend limits, audit trails and an off switch, and score the vendor on whether it can explain the objective function, not on whether it uses AI.

    How this works on owned infrastructure

    Most of the red-flag answers above exist because the platform, not the buyer, holds the data and the code. AdSovereign is an enterprise RTB stack (DSP, SSP, exchange, DMP and clean room) deployed on-premise or in the customer's own cloud account, so questions 7 to 18 and 55 to 60 have structural answers: the logs are yours because they are written to your storage, there is no percentage-of-spend fee, and exit is a matter of keeping the deployment running. We publish our own answers to this template on request as part of the pilot process. The architecture page describes the deployment, security covers group I, and integrations lists the exchanges and vendors behind groups E and F. The template itself is neutral; the product is mentioned only here.

    Sources

    1. ANA, Programmatic Media Supply Chain Transparency Study, complete report (5 December 2023). https://ana.net/programmatic
    2. Katten, "ANA Study Finds Over $20 Billion in Efficiency Gains Possible in Programmatic Advertising" (7 December 2023). https://quickreads.ext.katten.com/post/102iufy/ana-study-finds-over-20-billion-in-efficiency-gains-possible-in-programmatic-a
    3. ANA, "ANA Programmatic Transparency Benchmark Reveals Widening Gap Between Top and Bottom Advertisers", Q1 2026 (27 May 2026). https://www.ana.net/content/show/id/pr-2026-05-programmatic
    4. ANA Programmatic Transparency Benchmark, Q2 2026 findings, release reprinted by Fiducia (6 August 2026). https://www.fiducia.eco/post/ana-programmatic-transparency-benchmark-q2-2026-working-media-efficiency-reaches-a-record-45
    5. ExchangeWire, "The Ad Tech Toll Road" (16 September 2026). https://www.exchangewire.com/blog/2026/09/16/the-ad-tech-toll-road/
    6. MediaPost, "Microsoft To Shutter DSP, Formerly Xandr" (14 May 2025). https://www.mediapost.com/publications/article/405873/microsoft-to-shutter-dsp-formerly-xandr-replace.html
    7. PPC Land, "Microsoft's Xandr DSP closure opens doors for independent players" (22 June 2025). https://ppc.land/microsofts-xandr-dsp-closure-opens-doors-for-independent-players/
    8. Google for Developers, "Display & Video 360 Data Transfer v2 overview" (updated 14 October 2024). https://developers.google.com/bid-manager/dtv2/overview
    9. Amazon Ads, "Amazon Marketing Cloud" (accessed 17 October 2026). https://advertising.amazon.com/solutions/products/amazon-marketing-cloud
    10. Google for Developers, Real-time Bidding, "Testing and Releasing Your Application" (accessed 17 October 2026). https://developers.google.com/authorized-buyers/rtb/test-guide
    11. Google for Developers, Real-time Bidding, "Latency Restrictions and Peering" (accessed 17 October 2026). https://developers.google.com/authorized-buyers/rtb/get-started/peer-guide
    12. IAB Tech Lab, OpenRTB 2.6 specification, GitHub (accessed 17 October 2026). https://github.com/InteractiveAdvertisingBureau/openrtb2.x/blob/main/2.6.md
    13. PPC Land, "Explaining OpenRTB" (29 September 2026). https://ppc.land/openrtb/
    14. IAB Tech Lab, "sellers.json and SupplyChain Object" (finalized 31 July 2019). https://iabtechlab.com/sellers-json/
    15. IAB Europe, "Transparency & Consent Framework" (TCF v2.3, launched April 2025; adoption by 28 February 2026). https://iabeurope.eu/transparency-consent-framework/
    16. IAB Tech Lab, "Global Privacy Platform" (updated 12 August 2026). https://iabtechlab.com/gpp/
    17. Index Exchange, "QPS Optimization in Programmatic" (accessed 17 October 2026). https://www.indexexchange.com/index-explains/qps-optimization-programmatic/
    18. AdExchanger, "Attack Of The Clones: Programmatic's Hidden Scourge Of Bid Duplication" (17 January 2024). https://www.adexchanger.com/platforms/attack-of-the-clones-programmatics-hidden-scourge-of-bid-duplication/
    19. Geomotiv, "How to Build Your Own DSP: Step-by-Step Guide" (5 May 2026). https://geomotiv.com/blog/how-to-build-your-own-dsp-step-by-step-guide-to-building-a-custom-demand-side-platform/
    20. FreeWheel Advertiser API docs, "Bidding Agent" (updated 12 August 2026). https://api-docs.freewheel.tv/advertiser/docs/bidding-agent
    21. Netflix, "Netflix Upfront 2026: Get Closer" (13 May 2026). http://about.netflix.com/en/news/netflix-upfront-2026-get-closer
    22. PPC Land, "Netflix Ads gets Amazon audiences, Yahoo signals, and its own conversion API" (6 March 2026). https://ppc.land/netflix-ads-gets-amazon-audiences-yahoo-signals-and-its-own-conversion-api/
    23. Digiday, "The case for and against bringing programmatic in-house" (9 February 2026). https://digiday.com/media-buying/the-case-for-and-against-bringing-programmatic-in-house/
    24. Beet.TV, "P&G's Marc Pritchard on Addressing the Complexities in the Advertising Industry" (28 October 2024). https://www.beet.tv/2024/10/pgs-marc-pritchard-on-addressing-the-complexities-in-the-advertising-industry.html
    25. Marketing Dive, "P&G's Pritchard on how brands must navigate a new epoch in marketing" (27 March 2026). https://www.marketingdive.com/news/pgs-pritchard-on-how-brands-must-navigate-a-new-epoch-in-marketing/815940/
    26. Regulation (EU) 2023/2854 (Data Act), Articles 25, 29 and 50, EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854
    27. European Commission, "Data Act" policy page (entry into force 11 January 2024, application 12 September 2025). https://digital-strategy.ec.europa.eu/en/policies/data-act

    Changelog

    • 18 October 2026: aligned the title and heading and applied recorded source-URL corrections where needed. Factual research cutoff remains 17 October 2026.

    • 17 October 2026. Template version 1.0: 60 questions in 10 groups, 6 pass/fail gates, weights summing to 100, three proof tests. Next review 15 January 2027.

    What to read next

    Continue with the in-house programmatic reference guide.