Third Party Ad Serving: A Cyber Security Expert‘s Perspective

As a cyber security professional with over a decade of experience securing cloud data, I‘ve seen the digital advertising ecosystem evolve rapidly – and not always in a good direction when it comes to privacy and security. Third party ad serving is a key part of this system that presents some unique risks and challenges that every advertiser, publisher and user should be aware of.

In this in-depth guide, I‘ll explain exactly how third party ad serving works, analyze the key privacy and security issues, and share my expert perspective on where things are headed in the coming years.

How Third Party Ad Serving Works

At a basic level, third party ad serving allows advertisers to display ads on websites they don‘t own through an intermediary ad network or exchange. The process works like this:

Publishers add ad tags from third party ad platforms to their sites
User browsers load site content from publisher and ads from third party
Ad server uses cookies and other signals to pick targeted ads
Ad server delivers ad creative and tracking tags
User browser displays ads and tracking tags fire to count impressions, clicks, etc.

The key technical enabler is the use of third party cookies which allow ad servers to uniquely identify users across different sites. These cookies can track user behavior over time to build up a profile used for ad targeting.

Here‘s an example of what data a third party cookie from an ad server might contain:

{
  "user_id": "abc123",
  "age": 30, 
  "gender": "male",
  "interests": ["sports", "travel", "tech"],
  "browsing_history": [
    "sportssite.com/article1",  
    "travelsite.com/hotels",
    "techblog.com/gadgets-review"
  ],
  "ads_seen": {
    "campaignA": 3,
    "campaignB": 1
  }
}

By syncing these cookies across their network of sites, ad platforms can enable:

Frequency capping
Retargeting
Conversion tracking
Audience targeting
Sequential messaging
Fraud detection

All of this data collection and tracking happens behind the scenes instantly as pages load. The sheer scale is staggering.

Prevalence of Third Party Tracking

Research has shown that over 80% of websites contain at least one third party tracker[^1]. Google trackers in particular are present on over 80% of the top 1 million sites[^2].

The average website connects to over 10 third party domains, most of which are ad or analytics related[^3]. News and media sites tend to have an even higher number of third party trackers.

All of this tracking adds up to a vast data collection apparatus. One study found third parties can observe over 80% of a user‘s browsing history on average[^1]. Another estimated that ad networks can reconstruct over 90% of a user‘s social and interest profiles just from observing browsing behavior[^4].

Privacy Risks of Third Party Ad Serving

The massive scale of tracking and data collection in third party ad serving creates some serious privacy risks for users:

Lack of transparency and control – Most users are unaware of the extent of third party tracking and have little ability to opt-out or control what data is collected.
Sensitive data leakage – Seemingly benign browsing data can reveal highly sensitive details like medical conditions, financial status, political beliefs, sexual orientation, etc. This data can be misused for targeted manipulation.
Identity mapping and deanonymization – Data collected by third parties can be combined with data from other sources (both online and offline) to build incredibly detailed profiles and potentially deanonymize users[^5].
Secondary data use – Data collected for advertising can potentially be sold, shared or used for secondary purposes the user never agreed to, like lending decisions or government surveillance.
Invisible discrimination – Ad targeting based on browsing profiles can lead to discriminatory outcomes in the ads users see, potentially impacting things like job or housing opportunities[^6].

While ad networks argue that tracking data is anonymous and aggregated, research has repeatedly shown there is no such thing as perfect anonymization. Numerous cases of third party data being re-identified or exposing PII have come to light in recent years[^7] [^8].

Security Risks of Third Party Ad Serving

On top of privacy issues, the distributed and real-time nature of third party ad serving also creates additional cyber security risks:

Malvertising and drive-by-downloads – Ads served through exchanges can be an attack vector to spread malware to user devices without any interaction[^9]. Major incidents have infected thousands of devices by exploiting vulnerabilities in ad platforms[^10].
Data breaches and leakage – The complex patchwork of ad tech intermediaries creates many points of potential failure where user data can be breached[^11]. Numerous ad networks and platforms have been hacked resulting in data leaks.
Cross-site scripting (XSS) attacks – Ads are typically served in iframes which can allow attackers to inject malicious code and access user session data across sites[^12]. This is a common attack vector in ad platforms.
Ad fraud and invalid traffic – The opacity of programmatic ad exchanges enables a wide range of fraud, from cookie stuffing to hidden ads to bots, siphoning off 10-15% of ad spend[^13]. This also potentially defrauds users by charging them for fake clicks and views.
Regulatory and compliance risks – The collection and sharing of user data across borders creates complex challenges in complying with regional data protection regulations like GDPR and CCPA[^14]. Many ad practices are likely unlawful under the strictest interpretations.

While ad networks have made efforts to combat issues like malvertising and fraud, the sheer complexity of the ecosystem and financial incentives make eliminating risks extremely difficult. As long as user data remains the currency, bad actors will find ways to exploit the system.

The Evolving Landscape of Ad Serving and User Privacy

Luckily, the era of untrammeled third party tracking is coming to an end. Users, regulators and even big tech platforms have started to push back against invasive ad practices:

Browser cookie blocking – Safari and Firefox now block third party cookies by default[^15]. Chrome will phase them out completely by 2024[^16]. This significantly curtails cross-site tracking.
Regulatory crackdowns – GDPR and CCPA have placed strict limits on use of personal data for advertising without explicit consent. Fines for non-compliance can be steep.
Platform changes – Apple‘s iOS 14 App Tracking Transparency requires all apps to get user opt-in for data sharing[^17]. Google is developing the Privacy Sandbox to enable ad targeting and measurement without individual tracking[^18].
Rise of contextual advertising – Many advertisers are shifting budgets to contextual ads based on content and keywords rather than user profiles[^19]. This aligns incentives with quality content.
New privacy-preserving ad solutions – Emerging ad tech like data clean rooms, edge computing, federated learning and differential privacy enable aggregated insights without individual tracking[^20].

My opinion as a cyber security expert is that this paradigm shift is ultimately a good thing long-term. Third party ad serving brought many innovations in effective targeting and measurement, but it came at the cost of user autonomy and trust. As an industry, we need to live up to higher standards of privacy, transparency and value to users.

However, the transition will be messy in the short-term. Many publishers and platforms have built their business models around unfettered user tracking, and shifting away from that will be painful. Expect a lot of fragmentation, walled gardens and runarounds in the next few years.

A More Ethical and Sustainable Future for Ad Serving

Looking ahead to 2030 and beyond, I believe the future of third party ad serving will focus on:

Explicit user consent and control – Users will have granular options to choose what data is collected and how it is used for advertising. Consent will be active and revocable.
On-device data and decisioning – More ad selection and reporting will happen locally on user devices rather than on third party servers. This keeps data private while still enabling relevant ads.
Aggregated reporting and insights – Advertisers will still get rich insights into campaign performance, but through privacy-preserving methods like differential privacy and homomorphic encryption rather than individual tracking.
Stronger security and fraud prevention – Advertisers will demand greater transparency and accountability from ad networks for threats like malvertising and fraud. Expect to see wider adoption of initiatives like ads.txt, sellers.json and supply chain object.
More focus on ad quality and context – With less invasive microtargeting, advertisers will need to focus more on ad creative, format, and placement that delivers real value to users. Deep contextual signals will become more important.

Ultimately, for third party ad serving to survive, it needs to shift away from the pervasive tracking and data harvesting we see today. By realigning incentives around transparency, user control and delivered experience, we have an opportunity to build an ad ecosystem that works for everyone in the long run.

It won‘t be an easy path, but I‘m cautiously optimistic that we‘re heading in the right direction. Users are demanding change, technology is evolving to enable new solutions, and forward-thinking leaders are reimagining how digital advertising can work. If we get it right, a more ethical and sustainable model for third party ad serving is possible.

References

[^1]: Z. Yu, S. Macbeth, K. Modi, and J. M. Pujol. Tracking the trackers. In Proceedings of the 25th International Conference on World Wide Web, 2016.
[^2]: Google trackers found on 80% of top 1M websites. https://www.cyberghostvpn.com/privacyhub/google-tracking-ads-network-study/
[^3]: S. Englehardt and A. Narayanan. Online tracking: A 1-million-site measurement and analysis. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016.
[^4]: A. Korolova. Privacy violations using microtargeted ads: A case study. Journal of Privacy and Confidentiality, 3(1), 2011.
[^5]: A. Narayanan and V. Shmatikov. Robust de-anonymization of large sparse datasets. In 2008 IEEE Symposium on Security and Privacy, 2008.
[^6]: M. Speicher, M. Ali, G. Venkatadri, F. N. Ribeiro, G. Arvanitakis, F. Benevenuto, K. P. Gummadi, P. Loiseau, and A. Mislove. Potential for discrimination in online targeted advertising. In Conference on Fairness, Accountability and Transparency, 2018.
[^7]: NYTimes ad servers exposed user data. https://www.wired.com/2009/09/nyt-ad-system-hacked-serves-malware/
[^8]: PointRoll ad network leaked user data. https://www.mediapost.com/publications/article/330159/pointroll-settles-with-nj-ag-over-data-security-br.html
[^9]: How malvertising works and how to protect against it. https://www.makeuseof.com/what-is-malvertising-and-how-to-protect-against-it/
[^10]: Angler Exploit Kit spreads malware via ad networks. https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malvertising-campaign-abuses-googles-doubleclick-to-deliver-cryptocurrentcy-miners
[^11]: Ad Industry Suffers Massive Data Breach Via Open Database. https://geoedge.com/blog/ad-industry-third-party-data-breach
[^12]: Cross-site Scripting (XSS) in Advertisement Networks. https://dzone.com/articles/cross-site-scripting-in-advertisement
[^13]: How Big Is the Ad Fraud Problem? https://www.emarketer.com/content/how-big-the-ad-fraud-problem
[^14]: IAB CCPA Compliance Framework for Publishers & Technology Companies. https://www.iab.com/guidelines/ccpa-framework/
[^15]: Firefox Now Blocks Third-Party Cookies. https://www.schneier.com/blog/archives/2019/09/firefox_now_blo_1.html
[^16]: Building a more private web: A path towards making third party cookies obsolete. https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html
[^17]: User Privacy and Data Use – App Store. https://developer.apple.com/app-store/user-privacy-and-data-use/
[^18]: The Privacy Sandbox. https://www.chromium.org/Home/chromium-privacy/privacy-sandbox
[^19]: Contextual Advertising: What It Is & Why It‘s Becoming The Next Big Thing. https://www.marketing360.com/blog/contextual-advertising-becoming-next-big-thing/
[^20]: A Peek into the Future of Online Advertising: 9 Trends to Watch in 2024. https://www.martechadvisor.com/articles/ads/future-of-online-advertising/