Of 67 advertisers who wanted to join a transparency study, only 21 managed it. The other 46 could not obtain access to delivery data held by their own vendors. Not because the data did not exist, but because their contracts did not provide for it.
The association that ran the study is blunt about the cause:
“The most common explanation is simple: if brands don’t own their supply contracts attached with specific data rights, or require their agency to obtain access to such data for them, then they are blocking themselves from turning relevant data into valuable information to optimize decision-making.”
That is the whole problem in one sentence. In the United States, nothing about this is a right. It is a negotiation you either had or did not have, and the moment to have it was signature, not audit.
There is no law here, and none is coming
Worth stating plainly, because it reframes everything that follows.
No US law requires an intermediary to disclose its fees or margins to the advertiser. Not federal, not state. The chain is contractual end to end. And the study documents the consequence: supply-side platforms “cannot report costs for impressions where legal agreements with publishers do not permit that cost information to be shared with the buyer”. Somebody else’s confidentiality clause can lawfully block your visibility into your own spend.
The European Digital Services Act does not fill the gap either. Its advertising provisions oblige platforms to tell users what they are seeing and who paid for it, and oblige the largest platforms to maintain public ad repositories for researchers and regulators. Those repositories carry the ad, the payer, the targeting parameters and the reach. They carry no financial data about the intermediation chain, and nothing addressed to the advertiser buying it.
For contrast, one jurisdiction does regulate this. French law has required, since 1993 and explicitly for digital since 2015, that any purchase of ad space by an intermediary be made under a written mandate, that rebates granted by the seller appear on the advertiser’s invoice, and that the seller report directly to the advertiser within a month of delivery. That regime outlaws the buy-and-resell model outright. It exists nowhere else.
Which matters, because the guidance from the global advertiser federation is unambiguous about that model:
“the agency buys media at its own risk and in this way creates its own inventory of that media. As a result, the agency then becomes the principal and can sell that media to its clients at whatever price it can negotiate, irrespective of what it cost the agency to acquire or its true market value. Inventory Media is not transparent, nor is it auditable. Indeed, Inventory Media typically comes with strict non-audit clauses attached.”
And a survey of 48 companies found 32% buying inventory from their agency acting as principal, undisclosed.
The same survey exposes the gap between having a right and being able to use it: 83% hold contractual financial audit rights, but 65% do not have full access to the data held in the demand-side platforms operating on their behalf, log files and financial reporting included.
The published guidance converges on a short list. Full transparency on how every fee is calculated, covering platform fees, variable costs, management fees, performance fees and audience data fees. Data ownership and usage, with explicit reference to log-level data, portability, and the right to share it with your own agencies, auditors and consultants. Robust compliance and performance audit rights. A ban on rebates or incentives paid to your agency based on your spend. Reporting at a cadence and in a format you can actually use.
Plus one instruction worth quoting exactly: “Do not accept a DSP’s form contract. Each brand’s DSP contract should be bespoke.”
On the audit clause specifically, the federation’s guidance lists ten principles. No restriction on which audit firm you appoint. The auditor may contact media vendors directly. The audit covers every entity in the agency group, not one. It reaches back up to three years after the contract ends. The auditor is paid a fixed fee, never a percentage of recoveries, so nobody has an incentive to inflate findings. Non-compliance carries a penalty. And the agency’s finance chief signs a representation letter confirming compliance.
After the first transparency study, a British industry taskforce produced an audit kit in three documents, freely downloadable with no registration: a template audit permission letter, a list of data fields to request, and a data principles document.
The field list is the most concrete answer available to “what should I ask for”. The fields it marks essential include the most granular timestamp available, country, advertiser ID and name, seat ID, advertiser domain, campaign ID, deal ID, delivery domain, publisher ID and name, device type, exchange rate where applicable, buyer ID and network, the identifiers of the demand-side and supply-side platforms, gross revenue, publisher net revenue, supply-side platform fee, media cost, data cost, demand-side platform fee and its other fees.
Testing the kit produced measurable results. Study duration fell from 18 months to 9. The impression match rate between buy side and sell side rose from 12% to 58%. Unattributable spend dropped from 17% to 3%. Vendors shared roughly 80% of requested fields, refusing the remaining 20% for legal or technical reasons.
But the letter creates no rights. It says so:
“The Parties agree that the Disclosing Party’s provision of the Audit Information is without prejudice and subject to any contractual terms and conditions between any of the Parties hereto.”
It works only where your contract already allows it. The study concedes that adoption varied and that bespoke arrangements were often needed anyway.
One negative finding worth stating outright: I found no tool, template or methodology published by any advertiser association and explicitly sized for a company without a legal department or a data team. Both major studies used audit firms and multiple years. The British kit is, as of today, the only free, ready-to-use instrument a company can send to its vendors on its own.
Three public files let you reconcile an impression chain without an audit firm.
The authorized sellers file, published by the publisher at its domain root, declares which advertising systems may sell its inventory, each with an account identifier and a relationship type, direct or reseller.
The seller identity file, published by the platform, declares for each account identifier the entity actually paid, its domain, and its type. The official definitions are precise:
“PUBLISHER: the inventory sold through this account is on a site, app, or other medium owned by the named entity and the advertising system pays them directly.”
“INTERMEDIARY: the inventory sold through this account is not owned by the named entity or the advertising system does not pay them directly.”
The supply chain object, carried in the bid request, lists the intermediaries involved in order, with a flag stating whether the chain is complete. The construction rule is explicit:
“It is invalid for a reseller to copy the SupplyChain object from the previous seller to their request for that inventory without also inserting their node into the chain.”
The reconciliation runs in five steps. Pull the chain for a purchased impression. Check the completeness flag: at zero, some upstream link declared nothing and no inference about it is possible. For each node, read the seller identity file of the platform named and confirm the identifier exists with a coherent type. Compare the first node against the authorized sellers file of the site you were sold. Flag every mismatch.
That is roughly a day of development, and it catches the crude inconsistencies.
What those files do not prove
Being as precise about the ceiling as about the capability matters, because these mechanisms get sold as guarantees.
They are declarative. Verification happens between a crawler and a text file, never transaction by transaction. The specification says so itself:
“These tools cannot stop an unscrupulous ad platform from misrepresenting an unauthorized publisher ID as an authorized one by changing the publisher ID prior to offering the impression on an ad exchange. Participants should be aware of this limitation.”
A seller can stay anonymous. The identity file carries a confidentiality flag permitting the name and domain to be omitted. The entry must exist, but the entity being paid stays unverifiable from outside.
Updates are not immediate. With no expiry header the default cache is seven days, and on error the consuming system must reuse the last version it retrieved. Removing a dubious seller does not propagate at once.
And circumvention is academically documented. Two papers presented in 2024 and 2025 describe inventory pooling: low-quality sites pool their inventory at an exchange alongside legitimate ones, so the declared chain reconciles perfectly while the real origin is masked. The second concludes that the phenomenon had been underestimated by a factor of fifteen in earlier work.
Two further points about the assurance mechanisms often invoked here. Industry anti-fraud certification is paid and voluntary, so the certified population is a self-selected sample of firms that chose to be audited, not a census of the market. And accreditation by the measurement council covers specific metrics in specific environments, not a company as a whole, and the audit report is not public: only an accreditation letter is, with the full report going to the audited vendor, the audit firm and the council’s paying members.
If you do one thing without a dedicated team, do this one, because it is a setting rather than an audit.
The average campaign in the American study reached 44,000 sites. But 86% of impressions came from 3,000 sites, and 63% from the top 500. The other available measurements agree: 40,524 sites on average in the British study, 37,000 in a 2021 count.
Hence the recommendation, and it is the sizing that matters:
“Buyers should be able to get the scale they need by selecting 75 to 100 trusted sellers; that will provide access to thousands of high-quality websites.”
Seventy-five to a hundred trusted sellers, not thousands of domains one at a time. That is within reach of a small team.
The same study is categorical about which direction the list should run:
“Prioritize the creation and use of website ‘inclusion’ lists versus focusing on ‘exclusion’ lists. Exclusion lists are largely ineffective in practice.”
And the accompanying survey shows how little the lever is used: 6% of advertisers use inclusion lists alone, 26% rely on exclusion lists only, and among those maintaining an inclusion list, 45% refresh it monthly as recommended, with a quarter not knowing how often it is refreshed at all.
One practical caution: manual domain checking is unreliable. The study cites artificial sites whose names imitate those of recognized news titles closely enough to pass a human glance.
Start with the inclusion list. It is a setting, not an audit. Seventy-five to a hundred trusted sellers, refreshed monthly. You remove most of the worthless inventory before opening a single data file.
Fix the contract before you request data. That is the lesson of the 46 blocked advertisers. Fee transparency, log-level data ownership and portability, the right to share with your own auditors, audit rights, no rebates to your agency. And no form contracts.
Run the technical reconciliation. A day of development comparing the three public files across a sample of your impressions. It does not prove the chain is honest; it surfaces the inconsistencies.
Send the permission letter and the field list. They are free, they are drafted, and roughly 80% of requested fields came back when they were tested. Just know the letter grants you nothing your contract does not already give you.
And do not expect an audit to return what the structure withholds. Even the most complete exercise left 3% of spend unattributable, with vendors refusing a fifth of the requested fields. The goal is not total transparency, which is not available. It is knowing precisely which share of your spend you cannot say anything about. Naming that share before any budget moves is where our B2B paid acquisition work starts, with the inclusion list and the data rights settled first and the spend released after.
Frequently asked questions
Does any US law require intermediaries to disclose their fees to me?
No. There is no federal or state requirement. Access to fee and delivery data rests entirely on what you negotiated. The 2023 study documents cases where a supply-side platform's agreement with a publisher legally prohibits sharing the cost with the buyer.
Does the European Digital Services Act help?
Not for this. Its advertising transparency obligations run toward users and researchers, through ad repositories showing who paid for an ad and how it was targeted. They contain no financial data about the intermediation chain, and nothing addressed to advertisers.
What can I verify myself without an audit firm?
Three public files let you reconcile a chain: the authorized sellers a publisher declares, the seller identities a platform declares, and the list of intermediaries carried in the bid request. A script comparing the three catches the obvious inconsistencies in about a day of work.
Do those files prove the chain is clean?
No. They are declarative and not continuously audited. One specification states plainly that they cannot stop a platform from substituting an authorized publisher identifier before offering the impression. Academic work documents pooling schemes that leave the declared chain perfectly coherent.
Where should I start with no dedicated team?
With the inclusion list. The average campaign in one large study reached 44,000 sites while 86% of impressions came from 3,000. The published recommendation is to select 75 to 100 trusted sellers and refresh monthly.