Of 67 advertisers who wanted to join a transparency study, only 21 managed it. The other 46 could not obtain access to delivery data held by their own vendors. Not because the data did not exist, but because their contracts did not provide for it.

The association that ran the study is blunt about the cause:

“The most common explanation is simple: if brands don’t own their supply contracts attached with specific data rights, or require their agency to obtain access to such data for them, then they are blocking themselves from turning relevant data into valuable information to optimize decision-making.”

That is the whole problem in one sentence. In the United States, nothing about this is a right. It is a negotiation you either had or did not have, and the moment to have it was signature, not audit.

There is no law here, and none is coming

Worth stating plainly, because it reframes everything that follows.

No US law requires an intermediary to disclose its fees or margins to the advertiser. Not federal, not state. The chain is contractual end to end. And the study documents the consequence: supply-side platforms “cannot report costs for impressions where legal agreements with publishers do not permit that cost information to be shared with the buyer”. Somebody else’s confidentiality clause can lawfully block your visibility into your own spend.

The European Digital Services Act does not fill the gap either. Its advertising provisions oblige platforms to tell users what they are seeing and who paid for it, and oblige the largest platforms to maintain public ad repositories for researchers and regulators. Those repositories carry the ad, the payer, the targeting parameters and the reach. They carry no financial data about the intermediation chain, and nothing addressed to the advertiser buying it.

For contrast, one jurisdiction does regulate this. French law has required, since 1993 and explicitly for digital since 2015, that any purchase of ad space by an intermediary be made under a written mandate, that rebates granted by the seller appear on the advertiser’s invoice, and that the seller report directly to the advertiser within a month of delivery. That regime outlaws the buy-and-resell model outright. It exists nowhere else.

Which matters, because the guidance from the global advertiser federation is unambiguous about that model:

“the agency buys media at its own risk and in this way creates its own inventory of that media. As a result, the agency then becomes the principal and can sell that media to its clients at whatever price it can negotiate, irrespective of what it cost the agency to acquire or its true market value. Inventory Media is not transparent, nor is it auditable. Indeed, Inventory Media typically comes with strict non-audit clauses attached.”

And a survey of 48 companies found 32% buying inventory from their agency acting as principal, undisclosed.

Proportion of advertisers able to reach their own delivery data and comparison of legal requirements by jurisdictionProportion of advertisers able to reach their own delivery data, and comparison of legal requirements across jurisdictions. Sixty seven member companies of an American advertiser association expressed interest in participating in a supply chain transparency study, but only twenty one were able to do so, the remaining forty six being unable to clear the legal and other hurdles required to obtain access to log data from their demand side platforms, supply side platforms and advertising verification providers. Fifty two percent of those sixty seven advertisers held direct demand side platform data access through their own contracts. A separate benchmark survey found that eighty percent of respondents hold a direct contract with at least one demand side platform, seventy eight percent with a verification provider, but only twenty seven percent with a supply side platform. On the legal position, no federal or state law in the United States requires an intermediary to disclose its fees or margins to the advertiser, so access rests entirely on contract, and the study documents cases where legal agreements between a supply side platform and a publisher do not permit cost information to be shared with the buyer. In the European Union, the Digital Services Act imposes advertising transparency obligations that run toward users and researchers rather than advertisers: one article requires providers of online platforms to enable each recipient of the service to identify in real time that a message is an advertisement, on whose behalf it is presented, who paid for it where different, and the main targeting parameters; another requires very large online platforms to maintain a public repository of advertisements containing the content, the identity of the sponsor and payer, the period of display, the targeting parameters and the number of recipients reached per member state. Neither contains financial data about the intermediation chain. France is the exception: a statute of nineteen ninety three, extended explicitly to digital media in two thousand fifteen, requires that any purchase of advertising space by an intermediary be made on behalf of an advertiser under a written mandate contract, that any rebate granted by the seller appear on the invoice delivered to the advertiser, that the invoice be communicated directly by the seller to the advertiser even where the advertiser does not pay the seller directly, and that the seller report directly to the advertiser within one month following delivery, with a decree of two thousand seventeen specifying the contents of that report for digital advertising. That regime effectively prohibits the buy and resell model, and exists in no other jurisdiction.67 wanted their data. 21 got it.Advertisers who wanted to participate67Advertisers who cleared the legal hurdles21What the law requires, by jurisdictionUnited Statesnothing. Access rests entirely on contract.European Uniontransparency toward users, not advertisersFrancewritten mandate, rebates on your invoice,direct invoice, report within a monthEven so, only 52% of those 67 advertisers held direct platform data access through their own contracts,and only 27% had a direct contract with any supply-side platform at all.
Two thirds of interested advertisers were blocked by their own contracts. No US law would have helped them. Source : ANA, Programmatic Media Supply Chain Transparency Study, December 2023, page 44; French Act No. 93-122 of 29 January 1993, articles 20 and 23, and decree No. 2017-159 of 9 February 2017; Regulation (EU) 2022/2065, articles 26 and 39 (2023)

What to put in the contract

The same survey exposes the gap between having a right and being able to use it: 83% hold contractual financial audit rights, but 65% do not have full access to the data held in the demand-side platforms operating on their behalf, log files and financial reporting included.

The published guidance converges on a short list. Full transparency on how every fee is calculated, covering platform fees, variable costs, management fees, performance fees and audience data fees. Data ownership and usage, with explicit reference to log-level data, portability, and the right to share it with your own agencies, auditors and consultants. Robust compliance and performance audit rights. A ban on rebates or incentives paid to your agency based on your spend. Reporting at a cadence and in a format you can actually use.

Plus one instruction worth quoting exactly: “Do not accept a DSP’s form contract. Each brand’s DSP contract should be bespoke.”

On the audit clause specifically, the federation’s guidance lists ten principles. No restriction on which audit firm you appoint. The auditor may contact media vendors directly. The audit covers every entity in the agency group, not one. It reaches back up to three years after the contract ends. The auditor is paid a fixed fee, never a percentage of recoveries, so nobody has an incentive to inflate findings. Non-compliance carries a penalty. And the agency’s finance chief signs a representation letter confirming compliance.

The gap between holding a contractual audit right and being able to exercise itThe gap between holding a contractual audit right and being able to exercise it, together with the contract clauses that published guidance recommends obtaining. A survey of forty eight companies found that eighty three percent hold contractual financial audit rights, that twelve percent either do not hold them or do not know whether they do, that sixty five percent do not have full access to the data held within the demand side platforms operated on their behalf including log files and financial reporting, and that thirty two percent buy inventory from their agency acting as principal on an undisclosed basis. In a separate study, of sixty seven advertisers interested in participating, only twenty one were able to obtain access to log level data from their own demand side platforms, supply side platforms and verification vendors, the remaining forty six being unable to clear legal and contractual obstacles; fifty two percent of those sixty seven held direct demand side platform data access through their own contracts. Published contractual guidance recommends obtaining full transparency on the calculation of every fee including platform fees, variable cost fees, management fees, performance based fees and audience data fees; clarity on data usage and ownership with explicit reference to log level data, data portability and the right to share data with the advertiser’s own agencies, auditors and consultants; robust compliance and performance audit rights; a prohibition on rebates or other incentives paid to the agency or a third party based on the advertiser’s spend; and reporting at a cadence and in a format workable for the advertiser. It also instructs advertisers not to accept a platform’s form contract and to have a bespoke contract drawn up. On the audit clause specifically, a federation guide lists ten principles: no limitation on the choice of audit firm, the auditor’s ability to contact media vendors directly to verify accounts and remuneration, examination of supplier contracts rather than reliance on a list supplied by the agency, coverage of all entities within the agency group, a historical reach of up to three years after the contract ends, payment of auditors on a fixed fee basis rather than a percentage of recoveries, penalties for material non compliance, repayment of recovered amounts within a defined period, a representation letter signed by the agency’s chief financial or chief executive officer, and a requirement that every vendor relationship be covered by a written contract.The right on paper, the access in practiceHold contractual financial audit rights83%Lack full access to their own platform data65%Buy from their agency as undisclosed principal32%What the guidance says to obtainTransparency on how every fee is calculatedOwnership and portability of log-level dataThe right to share that data with your own auditorsCompliance and performance audit rights, reaching back three yearsAuditors paid a fixed fee, never a share of recoveries”Do not accept a DSP’s form contract.”
Most advertisers have the right on paper. Two thirds still cannot reach their own data. Source : WFA and FirmDecisions, Media Contract Guidance for Advertisers: Global Best Practice; WFA and Ebiquity Transparency Scorecard, January 2022, 48 respondents; ANA, Programmatic Media Supply Chain Transparency Study, December 2023 (2023)

The free toolkit almost nobody uses

After the first transparency study, a British industry taskforce produced an audit kit in three documents, freely downloadable with no registration: a template audit permission letter, a list of data fields to request, and a data principles document.

The field list is the most concrete answer available to “what should I ask for”. The fields it marks essential include the most granular timestamp available, country, advertiser ID and name, seat ID, advertiser domain, campaign ID, deal ID, delivery domain, publisher ID and name, device type, exchange rate where applicable, buyer ID and network, the identifiers of the demand-side and supply-side platforms, gross revenue, publisher net revenue, supply-side platform fee, media cost, data cost, demand-side platform fee and its other fees.

Testing the kit produced measurable results. Study duration fell from 18 months to 9. The impression match rate between buy side and sell side rose from 12% to 58%. Unattributable spend dropped from 17% to 3%. Vendors shared roughly 80% of requested fields, refusing the remaining 20% for legal or technical reasons.

But the letter creates no rights. It says so:

“The Parties agree that the Disclosing Party’s provision of the Audit Information is without prejudice and subject to any contractual terms and conditions between any of the Parties hereto.”

It works only where your contract already allows it. The study concedes that adoption varied and that bespoke arrangements were often needed anyway.

One negative finding worth stating outright: I found no tool, template or methodology published by any advertiser association and explicitly sized for a company without a legal department or a data team. Both major studies used audit firms and multiple years. The British kit is, as of today, the only free, ready-to-use instrument a company can send to its vendors on its own.

Composition of the free audit toolkit and measured results of testing it in real conditionsComposition of the free audit toolkit produced by a British industry taskforce and the measured results of testing it in real conditions. The toolkit comprises three documents freely downloadable without registration: a template audit permission letter addressed by a sponsoring advertiser or publisher to a disclosing party such as a demand side or supply side platform, in view of an audit conducted by an independent third party auditor; a data fields list; and a data principles document. The fields marked essential in that list include the most granular timestamp available, country, advertiser identifier and name, seat identifier, advertiser domain, campaign identifier, deal identifier, domain and address ending fields, publisher identifier and name, device type, foreign exchange rate where applicable, buyer identifier, buyer network and buyer name, demand side platform identifier, gross revenue, publisher revenue or net revenue, supply side platform fee, supply side platform identifier, media cost, data cost, demand side platform fee, and other demand side platform fees whether technical or data related. Non essential but useful fields include creative type, second bid price, auction type whether first or second price, exchange or integration type, transaction type whether open, private marketplace or programmatic guaranteed, winning bid price, industry category, full delivery address, verification tool identifiers, seller identifier from the seller identity file, and creative size. Testing this kit across eleven advertisers, seven agencies, six demand side platforms, six supply side platforms and ten publishers halved the study duration from eighteen months to nine, raised the impression match rate between the buy side and the sell side from twelve percent to fifty eight percent, and reduced unattributable spend from seventeen percent to three percent, with vendors sharing on average approximately eighty percent of requested fields and refusing the remaining twenty percent for legal or technical reasons. The template letter nevertheless creates no new right of access, since it states that the provision of audit information is made without prejudice and subject to any contractual terms and conditions existing between the parties, so it functions only where the underlying contract already permits it; the study acknowledges that adoption levels varied and that alternative bespoke solutions were often required.A free toolkit, and what it producedThree documents, freely availableA template audit permission letterThe list of data fields to requestThe data handling principlesWhat testing it changedStudy duration: 18 months, then 9Impressions matched: 12%, then 58%Unattributable spend: 17%, then 3%What the letter does not doIt applies “without prejudice and subject to any contractual terms”. It grants nothing new.And the negative findingNo association has published a tool sized for a company without a dedicated team.
Three documents, no registration. And a letter that grants no new right of access. Source : ISBA, Financial Audit Toolkit for Programmatic Advertising, version 1.2, September 2024; ISBA and PwC, Programmatic Supply Chain Transparency Study II, 18 January 2023 (2024)

What you can check yourself, with a script

Three public files let you reconcile an impression chain without an audit firm.

The authorized sellers file, published by the publisher at its domain root, declares which advertising systems may sell its inventory, each with an account identifier and a relationship type, direct or reseller.

The seller identity file, published by the platform, declares for each account identifier the entity actually paid, its domain, and its type. The official definitions are precise:

“PUBLISHER: the inventory sold through this account is on a site, app, or other medium owned by the named entity and the advertising system pays them directly.” “INTERMEDIARY: the inventory sold through this account is not owned by the named entity or the advertising system does not pay them directly.”

The supply chain object, carried in the bid request, lists the intermediaries involved in order, with a flag stating whether the chain is complete. The construction rule is explicit:

“It is invalid for a reseller to copy the SupplyChain object from the previous seller to their request for that inventory without also inserting their node into the chain.”

The reconciliation runs in five steps. Pull the chain for a purchased impression. Check the completeness flag: at zero, some upstream link declared nothing and no inference about it is possible. For each node, read the seller identity file of the platform named and confirm the identifier exists with a coherent type. Compare the first node against the authorized sellers file of the site you were sold. Flag every mismatch.

That is roughly a day of development, and it catches the crude inconsistencies.

What those files do not prove

Being as precise about the ceiling as about the capability matters, because these mechanisms get sold as guarantees.

They are declarative. Verification happens between a crawler and a text file, never transaction by transaction. The specification says so itself:

“These tools cannot stop an unscrupulous ad platform from misrepresenting an unauthorized publisher ID as an authorized one by changing the publisher ID prior to offering the impression on an ad exchange. Participants should be aware of this limitation.”

A seller can stay anonymous. The identity file carries a confidentiality flag permitting the name and domain to be omitted. The entry must exist, but the entity being paid stays unverifiable from outside.

Updates are not immediate. With no expiry header the default cache is seven days, and on error the consuming system must reuse the last version it retrieved. Removing a dubious seller does not propagate at once.

And circumvention is academically documented. Two papers presented in 2024 and 2025 describe inventory pooling: low-quality sites pool their inventory at an exchange alongside legitimate ones, so the declared chain reconciles perfectly while the real origin is masked. The second concludes that the phenomenon had been underestimated by a factor of fifteen in earlier work.

Two further points about the assurance mechanisms often invoked here. Industry anti-fraud certification is paid and voluntary, so the certified population is a self-selected sample of firms that chose to be audited, not a census of the market. And accreditation by the measurement council covers specific metrics in specific environments, not a company as a whole, and the audit report is not public: only an accreditation letter is, with the full report going to the audited vendor, the audit firm and the council’s paying members.

What a reconciliation script detects across the three public supply chain files and what it cannot detectWhat a reconciliation script detects across the three public supply chain files and what it cannot detect. The first file, published by the publisher at its domain root, declares which advertising systems are authorized to sell its inventory, each line carrying the advertising system domain, the seller account identifier within that system, and the relationship type, direct where the publisher directly controls the account or reseller where it has authorized another entity to control that account and resell its space. The second file, published by the platform, declares for each account identifier the entity actually paid, its domain and its type, the publisher value meaning the inventory sold through that account is on a medium owned by the named entity which the advertising system pays directly, the intermediary value meaning the inventory is not owned by the named entity or the system does not pay it directly, and the both value meaning both types transact through that seller. The third mechanism is an object carried in the bid request enumerating in order the intermediaries that participated in the transaction, each node carrying the advertising system domain and the account identifier, with a completeness flag indicating whether the chain contains all nodes leading back to the owner of the medium; the specification states that it is invalid for a reseller to copy that object without also inserting its own node. Reconciling the three sources allows an advertiser to verify that the domain being billed appears among the authorized sellers of the site, that the corresponding identifier exists in the platform’s identity file with a coherent type, and that the first node of the chain matches the declared publisher. These mechanisms do not however prove that the chain is honest. They are declarative and verification occurs between a crawler and a text file rather than transaction by transaction, the specification itself stating that these tools cannot stop an unscrupulous advertising platform from misrepresenting an unauthorized publisher identifier as an authorized one by changing it prior to offering the impression on an exchange. A confidentiality flag further permits a seller to omit its name and domain, leaving the entity paid unverifiable from outside. The default cache duration is seven days absent an expiry header, and on error the consuming system must reuse the last successfully retrieved version, so a seller’s removal does not propagate immediately. Finally, two academic papers presented at security and web conferences in two thousand twenty four and two thousand twenty five document circumvention through inventory pooling, allowing low quality sites to sell inventory under cover of reputable ones while leaving the declarative chain entirely coherent, the second concluding that the phenomenon had been underestimated by a factor of fifteen in earlier studies.Three files, and their ceilingWhat a script catchesA billed domain missing from the site’s authorized sellersAn account identifier absent from the platform’s identity fileA chain flagged complete whose first node does not matchWhat it does not catchSubstitution of an authorized identifier before the impression is offeredThe identity of a seller declared confidentialA recent removal, until the seven-day cache expiresInventory pooling, which leaves the chain perfectly coherentOn that last point, a 2025 paper concludes the phenomenon was underestimated by a factor of fifteen.
A day of development catches the crude inconsistencies. None of the three files proves the chain is honest. Source : IAB Tech Lab, ads.txt v1.1, August 2022; app-ads.txt v1.0, March 2019; sellers.json v1.0, July 2019; SupplyChain object, OpenRTB; Vekaria, Nithyanand and Shafiq, IEEE Symposium on Security and Privacy, 2024; Papadogiannakis et al., ACM Web Conference, 2025 (2022)

The highest-return lever, and the least used

If you do one thing without a dedicated team, do this one, because it is a setting rather than an audit.

The average campaign in the American study reached 44,000 sites. But 86% of impressions came from 3,000 sites, and 63% from the top 500. The other available measurements agree: 40,524 sites on average in the British study, 37,000 in a 2021 count.

Hence the recommendation, and it is the sizing that matters:

“Buyers should be able to get the scale they need by selecting 75 to 100 trusted sellers; that will provide access to thousands of high-quality websites.”

Seventy-five to a hundred trusted sellers, not thousands of domains one at a time. That is within reach of a small team.

The same study is categorical about which direction the list should run:

“Prioritize the creation and use of website ‘inclusion’ lists versus focusing on ‘exclusion’ lists. Exclusion lists are largely ineffective in practice.”

And the accompanying survey shows how little the lever is used: 6% of advertisers use inclusion lists alone, 26% rely on exclusion lists only, and among those maintaining an inclusion list, 45% refresh it monthly as recommended, with a quarter not knowing how often it is refreshed at all.

One practical caution: manual domain checking is unreliable. The study cites artificial sites whose names imitate those of recognized news titles closely enough to pass a human glance.

Actual concentration of advertising impressions against the number of sites a campaign reachesActual concentration of advertising impressions against the number of sites a campaign reaches, and the extent to which inclusion lists are under used. In a study covering twenty one advertisers, the average campaign reached forty four thousand sites and applications, with a range from three thousand six hundred and twenty seven to two hundred and twenty two thousand five hundred and thirty four sites depending on the advertiser, a figure consistent with the forty thousand five hundred and twenty four sites measured on average by an earlier British study and the thirty seven thousand recorded in a two thousand twenty one count. Yet eighty six percent of impressions came from only three thousand sites, and sixty three percent from the top five hundred sites. The published recommendation is to prioritize the creation and use of website inclusion lists rather than focusing on exclusion lists, the study stating that exclusion lists are largely ineffective in practice, to select seventy five to one hundred trusted sellers which provides access to thousands of high quality websites, and to update the list monthly. A survey accompanying the study shows the lever is barely used: only six percent of surveyed advertisers use inclusion lists alone, twenty six percent use exclusion lists alone, fifty nine percent use both, and among those maintaining an inclusion list only forty five percent update it monthly as recommended while a quarter do not know how often it is updated. The study further notes that manual verification of domain names is unreliable, citing artificially generated sites whose names imitate those of recognized news publications closely enough to pass a human check, which makes monitoring against delivery data necessary alongside manual curation.44,000 sites reached, 3,000 that matterSites reached by the average campaign44,000Sites delivering 86% of impressions3,000Trusted sellers recommended75 to 100How little the lever is used6% of advertisers use inclusion lists alone26% rely on exclusion lists, called “largely ineffective in practice”45% of those with a list refresh it monthly
86% of impressions come from 3,000 sites. The average campaign touches 44,000. Source : ANA, Programmatic Media Supply Chain Transparency Study, December 2023, and ANA Programmatic Benchmark Survey (2023)

The order to do this in

Start with the inclusion list. It is a setting, not an audit. Seventy-five to a hundred trusted sellers, refreshed monthly. You remove most of the worthless inventory before opening a single data file.

Fix the contract before you request data. That is the lesson of the 46 blocked advertisers. Fee transparency, log-level data ownership and portability, the right to share with your own auditors, audit rights, no rebates to your agency. And no form contracts.

Run the technical reconciliation. A day of development comparing the three public files across a sample of your impressions. It does not prove the chain is honest; it surfaces the inconsistencies.

Send the permission letter and the field list. They are free, they are drafted, and roughly 80% of requested fields came back when they were tested. Just know the letter grants you nothing your contract does not already give you.

And do not expect an audit to return what the structure withholds. Even the most complete exercise left 3% of spend unattributable, with vendors refusing a fifth of the requested fields. The goal is not total transparency, which is not available. It is knowing precisely which share of your spend you cannot say anything about. Naming that share before any budget moves is where our B2B paid acquisition work starts, with the inclusion list and the data rights settled first and the spend released after.