The Google AdEx Privacy Settlement and the Coming Identity Shake-Up

By Dan Jaye, CTO

On September 2, a (for now) proposed settlement in the Northern District of California put Google on the hook for a fundamental change to how digital advertising works. At the center is a new consumer privacy tool called RTB Control.

RTB Control functions like this: when consumers activate it, Google’s Ad Exchange will strip identifiers from the bidstream, effectively shutting down real-time bidding (RTB) for those impressions. This isn’t just a compliance box-checking exercise. By embedding opt-outs into auction mechanics, regulators have shifted privacy enforcement from being a browser setting or consent banner to being hard-coded into infrastructure.

But let’s caveat the potential impact up front: it depends heavily on consumer take-up. If adoption mirrors historic cookie-blocking rates, the effect could be modest. But, if walled gardens or privacy advocates actively (and successfully) promote RTB Control, adoption might accelerate and reshape the market far more dramatically.

The Context: Cookies Already on the Ropes

This settlement lands just as Chrome prepares to block third-party cookies. Safari and Firefox already did so years ago, but with Chrome controlling more than 60% of global browser share, the ripple effect is far larger.

For context: Aqfer tags, when configured not to collect data from users who block cookies, show an 88% acceptance rate for third-party cookies in web traffic (excluding paid media). Blocking third party cookies often breaks site behavior, so users have tended to leave them on. RTB Control doesn’t have those breakage side effects, so adoption could end up materially higher. We’re predicting incremental impact in the range of 10-25% of traffic, if consumers adopt the tool widely, and less so if they don’t.

Why RTB Control Hits Differently

Unlike cookies, RTB Control lives at the center of how programmatic auctions function. By cutting IDs at the auction level, it removes the data that powers targeting, measurement, and attribution. That creates knock-on challenges:

• Fraud detection and security – Will enough signals remain to filter out invalid traffic?
• Direct vs. auction models – Does this accelerate Google’s push to route demand into its own direct channels?

•  Follow-on enforcement – How long before regulators push others to adopt similar controls

While cookie-less identity solutions are often touted as “privacy friendly,” they’re opaque to consumers and lack meaningful consent. RTB Control, by contrast, is explicit and user-driven – which could make it more compelling for regulators and for consumers who feel “tricked” by endless consent management platform pop-ups.

Winners and Losers

 The paradox here is pronounced. Consumers gain privacy, but the biggest beneficiaries may be … the walled gardens?

• The likes of Meta, Amazon, and TikTok don’t need to pass IDs into the open bidstream. They operate inside their own authenticated ecosystems.
• Independent DSPs and SSPs, who built their value proposition on cross-site identity, are the ones exposed. Efforts like UID2 may struggle when regulators make clear that any identifier in the bidstream is fair game for removal.

Smaller publishers also face disproportionate pain. It’s worth pointing out that large players can adapt by pushing direct deals, but small and mid-size publishers lack the leverage or the infrastructure to make first-party data scale.

What Comes Next?

If adoption is limited, RTB Control might just shave 10% off addressable impressions – painful, but survivable. If adoption is widespread, the shift could cut materially into the open web’s remaining monetizable inventory. My back-of-the-envelope math leads me to thinking an 8% revenue drop for publishers isn’t out of the question, and that drop is layered on top of losses already inflicted by Safari, Firefox, and ad blockers.  

Mitigation paths are already emerging:

• Contextual advertising is resurging as a scalable fallback.

• Publisher-Advertiser Identity Reconciliation (PAIRs) offers a structured but clunky workaround.

• Containerized RTB – running the bidding logic within the SSP environment – provides publishers with direct access to impression dimensions, while reducing payload bloat and enhancing guardrails. I view this as one of the most viable mitigations, and I’ll write about it in much more detail in my next blog post. 

The Bottom Line – A Structural Change That Could Redistribute Identity Power.

RTB Control represents more than a privacy safeguard – it’s a structural change that could redistribute identity power.

• If consumer adoption is low, it will likely be a marginal speed bump.
• If adoption climbs into the 20% range, it very well might accelerate the open web’s fragility and further entrench the walled gardens.

Either way, the settlement signals a new enforcement model: privacy preferences aren’t just a browser toggle anymore. They’re baked directly into the ad auction itself. For advertisers, publishers, and intermediaries, the time to prepare is now.