Can web users trust ad tech’s server-side shift?

In response to Apple’s identity resolution crackdown, the online ad industry has rallied around server-side ways to sidestep browser-based controls. IAB Tech Lab’s Trusted Server is the biggest example of this. Not only does the open-source software promise publishers faster page-load speeds, it enables publishers to better control their ad tech stacks and minimize their exposure to browser-based blockades. 

Trusted Server originated at a time when third-party cookies were under siege and signal loss was a major concern. 

“When this initiative first started, it was pretty clear that it was time for publishers to start thinking about not continuing to keep everything within the browser itself,” said Rowena Lam, senior director of product, privacy and data at IAB Tech Lab, on the latest Digiday Podcast episode.

Taking ad calls out of the browser, however, has the effect of taking them out of users’ sights. A browser can see – and block – the calls a web page asks it to make. Once the calls run on a publisher’s server, though, users have to trust the publisher to a greater degree. 

For example, Trusted Server introduces the edge cookie, which is a server-side identifier that websites use for users. The edge cookie is created, in part, by hashing a user’s IP address via a secret key specific to the domain the user is visiting.

The downside of this from a user privacy control perspective is the edge cookie can be used as a persistent identifier. A person can clear their browsers’ cookies, but if they visit that website again while connected to the same IP address and the website uses the same secret key, a new edge cookie would be created that can be matched to the previous edge cookie, effectively undoing the user’s cookie-clearing. And if the website passes on that edge cookie via server-side calls to ad tech firms and others, those companies would be similarly positioned to use the edge cookie effectively as a persistent identifier connected to whatever other identifiers they have in place, all beyond the user’s visibility.

And this is where the trust in Trusted Server really matters.

“That doesn’t mean that the edge cookie itself automatically makes it to any of the downstream vendors the publisher engages with. And actually this is where the publisher does have more control. [The publisher] would have to proactively decide that this edge cookie gets sent to anyone. Nobody downstream would automatically receive an edge cookie,” Lam said.

Lam also noted that Trusted Server was designed from the start to support integration with consent management platforms. That would give websites a way to share a user’s consent status across the programmatic supply chain. But of course, that requires the user blindly trusting the site to do so.

Here are a few highlights from the conversation, which have been edited for length and clarity.

Publishers control how data is passed

“Going server side I would consider just more privacy-preserving in general and lets publishers actually better respect the consumer’s privacy choices ultimately because when it’s not the browser and the publisher is not telling the browser ‘go and call this particular partner’ and the publisher themselves are controlling it, they can decide and be pretty surgical ultimately about who they would want to call, which partner and what data that partner can get.”

Trusted Server’s transparency

“There is a fear of just broadly server-side because it’s not automatically observable to the consumer’s browser and you can’t automatically inspect it from that point. But what we’ve done for Trusted Server in particular is we’ve made sure all of this is considered. What’s included in Trusted Server is pretty robust logging and auditing. Anyone who is looking to deploy Trusted Server gets that out of the box.”

Publishers as privacy linchpin

“There’s no defaults per se in trusted server. We’re not trying to make legal determinations on behalf of publishers. What we do require publishers to do is make decisions on what exactly and how exactly they want to operate as it relates to respecting consumer privacy. That is the piece that’s built in natively to trusted server. So it’s not a matter of you’re using trusted server and it’s a free-for-all.”

Client-side vs. server-side privacy considerations

“I don’t think this conversation of consumer trust is necessarily different when we are talking about going server-side. We’re in a world today also now that there are privacy laws, regulation globally that actually mandate that publishers respect consumers’ choices about how their data is used. You have to continue to do that and do that correctly. When we’re talking client-side, there’s a lot more oopsies that can happen, whereas server-side – if you configure it incorrectly, there could be an issue – but there’s at least still a little bit more control.”