From ADOTATThe Field Kit: LiveIntent Sells "Authenticated" Reach. A Bot Got Authenticated.
LiveIntent Sells "Authenticated" Reach. Nobody Audits the ID Riding on Your Bid.Pick
Start with the finding. A peer-reviewed study at ACM's Internet Measurement Conference followed the HTTP Archive crawler, a bot that says it is a bot and has sat on the IAB Tech Lab Spiders and Bots list since 2013, through header bidding from 2022 to 2025. Seventeen of the eighteen ID vendors it met gave it an identity anyway, LiveIntent, ID5, Criteo, The Trade Desk and Experian's Audigent among them. Only Flashtalking said "Bot." LiveIntent tells Prebid its graph is authenticated daily through newsletter engagement. The crawler has never opened a newsletter.
ADOTAT's follow-up kit explains why a buyer should care, and it is about money, not manners. An ID is what turns a cheap impression into an expensive one. It lifts the bid, it puts the impression in your "authenticated audience," and it often drags a data fee onto your invoice. The kit traces the damage through five stops: the page, the auction, the targeting, the counting and the invoice. At the counting stop, vendors sent different IDs to competing exchanges on 18% of page views. One visit, two "people." Your reach looks bigger and your frequency cap leaks.
Here is the gap nobody owns. The Media Rating Council told Jack Neff it does not audit or accredit any identity provider. Your verification vendor grades the impression. Nobody grades the identity riding on it. Kean Graham of MonetizeMore put the incentive plainly: attaching an ID costs the vendor nothing and refusing costs them a bid. He sells bot filtering, so weigh it. He is still right.
The kit's answer is homework, not outrage. Get your ID roster by vendor from your DSP. Join your invalid traffic flags to the IDs that still carried a fee. Ask each vendor for 30 days of the requests it refused. Have a developer point an honest headless browser at a staging page and see who hands it an ID. Then put "fee follows validity" in the contract. As of Thursday morning no vendor had answered ADOTAT's questions. Selling identity is a business model. Selling identity you never checked is the problem.
Expanded from ADOTAT's Nov. 5 Field Kit, which draws on the peer-reviewed ACM IMC '26 paper by researchers at Indiana University, NJIT, Adalytics and DeepSee.io, ADOTAT's Nov. 4 report on it, vendor documentation, the Media Rating Council's statement to Jack Neff, and Kean Graham's written answers to ADOTAT on Nov. 3 and 4. The study covered HTTP Archive crawler traffic in header bidding to six SSPs from January 2022 to May 2025; the researchers could not decrypt the IDs, so nothing here says what any ID resolved to. Zeta Global (LiveIntent), Experian (Audigent), Mediaocean (Flashtalking), Criteo, Lotame and the paper's authors had not responded as of Thursday morning; ID5, The Trade Desk, Yahoo, PubMatic, OpenX and Magnite had not answered earlier ADOTAT inquiries. The checks and clauses are a buyer's tools, not legal advice. ADOTAT discloses that Graham's company sells the invalid traffic filtering he recommends, that two of the paper's authors work at Adalytics and DeepSee.io, and that the publisher has known executives at several companies named here for about two decades, including as a competitor. ADOTAT is reader-supported, with no paid placement in editorial.