Posted
CTV is currently managed across two parallel transaction systems, and the conversation about what that means for privacy hasn't really caught up yet.
On one side, you have programmatic CTV: DSPs, SSPs, open auctions, PMPs, and all the bidstream infrastructure the ad tech industry has spent years optimizing. On the other, the majority is direct sales automation movement that bypasses programmatic entirely, connecting advertisers to publisher ad servers for premium inventory without intermediaries.
The debate so far has centered on efficiency, economics, and fraud. But here's the thing: both paths create real privacy exposure, and neither is inherently solved.
The programmatic side: a familiar challenge
Programmatic CTV's privacy risks are structural. Every auction broadcasts device identifiers, IP addresses, and content signals to dozens of intermediaries, including bidders who don't win. Consent signals meant to flow through the IAB's Global Privacy Platform degrade as they pass through SSPs and exchanges, with no guarantee a consumer's original preference survives intact. And server-side ad insertion, the dominant delivery method in CTV, creates verification blind spots that legacy web-based tools weren't built to monitor.
The fraud numbers tell part of the story - Pixalate reported global programmatic CTV invalid traffic at 18% in 2025, with SSAI-delivered traffic running a massive 140% higher. But the privacy implications run parallel: if you can't fully verify what's happening in the supply chain from a fraud standpoint, you probably can't verify what's happening from a data-handling standpoint either.
The direct side: cleaner, but not clear
Direct sales automation solves a lot of these problems. When you transact at the ad-server level with a verified publisher, you eliminate bot traffic, spoofing, and the data leakage that comes with passing bid requests through a chain of intermediaries - that's genuinely significant.
But shorter supply chains don't always or automatically mean you are being compliant. Publishers running automated direct campaigns are building their own identity frameworks, activating first-party audience segments, a nd collaborating across data clean rooms for cross-publisher measurement. Each of these creates governance requirements (consent validation, data minimization, state privacy law compliance) that need continuous monitoring, not just a configuration checkbox during setup.
New state privacy enforcement kicked in across Kentucky, Rhode Island, and Indiana in Q1 2026, with updates coming in Connecticut, Colorado, and California. These laws don't distinguish between how an impression was bought. They care about whether the consumer's rights were respected.
The real question
If you've been in ad tech long enough, this moment feels familiar. When programmatic first arrived in display, it was the "remnant" channel, though to be messy, opaque, and low-value compared to direct sales. Over time, it matured and became the default. CTV may or may not follow that same arc (the supply is far more concentrated, giving publishers more leverage to keep premium inventory direct). But either way, the privacy challenge doesn't wait for the market to sort itself out - and with how sophisticated regulators have become, won’t wait.
What's needed is governance that works across both systems, not verification tools built for one supply chain and awkwardly retrofitted for the other. At Boltive, we think the answer is behavioral enforcement: continuously testing what actually happens when an ad serves, across real user journeys, rather than relying on what's supposed to happen based on platform configurations.
Because at the end of the day, the consumer on the other side of that CTV screen doesn't know or care whether their impression was transacted through a DSP or an automated IO. They just expect their privacy choices to be honored - and that expectation applies equally, regardless of the pipes.
The Governance That Failed Us: Why Digital Compliance Must Shift from Intent to Behavior
Go to Post
Text LinkThe Cost of Complacency: What the LinkedIn Privacy Lawsuit Means for Every Digital Brand
Go to Post
Text LinkAvoiding the Next Headline: What Privacy and Security Teams Need to Know Heading Into 2026
Go to Post
Text LinkThe Big Shifts Shaping the Future of Ad Tech: 3 Key Takeaways from the 2025 NAI Summit
Go to Post
Text LinkAI Adoption, Evolving Enforcement & the Convergence of Privacy & Security: 6 Big Takeaways from the 2025 PSF Spring Academy
Go to Post
Text LinkInside the California Law Association Privacy Summit: What Regulators Are Really Watching
Go to Post
Text LinkBoltive Launches New Product Ad Monitor: Revolutionizing Ad Insights with AI-Powered Discovery Engine
Go to Post
Text LinkIAPP GPS - Our Thoughts, Part 2: What Regulators Want Us To Do – The Value of Proactivity
Go to Post
Text LinkIAPP GPS - Our Thoughts, Part 1: What Regulators Want Us To Know – Busting Common Myths
Go to Post
Text LinkPrioritizing Children's Privacy: Strategies for Ethical Advertising and the Use of AI
Go to Post
Text LinkBusiness Ninjas Podcast - Secure Protection for Advertisers Against Invasive Media
Go to Post
Text LinkAutomating Threat Detection: How Boltive is Harnessing Artificial Intelligence to Reshape Ad Security
Go to Post
Text LinkForbes Article - The Privacy Prescription: Rules Restricting Health Data Use And How To Employ More Holistic Security Measures
Go to Post
Text LinkOur CEO, Dan Frechtling, featured on Leadership Live podcast with Daphna Horowitz
Go to Post
Text LinkWhy Data Privacy is Being Overhauled in 2023: Dan Frechtling featured on the Security Weekly Productions podcast
Go to Post
Text LinkOur Director of Product, Christine Desrosiers, discusses the current state of Ad Tech with Brand Safety Institute
Go to Post
Text LinkGeekwire wrote about the heartening link that brought our CEO and CFO to Boltive.
Go to Post
Text Link