The supply-chain files, traffic-quality checks and privacy signals behind every impression HBDR sells, and the current version of each standard.
Before a buyer bids, it checks the impression against public files and signals: ads.txt on the publisher's domain, sellers.json on each seller's domain, the SupplyChain object in the bid request and the consent string that travels with it. This page explains each standard as it stands in October 2026 and how HBDR applies it.
Each file and signal below answers one buyer question: is this seller authorized, and who touched the impression on its way to me?
Every publisher in our network maintains an up-to-date ads.txt file listing HBDR as an authorized seller. We proactively monitor and manage ads.txt entries to prevent unauthorized inventory reselling and ensure buyers always know they're purchasing legitimate inventory.
HBDR maintains a complete and transparent sellers.json file, providing buyers with full visibility into who is selling inventory on our platform. Every publisher relationship is documented and verifiable.
For our in-app publishers, we implement and maintain app-ads.txt to authorize legitimate ad sources and prevent mobile ad fraud across our app inventory.
We pass complete supply chain objects in every bid request, giving DSPs and advertisers full transparency into every node in the supply path from publisher to buyer.
| Standard | Where it lives | What it tells a buyer | Current version |
|---|---|---|---|
| ads.txt | The publisher's root domain, at /ads.txt | Which ad systems and account IDs may sell the site. DIRECT means the publisher controls the account; RESELLER means it has authorized another company to sell through it. | v1.1 (August 2022) adds OWNERDOMAIN and MANAGERDOMAIN |
| app-ads.txt | The developer website named in the app store listing | The same authorization for in-app inventory. Google finds the file only if the store listing names a developer website. | v1.1, shared with ads.txt |
| sellers.json | Each SSP's and exchange's own domain | Who is behind each seller ID: PUBLISHER (owns the inventory), INTERMEDIARY (resells it) or BOTH. A buyer matches the ID to the ads.txt line. | Finalized July 2019 |
| SupplyChain object (schain) | Inside every bid request | Every company that handled the request, one node each (asi, sid, hp). complete = 1 says the chain reaches back to the inventory owner. | source.schain in OpenRTB 2.6; source.ext.schain in 2.5 |
Sources: IAB Tech Lab ads.txt 1.1, sellers.json and SupplyChain object specifications; Google AdMob Help, app-ads.txt.
We use multiple layers of fraud detection including pre-bid filtering, real-time monitoring, and post-bid analysis to identify and block bot traffic, click fraud, and other forms of invalid traffic.
Real-time creative security scanning that detects and blocks malicious ads, forced redirects, and cryptomining scripts before they reach users.
Automated malvertising protection that scans every creative for quality, security, and compliance violations in real time.
HBDR adheres to TAG's anti-fraud guidelines and participates in industry-wide efforts to combat ad fraud and protect advertiser spend.
Continuous monitoring of traffic patterns across all publisher properties to identify anomalies, suspicious spikes, and potential fraud indicators.
Consent and opt-out signals travel with each ad request: the TCF string for Europe, GPP for US states, and Global Privacy Control from the browser.
Full compliance with the EU General Data Protection Regulation. We implement proper consent collection, data processing agreements, and user rights management across all European traffic.
Compliance with California Consumer Privacy Act and California Privacy Rights Act, including support for US privacy signals and Global Privacy Control. California requires a business to treat Global Privacy Control as a valid opt-out of sale and sharing. The older US Privacy String was deprecated on 31 January 2024 in favour of GPP.
Integration with IAB Europe's Transparency and Consent Framework, ensuring proper consent signals are passed through the programmatic supply chain. TCF v2.3 is the current version: since 28 February 2026 every TC string must carry the Disclosed Vendors section.
We work with leading Consent Management Platforms (OneTrust, Cookiebot, Didomi, etc.) to ensure publishers collect and manage user consent properly.
Support for IAB Tech Lab's Global Privacy Protocol (GPP), one string that carries the privacy signals of several jurisdictions: the US National section, US state sections, and the TCF for Europe and Canada.
We follow data minimization principles — we only collect and process data that is necessary for ad delivery and do not build user profiles or sell personal data.
Twenty US states have a comprehensive privacy law in effect in 2026. Indiana, Kentucky and Rhode Island joined on 1 January 2026. Google Ad Manager accepts only the GPP sections for US National, California, Colorado, Connecticut, Florida and Virginia. An opt-out of sale, sharing or targeted advertising in the US National section makes Google switch to restricted data processing.
The FTC's amended COPPA Rule took effect on 23 June 2025, and operators had until 22 April 2026 to comply. A child-directed site or app now needs separate verifiable parental consent before it discloses a child's data to third parties such as ad networks. Bid requests for that inventory carry the OpenRTB flag regs.coppa = 1.
Sources: IAB Europe, TCF v2.3; IAB Tech Lab, GPP and USPrivacy; Google Ad Manager Help, GPP; California Privacy Protection Agency FAQ; MultiState, Feb 2026; Federal Register, COPPA Rule, 22 Apr 2025; IAB Tech Lab, OpenRTB 2.6.
| Program | Scope |
|---|---|
| TAG Certified | Trustworthy Accountability Group certification across anti-fraud, brand safety, and anti-piracy programs |
| IAB Member | Active member of the Interactive Advertising Bureau, participating in industry standards development |
| IAB Tech Lab | Compliance with IAB Tech Lab specifications including OpenRTB, ads.txt, sellers.json, and prebid standards |
| Google Certified Publishing Partner (GCPP) | Certified by Google as a trusted partner for publisher monetization through Google Ad Manager and AdX |
| Prebid Member | Active participant in the Prebid.org community, contributing to open-source header bidding standards |
| Coalition for Better Ads | Adherence to the Coalition for Better Ads standards, ensuring ad formats meet user experience guidelines |
HBDR is a full-service ad technology and ad operations company serving publishers and advertisers across every channel, format, and device.
Client-side and server-side header bidding setup, optimization, and management using Prebid.js and server-to-server integrations
Complete GAM account setup, configuration, yield management, and ongoing ad operations
Open exchange, PMP, PG, and Preferred Deal management across all major SSPs and exchanges
Instream, outstream, and OTT/CTV video monetization with our custom-built high-performance video player
Standard display, rich media, and native ad format optimization for maximum RPMs
Mobile app ad monetization across banner, interstitial, rewarded video, and native formats
Implementation of UID2, LiveRamp, ID5, and other identity solutions for traffic with no third-party cookie: Safari and Firefox by default, and Chrome users who block them
Malvertising protection, creative scanning, and brand safety controls across all inventory
GDPR/CCPA/GPP compliant consent collection and signal propagation
Real-time revenue dashboard with granular breakdowns by every dimension
Data-driven ad placement and layout testing to maximize revenue without hurting UX
Dynamic and rule-based floor pricing strategies to capture maximum value from every impression