How to Protect Your Privacy From Real-Time Bidding

Every time you load a webpage or open an app, an invisible auction takes place in milliseconds. Your location, browsing history, device details, and personal interests are packaged into a "bid request" and broadcast to thousands of advertisers competing for your attention. This process is called real-time bidding (RTB), and it is one of the largest mass data-sharing systems ever created. Here is how it works, why it threatens your privacy, and what you can do about it.

What Is Real-Time Bidding?

Real-time bidding is the automated process that powers most of the online advertising you see. When you visit a website that displays ads, a chain of events fires in less than 100 milliseconds:

1. The website sends your data to a Supply-Side Platform (SSP), which represents the publisher selling ad space.
2. The SSP forwards a bid request containing your personal information to one or more ad exchanges.
3. The ad exchanges broadcast that bid request to potentially hundreds or thousands of advertisers and their Demand-Side Platforms (DSPs).
4. Advertisers evaluate your data, decide how much your attention is worth, and submit bids.
5. The highest bidder wins and their ad loads on the page — all before the page finishes rendering.

This happens billions of times per day across the internet. The scale is staggering: the global RTB market processes an estimated 700 billion bid requests daily.

What Personal Data Is in a Bid Request?

This is where the privacy problem becomes clear. Each bid request can contain a surprising amount of personal and sensitive data, including:

• Unique advertising IDs — device identifiers (such as mobile advertising IDs or cookie-based IDs) that can track you across sites and apps
• IP address — which reveals your approximate location and can be linked to your household
• GPS-level location data — especially from mobile apps, sometimes accurate to within a few meters
• Browsing history — the pages you have visited and the content you have engaged with
• Device information — your operating system, browser, screen resolution, and hardware details
• Demographic data — inferred age, gender, income bracket, and household composition
• Interest categories — topics and products you are believed to be interested in, often including sensitive categories like health conditions, political leanings, or financial status

Why RTB Is a Serious Privacy Threat

Massive, Uncontrolled Data Leakage

RTB creates what privacy researchers call a "data free-for-all." Once your data leaves the bid request, there is no technical mechanism to ensure it is deleted by the hundreds of parties that received it. Many companies store this bidstream data and use it for purposes far beyond advertising.

Data Brokers Exploit the System

Data brokers have been caught purchasing bidstream data to build surveillance profiles. In 2024, the FTC took enforcement action against Mobilewalla for collecting RTB data and using it to track consumers visiting sensitive locations including reproductive health clinics, places of worship, and homeless shelters — all without consumer consent.

National Security Risks

Researchers and government officials have warned that RTB data poses a national security threat. Because anyone can participate in ad exchanges as a buyer, foreign intelligence services can potentially access real-time location data and behavioral profiles of military personnel, government employees, and political leaders — all through the advertising ecosystem.

Surveillance and Profiling

Bidstream data has been used to track union organizers, identify political protesters, and even out individuals based on their visits to specific locations. The Electronic Frontier Foundation has documented how the advertising ecosystem effectively functions as a surveillance infrastructure.

Google's RTB Control: A New but Limited Option

In March 2026, a federal judge approved a class-action settlement requiring Google to create a new privacy setting called RTB Control. When enabled, it strips key identifiers from bid requests — including encrypted user IDs, device advertising IDs, and IP addresses — and blocks cookie matching, a technique used to link your data across platforms.

Google rolled out RTB Control in April 2026, emailing every U.S. Gmail user with a link to enable it. However, the judge who approved the settlement described it as "adequate, but by no means excellent," because the control is opt-in, not opt-out. Users must actively seek it out and turn it on. Research consistently shows most people never change default settings.

How to Protect Yourself From RTB

No single step eliminates RTB tracking entirely, but combining several strategies significantly reduces your exposure:

1. Use a Privacy-Focused Browser

Firefox and Brave offer built-in protections against many tracking mechanisms that feed RTB. Brave blocks ads and trackers by default, and Firefox's Enhanced Tracking Protection limits cross-site cookies and known trackers.

2. Install Privacy Extensions

Install uBlock Origin to block ads and trackers before they can initiate RTB auctions. Add Privacy Badger from the EFF, which learns and blocks trackers that follow you across sites. These extensions prevent many bid requests from ever being sent.

3. Disable Your Mobile Advertising ID

Your phone's advertising ID is a key identifier used in mobile RTB. Disable or reset it:

• iPhone: Settings > Privacy & Security > Tracking > toggle off "Allow Apps to Request to Track"
• Android: Settings > Privacy > Ads > select "Delete advertising ID"

4. Use a VPN

A VPN masks your IP address, removing one of the key data points from bid requests. Choose a reputable, no-log VPN provider.

5. Opt Out of Personalized Advertising

Visit the Digital Advertising Alliance's opt-out tool at optout.aboutads.info and the Network Advertising Initiative's opt-out page at optout.networkadvertising.org. Also check Google's Ad Settings, Apple's privacy settings, and individual app permissions.

6. Switch to Privacy-Respecting Services

Consider moving away from Gmail and other free services that rely on advertising revenue. Privacy-focused email providers, search engines, and browsers reduce the amount of data available to the RTB ecosystem in the first place.

7. Remove Your Data From Brokers

Even if you block RTB tracking going forward, data brokers already hold years of information about you — much of it sourced from bidstream data. PrivacyOn removes your personal information from 100+ data broker and people-search sites, cutting off one of the key downstream uses of RTB data. When brokers cannot match your profile with enriched data, the bid requests that do get through become far less valuable to advertisers.

Why Blocking RTB Matters

Real-time bidding is not just about annoying ads. It is a system that broadcasts intimate details about your life — where you go, what you read, what health conditions you research, what your political views might be — to thousands of unknown entities, billions of times per day. The data collected through RTB has been used for surveillance, discrimination, and exploitation.

Taking steps to limit your exposure to RTB is one of the most impactful things you can do for your digital privacy. Start with the tools above, enable Google's new RTB Control, and consider a comprehensive privacy service like PrivacyOn to handle the data that has already been collected. Your browsing habits are not commodities — protect them accordingly.