Colossus SSP alleged to mismatch user IDs

A supply-side platform (SSP) has been discovered to be declaring mismatched user IDs during specific transactions, causing some partners to question its techniques and put their relationship on pause.

Colossus SSP has been singled out in a new report by Adalytics, which analyses media buys on behalf of agencies and brands, as misdeclaring the IDs assigned to a given user during transactions run through demand-side platform (DSP) The Trade Desk.

Adalytics said it examined the source code of ads and bid responses served by The Trade Desk on behalf of different advertisers and on publisher properties from large national publishers to local news, blogs and specialised sites.

It studied whether an actual user ID stored in a user’s Chrome browser cookie storage matched with how 16 SSPs declared user IDs during bid transactions to uncover cases of ID stuffing.

The firm claims to have found only one SSP to report a different ID in the auction to the actual user ID: Colossus SSP.

Two publishers who spoke with Campaign US on background were able to verify that when they made calls through Colossus SSP, the bid that was returned through The Trade Desk assumed a different user ID from their own. This was based on Chrome browsers that have cookies enabled.

There could be various explanations for this mismatch.

Colossus SSP parent company Direct Digital Holdings said in a statement it “does not add or pass any Trade Desk user IDs in the bid request” because it transacts via Bidswitch, a “middleware” provider which connects various SSPs with DSPs. It said Adalytics' report is “riddled with false and misleading information.”

However, other SSPs that transact via Bidswitch do not appear to have user ID matching issues. Adalytics said it observed no discrepancies from TrustX, another SSP which appears to integrate with Bidswitch, when transacting with The Trade Desk. A media owner told Campaign US it works with several SSPs that funnel through Bidswitch and has not witnessed similar problems.

Bidswitch, owned by Criteo, hit back at any allegations that its technology could be causing the ID mismatch. It said it operates as a neutral “passthrough” platform, sending traffic from SSPs to DSPs “without manipulating the content of bid requests from SSPs or bid responses from DSPs.” 

“Bidswitch has been doing this for over 11 years with hundreds of partners throughout the industry, including the very largest,” Criteo general counsel Ryan Damon said in a statement.

“Any claims or implications by Colossus SSP that Bidswitch is to blame for Colossus SSP’s manipulation of the content of bid requests are untrue and we encourage all parties to investigate further into the merits of any such statements before publishing untrue statements,” Damon added.

Direct Digital Holdings followed up with a new statement on Friday: “As a long standing partner of Bidswitch over the last five years, we are confident they are following protocol and honouring their position in the value chain. The only issue here is the false and misleading research report from Adalytics.” 

Why ID mismatches can occur

Publishers and SSPs have been known to purposefully switch user IDs in order to make users appear to have desirable attributes so they can elicit higher bids. For instance, a user ID that appears to be associated with a doctor would attract pharmaceutical advertisers at higher rates.

A media owner told Campaign it had suspected “a couple of SSPs” of this activity in recent years.

A Direct Digital Holdings representative denied Colossus has engaged in “improper activities” such as ID switching, ID stuffing or ID bridging, whereby a publisher or SSP can connect an old user ID to a cookieless user via signals like an IP or email address.

“Direct Digital Holdings operates its Colossus SSP platform with transparency and in compliance with all applicable laws and industry standards,” the representative said.

They said Colossus SSP “has always been diligent when it comes to quality and transparency, working with Human, Confiant, Moat and other trusted industry partners to ensure we meet the highest standards in supply.”

However, multiple partners within the ad tech supply chain expressed concerns about the reliability of verification partners, with issues often slipping through the cracks. For example, none of the MRC-accredited ad verification platforms flagged Forbes’ recently uncovered made-for-advertising subdomain, per Adalytics’ report.

“We do have the systems set up, whether Tag or MRC, to accredit companies who are supposed to catch this. The primary problem here is that that system is not working,” said Jay Friedman, CEO of advertising agency Goodway Group, which uses analytics providers to help root out fraud and waste over verification providers.

The ID mismatch could be due to a technical issue, such as users browsing in incognito mode or storing multiple cookies. But four partners within the ad tech supply chain who spoke with Campaign on background suggested such technical issues would be unlikely to affect only one seller. 

Impacts on Colossus

Colossus is a relatively small SSP. One media owner said Colossus accounts for less than 10% of its total fill rate; another put the figure at less than 5%. The SSP has a focus on diverse-owned and operated publishers. 

Due to Colossus’ size, it can be easier for partners to hit pause. One media owner said it had suspended working with Colossus until it can get to the bottom of the ID issue. Another said it wouldn’t remove Colossus from its partner list so long as it continues to be paid on time.

DSPs have flagged issues with Colossus in the past. Google identified an issue with some bid requests from the SSP last fall within its DSP DV360 and immediately paused traffic on the inventory in question. It ended up issuing refunds to impacted advertisers and resumed its relationship with Colossus after the issue was rectified.

“Google has strict policies and robust enforcement systems to protect advertisers, publishers and people against invalid traffic. Late last year, our teams identified a source of invalid traffic that did not adhere to our guidance around how signals are shared in bid requests and took prompt action,” a Google spokesperson said.

Direct Digital Holdings CEO Mark Walker said that the company has a policy to correct any issues flagged by partners “within 24 to 48 hours.”

“When we identify an issue, we correct it,” he said.

Walker denounced any suggestions that Colossus’ ID mismatch was related to the holding company’s financial situation. Direct Digital Holdings’ share price has fallen 59% in the past month.

“The financial solvency of our company is very sound,” he said, adding that it remains profitable and its first-quarter performance was “up 20% year over year.” 

Below is Direct Digital Holdings’ full statement in response to Adalytics’ report:

“At Direct Digital Holdings integrity, accountability, and transparency make up our company's core values.

“Unfortunately, we believe that there has been a concerted effort to seek financial gain by attempting to discredit the performance and operations of DDH. To be clear, DDH remains operationally well-positioned and financially strong with estimated 2023 FY earnings of $157 million and is experiencing continued growth into 2024. We maintain a solid financial relationship with our partners and are committed to continuous improvement and strengthening our products and services. We have learned that there is a so-called research report from Adalytics, a for-profit entity, making intentionally false, misleading, and inaccurate statements that do not accurately represent the connections within the programmatic value chain and the role of Colossus SSP through The Trade Desk.

“Because Colossus SSP is not directly connected to The Trade Desk, but rather through a publicly traded intermediary, Colossus SSP does NOT add or pass any Trade Desk user IDs in the bid request in accordance with Open RTB protocols and The Trade Desk requirements. Furthermore, Colossus SSP has always been diligent when it comes to quality and transparency, working with HUMAN, Confiant, MOAT and other trusted industry partners to ensure we meet the highest standards in supply. As we have in the past, we will continue to work with The Trade Desk to resolve any concerns that they may have.

“Despite our repeated requests to see the report, Adalytics refused to allow us to review the report prior to its publication, which we believe falls in line with a prior record of Adalytics seeking attention instead of accuracy. We will vigorously defend our company’s reputation and will pursue all appropriate legal actions and remedies to address these intentionally false statements and fundamental misrepresentations.”