Reclaim your real estate: How publishers can kick third-party tags to the curb

The erosion of publishers’ control of their online real estate is a familiar tale, but a new wave of threats is emerging, as Mezzobit research has discovered. The outcome isn’t positive for either site operators or their audiences.

The first wave of land grabs began during the Web 2.0 era in the early part of the last decade as a flood of technology companies offered services enabled by the proverbial “single line of code” inserted into the page. This was followed by the programmatic revolution years later that triggered another explosion of tags.

Tags provide nearly unfettered access to visitors and data about their interactions. Great for transactions that bring value to the publisher, but the same tags can also result in added latency, data leakage, compliance issues, and nefarious problems like malware.

The average page now has 101 tags from 14 different vendors. Over the same two-year period, we also saw pages become about 20 percent slower, although part of this increase is attributable to the rise of video.

Tags are like icebergs: what lies beneath the surface is often much larger than what is immediately visible. We have seen tag chains more than 30 layers deep — one tag calling another — bringing in 300+ other tags. In addition to damaging the user experience, this “deep chain” makes it much harder for the publisher to understand and control which vendors interact with its visitors.

A few trends are powering this latest wave of incursions:

Problem:  Poor header bidding implementations

First came single bidders, then multiple bidders, then containers, then multiple and cascading containers, but more is not necessarily better. A header bidding container we examined called in nine bidders that in turn brought in 24 additional tags from 19 vendors.

Research has shown diminishing yield returns  on excess bidders after a certain point, but publishers still seem to be loading up on bidders and containers in hopes of goosing CPMs. Even though server-side bidders are on the way, they won’t fully replace client-side bidders for some time, so this issue isn’t going away soon.

Solution:

Publishers engaging in header bidding or fine-tuning existing implementations must first understand who their most valuable exchange partners are based on a combination of yield, demand diversity, ad quality, or other key business drivers.

Assemble a portfolio of bidders that both compete and complement, and then determine the best way to deploy them. Containers provide administrative efficiency, but often introduce their own problems. Look at how the containers sequence the bidders. Some feel that random bidder rotation is best, but that also means if one of your partners is often superior to others, this method only leverages that advantage part of the time.

Whether using containers, standalone bidders, or a combination, you’ll need to balance bidder timeouts against yield, as the fastest bidders aren’t necessarily the ones with the highest-priced bids.

Also look at the underlying demand sources using a page scanning tool, as each one brings in a cookie-synching call. Where there are exchanges with high duplication, eject the lower valuation partner to reduce the overall tag load. This is true for programmatic transactions anywhere in the page.

Problem: Tags coming in where they’re not supposed to

The publisher page is like a raucous party without a bouncer at the door: if a tag wants to bring in other third parties without checking with the site operator, it’s hard to detect and even harder to stop.

One popular shortcut is for third parties to call in their own Google Analytics, comScore, Nielsen and Quantcast tags. In one case we found more than 200 analytics account IDs not belonging to the publisher in the course of a single month. Some appeared on every pageview. A closer look found these analytics tags hanging off a variety of vendors, such as commenting widgets, video players, ad providers, social sharing tools, and WordPress plug-ins.

Data management platform tags and cross-device pixels similarly sneak in through non-ad vendors, raising a suspicion of unauthorized retargeting. More innocent problems, such as repeated loading of JavaScript libraries such as jQuery, can cause performance problems.

Solution:

While most publishers run new technology in a sandbox environment before pushing to production, they often only look at obvious problems like errors or breaking other page elements. They should expand this to observe a few hundred pageviews to see what potentially unexpected third party calls are made.

Some larger publishers use third-party services to scan varied ad creative, but most publishers rely on the ad quality measures of their exchange partners to ensure unusual or malicious payloads don’t slip through. Some of the most cautious publishers are found in the healthcare space — where regulations relating to data leakage are much tighter — and they set up proxy servers to introduce a scanning checkpoint for all third-party calls.

Publishers should ensure that their contracts enumerate what partner technology can and cannot do. Boilerplate often includes references to malware, but publishers also should insist on listing all cookies dropped and their purpose as well as approving any third-party access beyond the contracting vendor. Publishers can get valuable protection by working only with exchanges that have a proven record for ad quality.

A rise of technology vendors who mask their identity — about 5 percent of the total — also should be viewed with great suspicion. Mezzobit’s data team has built a database of over 3,000 technology companies, and when investigators pull back the veil on these masked tags, most belong to young start-ups or second/third-tier vendors.

Problem: Poor management of on-page real estate

Once tags find their way onto a page, it’s often hard to dislodge them. Most site operators have procedures for onboarding new vendors, but they rarely evaluate existing tags for continued business value unless there’s a redesign or re-platforming.

Many sites deliver a full load of tags to every user, whether or not it’s appropriate for their use case. As mobile traffic grows and most publishers handle it through responsively designed pages, this has a severe impact on page latency and bounce rate.

Solution:

Periodic audits–at least annually–can easily clip this problem, although a constant churn of vendors demands continual vigilance. Publishers have increased enthusiasm for such spring-cleaning, as ad blocking rates creep upward due to site latency and consumer privacy concerns.

Use of a tag management system (TMS) can decrease the overhead related to administration as well as the time to bring a new tag live (or kill obsolete code). TMSes aren’t optimal for all tags, and typically perform better with analytics tags than ad-related code. As with bidder containers, implementing a TMS carelessly can create more headaches than it solves.

However, TMSes can eliminate the problem of carpet-bombing users with every tag under the sun. By targeting tags based on user platform, referrer, and other characteristics, overall page weight can be reduced.

Industry wide standards like Trustworthy Accountability Group and the IAB’s LEAN ad standards are also taking aim at these issues. On the brand side, the Association of National Advertisers continues to push for simplification in the digital ad supply chain.

Outside of the digital walled gardens, we’re not going to see a return to the analog days when publishers had an iron grip on their audiences. But with a bit more focus on technology and governance, site operators have it in their power to restore order and speed to their digital properties.