Researchers use ad creatives to infer tracker-advertiser links
Researchers Maaz Bin Musa and Rishab Nithyanand have developed ATOM, a novel, generalizable technique to infer data sharing relationships between online trackers and advertisers. Unlike prior methods, ATOM is independent of ad delivery protocols or specific artifacts, instead leveraging personalized ad creatives to detect when blocking a tracker affects an advertiser's ability to deliver targeted ads. This research aims to provide a tool for auditing compliance with privacy regulations like CCPA and GDPR, which require disclosure of data sharing partners.
Key Takeaways
- ATOM uses personalized ad creatives, not bid values or protocol-specific artifacts, to infer tracker-advertiser data sharing.
- The test deployment analyzed nine advertisers and reported 100% model accuracy for OpenX, Exponential Advertising Intelligence, and The Trade Desk.
- Table 3 linked OpenX to Oracle and Alphabet, Pubmatic to Alphabet, and Media Math to OpenX and Facebook.
- The researchers generated 5.3M ads, with 31.5K unique creatives, across 5,400 personas and six interest groups.
- ATOM validated some inferences with CCPA disclosures, KASHF bid analysis, and cookie-syncing logs.
Why It Matters
ATOM gives auditors a way to test whether advertisers and trackers are sharing data even when the exchange happens server-side or through other paths invisible to a browser. That matters because the paper ties the method directly to disclosure rules in GDPR, CCPA, and CPRA, and shows it can surface relationships missed by earlier header-bidding or retargeting-based approaches. The broadest signal to watch is whether auditors can reproduce ATOM’s advertiser-level results, especially the nine models that cleared the paper’s 60% holdout threshold.
Additional Context
The introduction of ATOM coincides with a period of intensified enforcement by European and U.S. regulators against opaque tracking practices. Per IAPP in January 2025, behavioral advertising and the future of cookie-based tracking remained central to ad tech policy, as privacy authorities in the Netherlands, France, and Denmark cracked down on non-compliant cookie walls and unclassified trackers. These enforcement actions often highlight a 'visibility gap'—where companies disclose some partners while internal data exchanges remain obscured from the consumer. Regulatory pressure is increasing for both publishers and the platforms that facilitate ad delivery. According to analysis from AO Shearman in October 2024, data protection authorities across the EU have pivoted toward the automation of cookie compliance assessments to proactively identify infringements. This trend mimics the methodology utilized by ATOM, suggesting a future where regulators use similar algorithmic tools to conduct large-scale, automated audits of the online advertising ecosystem. Simultaneously, the enterprise privacy market is evolving to meet these demands through AI-driven auditing. Per Scytale in May 2026, leading compliance platforms such as OneTrust and Ketch are now prioritizing continuous control monitoring and automated evidence collection to maintain alignment with multi-framework regulations like SOC 2 and GDPR. The academic development of techniques like ATOM provides the technical foundation for these commercial tools to better map third-party risk and verify the integrity of Do Not Sell/Share signals across increasingly fragmented advertising stacks.
Read full article at petsymposium.org
Get this in your inbox → Subscribe
Enjoy our coverage?
Add StreamingMeme as a preferred source on Google to see more of our streaming news at the top of your Search results.
Add as preferred source