Study Finds Ad-Tech Firms Attaching Human IDs to Bots

Full analysis

A new academic study says ad-tech companies are stamping real human tracking IDs onto bots, which makes automated traffic look like real people to advertisers. Researchers at Indiana University and the New Jersey Institute of Technology, working with Adalytics and DeepSee.io, looked at 18 vendors. Zeta Global's LiveIntent got called out as the worst. Criteo, ID5, and Experian's Audigent were caught handing different IDs to different paths inside the same auction. The Trade Desk came out nearly clean. Flashtalking was the only vendor never once caught serving human IDs to bots.

What's being decided here isn't whether this is fraud. The Media Rating Council, the body that accredits traffic-counting, confirmed it doesn't audit identity solutions at all. So no rule got broken. What's actually on the table: whether the authenticated-traffic premium survives, and who gets to write the credential standard that didn't exist yesterday. This is hard to undo once it moves, because the moment buyers stop trusting EIDs (persistent tags like a hashed email that follow a user across sites), the whole post-cookie identity pitch loses its reason to exist. No hard deadline, but the next identity renewal cycle sets the clock.

The Skeptic. Read the fine print before you panic. The MRC says this breaks no current invalid-traffic standard, which means every IVT warranty in your contracts still holds. Adalytics-branded studies have a track record of big headlines that shrink under procurement review, where methodology and sample size get real scrutiny. Criteo and ID5 handing different IDs to different supply paths could be deduplication logic, not fraud. And nobody serious ever thought a 60% match rate meant 60% humans. The real hole: almost no buy-side contract actually guarantees EID accuracy, so there's nothing to enforce. In plain terms, the industry is shocked to find the thing it never checked was dirty.

The Strategist. EIDs were sold as the clean replacement for third-party cookies. If they're being stamped on bots, the authenticated-traffic premium, the extra money buyers pay for inventory tied to a "real" logged-in person, has a crack running through it. The Trade Desk landing nearly clean is a gift to Unified ID 2.0, its industry ID standard, because now discipline is a selling point. Zeta Global's LiveIntent problem cuts at the center of its data story. Longer term this pushes money toward cleanrooms and publisher-first identity, where the ID never leaves a controlled space. Someone walks through the MRC audit gap within a year, and whoever writes that standard decides who survives the next identity shakeout.

The Market Analyst. Zeta Global takes the most concentrated reputational damage. LiveIntent is central to its differentiated data pitch, and "singled out for brazen behavior" in a paper with named university co-authors doesn't clear in one news cycle. Expect buyers to press on the ID graph during renewals, which pressures the stock the way doubt always does when the moat is the story. Criteo has more revenue to absorb this but adds another smudge to an already messy identity narrative. The Trade Desk and Flashtalking are the clean names, and I'd bet TTD cites this study in sales decks within weeks. In everyday terms: the companies that sell trust just failed a trust test, and investors reprice trust fast.

The Operator. Audit your EID ingestion now, not next quarter. If your SSPs are passing LiveIntent or Audigent IDs, your match rates are polluted and your frequency caps are broken against sessions that were never human. Retargeting breaks first. You're spending budget suppressing bots you logged as converted customers, and chasing bots you logged as warm prospects. At 90 days the second-order hit shows up: brand safety vendors spin EID integrity into a separate audit line, and onboarding gets slower for everyone. Your verification team needs a filter that cross-checks the ID against the user agent, the browser signature that says what's actually making the request. For a non-specialist: the plumbing that labels who's who was mislabeling robots as people.

The Customer / End User. Put the advertiser in the room. The CMO paying a premium for "authenticated audiences" just learned some of those authenticated people were bots wearing borrowed names. That's not an abstract methodology dispute, that's a line item that didn't deliver. A buyer asks their agency Monday: which of my vendors is on the clean list, and can you prove it? Flashtalking and The Trade Desk get a free referral out of this. Everyone else gets a procurement questionnaire. Buyers aren't shopping for better identity right now. They're shopping for the vendor that won't embarrass them in front of their CFO.

The tensions

Is this a scandal or a shrug? The Skeptic says no rule broke and buyers already discounted match rates, so this clears procurement and fades. The Market Analyst and the Customer say it doesn't matter that no rule broke, because the whole product was trust, and trust reprices on headlines, not on MRC bylaws. Both can't be right about Zeta.

Does this help or hurt the open-web identity project? The Strategist frames The Trade Desk as the cleanup winner, reinforcing EIDs through a disciplined standard. But if the authenticated premium itself is cracked, the cleanroom and walled-garden path that never passes an ID around at all becomes the winner, not the cleanest ID graph on the open web. Clean EID and no-EID are both reading this study as proof they were right.

Who writes the rule? Everyone agrees the MRC audit gap is the opening. Nobody agrees who fills it. IAB Tech Lab is the obvious vehicle, but the vendors who'd be graded are the same ones who fund the standards bodies. That's the catch.

What it hinges on

Two things. First, whether any buyer with real budget converts this study into a contract term, a measured match-rate guarantee with a penalty, rather than a strongly worded email. If they do, the authenticated premium reprices and the clean vendors win share. If they don't, the Skeptic is right and this fades by the next upfront. Second, whether the MRC or IAB Tech Lab actually stands up an identity audit, because an audit gap that stays a gap means "no rule broken" holds as the industry's defense indefinitely.

The council leans toward real damage for Zeta specifically and a slow repricing of the authenticated-traffic premium generally, but it does not lean toward a fast regulatory fix. The incentive to keep the gap open is too strong. The vendors who'd fail the audit are the ones who'd pay for it.

What to de-risk before acting: pull your own EID-to-user-agent cross-check on live inventory this week. Don't wait for the standard. The companies that can show buyers a clean audit of their own pipeline win the renewal conversation whether or not the MRC ever shows up.

Prediction: Neither the MRC nor the IAB Tech Lab will launch an accreditation or audit program specifically for identity solutions (EID integrity) before the end of 2026, despite this study exposing the gap.

Confidence: Medium. The bodies move slowly and their funders would fail the audit.

Why: The study's whole finding rests on the MRC confirming it does not audit identity solutions, so there is no existing program to invoke and a new one has to be built from scratch. Standards bodies like the MRC and IAB Tech Lab are funded and staffed by the same vendors who would be graded, including the ones caught here, which means there is no fast incentive to stand up a test that several members would fail. The opposite outcome, a credential program within two months, would require these bodies to move faster than they ever have on a measurement standard and to do it against their own members' interests, which is why it's the less likely path. The pressure is real, so this lands in 2027 at the earliest, not by year-end.

Revisit by 2026-12-31: We're right if neither the MRC nor the IAB Tech Lab has publicly launched an identity-solution audit, accreditation, or certification program by December 31, 2026. We're wrong if either body launches or formally opens enrollment for such a program before that date.

This is a status-quo call, and it earns its place because the reader is being told a regulatory door is open and someone will walk through it. The force holding the door shut is that the people who'd have to build the lock are the ones it would lock out.