IAB Tech Lab's Server-Side Shift Puts Privacy Trust on Publishers

Ad tech's move to server-side ad calls takes those calls out of the browser — and out of the user's sight. That trade-off sits at the center of the latest Digiday Podcast conversation with Rowena Lam, senior director of product, privacy and data at IAB Tech Lab, whose Trusted Server open-source software is the industry's biggest server-side play.

The industry rally around server-side technology follows Apple's identity resolution crackdown, and it dates back to the period when third-party cookies were under siege and signal loss ranked among publishers' top concerns.

"When this initiative first started, it was pretty clear that it was time for publishers to start thinking about not continuing to keep everything within the browser itself," Lam said.

Trusted Server promises publishers faster page-load speeds, greater control over their ad tech stacks and less exposure to browser-based blockades. But the mechanics matter for anyone watching their privacy.

What does the edge cookie actually do?

Trusted Server introduces the edge cookie, a server-side identifier websites assign to users. It is created partly by hashing a user's IP address via a secret key specific to the domain being visited.

Here's the catch: a person can clear their browser cookies, but if they revisit that site from the same IP address and the site uses the same secret key, a new edge cookie gets created that can be matched to the previous one — effectively undoing the cookie-clearing. If the publisher passes that identifier along via server-side calls to ad tech firms, those companies could use it as a persistent identifier linked to their existing ones, all beyond the user's visibility.

That's where the trust in Trusted Server really matters.

"That doesn't mean that the edge cookie itself automatically makes it to any of the downstream vendors the publisher engages with. And actually this is where the publisher does have more control. [The publisher] would have to proactively decide that this edge cookie gets sent to anyone. Nobody downstream would automatically receive an edge cookie," Lam said.

Lam also noted Trusted Server was designed from the start to support integration with consent management platforms, giving websites a way to share a user's consent status across the programmatic supply chain. That, too, requires users to trust the site to follow through.

Do publishers gain or just inherit risk?

Lam framed the server-side model as more privacy-preserving overall.

"Going server side I would consider just more privacy-preserving in general and lets publishers actually better respect the consumer's privacy choices ultimately because when it's not the browser and the publisher is not telling the browser 'go and call this particular partner' and the publisher themselves are controlling it, they can decide and be pretty surgical ultimately about who they would want to call, which partner and what data that partner can get," she said.

She acknowledged the transparency concern directly:

"There is a fear of just broadly server-side because it's not automatically observable to the consumer's browser and you can't automatically inspect it from that point. But what we've done for Trusted Server in particular is we've made sure all of this is considered. What's included in Trusted Server is pretty robust logging and auditing. Anyone who is looking to deploy Trusted Server gets that out of the box."

Trusted Server ships with no defaults, and IAB Tech Lab does not make legal determinations on publishers' behalf. Publishers must decide exactly how they operate on consumer privacy. As Lam put it: "it's not a matter of you're using trusted server and it's a free-for-all."

On client-side versus server-side risk, she argued the balance still favors servers:

"When we're talking client-side, there's a lot more oopsies that can happen, whereas server-side – if you configure it incorrectly, there could be an issue – but there's at least still a little bit more control."

Global privacy laws, she added, already mandate that publishers respect consumers' data choices regardless of where ad calls run.

The server-side shift doesn't eliminate the trust question — it moves it from the browser to the publisher, and every publisher deploying Trusted Server now owns that decision.