Programmatic Advertising & Espionage: Advertising Intelligence 🕵️

By Max Legrand · GreyFox Ads · Privacy & Open Web

There is a dark side to digital advertising. An investigation reported by French newspaper Le Monde has brought attention to how in-app bid request data can be used to infer sensitive locations and movements. And this is not the kind of targeting any of us should be proud of. 😰

1. What did the French investigation reveal?

Journalists at Le Monde obtained millions of in-app bid request (BR) logs and examined records associated with GPS coordinates around highly sensitive sites in France, including the DGSI, DGSE and military facilities.

Their reported approach was unsettlingly straightforward: identify recurring advertising IDs in requests associated with those locations, then look for the same identifiers elsewhere in the available logs.

That could reveal other locations visited by devices associated with those IDs. A recurring device identifier does not, on its own, prove a person's identity or employment (and location records may be inaccurate), but the potential for sensitive inference is clear.

For the original reporting, see the Le Monde investigation and Micode's interview with journalist Martin Untersinger.

2. How can programmatic bid requests reveal location data?

A bid request is the technical message that offers an advertising opportunity to potential buyers. Depending on the app, permissions and technical configuration, that message may include information such as a mobile advertising identifier and location signals.

In the scenario described in the investigation, the risk comes from linking records across multiple auctions: a stable identifier combined with precise GPS coordinates can create a trail of places associated with a device.

That is why data minimisation matters. A piece of information that seems useful for one advertising decision may become highly revealing when it is collected repeatedly and combined with millions of other records.

3. Why is the Open Web app ecosystem particularly exposed?

Here in France, this raises an uncomfortable question for the programmatic industry: who receives the information sent through our advertising pipes?

Unlike a tightly controlled walled garden, an open in-app advertising supply chain can involve several intermediaries. App ad servers may send bid requests to connected SSPs and other authorised partners; requests can then reach DSPs and, in some configurations, bid listeners.

Not every participant necessarily receives precise GPS data, and transmission depends on technical choices and applicable consent. But every unnecessary recipient increases the potential exposure of sensitive information.

Transparency in auction mechanics is useful. Unrestricted disclosure of personal data is not. The two should never be confused.

4. Two technical ways to reduce advertising intelligence risks

The original GreyFox Ads post highlighted two directions for protecting the in-app ecosystem:

• 🛡️ Reduce location precision: replace exact GPS coordinates with coarser geographical signals, such as postcodes, when appropriate. (Even coarse location data may remain personal data and can still be sensitive in combination with other signals.)
• 🛡️ Protect identifiers and limit linkability: explore privacy-preserving architectures, including clean rooms or short-lived session-based approaches such as those discussed around Utiq's AdTech Pass. (Encryption or pseudonymisation alone does not make data anonymous; access controls, purpose limitation and retention policies also matter.)

Neither approach is a magic shield. The objective is to prevent unnecessary sharing and repeated cross-context tracking while preserving legitimate, privacy-compliant advertising use cases.

5. What happens if the programmatic industry does nothing?

Three risks stand out in our original commentary: further journalistic investigations, advertisers losing confidence in Open Web environments, and additional regulatory or technical constraints.

For independent publishers, that would be particularly frustrating. They already compete with major platforms for advertising investment. A privacy scandal could make it even harder to persuade brands that the Open Web is a responsible place to spend.

The industry should not wait for the next headline. Responsible data governance is part of advertising quality. For related reading, see our article on fingerprinting and our discussion of robots.txt and access controls (a separate technical issue, but another reminder that open access needs clear rules).

6. How does GreyFox Ads approach a quality Open Web?

At GreyFox Ads, we believe that the French Open Web can deliver real advertising effectiveness—and that quality, simplicity and transparency should be central to its future.

Our Master Curated Deal focuses on several practical levers:

• 📡 Supply Path Optimisation (SPO): prioritising publisher-direct supply paths.
• 🚫 Less ad clutter: excluding sites and subdomains overloaded with advertising—the famous “Christmas tree” effect. 🎄
• 📐 Screen-share optimisation: looking beyond conventional viewability to the actual presence of ads on screen.
• 🎯 Addressability across environments: using appropriate signals for cookie-based, cookieless and non-consented traffic, without treating the absence of consent as permission to track.
• 👌 Easy activation: curated deals designed for media traders.
• 🪟 Cost transparency: clearer visibility into the programmatic supply chain.

These measures are part of our quality-focused commercial approach; they should not be mistaken for a claim that curation alone prevents the location-data abuses discussed above. Those require safeguards throughout the ecosystem.

For more context on reducing unnecessary intermediaries, read our article on reseller-heavy supply paths.