Overview

Privacy can remove IP, user-agent, identifier, and other telemetry needed for invalid-traffic decisions. This chapter explains the MRC’s privacy-aware boundary: retain lawful context, distinguish GIVT from SIVT, reconcile source and property identity, separate internal test traffic, and report decision rate and unknown outcomes instead of guessing.

Learning outcomes

Privacy restrictions can reduce observability; missing telemetry is not automatically valid or invalid traffic.
The IVT decision rate shows the share of intended impressions with enough signals for a responsible determination.
Source reconciliation, SIVT corroboration, and separation of internal test traffic protect the meaning of reported CTR.

Keywords

PrivacyTelemetryDecision rateSIVTReconciliationUnknown

Detection Under Privacy: Decide, Don’t Guess

After a benchmark shows that richer behavioral features can improve classification, the operational question changes: what can a measurement organization lawfully and reliably decide when the signals are incomplete? This chapter focuses on the MRC’s answer for invalid-traffic measurement—preserve useful telemetry where possible, respect privacy as a hard requirement, distinguish routine filtration from sophisticated investigation, and report uncertainty instead of hiding it. The goal is not to collect everything or to label everything; it is to make the strongest decision the available evidence can support.

Telemetry is necessary, but privacy sets the boundary

Invalid-traffic detection depends on the quality of the record describing an advertising transaction. The MRC identifies data quality and completeness as critical and asks measurement organizations, where possible and applicable, to maintain information about the network origin, the full user-agent string, cookies or unique identifiers, application identifiers, referrer sites, device identity and type, and the ad-serving context. Placement, campaign, site, and application information help explain what was supposed to happen. Device and agent information help describe how the event arrived. Origin and referral information help connect the event to a supply path.

These fields do different jobs. An IP address can support origin and data-center analysis. A user-agent string can distinguish a recognized browser from a non-browser or unknown header. A publisher, placement, or campaign field connects activity to the commercial context in which it should be interpreted. A referrer or application identifier can help reconcile what the transaction claims with where it appears to have come from. The more of this context is lost, the more the measurement organization must rely on weaker proxies or leave a decision unresolved.

That does not give a measurement organization permission to gather data without regard to law or user expectations. The MRC states that privacy regulations are requirements to follow, not obstacles to engineer around. Its standards and audits do not provide a reason to deviate from applicable privacy rules. Organizations should explain in their privacy policies why information is collected and how it may be used or shared, consider local requirements, and monitor changes in browser and identification restrictions.

The tension is practical. Reduced IP granularity can impair data-center lists and origin analysis. A less complete user-agent string can weaken checks based on browser identity. The loss of cookies, identifiers, or other user-level signals can make session-level and activity-based analysis less precise. A measurement organization may still be able to detect some invalid traffic, but it may no longer be able to apply the same rule with the same confidence across every browser or environment.

The MRC therefore asks organizations to study the effect of uneven signal availability rather than pretending that the effect does not exist. Differences by browser, environment, country, or position in the advertising ecosystem should be documented as limitations where they matter and periodically evaluated for their impact on IVT effectiveness. At least annually, measurement organizations must assess how much their detection capabilities rely on IP address, user-agent, and user-level analysis, how privacy-related changes affect the decision, and whether a claimed signal limitation might be an attempt to evade detection.

That last distinction is difficult but essential.

Published by DeepMox

FAQ

What is the IVT decision rate?

The IVT decision rate is the number of recorded impressions with sufficient information for an IVT determination divided by all impressions intended for measurement and reporting. Impressions lacking enough information are reported as such and excluded from IVT rates.

Why must source and property identity be reconciled?

Source and property identity must be reconciled because the same interaction rate means something different when the declared domain, app, or inventory type does not match delivery. A mismatch needs investigation, not an automatic finding.

How should internal test traffic be handled in advertising measurement?

Internal test traffic should be segregated from production or clearly identified before impression counting. Supported test activity can be excluded and separately reported so users can reconcile the measurement.

Previous10 minPublisher-Level Click Fraud: FDMA2012 Benchmark

Next11 minPublisher-Level Click Fraud: What Makes CTR Trustworthy

Publisher-Level Click Fraud: Detection Under Privacy

Detection Under Privacy: Decide, Don’t Guess

Telemetry is necessary, but privacy sets the boundary

FAQ