If you have never typed the words "extended ID" into a contract and couldn't tell LiveIntent from ID5 at a party, keep reading anyway. Nearly every programmatic dollar you spend now carries somebody's ID, and somebody charged you for it.

Here is the whole thing in one paragraph. A peer-reviewed study presented at ACM's Internet Measurement Conference followed the HTTP Archive crawler, a bot that announces itself as a bot and has sat on the IAB Tech Lab Spiders and Bots list since 2013, through header bidding from 2022 to 2025. Seventeen of the eighteen ID vendors it met gave it an identity anyway: LiveIntent, ID5, Criteo, Experian's Audigent, The Trade Desk, Lotame, Yahoo and the rest. One Audigent ID followed it across 29,770 websites. Only Flashtalking said "Bot." It said it 440,504 times.

LiveIntent describes its graph to Prebid as authenticated daily through engagement with email newsletters. The crawler has never opened a newsletter. It got authenticated anyway.

That's the flaw in one sentence: ID modules don't check for a human. They get paid for persistence. And an ID is what turns a cheap impression into an expensive one. It's why the bid goes up, why the impression counts toward your "authenticated audience," and often why a data fee lands on your invoice. Nobody audits it. The Media Rating Council told Jack Neff it does not audit or accredit any identity provider. Your verification vendor checks the impression. Nobody checks the identity riding on it.

Kean Graham of MonetizeMore, whose LinkedIn post made the study famous, explained the economics in one line: "Attaching an ID costs the vendor nothing and refusing costs them a bid." He sells bot filtering, so weigh accordingly. He's still right.

The vendors got our questions before Wednesday's piece ran, with a noon Eastern deadline today. As of Thursday morning, none has answered.

Here's the line that matters. Selling identity is a business model. Selling identity you never checked is the problem. Every check in this kit comes down to one move: make them count, in writing.

Before the checks, the map. An ID touches your money in five places, and a bot wearing one costs you at every stop.

Stop one: the page. The publisher's site runs ID modules that call each vendor and attach whatever comes back to the bid request. This is where a declared bot should get a blank. Seventeen times out of eighteen, it didn't.

Stop two: the auction. The SSP passes the IDs to bidders. Impressions with an ID clear higher than impressions without one. That's the whole pitch, and it's why publishers adopted them.

Stop three: the targeting. Your DSP matches the ID to an audience you bought. If a bot's ID lands in that audience, you just paid a premium to target a server.

Stop four: the counting. Frequency caps and reach reports run on IDs. The study found vendors sent different IDs to competing exchanges on 18% of page views, ID5 on 32%. One visit, two "people." Your reach looks bigger and your frequency cap leaks.

Stop five: the invoice. Data and identity fees are often billed by the impression or the segment. If the impression went to a bot, the fee didn't notice.

If you can't say which ID vendors touched your buys, you can't say which of those five stops cost you. That's where the kit starts.

Below the line for members: seven checks before you renew, a four-step test you can run before you pay, four questions on splits, merges and super-nodes, the three emails Wednesday's playbook didn't cover, a dodge decoder, five new contract clauses, a section for publishers, and what to do if you already pay for "authenticated" audiences.