A robot walked into ad tech wearing a name tag that said BOT. Seventeen of the eighteen biggest identity vendors issued it a driver's license anyway. The test that would have caught it was free, public and sitting in plain sight for years. The academics who found it gave it one paragraph. The CEO who made it go viral now says the trades got it wrong, and the truth is worse.

This is not a sophisticated fraud ring. No residential proxies. No CTV spoofing. No server farm with a cool code name and a Telegram channel. It's the HTTP Archive crawler, a public research bot running out of Google Cloud. It writes "PTST" into every request like a name tag, it has sat on the IAB Tech Lab Spiders and Bots list since 2013, and it publishes everything it sees in a free public database. It is the least stealthy bot on Earth. It is a Roomba with a press badge.

It's also the most famous bot in ad tech. Adalytics used this exact crawler in March 2025 to show ads from the U.S. Navy, Fortune 500 brands and verification vendors' own clients landing on bots. It made the Wall Street Journal. The ANA called for an investigation. Everyone clutched their pearls. Then everyone went back to work.

Now a peer-reviewed study shows that this same bot, the one the whole industry got publicly spanked over, was being handed identities by 17 of the 18 biggest ID vendors in programmatic. LiveIntent. ID5. Criteo. Experian's Audigent. The Trade Desk. Lotame. Yahoo. PubMatic. OpenX. Magnite's Rubicon.

Only Flashtalking read the name tag. It wrote back "Bot." 440,504 times. The other seventeen handed it a lanyard.

That's not a detection failure. Detection would require someone to look.

The study, "A Longitudinal Study of Extended User IDs in the Online Advertising Ecosystem," was presented at ACM's Internet Measurement Conference by researchers from Indiana University and NJIT, with Adalytics and DeepSee.io. It's a short paper, and its headline finding is about adoption: sites passing extended IDs jumped from 29% to 84% between January 2022 and May 2025.

The bot finding gets one paragraph. Section 4.2.2. It doesn't count the impressions. It doesn't estimate the spend. It doesn't ask why. The academics found a body and filed it under miscellaneous.

It also skips the part that should end careers. The test cost nothing. HTTP Archive's data sits in Google BigQuery for anyone to query. Every identity vendor on that list has engineers who could have pulled their own IDs off a self-declared bot any day of the last three years. Every verification company could have. Every DSP buying "authenticated audiences" could have.

Nobody ran it, or somebody ran it and kept shipping. Pick which one bothers you more.

Kean Graham, founder and CEO of MonetizeMore, is the man whose LinkedIn graphic turned that one paragraph into the week's most-shared ad tech post. His conclusion is the same: the industry should get proactive "instead of waiting for the next academic study to do the auditing for free."

Why would seventeen vendors hand an identity to a bot that has been on the industry's own list for thirteen years?

Graham's answer is short enough to forward.

"Because nothing in their incentive structure punishes it. The ID layer competes on coverage and match rates. Attaching an ID costs the vendor nothing and refusing costs them a bid and the MRC does not audit identity providers, so nobody is checking."

And the line that belongs on every identity vendor's pitch deck: "Filtering declared bots is bare minimum. The ID layer treated it as optional because for 13 years on that list, it was."

Graham sells this check for a living. MonetizeMore's Traffic Cop filters invalid traffic, so put that in your back pocket. But on this point he's right, and it isn't close. "GIVT is the easiest check in the chain," he said. Matching a user agent against a public list is not rocket science. It's a lookup. Your fridge could do it.

The vendors had more than the list. ID5's own documentation says its module sends the user agent to ID5. The bot's name tag was hand-delivered to the vendor, and the vendor mailed back a person. That's not missing a clue. That's being handed a signed confession and stamping it approved.

The paper treats bot IDs as an accuracy problem. It's a business model.

An ID in a bid request raises the bid. That's the whole pitch: addressable impressions clear higher than anonymous ones. Publishers adopted ID bridging because it lifts their yield. ID vendors win when their ID shows up on more impressions. Nobody in that chain gets paid to return a blank.

So when a visitor shows up with no login, no cookies, no history and a sign on its forehead that says bot, the economically rational move is to hand it an ID anyway. A blank costs everyone money. A guess pays everyone except the advertiser, who, as usual, gets the check.

That's why adoption kept climbing after Google killed cookie deprecation in July 2024. There was no longer a cookie to replace. The IDs stayed because they make inventory more expensive.

Graham put it bluntly: "everyone takes a cut of the bot traffic revenue and has little financial incentive to fix a problem that hurts every legitimate company in ad tech."