1. Creating a User ID
(1) User makes any HTTP request
(2) Server creates unique user ID
Website.com
(3) Web server responds, storing the user ID in a cookie.
A different ID set for each user, browser, login, and device, from each domain, which means the typical user has 100’s of cookies.

2. Opt Out (1) User visits Web site Opt-Out interface.
Website.com
(2) Web server sets specific Opt-Out cookie.
(3) User visits a 3rd party’s Opt-Out interface
(4) 3rd party sets a specific Opt-Out cookie
(5) [Optional] A coordinator like the NAI or DAA Opt Out system can instruct a web browser to make Opt-Out requests to all participating domains.
3rd party
Coordinator

3. Data Flow – Client and Server
(1) Any HTTP request within a cookie-compliant client results in [previously set] cookies appended to that request
(2) Server reads the cookies sent in the request
Website.com
(3) Web server can optionally respond with more cookies, or add/edit/delete the information within a cookie
Modern browsers can store as much as 4093 bytes per cookie, and that data may only be read by the domain setting the cookie.

4. ID Sync (1) User visits Web site
Website.com
(2) Web/ad server reads cookie, responds with a redirection to a 3rd party.
(3) The redirection contains an ID from website.com in the URI-Query.
(4) 3rd party reads their cookie & the website.com ID, associating these server-side.
3rd party

5. Cookie/ID Accessed at Run-Time
(1) User visits Web site
Website.com
(2) Web/ad server reads cookie, responds with page (ad tag).
(3) Ad tag on Web page makes ad request to 3rd party
(4) 3rd party reads their cookie & user ID, then serves ad targeted and fcapped to that user.
(5) [Optional] 3rd party sends bid request to RTB 4th party with the 4th party’s user ID in the bid request (3rd and 4th party previously synced IDs), so they can match to a targeted ad, fcap, etc.
3rd party
RTB 4th party

6. Data
(1) User visits Web site
Website.com
(2) Web/ad server sets a cookie.
Modern browsers can store as much as 4093 bytes per cookie, and that data may only be read by the domain setting the cookie.
Because cookies are sent on every HTTP request, it’s best to keep them as small as possible, using them to store an ID that can look up more information on the server.

7. Market Coverage