Does connecting website X to an RTB exchange enable all potential bidders to track all traffic and users in such website X?

In other words, can bidders build full user behavior history of what the users do inside website X on a pageview by pageview basis?

This question was asked on quora, below is my answer.

The short answer is yes. Connecting your site to an SSP, or RTB exchange opens your inventory and your users up to being tracked by as many DSP buying platforms as are enabled on your inventory.

Data Leakage

Every impression is put out to bid, along with that a user identifier is passed. This gives the buyers the information they need to make a decision, “Do they buy or not?” If the buying platform decides to track the user and build a profile on that user’s behavior, there’s little the publisher can do from a technology perspective. The shorthand for this misappropriation of information is Data Leakage.

Sell side platforms and exchanges generally have contracts that restrict buy side platforms (DSPs) from taking advantage of this situation. Data leakage was a serious concern in the early days of RTB and publishers were quick to ask for assurances from their SSP partners.

It’s a two-sided issue, though. The publisher is concerned about their user population being profiled, tracked and then purchased on cheaper inventory. The buyers have concerns about their advertiser intent data being tracked. The publisher can use this data to raise prices on the inventory or cut the buy side platform out of the deal.

Private Exchange

Both buy side platform companies and sell side platform companies are striving to introduce more controls over inventory and ad deals in RTB. The concern over data leakage has largely been subdued. Higher valued inventory and advertising is being sold privately using enhancements made on the RTB ecosystem. These private exchanges limit the exposure of high-value inventory to a subset of buyers and vice-versa.