Ad tech vendor Colossus faces scrutiny for alleged mismanaging IDs

Their concerns stem from a report by ad transparency startup Adalytics, which discovered that Colossus was mislabeling IDs, leading to unintended ad purchases. The repercussions of these erroneous purchases are significant, ranging from targeting the wrong audiences to bombarding them with repeated ads and potentially disrupting conversion tracking models.

The situation has particularly resonated with one agency holding group.

An executive, preferring anonymity, revealed that Colossus is an approved supply-side platform for their company, used by several clients. Following the Adalytics report, they are now meticulously reviewing bid requests and impressions routed through Colossus since the year’s start to validate claims of ID spoofing and its potential impact on their clients. Next steps include assessing the financial fallout and seeking refunds from Colossus, with a broader reevaluation of their relationship with the SSP on the table.

The agency exec was not sure yet of how much money their clients would be owed from Colossus, but assuming that the IDs were being switched to a known user from an average, untargetable user ID, they approximate it would be at least a 30% lift in CPM, based on the lifts they’ve experienced through cookie-less targeting alternatives, such a Google’s Privacy Sandbox. But additional identifying information on these swapped IDs, such as the user’s profession or even multicultural identifiers (given the Colossus SSP specializes in multicultural audiences), could increase the baseline CPM by 200% to 400%, they said.

And it’s not just this agency rethinking its ties; across the board, some ad tech vendors have stopped dealing with Colossus as a marketplace altogether.

“We’ve stopped buying from Colossus,” said an ad tech exec, who asked to remain anonymous due to commercial sensitivities.

Their decision, made independently of the Adalaytics report, was based on their own testing, which ultimately led them to the same conclusion. The results are outlined here, but the main takeaway is this: ID mismatches are not unique to Colossus; they are actually quite common across various ad tech vendors. However, the specific problem with Colossus is that the user IDs never matched, setting it apart from other vendors.

The same goes for a publisher, who also spoke to Digiday on condition of anonymity. But it wasn’t just the Adalaytics report that put them off selling ads through the Colossus programmatic marketplace. It was also its financial standings.

According to Colossus’ parent company Direct Digital Holdings’ Form 8-K: Current report filing, filed on April 23:

• The company’s auditor, Marcum, resigned as its independent registered public accounting firm, effective immediately. While the report said that the audit “was not designed to identify or detect violations of law or fraud, Marcum’s resignation was not a result of any violation of law or fraud of the Company identified during its audit procedures to date.”
• The company was late on its filings: Form NT 10-K: Notice under Rule 12b25 of inability to timely file all or part of a Form 10-K, 10-KSB, or 10-KT — filed on April 2. 

Such rapid succession of concerning events certainly leaves room for speculation.

Which is why the publisher executive, whose company uses Colossus SSP (among 32 other SSPs), said that after they were made aware of the Adalytics report last week, they paused Colossus because the ID mismatching — and indications of financial troubles within the company — set off too many alarm bells.

Colossus SSP only made up a single-digit percentage of the publisher’s programmatic fill rate. The exec continued that while “it’s not a significant exposure for us, it’s also not worth taking the risk. So we just decided to pause until we could figure out what’s going on.”

The publisher said they went through all of the 33 SSPs that the media company works with with a fine-toothed comb to see if ID rotation or ID spoofing was happening with any other vendors and only one other SSP (who the exec declined to name) had been caught doing the same thing.

Colossus could be facing other issues with this, ultimately leading to lost faith — and business — from publishers going forward.

Because Colossus represented such a small fill rate for the publisher, which is already being replaced by other SSPs, the publisher said, “It’s not even worth our time to go and investigate any further than that. If it looks anomalous compared to every other SSP, it’s just not a risk worth taking for us.”

Not only that, but the fact that the auditor for Colossus’ parent company stepped away abruptly and the company had to ask for an extension of their filings raised a lot of red flags to the publisher exec about the financial standing of Colossus.

While there isn’t any outstanding money owed to the media company from Colossus — beyond the small portion of ad inventory sold through the SSP over the past couple of weeks — the exec said, “Seeing that their auditor stepped away and they asked for an extension with their filings — that’s just never a good sign. … There’s usually a very clear reason they’re stepping away, either for payment or they don’t want to be associated with something or they don’t want to certify … [by] attaching their name to the financial statements.”

For its part, Colossus has responded to Adalytics’ claims that it has misdeclared IDs in bid requests by attributing the issue to the complexities of the ad tech ecosystem. It points out that the vast number of technical integrations with various vendors inherently exposes their platform to potential discrepancies.

True as this may be, there are few things to also consider: The sheer scale, valuable ID replication, selective targeting of a major demand-side platform and potential financial benefits suggest the ID mismatches have been enough to cast doubt in the minds of some ad execs that these were not isolated incidents, but an intentional practice by Colossus SSP to misrepresent inventory for higher yields.

Aware of the damaging optics, the ad tech vendor is taking legal action against Adalytics for defamation, injurious falsehood, and false advertising, aiming to mitigate the damage and shield its reputation from the storm.

Editor’s note: this story was updated on May 16 to reflect the fact that Colossus had filed a lawsuit against Adalytics.