What Retargeting Is, Mechanically
Retargeting is the practice of serving ads to users who previously interacted with a site, app, or product catalog. The mechanism depends on a persistent identifier—a third-party cookie, a mobile advertising ID, a hashed email, or a first-party identifier—that lets a demand-side platform (DSP) recognize the same browser or device across publisher inventory. That identifier is matched against a retargeting audience, a list of users who fired a specific event: a product view, an add-to-cart, a checkout abandonment.
The economic premise is simple. Users who have already expressed intent convert at higher rates than cold traffic, so advertisers bid more for them. That higher bid should, in theory, win more auctions and produce cheaper conversions. In practice, the chain from event to impression has at least six links, and any one of them can break. This article traces that chain using primary-source artifacts—the IAB Tech Lab’s OpenRTB specification, the IAB Europe Transparency and Consent Framework, Google’s Ads and Privacy Sandbox documentation, and the public record of antitrust testimony—and identifies where retargeting fails.
The Retargeting Pipeline, Step by Step
1. Event capture and audience construction
A retargeting audience begins with a pixel, SDK, or server-side event. The advertiser’s site fires a request to the DSP or ad network, which records the user identifier and the event type. The DSP then adds that identifier to a segment. In OpenRTB 2.6, this segment is represented in the User.data object, where data.id names the data provider and data.segment[].id names the segment. The spec is explicit that segment IDs are provider-defined; there is no universal taxonomy. That means two platforms can both claim to target “cart abandoners” while using different definitions, lookback windows, and exclusion rules.
Failure mode: event loss. If the pixel does not fire—because of a consent blocker, a JavaScript error, a server-side timeout, or a browser that partitions storage—the user never enters the audience. The advertiser sees a smaller addressable pool and attributes the shortfall to “low match rates” without checking whether the event itself was recorded.
2. Identifier resolution and match rates
Once an audience exists, the DSP must recognize the same user on publisher inventory. This is the match rate problem. On the open web, the DSP compares its identifier (often a cookie) against identifiers available in the bid request. If the user’s browser has blocked third-party cookies, the DSP may fall back to a first-party identifier, a hashed email, or a probabilistic signal. Each fallback has different coverage and different error rates.
Google’s documentation for Privacy Sandbox APIs describes how Protected Audience (formerly FLEDGE) moves audience matching into the browser: the browser stores interest groups and runs an on-device auction. That changes the failure surface. Instead of a server-side cookie match, the browser decides whether the user is in an interest group and whether to generate a bid. If the interest group is not present—because the user cleared storage, used a different browser profile, or never visited the advertiser’s site in that browser—the retargeting ad cannot be served, regardless of the advertiser’s bid.
Failure mode: identifier mismatch. The advertiser’s CRM says the user is a high-value cart abandoner. The bid request carries no identifier the DSP can resolve. The impression goes to a cold audience or not at all.
3. Consent and legal basis
In the European Economic Area and the UK, retargeting depends on a legal basis for processing personal data. The IAB Europe Transparency and Consent Framework (TCF) v2.2 defines how consent signals are encoded and transmitted in the bid stream. Under TCF, a vendor must have a registered purpose and legal basis to use data for advertising. If the user denies consent for purpose 1 (store and/or access information on a device) or purpose 4 (select personalised ads), the DSP should not use the identifier for retargeting.
The failure here is not technical but procedural. A DSP may receive a bid request with a TCF string that indicates consent is absent, yet still bid if its configuration does not enforce the signal. Conversely, a publisher may pass a consent string that is technically valid but does not cover the specific vendor. The result is either non-delivery (the compliant case) or delivery without a valid basis (the enforcement case). Both look like “retargeting doesn’t work” to the advertiser, but only one is a legal risk.
4. Auction dynamics and bid shading
When the DSP decides to bid, it submits a bid price. On many exchanges, the auction is first-price, meaning the winner pays the amount they bid. To avoid overpaying, DSPs use bid shading: they estimate the market clearing price and bid below their true valuation. The algorithm is proprietary, but the economic consequence is documented in exchange and DSP materials: shading reduces the effective bid for retargeted users, which can cause the DSP to lose auctions it would have won at its unshaded valuation.
Failure mode: shading error. If the shading model overestimates the clearing price, the DSP bids too low and loses. If it underestimates, the DSP overpays. Retargeting campaigns are especially sensitive because the advertiser’s willingness to pay is high; a shading model trained on cold traffic may systematically underbid for retargeted users.
5. Frequency capping and creative fatigue
Retargeting audiences are small relative to cold audiences. A user who abandoned a cart may see the same ad dozens of times across publishers. Frequency capping is supposed to limit this, but caps are often set per campaign, per device, or per exchange, not per user across all channels. The result is over-delivery to a narrow pool, declining click-through rates, and rising cost per acquisition.
Failure mode: saturation. The audience is not exhausted in the sense of having no users left; it is exhausted in the sense that the users who remain are unresponsive. The advertiser blames the creative or the audience definition, but the mechanism is frequency.
6. Measurement and attribution
Finally, the advertiser must attribute conversions to retargeting. This is where the chain is most fragile. If the conversion pixel fires on a different device or browser than the ad impression, the attribution system may not connect them. If the advertiser uses a last-click model, retargeting gets credit for conversions that would have happened anyway. If the advertiser uses a view-through window, the credit may be overstated.
Failure mode: misattribution. The campaign appears to fail because the measurement system cannot see the conversions it caused, or it appears to succeed because it takes credit for organic demand. Neither is a mechanism failure in the ad serving path, but both determine whether retargeting is judged to work.
Why Retargeting Fails: A Diagnostic Framework
When a retargeting campaign underperforms, the cause is usually one of the six links above. The diagnostic order matters because fixing a downstream link will not help if an upstream link is broken.
- Check event capture first. Verify that the pixel or SDK fires on the intended pages and that the event reaches the DSP. Use the DSP’s audience size as a proxy: if the audience is smaller than expected, the problem is upstream.
- Check match rates. Ask the DSP for match rate reporting by identifier type. If third-party cookie match rates are low, test first-party or hashed-email alternatives.
- Check consent enforcement. In regulated regions, confirm that the DSP is reading TCF signals and that the publisher’s consent string covers the vendor. Non-delivery may be compliance working as intended.
- Check bid shading. Compare the DSP’s win rate for retargeting versus prospecting. A low win rate at a high bid suggests shading is too aggressive.
- Check frequency. Pull frequency distribution reports. If a small share of users receives a large share of impressions, the cap is not working across channels.
- Check attribution. Run a holdout or incrementality test. If the conversion rate for the retargeted group is not higher than a matched control, the campaign may be harvesting demand rather than creating it.
What the Primary Sources Actually Say
The OpenRTB 2.6 specification, maintained by IAB Tech Lab, defines the data structures but does not mandate how DSPs use them. The TCF v2.2 policy defines consent encoding but leaves enforcement to vendors and regulators. Google’s Privacy Sandbox documentation describes the Protected Audience API but notes that it is subject to change and that availability varies by region. None of these sources promises that retargeting will work; they define the interfaces through which it might work.
Where behavior is undocumented, say so. For example, the exact bid shading algorithm used by a given DSP is not public. The exact match rate for a given identifier type in a given geography is not public. The exact frequency cap enforcement across exchanges is not public. These are gaps, not conspiracies. The practical response is to measure what can be measured and to treat vendor claims as hypotheses to be tested against observed delivery.
FAQ
Why does my retargeting audience size keep shrinking?
Audience shrinkage usually comes from three sources: event loss (the pixel or SDK is not firing), identifier loss (users are clearing cookies or using browsers that block third-party storage), and consent loss (users in regulated regions are denying consent for advertising purposes). Check the event capture first, then match rates, then consent signals.
Is retargeting still possible without third-party cookies?
Yes, but the mechanism changes. First-party identifiers, hashed emails, and on-device APIs like Protected Audience can support retargeting without third-party cookies. Each has different coverage and different failure modes. The advertiser’s job is to understand which identifier is being used and what its match rate is in the relevant geography.
Why do retargeting campaigns sometimes show high click-through rates but low conversion rates?
High click-through with low conversion often indicates that the audience is being served ads after the purchase decision is already made, or that the creative is attracting clicks from users who are not actually in the market. It can also indicate attribution mismatch: the conversion is happening on a different device or is being counted by a different system. Check the audience definition and the attribution window before changing the creative.
What is bid shading and how does it affect retargeting?
Bid shading is a DSP technique for estimating the market clearing price and bidding below the advertiser’s maximum willingness to pay. It reduces overpayment in first-price auctions. For retargeting, where willingness to pay is high, aggressive shading can cause the DSP to lose auctions it should win. The shading algorithm is proprietary, so the advertiser cannot inspect it directly; the practical check is win rate and cost per acquisition by audience segment.
What to Do Next
Retargeting is not a single system; it is a chain of systems, each with its own documentation and its own failure modes. The next time a retargeting campaign underperforms, resist the urge to change the creative first. Trace the chain: event capture, identifier resolution, consent, auction, frequency, attribution. Fix the earliest broken link. If the chain is intact and the campaign still fails, the problem may be that the audience was never going to convert—and that is a targeting problem, not a delivery problem.
For a follow-up, consider a post on how incrementality testing works for retargeting, or a glossary of OpenRTB fields that matter for audience targeting. Both would extend the site’s coverage of mechanism-level explainers.
