Programmatic advertising vendor due diligence: questions to ask before signing

What to take away

For programmatic advertising, start with documentation for the actual demand-side platform (DSP) or agency. If a supplier proposes Google Display & Video 360 or The Trade Desk, ask which party operates the DSP seat and supports its claims.
Ask for auction mechanics in writing, including what the vendor operates itself and what is supplied by another platform or partner.
Check data rights, fee disclosure and termination terms before commercial terms, because those three clauses decide what you can prove later.
Score every answer against a written rule so two buyers reach the same verdict, the method set out in programmatic advertising supplier comparison.

Platform and data questions

What the platform actually does

Ask the vendor to map each feature to the platform's own documentation. If they claim a native placement, the LinkedIn Sponsored Content overview is the reference point for what that format is. If they claim bidding control, the Google Ads platform overview shows the structure buyers are working within.

Platform and data due diligence

Map each feature to vendor documentation
Name surface, auction and reporting endpoint
Identify inventory sourceopen, private or closed
Confirm event data ownership and retention
Request sample report with column definitions
List every sub-processor, country and purpose

A vendor that cannot name the surface, the auction and the reporting endpoint is reselling something it does not operate. That is not disqualifying, but it changes the contract you need.

Ask which inventory sources feed the buy, and whether the vendor buys on the open exchange, a private marketplace or a closed network. The answer decides how much control you keep over placement lists and exclusion rules.

Request evidence that the vendor checks authorised sellers against IAB Tech Lab's ads.txt, sellers.json and SupplyChain object specifications. For OpenRTB traffic, ask which version and fields are supported, and how the vendor detects invalid traffic (IVT) and domain spoofing; ask for examples of blocking and reporting rather than a general assurance.

Data, consent and reporting rights

Ask who owns the event data, how long it is retained and what happens on exit. Request a sample report with column definitions, not a dashboard screenshot.

Name every sub-processor in the contract, with the country of processing and the purpose for each one. A vendor that treats that list as confidential is telling you something about its own supply chain.

Identify whether you and the vendor act as controller, joint controller or processor for each data flow. Check the arrangements against UK GDPR and the Data Protection Act 2018; where cookies or similar technologies are used, ask how PECR requirements are met. Request a Data Processing Agreement (DPA) covering instructions, security, sub-processors, assistance, deletion or return of data, and audit rights. Check each relevant organisation's ICO data protection fee registration or documented exemption; ICO registration is not proof of compliance.

For any restricted international transfer, ask for the destination and transfer mechanism, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses (SCCs), or a UK adequacy decision. Ask for the transfer risk assessment where required. If the vendor relies on the IAB Europe Transparency & Consent Framework (TCF), check how consent signals are collected and passed; the framework does not itself establish compliance with UK GDPR or PECR.

Ask what happens to aggregated reporting after termination, because some vendors keep the history and charge for access to it.

Where a buy includes social inventory, ask for the platform's own documentation on its auction, delivery controls and reporting fields. Do not assume those controls apply to other DSP inventory.

Commercial and operational questions

Fees, minimums and exit

Get the full fee stack in one table: platform fee, data fee, managed service fee and any minimum spend. Ask what triggers a rebate and who receives it.

Illustrative fee exposure

£25,000monthly media spend
12%undisclosed take rate
£3,000monthly fee
£36,000annual fee

Ask for the fee model before you share a media plan, so the quote is not shaped by the budget you reveal.

For a team spending £25,000 a month, an illustrative undisclosed 12% take rate is £3,000 a month, or £36,000 a year. That figure is an example, not a market benchmark.

Check the notice period, the data export format and the cost of an early exit. A 90-day notice clause and a 12-month term together mean you are committed for 15 months in practice.

Before signing, check that the contract names the DPA and gives you audit rights, clear breach-notification terms, and explicit liability and indemnity provisions. It should also state the governing law and jurisdiction; do not rely on a general promise to agree these details later.

Service model and escalation

Ask who answers a live delivery failure at 22:00, and what the response time is written into. Request two references from clients of a similar size and category.

Ask for security assurance relevant to the service: the scope and status of any ISO/IEC 27001 certification, a SOC 2 report if available, a recent penetration-test summary and remediation status, and details of cyber insurance, including its limits and exclusions. Treat these as evidence to assess, not a substitute for checking the vendor's controls.

Ask whether the vendor holds Trustworthy Accountability Group (TAG) Certified Against Fraud or Brand Safety Certified status, and verify the scope rather than relying on a logo. These certifications can support due diligence but do not replace your own checks.

If the vendor also supplies measurement, check whether the same team grades its own work. The wider selection criteria in the programmatic advertising tools and supplier guide explain how to separate supply, service and measurement roles.

Onboarding and handover

Onboarding questions

Ask for the first 30 days in writing: who sets up the account, who writes the tracking plan and who signs off the creative.

Onboarding and handover checks

First 30 days in writing
Who sets up the account
Who writes the tracking plan
Who signs off the creative
Time from signature to first impression
Owner of conversion definitions
Monthly platform-to-invoice reconciliation

Ask how long a campaign takes to move from signed paperwork to first impression. A vendor that cannot answer with a range has not onboarded many clients of your size.

Measurement handover

Agree who owns the conversion definitions and where they live. If the vendor's platform holds the only copy, your reporting breaks on the day you leave.

Ask for a monthly reconciliation between platform spend and invoice. Small variances are normal, but an unexplained gap is a reason to pause the next payment.

Set out the measurement method and acceptance criteria before launch. Ask whether viewability measurement follows the Media Rating Council's Viewable Ad Impression Measurement Guidelines and relevant IAB standards, and name any independent verifier, such as Integral Ad Science (IAS) or DoubleVerify. Require reporting for viewability, invalid traffic and brand suitability, including how discrepancies are investigated.

Decision table

Choose

First managed campaign, spend under £10,000 a month: A vendor with published fees and a named account lead
In-house team with its own DSP seat: A service layer with transparent data rights
Regulated sector with strict consent rules: A vendor that will sign your data processing terms
Multi-market buying across the UK and EU: A vendor with per-market reporting and tax clarity
Testing a new channel for one quarter: A short initial term with a break clause

Avoid

First managed campaign, spend under £10,000 a month: Any deal where the fee is described only as included
In-house team with its own DSP seat: Vendors that require you to move your seat to them
Regulated sector with strict consent rules: Vendors that will not name their sub-processors
Multi-market buying across the UK and EU: Vendors quoting a single blended rate
Testing a new channel for one quarter: Annual commitments with no exit route

Common questions

How long should due diligence take?

For a spend under £10,000 a month, two to three weeks is workable if you issue one written questionnaire. Larger contracts justify a second round covering data and security.

What single document matters most?

The fee schedule. It is the only document that tells you what the vendor earns, from whom, and whether your media budget and their revenue are aligned.

Should I insist on a trial period?

Yes where possible. A 30-day paid pilot with agreed reporting gives you delivery evidence that no reference call can replace.

Who signs off the vendor?

One named buyer should own the scorecard, with finance confirming the fee model and a legal or data lead confirming the processing terms.