New advertising initiative aims to evade ad blockers: what to know about IAB’s Trusted Server proposal

The International Advertising Bureau, an organization that sets standards and provides support for the online advertising industry, has introduced a new open-source initiative aimed, among other things, at bypassing ad blockers and minimizing the revenue loss that comes with them.

The project, called Trusted Server, has been in the Proof of Concept stage since July, with the IAB now encouraging publishers to test it out.

As an ad blocker developer, AdGuard is watching this closely. Trusted Server is pitched as a privacy-friendly workaround to traditional client-side tracking methods. It is supposed to do so by shifting the ad tech operations to a controlled server environment. According to the IAB, this setup is supposed to comply with user consent and improve transparency — though from where we stand, it looks more like an effort to rebuild tracking infrastructure under a new name.The goal remains the same: keep ads visible and tracking intact, even as users push back harder than ever (IAB itself notes that “ad blocking rates continue to rise worldwide”).

Trusted Server might be open-source, and its ambition to merge two opposites — tracking and privacy — is certainly worth examining. But as we’ve said many times before, and still firmly believe, these two concepts are fundamentally at odds. Below are our thoughts on the Trusted Server initiative: its potential benefits, privacy risks, and the likely impact it could have on ad blockers like AdGuard.

Trusted Server: is it really trustworthy?

First things first. Let’s start with what Trusted Server is, as it described in the IAB proposal. At its core, Trusted Server is a new way for websites to show you ads. Instead of loading ads and tracking scripts directly in your browser (like most websites do today), it moves all of that behind the scenes, to powerful servers that the website owner controls.

Think of it like this: normally, when you visit a website, your browser talks to several ad companies, loads their scripts, and decides which ads to show. With Trusted Server, your browser doesn’t do any of that. Instead, the website’s own server handles the ad business — talks to ad companies, picks the ad, and sends the final result back to your browser to display, all in one package.

This whole system runs on a cloud platform called Fastly, and the idea is to make ads faster, harder to block, and — according to its creators — more respectful of privacy.

For those who want a deeper technical look, here’s a breakdown of how it works now and how it will work if the initiative is implemented.

In traditional web advertising, the ad serving process involves multiple client-side network requests and JavaScript executions:

1. User visits a publisher’s website
2. Browser loads publisher’s HTML containing ad slots with JavaScript tags
3. Browser executes ad network scripts (GAM, Prebid, etc.)
4. Each script makes separate HTTP requests to ad servers
5. Real-time bidding occurs across multiple SSPs (supply-side platforms)
6. Winning ads are rendered client-side
7. Tracking pixels fire for impressions/clicks

This is how it works in the traditional online advertising model. What changes with Trusted Server is that it consolidates ad serving logic on the server side:

1. User visits a publisher’s website
2. Browser loads publisher’s HTML (no ad network scripts)
3. JavaScript makes single request to ad-creative
4. Trusted Server generates synthetic ID
5. Server makes parallel requests to ad partners
6. Server aggregates responses and proxies assets
7. Single JSON response returned to client
8. Client renders ads from first-party URLs

In a nutshell, Trusted Server is a big shift from the usual client-side ad delivery to a setup where everything happens on the server. It can improve performance and make things easier for publishers, but it also centralizes data collection and gives users less visibility into what’s going on behind the scenes.

For users who don’t use any kind of ad blocker, Trusted Server can look like a solid improvement on the surface. There are real benefits:

• Faster page loads, since it removes the need for a bunch of third-party JavaScript files that usually slow things down.

• Reduced fingerprinting risks, because those third-party scripts aren't running directly in the browser anymore.

• Better security, thanks to cutting out third-party code that could be exploited for malicious purposes.

But it’s not all good news. Trusted Server comes with some serious trade-offs — especially when it comes to privacy. The whole system relies on fingerprinting to work. It builds a “Synthetic ID” based on stable data points like:

• client_ip

• user_agent

• first_party_id

• publisher_domain

• accept_language

This means fingerprinting is no longer just a workaround, it’s the foundation. Sure, fingerprinting already exists, but at least right now, different companies use different methods, which makes it harder to stitch everything together. Trusted Server could make it much easier to build a massive shadow profile on a user across the web. And worst of all, users wouldn’t even know it’s happening. Everything appears to be “first-party,” but behind the scenes, they’re being tracked and targeted through what’s essentially a persistent fingerprint.

Impact on ad blockers: a new old challenge

For over a decade, ad blockers have been the digital equivalent of immune systems — shielding users from all the things that make the modern web messy, invasive, and unsafe.

That includes:

• Tracking scripts: dozens of third-party trackers following users across the web

• Performance killers: heavy JavaScript that slows pages to a crawl

• User profiling: fingerprinting, cross-site tracking, and data harvesting

• Security threats: malvertising and malicious code injection

• User experience degradation: intrusive pop-ups, auto-play videos, layout shifts

Our filter lists have grown to block hundreds of thousands of domains, and users have come to rely on us for a faster, cleaner, more private web experience.

What makes Trusted Server ads harder to block

Trusted Server doesn’t change the goal of online advertising, it just changes how it’s delivered. Instead of loading third-party scripts into your browser, everything now happens server-side and is delivered under the publisher’s own domain. This is known as first-party domain serving, and it makes ads look like part of the site itself.

Traditionally, blocking was as simple as filtering requests to known ad domains like:

doubleclick.net, googlesyndication.com

With Trusted Server, ads are instead served from domains like:

nytimes.com, cnn.com

This makes them harder to distinguish from real content and harder to block with conventional, domain-based filters.

On top of that, there’s server-side processing. Instead of running JavaScript in the browser, the entire ad-serving logic runs invisibly on the server. From the browser’s perspective, it’s just a single request: no trackers, no external calls, nothing to intercept.

Here’s a simplified version of what’s happening behind the scenes:

let ad_response = fetch_ads_from_partners(&synthetic_id).await;
let proxied_creative = proxy_asset(&ad_response.creative_url);

This makes it much harder for browser-based blockers to detect or stop ads in real-time.

That said, this is not an entirely new type of challenge. We’ve encountered similar tactics before — like CNAME tracking, where third-party tracking is masked as first-party by redirecting DNS. Trusted Server is a more complex implementation of the same principle: disguising tracking and ad delivery as native website functionality.

In the short term, filter-based ad blockers like AdGuard remain effective in many cases. Even when ads are served from first-party domains, they can still be identified through layout patterns, container behavior, or other on-page signals.

In the longer term, the ad-blocking community is already moving beyond simple pattern matching. By using machine learning-based detection, which the ad blocking community is now working on, ad blockers will be able to analyze the visual and behavioral traits of ads regardless of where or how they were loaded.