Category: TCF and Vendors
Supply Path Optimisation
Also known as: SPO, Supply Path Optimization, Supply-Path Optimization
Simply put
Supply Path Optimisation (SPO) is the practice of evaluating and streamlining the routes an ad buy takes through the programmatic advertising ecosystem to reach publishers. It generally aims to cut out unnecessary intermediaries and redundant connections so that each step in the chain adds value. The goal is typically a more efficient and direct path between advertisers and the ad inventory they want to buy.
Formal definition
Supply Path Optimisation (SPO) is a set of methods by which programmatic media buyers evaluate and consolidate the available paths to a given piece of inventory, selecting the most efficient connections between buyers and sellers and avoiding redundant or inefficient intermediaries. In practice this involves identifying which ad tech platforms (such as SSPs and exchanges) to route spend through, reducing the number of intermediaries until each remaining party demonstrably adds value. Note that the evidence provided describes SPO at a general conceptual level; specific implementation criteria, evaluation metrics, and vendor-specific mechanics are out of scope for this definition and vary by buyer and platform.
Why it matters
Supply Path Optimisation matters because the programmatic advertising ecosystem often routes a single ad buy through multiple intermediaries, and each connection can add cost, complexity, and opacity without necessarily adding value. By evaluating and consolidating these routes, buyers aim to reach publisher inventory more directly and efficiently, retaining more control over how and where their spend flows.
For readers focused on cookie consent and data protection, SPO is relevant because the number and identity of intermediaries in the supply chain has implications for transparency and accountability. Each additional ad tech platform in the path may be a party that receives or processes user-related data, and reducing redundant intermediaries can, in principle, narrow the set of vendors involved. However, the evidence provided describes SPO as an efficiency-focused advertising practice rather than a privacy or consent mechanism, and SPO alone should not be treated as a means of achieving consent compliance.
Because SPO is defined here at a general conceptual level, its specific effects on data flows, vendor relationships, and compliance obligations depend on how a given buyer or platform implements it. Any assessment of the privacy or legal consequences of a particular supply path would require facts beyond the scope of this definition.
Who it's relevant to
Programmatic media buyers and advertisers
Buyers use SPO to evaluate and consolidate the paths their ad spend takes, selecting the most efficient connections to sellers and avoiding redundant or inefficient intermediaries. This group is the primary practitioner of SPO as described in the evidence.
Ad tech platforms (SSPs and exchanges)
Platforms such as SSPs and exchanges are the intermediaries whose value SPO is designed to assess. Their inclusion in a buyer's supply path may depend on whether they demonstrably add value relative to other available routes.
Privacy and data protection professionals
Because each intermediary in a supply path may be a party that receives or processes user-related data, professionals assessing vendor relationships and data flows may find the composition of the supply path relevant. That said, the evidence frames SPO as an advertising efficiency practice, not a consent or compliance tool, and any privacy assessment would require facts beyond this definition.
Inside SPO
Supply Chain Rationalisation
The process by which advertisers, agencies, or demand-side platforms reduce the number of intermediaries (exchanges, resellers, SSPs) through which they buy inventory, aiming to reach publishers via the most direct and efficient paths.
Path Transparency
Visibility into the sequence of technology partners that sit between a buyer and a publisher, often supported by mechanisms such as ads.txt, sellers.json, and the OpenRTB SupplyChain object, which help identify authorised sellers and resellers.
Cost and Fee Analysis
Evaluation of the take rates, auction dynamics, and duplicated paths within programmatic buying, used to decide which supply paths deliver value and which add cost without benefit.
Data Protection Interface
The point at which supply path decisions intersect with privacy law, because each intermediary in a path may place or access cookies or similar technologies on a user's device and may process personal data such as identifiers, bringing the ePrivacy and GDPR regimes into scope for buyers evaluating those paths.
Consent Signal Propagation
The passing of consent and preference information (for example via frameworks such as the IAB Transparency and Consent Framework) along the supply chain, so that downstream partners are informed of the legal basis relied upon for any device access or personal data processing.
Common questions
Answers to the questions practitioners most commonly ask about SPO.
Does supply path optimisation improve cookie consent compliance?
No. Supply path optimisation is primarily a media-buying efficiency practice aimed at reducing the number of intermediaries between a buyer and publisher inventory, improving cost transparency and reducing fraud. It is not a consent mechanism and does not, on its own, satisfy any consent or transparency obligations. Under EU and UK rules, the placing of and access to information on a user's device (governed by the ePrivacy regime) and any subsequent processing of personal data (governed by the GDPR) still require a valid legal basis independently of how the supply path is structured. Reducing intermediaries may indirectly reduce the number of parties processing personal data, but it does not replace the need for lawful consent or other appropriate safeguards.
If we consolidate to fewer supply paths, do we still need to name every vendor in our consent notice?
Consolidating supply paths does not remove transparency obligations toward the vendors that remain. In most EU jurisdictions, valid consent must be informed, which generally means users should be able to understand which parties may set cookies or similar technologies and process their personal data. Fewer intermediaries can make this disclosure more manageable, but any third party still involved in setting or accessing information on the device, or in downstream processing, typically needs to be accounted for in your consent information and records. The precise expectations around vendor disclosure can vary by jurisdiction and by the guidance of the relevant data protection authority, so this should be assessed against your specific setup.
How does supply path optimisation interact with a consent management platform (CMP)?
A CMP manages how consent is collected, signalled, and logged, and it may transmit consent signals to downstream parties, for example through frameworks such as the IAB Transparency and Consent Framework (TCF). Supply path optimisation operates at the media-buying layer and is largely separate. In practice, reducing the number of vendors in a supply path may reduce the number of parties to which a CMP must communicate consent status, and may simplify the vendor list a CMP presents to users. However, the CMP configuration and the supply path decisions should be kept aligned so that vendors removed from the supply path are also reflected in the consent interface and records. Neither the CMP nor the optimisation exercise guarantees compliance on its own; both support decisions that ultimately require legal judgment.
What consent records should we keep when we change our supply path?
Where consent is the legal basis, organisations are generally expected to be able to demonstrate that valid consent was obtained, which typically involves logging what a user was shown, what they agreed to, and when. When you change your supply path, it is prudent to keep a record of which vendors were added or removed and from what date, so that your consent logs remain consistent with the parties actually processing personal data at any given time. The specific record-keeping expectations depend on your jurisdiction and the applicable guidance, so treat this as a general practice rather than a fixed rule.
Do the same rules apply to non-cookie technologies used in optimised supply paths?
Yes, in the sense that similar technologies are generally treated the same way as cookies under EU and UK rules. Pixels, SDKs, local storage, server-to-server identifiers, and fingerprinting techniques used within a supply path fall within the same rules governing the storing of or access to information on a user's device where applicable, and any resulting personal data processing is governed by the GDPR. Optimising a supply path does not change how these technologies are classified, so each should be assessed for whether it requires consent or another legal basis.
How do supply path decisions differ between EU/UK opt-in regimes and US opt-out regimes?
The obligations attached to vendors in a supply path vary by jurisdiction. In most EU and UK contexts, non-essential cookies and similar technologies typically require prior, freely given, specific, informed, and unambiguous consent through a clear affirmative action before data flows to supply path partners. Under several US state frameworks, such as the CCPA and CPRA in California, the model is often opt-out rather than opt-in, and signals such as Global Privacy Control may need to be respected. This means the same optimised supply path may need to handle consent or opt-out status differently depending on the user's location. You should confirm the specific requirements for each relevant jurisdiction rather than applying one region's approach universally.
Common misconceptions
Supply Path Optimisation is purely a commercial or media-efficiency exercise with no privacy dimension.
Because each intermediary in a supply path may set or read cookies, pixels, SDKs, local storage, or engage in fingerprinting, and may process personal data such as advertising identifiers, SPO decisions can materially affect obligations under the ePrivacy Directive (governing device access) and, separately, the GDPR (governing any resulting personal data processing) in EU jurisdictions. These regimes are distinct, and satisfying one does not automatically satisfy the other.
Reducing the number of intermediaries through SPO by itself makes a buyer compliant with cookie consent requirements.
Shortening a supply path may reduce the number of parties accessing a user's device, but it does not on its own establish valid consent. In most EU jurisdictions, non-essential cookies and similar technologies generally require prior consent that is freely given, specific, informed, and unambiguous. Fewer partners does not remove the need to obtain and honour that consent, and requirements differ under other frameworks such as certain US state laws that rely on opt-out.
Standards like ads.txt, sellers.json, and the SupplyChain object confirm that a supply path is privacy-compliant.
These transparency mechanisms are designed to identify authorised sellers and resellers and to expose the chain of intermediaries; they are not consent or compliance tools. They do not verify that valid consent was obtained or that a lawful basis exists for personal data processing under the GDPR, and they do not replace legal judgment about a given path.
Best practices
Map the intermediaries in each supply path and, for each one, identify whether it may place or access cookies or similar technologies on the user's device or process personal data, so that ePrivacy and GDPR obligations are assessed separately rather than conflated.
Use transparency mechanisms such as ads.txt, sellers.json, and the OpenRTB SupplyChain object to understand the chain of authorised sellers and resellers, while treating them as visibility tools rather than proof of consent or compliance.
Verify that consent and preference signals, for example those carried under frameworks like the IAB Transparency and Consent Framework, are propagated to downstream partners in the retained paths, and document where propagation cannot be assured.
Prefer supply paths where the relevant legal basis for any device access and personal data processing can be evidenced, and treat the availability of valid consent as a factor alongside cost and efficiency when rationalising the chain.
Maintain records of supply path decisions and the consent-handling arrangements of retained partners to support accountability, recognising that requirements and enforcement positions differ across the EU, the UK, and individual US states.
Involve legal or data protection advisers in supply path decisions rather than relying on adtech tooling alone, since such tools support compliance but do not replace the legal judgement needed given evolving regulatory guidance.
