CTV and streaming: how ads reach the big screen

You are watching a cooking show on a smart TV and, right on cue, a two-minute ad break plays: a car, a bank, a snack. It looks like old-fashioned TV, but each of those ads may have been chosen in a split-second auction for your household. That is CTV advertising, the fastest-changing channel in ad tech and one of the most attractive to fraudsters.

Traditional TV is a radio tower shouting the same ad to everyone in the city. Connected TV is a postman delivering a different envelope to each house, while still making it look like a normal TV break.

The vocabulary

The ad-tier wave

For years the big subscription streamers refused ads. Then Netflix launched a cheaper plan with ads in November 2022 in a dozen markets including the US, Brazil, Japan and South Korea, and later built its own ad tech. Amazon went further in January 2024 by putting ads into Prime Video by default in the US, with an extra fee to remove them, and then expanded that to other countries. Disney+, Max and others followed with ad tiers. In India, the merger that created JioHotstar in 2025 combined two of the country's largest ad-supported streamers.

How an ad reaches the TV: SSAI vs CSAI

SSAI creates a verification problem. Because a server, not the TV, calls the ad server, the request must forward the real device's IP address and user agent in special headers. If those headers are missing or faked, the buyer cannot tell a real living-room TV from a script running in a data center.

1. An ad break is coming: You are watching a show in a streaming app. An ad pod (a break of several ads) is due.
2. The server asks for ads on the TV’s behalf: With SSAI, a server, not the TV, requests the ads. It passes along the TV’s IP address and device details in the VAST request.
3. The pod is sold: Buyers bid for the slots. CTV prices are high because the screen is big and the viewer is often a whole household.
4. Stitched into the stream: The SSAI server stitches the ads into the video so they play smoothly, like broadcast TV. Great for viewers, but the buyer never talks to the TV directly.
5. The fraud: SSAI spoofing: Because requests come from servers, a fraudster can run a server that pretends to be SSAI for millions of TVs that are not watching anything. This is SSAI spoofing. Schemes like this have faked huge volumes of requests.
6. The defence: Buyers verify that SSAI servers are known and certified, check that device signals are consistent, and use standards and signed identifiers to prove a real device requested the ad.

VAST, pods and the ad break

1. The player reaches a breakThe content has cue points marking where a Pre-roll or Mid-roll break goes.
2. It requests a podInstead of one ad, it asks for an ad pod: say, four slots adding up to 120 seconds, with rules like no two car brands.
3. An auction or ad server fills the slotsDirect deals, programmatic guaranteed buys and open-market bids compete for positions in the pod.
4. VAST describes each adEach winning ad arrives as a VAST document: where the video file lives, how long it runs and which tracking URLs to call at start, quartiles and completion.
5. Tracking firesImpressions and quartile events are reported, either by the device (CSAI) or by the SSAI server on its behalf.

ACR and household IDs

Smart TVs can use ACR (automatic content recognition) to identify what is on screen, including broadcast and cable, by matching audio or video fingerprints. With the viewer's permission, TV makers turn that into viewing data for targeting and measurement. Because a TV is shared, the key identity unit is the Household ID, usually tied to the home IP address and linked to other devices on the same network. That link powers Addressable TV and cross-device measurement, but IP-based households are fuzzy: shared networks, VPNs and changing addresses all blur them.

Why CTV attracts fraud

• High prices: CTV CPMs are typically well above web display, so each fake impression is worth more.
• No cookies, limited JavaScript: many TV apps cannot run the verification scripts common on the web.
• SSAI trust gap: SSAI spoofing uses servers to impersonate SSAI providers and invent ad requests for TVs that do not exist. Schemes publicly exposed by researchers, such as ICEBUCKET in 2020, did exactly this at scale.
• App and device spoofing: App spoofing claims a premium streaming app, and device spoofing makes a phone or server look like a TV.
• Screens that are off: ads can keep playing to a TV nobody is watching, or on a set-top box with the TV switched off.