Detecting Invalid Traffic Without Cookies: Why IP Intelligence Replaced Your Verification Stack

What Cookie Deprecation Actually Broke

When Google Chrome shipped its full third-party cookie blockade in January 2026, it did not just affect retargeting. The collateral damage hit ad verification infrastructure harder than most teams anticipated. Here is what stopped working:

Why IP Intelligence Works Without Cookies

IP intelligence does not need cookies because it operates at the network layer. Every HTTP request — whether it comes from a browser, a mobile app, a smart TV, or a server-side header bid — carries the source IP address. That address contains five fraud-detection signals that cookie-based systems could never access:

Server-Side Integration: Prebid & OpenRTB

The biggest advantage of IP-based verification is that it works at the protocol level. You do not need JavaScript, you do not need pixels, and you do not need cookie consent. Here is how demand-side platforms integrate IP intelligence into their bidding logic:

// Prebid.js bid adaptation with IP intelligence
// Runs server-side — no cookies, no JS in the user's browser

async function validateImpression(bidRequest) {
  const ip = bidRequest.device.ip;
  const startTime = performance.now();

  // Single API call returns all fraud signals
  const ipData = await fetch(
    `https://ip-info.app/api/v1/geolocate?ip=${ip}`,
    {
      headers: {
        'x-api-key': process.env.IP_API_KEY,
        'Accept': 'application/json'
      }
    }
  ).then(r => r.json());

  const latency = performance.now() - startTime;

  // Build fraud score from IP signals
  const fraudScore = calculateAdFraudScore({
    connectionType: ipData.connection_type,
    isVpn: ipData.security?.vpn,
    isProxy: ipData.security?.proxy,
    isTor: ipData.security?.tor,
    isDatacenter: ipData.connection_type === 'datacenter',
    isMobile: ipData.connection_type === 'mobile',
    countryMatch: ipData.country_code === bidRequest.user?.geo?.country,
    asnReputation: getAsnReputation(ipData.asn),
    ipVelocity: await getIpVelocity(ip, '10m'),
  });

  return {
    score: fraudScore,
    recommendation: fraudScore > 70 ? 'block' : fraudScore > 40 ? 'scrub' : 'accept',
    signals: {
      connectionType: ipData.connection_type,
      country: ipData.country_code,
      city: ipData.city,
      isp: ipData.isp,
      org: ipData.organization,
      latency: Math.round(latency),
    },
    // For SIVT (Sophisticated Invalid Traffic) detection
    isSivt: fraudScore > 70 && (
      ipData.security?.vpn ||
      ipData.security?.proxy ||
      ipData.connection_type === 'datacenter'
    ),
  };
}

function calculateAdFraudScore(signals) {
  let score = 0;

  // Datacenter connections on display campaigns
  if (signals.isDatacenter) score += 35;

  // VPN/proxy/tor masking
  if (signals.isVpn) score += 25;
  if (signals.isProxy) score += 20;
  if (signals.isTor) score += 40; // Tor exit nodes = almost certain fraud

  // Geographic mismatch
  if (!signals.countryMatch) score += 15;

  // High IP velocity (rapid rotation)
  if (signals.ipVelocity > 20) score += 30;

  // ASN reputation (known bot farm networks)
  if (signals.asnReputation === 'suspicious') score += 25;
  if (signals.asnReputation === 'malicious') score += 45;

  return Math.min(score, 100);
}

This pattern runs entirely on your bidding server. The IP check happens in 35ms — well within the 100ms timeout window for OpenRTB bid responses. Because there is no JavaScript execution in the browser, it works for CTV inventory, mobile in-app, and AMP ads where cookie-based solutions never functioned.

The Three Categories of Invalid Traffic — And How IP Catches Each

The MRC (Media Rating Council) and TAG classify invalid traffic into three tiers. IP intelligence detects all three with different signal combinations:

The Residential Proxy Problem: Why Cookie-Based Systems Never Caught It

Residential proxies are the single hardest fraud vector for cookie-based systems to detect. A residential proxy routes bot traffic through a real home broadband connection, making the IP address appear identical to a legitimate user. Cookies see a normal browser session on a normal residential IP — and pass it through.

IP intelligence catches residential proxies through three signals that cookies cannot access:

How MediaShield Eliminated $3.1M in Annual Ad Waste

MediaShield operates a mid-size demand-side platform processing 2.8 billion monthly impressions across display, video, and CTV inventory. When Chrome deprecated cookies, their invalid traffic detection rate dropped from 94% to 61% within three weeks. Fake impressions surged, CPMs climbed, and advertiser complaints tripled.

They replaced their cookie-dependent verification layer with IP intelligence, integrating it at the OpenRTB bid adapter level. Every incoming bid request gets an IP check before the platform responds with a bid:

The most surprising result was the CPM improvement. Advertisers bid more aggressively on verified-clean inventory. When MediaShield started annotating bid responses with an IP-verified quality signal, their win rates on premium deals increased by 28% because buyers trusted the inventory quality.

CTV & Connected TV: Where IP Intelligence Has No Competition

Connected TV is the fastest-growing ad segment, projected to reach $42B in US ad spend by 2027. CTV inventory also has the highest invalid traffic rates — 26% of CTV impressions are fraudulent, according to DoubleVerify. Cookie-based detection has never worked on CTV because smart TVs do not have browsers, do not execute JavaScript, and do not store cookies.

IP intelligence is the only viable fraud detection method for CTV. Every streaming device connects through a network, and that network leaves an IP trail. The detection logic is straightforward:

Advanced Patterns: Beyond Basic IP Checks

Latency Budget: Why 35ms Matters for Header Bidding

In programmatic advertising, latency kills yield. The average OpenRTB auction timeout is 200ms. Your bidding infrastructure has roughly 100ms of that budget after accounting for network transit and auction overhead. Every fraud check you add eats into that budget.