Header Bidding for Publishers and Ad Networks: Managed Wrapper, Open-Source Prebid, or Your Own Layer

Header bidding lets a publisher ask many ad buyers for a price at the same moment, before the ad server chooses what to show. Every buyer then competes for the same space. There are three ways to get it. One is a managed wrapper, a vendor's hosted version of the code and its settings. Another is the free open-source Prebid software run by your own team. The third is a layer you write yourself. They differ mostly in who does the upkeep and who can see the raw auction data.

What does header bidding do?

When a page has a space for an ad, a small piece of code on the page sends a bid request to several bidders. A bid request says which space is for sale and on which page. Prebid.org publishes free, open-source software for this. It describes the usual setup this way: “Prebid collects bids before the ad server is called, and the ad server makes the final decision.” The bidders are supply-side platforms (SSPs), demand-side platforms and ad exchanges, and each returns a price. The code passes the best prices to the ad server, which compares them with your direct deals. All pages quoted in this article were read on 10 November 2026.

A wrapper is the container around that code: the list of buyers, the time limit for answers, the price rules and the link to the ad server. Prebid.org says its software is the most widely used wrapper of this kind. It adds that Prebid “can also be used as a complete bidding library”, picking the winner on the page, with any ad server bidding into it like other demand.

What does header bidding change in revenue?

More buyers see each space at the same time, so the winning price can rise. The size of the gain depends on your traffic, your formats and which buyers want your audience. Prebid says requests go out in parallel: “Requests are sent to all bidders at once, rather than one at a time.”

There is a cost. Prebid's page says: “By delaying the ad serving, you may lose impressions from users who bounce very quickly.” Fewer bidders mean a faster auction, “But fewer demand partners also means fewer chances for an optimal bid.” Measure revenue per thousand page views (page RPM) and page speed together.

Client-side or server-side, and what happens to page speed?

In a client-side auction the visitor's browser sends the bid requests. Prebid.js, “a JavaScript library that runs in the browser”, does this. In a server-side auction the browser sends one request to a server, which asks the buyers. Prebid's server product is Prebid Server. Prebid.org says passing the load to a server “can be faster than running them client-side from the browser”, and that a mix of both is possible. It recommends testing “the number of bidders, timeout values, and client-vs-server” on your own pages.

Prebid.org says server-side bidding “is required in environments that don’t have HTML header sections in which to put JavaScript, such as mobiles apps and Accelerated Mobile Pages (AMP) sites.” For app traffic, that settles part of the choice.

What does a managed wrapper include?

A managed wrapper is a service where a vendor builds, hosts and updates the header bidding setup for you. Prebid.org says publishers without engineers can use “a managed service company that can integrate and maintain Prebid for you”, and lists them. Its directory names Adapex, Aditude, AdPushup, Assertive Yield, Freestar, Livewrapped, Magnite, Media.net, Microsoft Monetize, PubMatic, Setupad and others.

Scope varies by vendor. Magnite says its Prebid-as-a-service lets large publishers “deploy and control custom header bidding implementations without writing code”. That is Magnite's claim. Expect some mix of these, and ask which are in the price:

• The wrapper code, buyer list and time limit, kept current, plus ad server setup
• A screen to change settings without a developer, and reports
• The consent connection, and a hosted Prebid Server if you want server-side auctions

What do you give up with a managed wrapper?

The costs fall into money, control and data, and a contract can limit each one.

• Money. Managed services can charge a monthly fee, a share of revenue, a margin inside a bundle with the vendor's own demand, or a mix. The vendor pages read here state no prices, so ask for the exact formula and for revenue reported net of every deduction.
• Control. The vendor may decide which buyers are added, how the auction is tuned and which update goes live. Ask whether you can override settings and whether changes are logged.
• Data. Many reports show totals, not single auctions. To check a vendor you need a record of each auction: who was asked, who answered, at what price and how fast. Ask whether you get it, in what format and for how long.

A vendor that also sells demand has a reason to favour its own buyer. Ask how it shows that its buyer is treated like the others, and get the answer in writing.

What does running Prebid yourself take?

The software costs nothing to license: Prebid.org says “Prebid is free to anyone who wants to use it.” You pay in staff time:

• Updates. Prebid.org says: “We suggest you upgrade at least every six months.” Releases bring “bug fixes, performance improvements, new features, better regulation support”, and each buyer connects through an adapter, a small module that talks to it.
• Building and testing. You choose the buyer and analytics modules in your Prebid.js file, rebuild it, and test it on real pages in several browsers before each release.
• Reporting. Prebid.org lists “many analytics adapter plugins”. You pick one, connect it and decide what is stored. This is where auction-level records come from.
• Ad server setup. Line items, the ad server's records of each price level, and the price rules must match what the code sends, or revenue leaks quietly.
• Server-side hosting, if you use it. Prebid's hosting guide says: “Prebid Server is not a turn-key solution.” It adds: “You need to commit to checking at least quarterly for updates. There are new releases most every week.” Prebid's server overview also warns that installing it “is not nearly as easy as Prebid.js”.

A middle route is to hire a firm to set up and maintain Prebid under accounts you own. You keep the code and the data.

Where do consent and privacy rules bite?

Every bid request can carry facts about a person, so where privacy rules apply, every route must record the visitor's choice and pass it on to the buyers.

In the EU, the consent record is usually a Transparency and Consent Framework (TCF) string from IAB Europe. A consent management platform (CMP), the pop-up that asks visitors, produces it. IAB Europe's page says TCF v2.3 launched in April 2025 and that “TCF participants have until 28 February 2026 to adopt TCF v2.3”. IAB Europe's notice of 16 July 2026 gives CMPs until 23 October 2026 to implement the new TCF v2.4 disclosures on the web. The date for apps and connected TV is 23 February 2027. The EU Court of Justice's press release on its judgment of 7 March 2024, in case C-604/22, says the string “contains information concerning an identifiable user and therefore constitutes personal data within the meaning of the GDPR.” It adds that, when the string is associated with an identifier such as an IP address, the information may make it possible to identify the user. Treat it as personal data in your logs. For Google Ad Manager, Google's help page says “a certified CMP integrated with the TCF is required when serving personalized ads to users in the EEA and UK.”

In the US, rules differ by state. The California Attorney General's page lists “The right to opt-out of the sale or sharing of their personal information including via the GPC”. GPC is the Global Privacy Control, a setting in some browsers, or a browser extension, that tells a site to stop selling or sharing a person's data. Prebid has modules that read consent signals from the CMP and pass them to buyers, including one for the IAB's Global Privacy Platform. Their limit, in Prebid's words: “Prebid functionality created to address regulatory requirements does not replace each party’s responsibility to determine its own legal obligations and comply with all applicable laws.”

With a managed wrapper, ask who is the data controller for the auction data and who signs the data processing terms.

How do identity and cookies affect header bidding?

Buyers can pay more for a visitor they recognise. Prebid's User ID module sets up shared pseudonymous IDs, which its page calls “an important way of increasing the value of header bidding”. You choose the ID modules and take legal advice on the notice to visitors.

Server-side auctions add a step. The Prebid Server guide says “Many bidders track their bidder-specific user IDs through cookies”, and that those cookies “must be consolidated under the Prebid Server domain”. This is called cookie syncing, and it only runs “If privacy regulations allow”. Where a sync does not happen, the buyer may not recognise the visitor.

On 22 April 2025 Google wrote that it would “maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies.” On 17 October 2025 Google said it would “retire the following Privacy Sandbox technologies”, among them Topics and Protected Audience, two of its browser-based ad targeting tools. Its cookie pages still say cookies “can be blocked by browser design, Enterprise policy, or user choice.” Chrome's release notes for version 153, with stable release scheduled for 8 September 2026, still cite Chrome's announcement “that the current approach to third-party cookies will be maintained”. No later Google statement found for this article changes that.

So cookies will work for some visitors and not others. Ask how each option performs for visitors without one.

How do you compare options with a controlled test?

A promised uplift is the vendor's hope. Assertive Yield's directory page says it has shown “a remarkable uplift in visitor revenue, surpassing existing monetization solutions by more than 20%”. That is its own claim and says nothing about your pages.

• Split traffic at random between your current setup and the new one. Run both together, on the same pages, for whole weeks, longer if traffic is small.
• Fix the question first: revenue per thousand page views for each group, net of every fee, with page speed and bounce rate beside it. Decide the length and the success line before you start.
• Take the numbers from your own ad server and records, not from the vendor's dashboard alone.
• Include hard cases: slow connections, visitors who refuse consent, apps and EU traffic.

When is building your own layer justified?

Rarely, and usually not from nothing. Prebid.org says the code and documentation on its site are “released under the Apache License”, so a firm can build on top of Prebid. Any of these can justify custom work:

• You run an ad network or SSP and the auction itself is your product, with your own rules for floors, deals or which buyers see which space.
• Contracts or data rules require every auction record to stay inside your systems.
• Your inventory is unusual, such as screens or app formats Prebid does not cover well.
• At your volume, vendor fees cost more than a team that maintains your own code.

Do not build because a vendor's report disagrees with yours, since a new system adds one more set of numbers. Do not build to save a fee on one site with ordinary display ads.

What do you keep if you leave a vendor?

Several vendors in Prebid's directory build on Prebid itself. Magnite, for one, says its service works “via Prebid.js, Prebid Mobile and Prebid Server”, so moving between Prebid-based setups should be a smaller job than leaving a closed one. Ask in writing for:

• Your own accounts with every SSP and exchange, so buyer relationships and payments stay with you
• The full wrapper configuration in readable form: buyers, time limits, floors and settings per page
• Auction-level records, exported to storage you control, for the whole contract term
• Consent records, user ID settings and the ad server line items, which should already be in your account
• A notice period and a handover plan, including who removes the vendor's script from your pages

A firm that builds it should leave you the repository, the build steps and the test pages.

What should you ask a vendor or a firm that would build it?

• What exactly do you charge, and what is deducted before the revenue figure you report to us?
• Do you also sell demand, and how do you keep that from affecting which bid wins?
• Is it built on open-source Prebid, and which version are we on today? How often do you update it?
• Can we export auction-level records, in what format, at what cost, and for how long are they kept?
• Which consent platform and signals do you support for the EU and for US states?
• How does it behave for a visitor without a cookie, and in a mobile app?
• Will you run a split test on our traffic, with numbers taken from our own ad server?
• What do we keep and what do you hand over if we leave?

Where does amBrain fit?

amBrain publishes this blog. In its own words: “amBrain builds supply-side platforms (SSP) for publishers.” A second line concerns ad event data: “amBrain builds event analytics pipelines for ad tech: collection, processing and reporting of impression and click events.”

amBrain has been building software since 2019. On how it works with clients, it says: “Three formats: full delivery, a dedicated team, or engineers embedded in your team.” Its line on ownership is “The client keeps full ownership of the product and the code, except our reusable components.” Ask for the list of those components by name before you sign.

This article is not a case study and describes no client work. The lines above name no client, and nothing here says that amBrain has built a header bidding product for any company. The article gives no amBrain prices or timelines and claims no relationship with any vendor it names. Every outside source is cited from its own page.

It is not legal advice either. Have a lawyer read vendor contracts, data processing terms and your consent set-up before you sign. If amBrain is on your shortlist, ask it the same questions as any other firm.