TAG Certification and the TAG-ID Field in ads.txt

The standard ads.txt line has three required fields: exchange domain, account ID, and relationship type (DIRECT or RESELLER). But there's a fourth field that most publishers either ignore or don't know exists.

text
google.com, pub-1234567890, DIRECT, f08c47fec0942fa0

That last value — f08c47fec0942fa0 — is a TAG-ID, also known as a Certification Authority ID (CAID). It identifies the SSP's certification status with the Trustworthy Accountability Group.

Most publishers copy this field blindly from SSP onboarding templates. Some remove it because they don't know what it is. Neither approach is ideal. Here's what TAG-ID actually does and why it matters.

What TAG Is

The Trustworthy Accountability Group is an industry body that certifies companies in the digital advertising supply chain against specific threats:

• TAG Certified Against Fraud: The company meets standards for detecting and preventing ad fraud
• TAG Brand Safety Certified: The company meets standards for protecting advertiser brand safety
• TAG Certified Against Piracy: The company doesn't monetize pirated content

TAG certification is voluntary and requires ongoing compliance. Companies pay for certification, undergo audits, and maintain specific technical standards. The certification is a trust signal — it tells DSPs that this entity has been independently verified to meet anti-fraud and brand safety standards.

Major SSPs like Google, PubMatic, Magnite, Index Exchange, and OpenX all hold TAG certifications. Many smaller SSPs do too.

How TAG-ID Works in ads.txt

The TAG-ID field in ads.txt serves a specific purpose: it allows DSPs to programmatically verify that an SSP listed in your ads.txt is TAG-certified.

The flow:

1. Publisher includes google.com, pub-123, DIRECT, f08c47fec0942fa0 in their ads.txt
2. DSP parses the entry and extracts the TAG-ID f08c47fec0942fa0
3. DSP checks the TAG-ID against TAG's registry of certified companies
4. If the ID matches a valid, active certification, the DSP knows this supply path involves a TAG-certified seller
5. The DSP factors this into its trust scoring and supply path optimization

Without the TAG-ID, the DSP can still check TAG's public registry using the SSP's domain name. But the TAG-ID makes verification faster and more definitive — it's a direct lookup rather than a fuzzy match.

The Common TAG-IDs You'll See

A few TAG-IDs appear repeatedly in ads.txt files because they belong to major SSPs:

TAG-ID | Company

f08c47fec0942fa0 | Google

0bfd66d529a55807 | AppNexus (Microsoft/Xandr)

5d62403b186f2ace | PubMatic

d4c29acad76ce94f | Magnite (formerly Rubicon Project)

You don't need to memorize these. When an SSP provides you with their ads.txt line template, the TAG-ID is included if they're certified. Use exactly what they provide.

Why TAG-ID Matters for Revenue

DSPs use TAG certification as a trust signal in their supply path decisions:

Supply path prioritization. When a DSP has multiple paths to the same impression, TAG-certified paths get priority. The DSP knows the certified SSP has fraud prevention measures in place, which reduces the risk of the impression being fraudulent.

Brand safety campaigns. Advertisers running brand safety-sensitive campaigns (financial services, healthcare, major consumer brands) often configure their DSP to require TAG-certified supply paths. If your ads.txt entry for an SSP is missing the TAG-ID, the DSP may not recognize the path as TAG-certified, even if the SSP holds certification.

Fraud filtering. DSPs that run their own fraud detection factor TAG certification into their risk scoring. A TAG-certified supply path starts with a higher trust baseline, which means less aggressive filtering and more bid opportunities.

The practical impact: including accurate TAG-IDs doesn't dramatically change your revenue on its own. But it removes a potential friction point in DSP verification. In a programmatic ecosystem where every trust signal matters, it's one more thing working in your favor rather than against you.

Common TAG-ID Mistakes

Using the Wrong TAG-ID

Copying a TAG-ID from the wrong SSP line and pasting it into a different SSP's entry. Each SSP has its own unique TAG-ID. Using Google's TAG-ID for a PubMatic entry creates a mismatch that DSPs can detect.

Fix: Always use the TAG-ID provided by each SSP in their specific ads.txt template. Don't copy between lines.

Making Up a TAG-ID

Some publishers fill in random strings or placeholder text in the TAG-ID field. DSPs validate TAG-IDs against the TAG registry. A fake ID either fails validation silently or flags the entry as suspicious.

Fix: If you don't have the TAG-ID for an SSP, leave the fourth field empty. An absent TAG-ID is neutral. A fake one is negative.

Keeping TAG-IDs for Decertified Companies

TAG certifications expire if companies don't renew. If an SSP lets their certification lapse, their TAG-ID becomes invalid. DSPs that check TAG-IDs against the current registry will see the expired status.

This is rare with major SSPs, but it does happen with smaller companies. There's no practical way for publishers to monitor this manually.

Omitting TAG-IDs That SSPs Provided

Some publishers strip the TAG-ID field when cleaning up their ads.txt, either intentionally (thinking it's unnecessary) or accidentally (regex gone wrong). This removes a valid trust signal.

Fix: When SSPs provide a TAG-ID in their ads.txt template, include it. It's there for a reason.

Should You Add TAG-IDs Yourself?

If your ads.txt entries are missing TAG-IDs and you want to add them, follow these rules:

1. Only add TAG-IDs for SSPs that are actually TAG-certified. Check the TAG registry to verify.
2. Use the exact TAG-ID from the registry. Don't guess or approximate.
3. If you can't find the TAG-ID, ask the SSP. Their ads.txt template should include it.
4. If the SSP isn't TAG-certified, leave the field empty. Don't add a TAG-ID for a non-certified company.

The safest approach: when adding or updating SSP entries, request the complete ads.txt line from each SSP, including the TAG-ID. Use their template exactly.

TAG-ID and sellers.json

TAG certification also appears in sellers.json. SSPs can include a certification_authority_id field in their sellers.json entries, which serves the same purpose as the TAG-ID in ads.txt — it links the seller to their TAG certification.

DSPs that run comprehensive verification cross-reference both:

• The TAG-ID in your ads.txt for each SSP
• The certification data in the SSP's sellers.json for your account

When both align, verification confidence is highest. When they conflict or when one is present but the other is missing, the DSP may flag an inconsistency.

Frequently Asked Questions

Do I need TAG certification to include TAG-IDs in my ads.txt?

No. The TAG-ID in your ads.txt entries represents the SSP's certification, not yours. Publishers don't need their own TAG certification to use the field. You're simply declaring which certified SSP is authorized to sell your inventory.

What happens if I leave all TAG-IDs blank?

Nothing catastrophic. DSPs can still look up SSP certification status through other means (TAG registry, sellers.json certification fields). But you're removing a convenience that makes verification faster and more definitive. Think of it as helping DSPs help you — the easier you make verification, the more smoothly bids flow.

Can TAG-ID affect my ads.txt validation?

No. The TAG-ID field is optional per the IAB spec. Ads.txt validators won't flag missing TAG-IDs as errors. However, advanced verification tools (like BeamFlow's scanner) do check TAG-IDs for accuracy when present and flag mismatches.

How do I check if my TAG-IDs are correct?

Run your domain through BeamFlow's scanner. The report shows verification status for each entry, including TAG-ID validation against the TAG registry.

Is TAG certification the same as ads.txt compliance?

No. They're complementary but separate. ads.txt is a publisher-side declaration of authorized sellers. TAG certification is an SSP-side certification of anti-fraud and brand safety standards. TAG-ID in ads.txt connects the two, letting DSPs verify both in one pass.