How do ad networks trackers get loaded?

Question

I just installed Ghostery on my browser, and when accessing any random page, I see a lot of advertising trackers that, however, don't appear in the page's source code.

For example, let's take http://www.latimes.com: according to Ghostery, one of the ad trackers it loads is by AppNexus, and the URLs it shows are of the form http://secure.adnxs.com. And yet, if I do "view source", I don't see that URL anywhere in the page. At least in the case of Google and Doubleclick's trackers, I can find them in the source (and conversely, when I read the page, all the ads I see come from Google/Doubleclick).

Obviously these trackers are being loaded through Javascript... but where? Which code is redirecting and loading those trackers? The only way I can think of is if they come from the Doubleclick code... but, aren't AppNexus (and all the other ad networks) supposed to be Doubleclick's competition? Why would Doubleclick load their competition's trackers? How does that even work?

(I know about real time bidding, supply side platforms and so on, at least in theory. I'm just trying to understand how it all works, using this practical example).

Answer 1

There's a few explanations that I can think of off the top of my head.

The first is ad waterfalls, which it sounds like you know about from the real time bidding. It's quite possible that AppNexus is loading during the DoubleClick bidding waterfall. While they may be competitors, it can be quite common to load several ad networks through DoubleClick and have them compete against each other.

From what I understand, DoubleClick isn't adsense. It's an ad waterfall real time bidding solution in which you can put your own ad networks into the DoubleClick script. This allows for you to have ad networks bidding against each other for the spot.

Next is as you say, it's possible that the AppNexus is loading through javascript somewhere in the .js files. Often times it can be difficult to thoroughly navigate through what the .js files are doing on a large site. This is especially the case if the .js files are large and well obfuscated. It's even more complicated once .js files start calling other .js files and having to track through all of that can be very difficult if the source code is scrambled well.

The other possibility is that there is alternate language on the page that isn't Javascript, and that is what is calling the AppNexus data. Data can be passed through many different types of languages as well as many different types of objects. It's possible to be tracked by remote servers even through images loading on a page, as well as any other type of flash, java, or other object that is loaded into the browser.