I also had something to do with the RTB ecosystem. You have a point, but I was also impressed at how low the standards were, how cheaply you could target an imm

I also had something to do with the RTB ecosystem. You have a point, but I was also impressed at how low the standards were, how cheaply you could target an immense amount of people, and how nothing is enforced. A total nobody could easily spend O($1000) and serve malware to millions of people, served out of his own ad server. If he was going through a DSP there would be some sort of approval of ads but no enforcement that the same ad was the one actually being served. This was when Flash was still around and unsandboxed on most browsers and buggy as hell. Oh, and the industry-standard self-hosted ad server was a PHP thing which carried a backdoor for months/years before anyone noticed. Someone just replaced the tarball on the developer's site and went unnoticed. And the people selling data... do most people know that this is possible: you buy a car, offline, at company X. They have your phone number. You visit website Y, type your phone number. You visit site Z, they can buy your phone number from website Y, and match that to your phone from the car company which sold your data to third-party W, and know for a fact which car you bought. No profiling, statistics, guessing, inference. They have the actual data. Costs O($0.25). This was years ago, frankly I doubt things improved and I doubt they are as cash-rich now.