Open source ad stack: what Prebid covers, what it doesn't

Every publisher with an engineering team asks the same question sooner or later: Prebid is free, so why pay anyone to run it? We went through about 380 open-source adtech projects to answer it properly. The short answer: open source gives you about two thirds of the plumbing, and almost none of the product.

For each project we checked the licence file, the last commit and the latest release on GitHub, so the list reflects what is actually alive, not what a README promises. This post covers which parts are which, where the gaps are, and the licence traps to watch for if you build your own stack.

What does a publisher’s ad stack have to do?

Whatever the surface, a publisher needs the same nine jobs done:

Demand: run an auction against many bidders, in the browser and on a server.
Ad serving: decide between direct, guaranteed, private deals, open auction and house ads.
Rendering: get the creative on screen and fire the trackers.
Identity and consent: capture consent, pass IDs and enforce privacy rules.
Data and yield: log bids, report revenue, and tune floors and timeouts.
Quality: catch invalid traffic and bad creatives, and measure viewability.
Ad ops tooling: manage line items, key-values and configuration.
Supply-chain transparency: keep ads.txt, app-ads.txt, sellers.json and schain in order.
Sales: run direct deals and PMPs, and now sell to AI buying agents too.

What open source does well

The auction is solved, and it’s Prebid. Prebid.org is the only open-source stack that is production-grade on every surface:

Web: Prebid.js 11 (11.44 at the time of writing), with a core now mostly written in TypeScript and more than 500 bidder adapter modules in the repo.
Server-side and AMP: Prebid Server in Go (v4.11) and Java (4.4), each shipping a new release every few weeks.
Apps: Prebid Mobile for iOS and Android.
Video and rendering: Prebid Cache stores bids for video and AMP, and the Prebid Universal Creative renders winning bids inside your ad server’s creatives.

All of it is Apache-2.0 licensed. Nothing else comes close on even one of those surfaces.

The building blocks around the auction are healthy too:

Protocol libraries: OpenRTB libraries and validators, and IAB Tech Lab’s TCF and GPP consent-string libraries, which many commercial consent tools build on.
Video players: Shaka Player, hls.js, Video.js and Android’s Media3 all integrate with ad SDKs.
Identity: UID2’s code, including the operator service, is published in IAB Tech Lab’s GitHub under Apache-2.0. SharedID ships inside Prebid.js, and ID5 has an open-source client.
Data infrastructure: Kafka, Flink and ClickHouse. ClickHouse is now a common choice for storing ad events.
Machine learning and measurement: FuxiCTR, Vowpal Wabbit and TorchRec for models, and Meridian and Robyn for marketing-mix work. This is the healthiest corner of the whole catalogue.

If your plan is “use Prebid for the auction”, open source has you covered.

Where does open source run out?

The gaps cluster in five places. Each is a job every publisher needs done, and none has a credible open-source answer.

1. The control plane

Prebid Server needs a database of accounts and stored requests: which bidders run on which ad unit, with which parameters. Prebid’s own hosting documentation says it plainly: “there aren’t any open source tools for populating this database.” Every Prebid Server host builds its own.

The same is true for the rest of the control plane: wrapper configuration, version pinning, A/B tests, and syncing ad units and line items with Google Ad Manager. The pieces you can download are command-line tools, not a console your ad ops team can use.

2. Bid-level analytics and yield

Prebid has analytics adapters that emit bid events. There is no open-source backend or dashboard that turns those events into what you need to see:

win rate by bidder
timeout losses
latency
revenue that reconciles with GAM

Prebid’s floors module applies whatever floors you configure, but nothing open source tells you which floors to set. The same goes for timeouts. There is no open-source floor optimiser, timeout tuner or traffic shaper.

This is the gap that costs publishers the most money, because it hides the bids you lost.

3. Video and CTV ad serving

Open source has excellent players and good SCTE-35 tooling for marking ad breaks. It has no production ad-insertion product:

No CTV bidding SDK. Prebid Mobile covers iOS and Android. There is no Prebid SDK for Roku, Tizen or webOS, and Roku’s own ad framework is closed source.
No production server-side ad stitcher. Eyevinn’s server-guided ad insertion proxy is the closest open-source option, and its own repo calls it experimental.
No open-source decisioning for ad pods, including frequency capping and competitive separation.
No open measurement code. The native Open Measurement SDK is distributed through IAB Tech Lab’s tools portal, not as an open-source repository.

FreeWheel, SpringServe, Publica, Google DAI and AWS MediaTailor own this layer.

The consent libraries are open. The products are not:

Consent tools: we found no actively maintained open-source consent tool registered as a TCF CMP. Registration and ongoing compliance are the barrier, not the code.
Clean rooms: there is no turnkey open-source clean room. Meta’s Private Computation Solutions repo and ByteDance’s Jeddak privacy-SQL project are both archived, and only the cryptographic building blocks survive.
Ad quality: there is no open-source creative or malvertising scanner for web or apps. The IAB/ABC International Spiders and Bots List is a paid annual subscription.

Open source gives you signals, such as bot detection and device detection, but not an ad-quality product.

5. Selling to AI agents

Agentic advertising is the fastest-growing open-source area of all, and it’s still early:

AdCP 3.2 is generally available, with official SDKs for TypeScript, Python and Go, and a Java SDK in the same GitHub organisation.
The Prebid Sales Agent moved to Prebid.org in January 2026. Its release tags have reached 2.0, but its own README still calls it alpha software.
IAB Tech Lab’s AAMP family includes reference buyer and seller agents (see AAMP and AdCP compared).

What doesn’t exist yet is a production sales agent with a real catalogue, pricing rules and approvals that a publisher can switch on.

The graveyard: don’t build an exchange

Some parts of the catalogue read like a warning.

Exchanges and DSPs. Every general-purpose open-source exchange or DSP we found went dormant in 2018 or 2019: RTBkit, OpenSSP, vanilla-rtb and RTB4FREE. The market doesn’t sustain open-source exchanges. A publisher doesn’t need one anyway, because Prebid Server already runs the auction.

Ad servers. Revive Adserver (PHP, GPL-2.0) is the only mature open-source ad server still shipping, now on 6.0. Publishers overwhelmingly run Google Ad Manager, so integrating beats replacing.

Privacy Sandbox. In October 2025 Google announced it would retire Topics, Protected Audience and Attribution Reporting. Chrome deprecated Protected Audience in Chrome 144 with removal planned for Chrome 150. Google has archived the Bidding and Auction server repos, and Prebid.js 11 removed its paapi, paapiForGpt and topLevelPaapi modules. Chrome kept its current approach to third-party cookies. If Privacy Sandbox work is still on your roadmap, you can take it off.

The licence traps

If you’re building a commercial service, or modifying code you ship to others, the licence matters as much as the code.

AGPL-3.0: Aerospike Community Edition, Metabase (outside its enterprise folder), Plausible, Unleash (since v8) and IAB Tech Lab’s Agentic RTB Framework. These are fine to run unmodified as a separate service. They’re risky to modify or embed in something you distribute.
Moved away from open source: Snowplow’s collector and enrich (Snowplow Limited Use Licence), RudderStack server (Elastic License 2.0), ScyllaDB (source-available) and UAParser.js v2 (AGPL-3.0). threefive, a popular SCTE-35 library, moved from MIT to GPL-2.0.
Moved back: FingerprintJS returned to MIT in version 5.
Data: the public Criteo click-log datasets are CC BY-NC-SA 4.0, which means non-commercial use only. Don’t train production models on them.

Prebid’s projects, UID2, AdCP, IAB Tech Lab’s AAMP agents and the Google player projects are Apache-2.0 or MIT, and safe to build on. Check each IAB Tech Lab repo individually, though: the Agentic RTB Framework is the exception.

So, should you run Prebid yourself?

You can, and plenty of publishers do. Go in knowing what the free part covers.

You get from open source	You still build and run
The auction (Prebid.js, Prebid Server, Prebid Mobile)	Configuration, accounts and the ops console
Consent string libraries	Consent enforcement wired into the auction for each account
Analytics adapters that emit bid events	The pipeline, dashboards and GAM reconciliation
A floors module	Knowing what the floors and timeouts should be
A Prebid.js release most weeks	Testing and upgrading without breaking pages
Video players	Ad insertion and pod decisioning for CTV
AdCP and an alpha sales agent	A sales agent you can trust with real budgets

The left column is free. The right column is a team. If you have that team, self-hosting Prebid is a sound choice. If you don’t, the right column is what you’re actually buying when you pay a host. That’s the part BidCliq works on: the auction is Prebid, and we don’t hide that.

What to do next

List the nine jobs above and mark which ones your team owns today, which a vendor owns, and which nobody owns.
If you self-host Prebid Server, decide who builds and maintains the stored-request database and the tooling around it before you go live.
Put a named owner on Prebid upgrades. Prebid.js ships most weeks, and Prebid Server every few weeks.
Run a licence check on every open-source component you modify or redistribute, especially anything AGPL or source-available.
Remove any remaining Privacy Sandbox work from your roadmap and your Prebid builds.

Versions, licences and project status checked on GitHub and vendor docs on 27 October 2026. Open source moves fast; if you spot something out of date, tell us.

Frequently asked questions

Is Prebid free to use for publishers?

Yes. Prebid.js, Prebid Server (Go and Java), Prebid Mobile, Prebid Cache and the Prebid Universal Creative are all Apache-2.0 licensed. You pay for the infrastructure and the people who run them, not the code.

What does a publisher still need to build when self-hosting Prebid Server?

At minimum, the database of accounts and stored requests that tells Prebid Server which bidders and parameters to use. Prebid's hosting documentation states there are no open-source tools for populating it, so every host builds its own.

Is there an open-source CTV ad server or SSAI stitcher?

Not a production one. Open source has strong players and SCTE-35 tooling, but server-side ad insertion and ad-pod decisioning are commercial products. Eyevinn's server-guided ad insertion proxy is open source but labelled experimental.

Are Privacy Sandbox APIs still worth building for?

No. Google announced in October 2025 that it would retire Topics, Protected Audience and Attribution Reporting, and Prebid.js 11 removed its PAAPI modules. Chrome kept its current approach to third-party cookies.

Which open-source licences should publishers be careful with?

AGPL-3.0 projects such as Aerospike Community Edition, Metabase, Plausible and Unleash are fine to run unmodified as a separate service, but risky to modify or embed in software you distribute. Source-available licences such as Elastic License 2.0 can restrict offering the software as a service.

About the author

Sharad Yadav

Founder, BidCliq

Sharad Yadav is the founder of BidCliq, a publisher-first ad monetization platform that helps publishers and ad ops teams run header bidding, Prebid and programmatic across display, video, app and CTV. Before BidCliq, he led AdTech and product at GeeksforGeeks, where he built an in-house ads product that doubled programmatic revenue within nine months and an anti-adblock solution that lifted ad yield by 10%. He is a founding member of AdCP.