A dated citation-heavy timeline of browser adtech. Six sub-decades, each with primary sources. The point is to place every feature spec in this repo against its industry antecedent — every module has a history-of-web position, and the history is what makes the modules' choices legible.

This is a survey, not an essay. Dense, dated, citation-heavy. Each subsection cites two-to-five primary sources. Facts I could not verify against a primary source are noted as such.

The first web banner ran on HotWired in October 1994 — a rectangular AT&T image that read "Have you ever clicked your mouse right here? You will." The click destination was a curated AT&T microsite. Sold at a $30,000 CPM for a three-month exclusive (Zeff and Aronson 1997). The 468×60 dimension became the IAB "full banner" standard by 1996 and remained the anchor unit through the decade (Interactive Advertising Bureau 2017b).

DoubleClick was founded in 1995 as an ad-serving intermediary between advertisers and publishers. Its S-1 (1998) (DoubleClick, Inc. 1998) documents the earliest scale-out ad-server architecture — DART (Dynamic Advertising Reporting and Targeting) — and the third-party cookie mechanism it depended on. The DART cookie was the first ad-tech identifier deployed at scale; every subsequent identifier debate carries its ancestry.

Popup ads were introduced around 1997 by Ethan Zuckerman at Tripod (now well-documented in Zuckerman's own retrospective). The first-generation popup was a window.open() call fired on page load; the second-generation was window.open() on unload (a "popunder"). The unload popup is a direct ancestor of the modern exit-intent overlay (Bounce Exchange (Wunderkind), n.d.).

Interstitials — full-page ads shown between navigations — appeared around 1999 via companies like Unicast (this claim is common in industry retrospectives; I could not find a primary source for the "first" attribution and cite it as attributed rather than verified).

Zeff & Aronson's Advertising on the Internet (Zeff and Aronson 1997) is the earliest published survey of the pre-2000 landscape and remains the reference for what the banner-era buy side thought it was doing.

Google AdWords launched October 2000 as a self-service search-ad platform. The initial pricing was CPM; the shift to CPC in 2002 was the pivot (Battelle 2005). AdSense followed in 2003 as the publisher-side counterpart, extending contextual ad matching from Google-hosted search to arbitrary publisher pages.

The Google model rested on the second-price / generalized- second-price auction (Edelman, Ostrovsky, and Schwarz 2007). Bids were entered as maximum willingness-to-pay per click; the price paid was the next-highest bid plus one cent. The economic-theory papers making GSP tractable came several years after Google's implementation was already at scale — the pricing preceded the theory.

Overture (formerly GoTo.com) held the patent on paid search placement and was acquired by Yahoo in 2003 — the settlement of the patent dispute with Google set the ground rules that would govern the search-ad market for the following decade. Battelle (Battelle 2005) is the canonical narrative history.

Long-tail contextual matching (AdSense) was the mechanism that extended ad monetisation to any web page with content, not only search results. This is the direct antecedent of our pocket-es integration — search + contextual sponsored inventory mixed at render time.

Right Media, founded 2005, was the first open ad exchange — publishers and advertisers meeting in a real-time auction rather than through pre-negotiated contracts. Yahoo acquired Right Media in April 2007 for $680M (public press coverage; the specifics I attribute to industry press rather than a primary source).

DoubleClick was acquired by Google in April 2008 for $3.1B, folded into what became Google Ad Manager and eventually the Ad Exchange (AdX). The FTC and EU Commission both reviewed the acquisition; Srinivasan's Why Google Dominates Advertising Markets (Srinivasan 2020) is the reference for the antitrust posture that emerged from those reviews.

Real-Time Bidding (RTB) scaled up through 2010–2012. The OpenRTB protocol (IAB Tech Lab 2016) standardised the bid-request / bid-response shape; a bid request now contained user identifiers, device data, contextual data, and floor prices, and had to be answered in under 100ms. Olejnik et al.'s NDSS 2014 paper (Olejnik, Minh-Dung, and Castelluccia 2014) documented how bid-request leakage could be reversed by a passive observer to recover winning bid data — one of the earliest measurement studies to show that RTB's structural opacity was audit-adverse by design.

Cookie synchronization at scale — the mechanism by which two ad servers agree on a shared user identifier without a common domain — became universal in this period (Papadopoulos, Kourtellis, and Markatos 2019). Every RTB request required a common identifier; every publisher had its own cookies; the sync step happened via pixel redirects, and the number of redirects per pageload became a measurable pollution (Englehardt and Narayanan 2016).

Second-price auctions were the industry default until Google shifted to first-price in September 2019 (Google Ad Manager Team 2019) — motivated in the announcement by the failure of second-price under the multi-exchange conditions header bidding had made universal.

Mobile programmatic ad-spend crossed desktop around 2015. IAB VAST (Video Ad Serving Template) (Interactive Advertising Bureau 2019) had already standardised video-ad delivery in 2008; VPAID (Video Player Ad- serving Interface Definition) followed. The video-ad ecosystem is structurally separate from display and has its own compliance regime; we do not model it in wal.sh, but it is the largest programmatic segment by dollar volume.

Header bidding — client-side pre-auction across multiple exchanges before the ad server's own decision — landed with Prebid.js in 2015 (Prebid.org 2015). Publisher motivation: multiple demand sources bidding simultaneously against the same impression, rather than sequentially through the ad server's waterfall. The bid mechanics are documented in the Prebid.org materials; the measurement side is Cook, Nithyanand & Shafiq (Cook, Nithyanand, and Shafiq 2020) — header bidding is legible to a passive observer in a way that server-side auctions are not, so it became the substrate for tracker-advertiser relationship inference.

Ads.txt (Authorised Digital Sellers) (Interactive Advertising Bureau 2017a) launched in 2017 as an anti-domain-spoofing convention: publishers publish a /ads.txt file listing the exchange accounts authorised to sell their inventory. Buyers refuse bids from unlisted sellers. The convention was widely adopted within twelve months — one of the few industry conventions where adoption was fast because the enforcement mechanism was simple.

Cambridge Analytica broke in March 2018. The immediate technical substrate was Facebook's Graph API v1, which had allowed third-party app access to friend-of-user data. The regulatory consequence was the acceleration of GDPR enforcement and the first serious industry conversation about consent-mediated identifier flow.

Englehardt & Narayanan's million-site measurement (Englehardt and Narayanan 2016) is the reference dataset for the tracker landscape as it existed at the peak of the programmatic era. Acar et al.'s The Web Never Forgets (Acar et al. 2014) had already documented the persistent-identifier techniques — canvas fingerprinting, evercookies, respawning — that made the consent conversation urgent.

GDPR took effect 25 May 2018. IAB Europe published the Transparency & Consent Framework (TCF) v1 (IAB Europe 2020) as the industry's compliance-plumbing standard; v2 followed in 2020. The CMP (Consent Management Platform) became a required layer for any European-facing publisher.

CCPA (California Consumer Privacy Act) took effect 1 January 2020. Structurally simpler than GDPR (opt-out rather than opt-in for most purposes), but architecturally similar in requiring per-user identifier controls.

Apple Intelligent Tracking Prevention (ITP) shipped in Safari 11 in September 2017 (WebKit Team 2017) and iterated aggressively through ITP 2.x (2018–2019), progressively partitioning and expiring third-party cookies until third-party cookies were effectively unavailable in Safari by 2020. The technical mechanism — heuristic classification of tracking domains combined with cookie storage partitioning — is documented in the WebKit blog posts.

Firefox Enhanced Tracking Protection (ETP) shipped by default in June 2019 (Mozilla 2019). Mechanically similar to ITP (third-party cookie blocking with an exception list) but derived from Mozilla's Disconnect list rather than a heuristic classifier.

Chrome announced Privacy Sandbox in August 2019 with the intent to "make third-party cookies obsolete" over a multi-year timeline (Google 2020). The initial FLoC proposal (Federated Learning of Cohorts) — clustering users into 1000-user cohorts and exposing the cohort ID to ad-serving code — was announced in 2020, tested in 2021, and abandoned in 2022 in favour of Topics API (Google 2022b). Attribution Reporting API (Google 2022a) followed as the attribution replacement.

The full third-party-cookie deprecation timeline in Chrome slipped multiple times through 2022, 2023, and 2024 before being paused indefinitely in 2024. As of this writing (2026) the Sandbox is a partial deployment; the deprecation itself did not happen on the announced schedule.

The industry response to third-party cookie deprecation split into three tracks:

First-party data collection. Publishers invested in newsletter signups, registration walls, and consent flows to build first-party identifier bases. The audience-graph industry (LiveRamp, Merkle, Neustar) pivoted to identifier-resolution products keyed on first-party data. No single primary source; the pattern is visible in industry press.

Contextual resurgence. Advertisers rediscovered contextual targeting — matching ads to page content rather than user identity — as a cookie-less alternative. IAS, DoubleVerify, and others launched contextual products. This is a return to the AdSense model of 2003.

"Made for Advertising" (MFA) as measured category. The ANA 2023 programmatic-transparency study (Association of National Advertisers 2023) characterised MFA as sites optimised specifically for ad-serving with no authored editorial value. 15 % of measured impressions landed on MFA. The 2024 follow-up (Association of National Advertisers 2024) documented that buy-side awareness had increased but MFA share had not decreased. Vekaria et al.'s "The Inventory is Dark and Full of Misinformation" (Vekaria et al. 2022) is the academic-measurement companion.

AI-generated creative wave. Starting around 2023, generative AI began producing display-ad creatives at scale — banners, product images, promotional copy — with little quality control. Adalytics investigations (Adalytics, n.d.) documented AI-generated creative in premium-branded programmatic inventory through 2024–2025. Zeng, Kohno & Roesner's "Bad News" (Zeng, Kohno, and Roesner 2020) is the pre-AI-wave measurement of the same failure mode; the AI-wave measurement literature is still consolidating.

Google Attribution Reporting API. (Google 2022a) shipped as a browser- mediated attribution mechanism. Buyer response was mixed; the API requires substantial buyer-side infrastructure and the aggregation noise (differential privacy) is high enough that click-level attribution is not recoverable — which is the point.

Every module spec in this repo references a specific era:

• beacon — 1994–2000 pixel-transport ancestry.
• tracker — 2013–2018 measurement-vocabulary standardisation.
• ab-engine — 2000–2007 GSP-auction ancestry.
• attribution-engine — 2007–2013 last-click reign.
• attribution-audit — 2022–2026 Attribution Reporting API context.
• intent-signals — 2013–2018 engaged-time convention.
• exit-intent — 2013–2018 Bounce Exchange antecedent.
• stuffing-detectors — 2022–2026 ANA MFA measurement lineage.
• sponsored-research — 2013–2018 native / recommendation-widget proliferation.
• sponsored-display — 1994–2000 IAB banner standard.
• sponsored-formats — the format taxonomy across all six eras.
• plates — 2022–2026 AI-generated creative wave.
• pocket-es-integration — 2000–2007 contextual-search descent.
• search-mount — 2018–2022 dependency-inversion post-CMP.

External wal.sh corpus references for the survey:

• Web Trackers Analysis (Alexa Top 800) — 2012 Graphviz map of the DoubleClick / Comscore / Quantcast / BlueKai tracker ecosystem; primary source for the 2007–2013 exchange-era summary.
• Historical UI Systems: 40 Years of Invariants — the pre-web-adtech windowing-system substrate (Xerox PARC, X11, NeXTSTEP, Plan 9) the 1994–2000 banner era was built on top of.
• SLIDR: Real-Time Robotic Traffic Detection — Amazon IAAI 2023 system; the 2022–2026 IVT-detection lineage the ANA MFA measurements motivated.

• HotWired banner date and price: multiple secondary sources agree on October 1994 and $30k CPM for a three-month exclusive; the primary sales contract is not public. Zeff & Aronson (Zeff and Aronson 1997) confirms the general period and economics.
• Popup attribution to Ethan Zuckerman at Tripod: Zuckerman has published a personal retrospective in The Atlantic (2014) taking credit and apologising; primary source. Not cited here inline because the attribution is not load-bearing for any wal.sh module.
• Unicast interstitial claim (1999): commonly cited but I could not verify against a primary source; attributed above rather than verified.
• Right Media acquisition price ($680M, 2007): industry press; the specific figure varies slightly across sources.
• Cambridge Analytica technical details: public reporting is consistent on the Graph API v1 access pattern; the exact data volumes are disputed. I have cited only the regulatory consequence, which is well-attested.
• Chrome third-party cookie deprecation timeline: multiple official Google blog posts have been superseded; the current state (paused indefinitely, 2024) is documented in Chromium blog updates through 2024–2025.

• The video-ad ecosystem (VAST/VPAID) is entirely omitted from this survey. It is the largest programmatic segment by dollar volume and the smallest by wal.sh coverage — the site is text-first. A separate video-history survey is defensible.
• Non-Western adtech ecosystems (WeChat, Yandex, Baidu, Naver) are omitted. The 30-year survey above is a Western-Web account. The audience-graph and identifier-resolution mechanics are similar; the regulatory and platform-consolidation trajectories are different.
• The Retail Media Network wave (Amazon Ads at $46B run-rate, Walmart Connect, Target Roundel) is the largest current growth segment in adtech. It uses first-party identifiers by construction (retailer login) and sidesteps most of the post-cookie improvisation. Not modelled in wal.sh; a separate survey is defensible.