rtblintAlpha

Blog · IAB

What the IAB Tech Lab 2026 roadmap means for OpenRTB

· rtblint

IAB Tech Lab published two 2026-planning posts in January: a broad roadmap built around agentic advertising, and a narrower one titled "Essential OpenRTB Updates You Can't Ignore for your 2026 Roadmap." Only the second one names OpenRTB fields, and half of what it covers is not an OpenRTB field at all. Here is what is actually verifiable, field by field.

The roadmap post is not about OpenRTB

"Navigating the Agentic Frontier: The IAB Tech Lab 2026 Roadmap" is the company's public statement of priorities for the year, and it is dominated by Agentic Advertising Management Protocols (AAMP), an Agentic Real-Time Framework, and buyer and seller agent SDKs published to Tech Lab's GitHub. It also lists a bi-annual cadence for GPP, a Privacy Lab for testing privacy-enhancing technologies, and continued work on the Live Event Ad Playbook (LEAP) for CTV. What it does not contain is a line-item OpenRTB spec roadmap: no field names, no object diffs, no version targets. That is normal for this kind of post. It is a priorities memo for an industry audience, not a change log for a protocol.

The company published a second, narrower post the same month: "Essential OpenRTB Updates You Can't Ignore for your 2026 Roadmap." That is the one worth reading if you write or validate bid requests.

What actually landed in the Content object

Two attributes were added to Object: Content in OpenRTB 2.6x during the 2.6-202501 release cycle: gtax and genres. gtax names the taxonomy in use, drawn from the List: Category Taxonomies in AdCOM 1.0, and defaults to IAB Tech Lab Content Taxonomy 3.1 if omitted. genres is an array of unique IDs from whichever taxonomy gtax points to, and it is meant to replace the older singular genre string field. Content Taxonomy 3.1 itself carries roughly three times the category count of the deprecated Content Taxonomy 1.0, with a subset of rows specifically for CTV genres, which is the inventory type these fields are aimed at: full-episode and long-form video where genre classification affects both targeting and brand safety.

The practical path is site.content.genres or app.content.genres depending on inventory type, paired with content.gtax when you are not using the default taxonomy. If your fixtures still carry the old singular genre field and nothing in genres, that is the exact migration gap this update created: two fields, one deprecated and one additive, doing overlapping jobs during the transition, the same shape as the placement to plcmt migration from 2.6-202303.

The same post also describes Extended Content Identifiers (ECIDs), a framework for attaching more specific content identity to a request. The company's own description is that ECIDs "work within the existing Content object," which is a lower bar than adding a new object: it is additional identifier fields on something that already exists in every 2.6x bid request that carries content metadata.

The Curation object is not in OpenRTB

The same post spends real space on a new Curation object providing "transparency on how curated deals are described." That object belongs to a separate Deal Sync API specification, not to OpenRTB request or response schemas. The Deal Sync API repository states this directly: it is "a separate API that is NOT included in OpenRTB Request/Response," a one-directional push (SSP to DSP) of static deal metadata such as terms, inventory scope, and curation fee disclosure, meant to run alongside the bidstream rather than inside it. Its public comment period closed January 31, 2026.

For anyone building against this expecting new fields under imp.pmp.deals, that expectation is wrong by design. The Deal Sync API is explicit that deal criteria sent through it are not guaranteed to match what shows up in the live bid request, and that buyers must keep validating deal IDs against actual OpenRTB targeting rather than trusting the sidecar feed. It is a business-terms channel, not a bid request extension, and it will not show up in anything that parses OpenRTB JSON.

What is actually in flight, verified against the source repos

Four tracks are independently checkable in public repositories and press material, and together they tell a more useful story than either January post does alone.

  • GPP keeps adding US state sections on a real cadence. IAB Tech Lab's October 2025 privacy update confirmed a bi-annual GPP release cycle starting in 2026 and added Maryland (effective October 1, 2025), plus Indiana, Kentucky, and Rhode Island (effective January 1, 2026). All four sections are merged into the Global Privacy Platform repository. See GPP keeps growing for what regs.gpp and gpp_sid need to carry as a result.
  • The DSA extension has not changed in substance. The regs.ext.dsa and bid.ext.dsa community extension still runs on the same dsarequired values and pubrender flag defined after the Digital Services Act's February 2024 applicability date. IAB Tech Lab's DSA Ads Transparency Taskforce says it continues engaging regulators and promoting adoption, but nothing we found names a new 2026 enforcement milestone or a spec revision. See DSA transparency in OpenRTB.
  • ads.cert has no new 2026 milestone. ads.cert 2.0 has carried "ready for adoption" messaging since 2024, and we found no update to that status for 2025 or 2026. That absence is itself the update: see OpenRTB 3.0 and ads.cert in 2026.
  • The dated-snapshot cadence has slowed. OpenRTB 2.6 shipped 2.6-202409 in September 2024, 2.6-202501 in January 2025, and 2.6-202505 in May 2025, roughly a four-month rhythm. As of this writing, no successor to 2.6-202505 has shipped, an eight-month gap against that rhythm. See how dated snapshots work if that naming is unfamiliar.

None of this touches OpenRTB 3.0. Nothing found in Tech Lab's 2026 communications or the openrtb repository suggests a change to 3.0's adoption status, which remains minimal years after it went final. The concrete 2026 spec work landed in 2.6x, not 3.0, continuing a run of years where 2.x absorbs whatever 3.0 was meant to solve.

What to check this year

If you have already added gtax and genres to content objects, confirm the array type on genres and that you are not still populating only the deprecated singular genre. Run requests through the bid request tester to catch type and path mistakes before they reach a partner. rtblint's OpenRTB 2.6 catalog runs through the 2.6-202505 snapshot; it does not validate the Deal Sync API, since that traffic never appears inside an OpenRTB bid request or response for rtblint, or any bid request validator, to see. For CI, pin your spec snapshot and gate on rule IDs as described in the CLI docs, and re-pin when the next 2.6 dated snapshot lands, whenever that turns out to be.

Sources