Digital Element - Digital Element

Why Legitimate ISP IP Addresses Are Mistaken for Proxies

Posted on February 27, 2026February 27, 2026 by Digital Element

Streaming providers occasionally encounter situations where legitimate subscribers are blocked because their IP address appears to be operating as a VPN or proxy. In many cases, neither the subscriber nor the ISP has intentionally enabled any anonymization service, which can make these blocks difficult to explain and even harder to resolve.

What’s often misunderstood is why this happens. These classifications are not based on who owns the IP address or how the ISP’s network is designed. Instead, they are driven by observable traffic patterns. When an IP shows behavior that resembles how modern residential proxy networks operate, it may be flagged—even if the IP itself was issued by an ISP and is being used by a legitimate household.

As the internet has evolved, so has the way proxy networks are built. Today, many residential proxies do not rely on traditional data centers. Instead, they quietly operate inside real households using ISP-assigned IP addresses. This shift has made proxy detection more complex for streaming platforms and more confusing for everyone involved.

The Problem: Why Legitimate ISP IPs Get Blocked

A common entry point is the installation of free VPNs, browser extensions, or mobile apps that rely on peer-to-peer networking. These services often include permissions, disclosed only in the fine print, that allow a user’s internet connection to be reused as part of a broader proxy pool.

Once installed, the device becomes a relay node. Traffic from remote users flows through that household’s connection and exits the internet under the same public IP address assigned by the ISP. From the subscriber’s perspective, nothing appears unusual. From the ISP’s perspective, the network is functioning normally.

From the streaming provider’s perspective, however, the IP now carries mixed traffic patterns originating from multiple locations. This behavior closely resembles a residential proxy service, even though neither the subscriber nor the ISP has knowingly participated in one.

Why These Blocks Occur and Why ISPs Are Often Surprised

Streaming platforms make access decisions based on observed risk signals, not assumptions about intent. When an IP shows signs of relaying traffic, geographic instability, or anonymization behavior, it may be blocked to protect licensed content and reduce abuse.

In shared residential environments, such as apartment buildings or managed broadband networks, a single device acting as a relay can impact everyone behind the same public IP. This is why legitimate viewers may be blocked even when they are not using a VPN themselves.

Importantly, this behavior does not originate from ISP infrastructure. Shared IPs and NAT (Network Address Translation) are standard across residential networks and do not cause proxy classification on their own. The activity triggering these signals occurs inside the subscriber environment, outside the ISP’s visibility or control. This is why ISPs are often blindsided by these situations and why ownership of the IP alone does not explain the behavior being observed.

Adding Time-Based Context to Proxy Detection

One of the core challenges in proxy detection is understanding recency. Many systems rely on simple indicators that show whether an IP was seen acting like a proxy within a fixed window of time. These signals lack the context needed to determine whether the behavior is ongoing or historical.

Nodify addresses this by adding time-aware proxy intelligence. Each observed proxy event is recorded with precise timestamps and frequency data. This allows streaming providers to see when proxy behavior occurred, how often it was observed, and whether it is still active.

With this level of detail, platforms can distinguish between a short-lived relay event and sustained proxy activity. This helps reduce false positives while still enforcing content protection policies effectively.

Using Behavioral Signals to Reduce False Positives

While Nodify answers when proxy behavior occurred, IP Characteristics helps explain how an IP is being used over time.

IPC analyzes behavioral and environmental signals such as device counts, geographic stability, and connection volatility. These signals provide insight into whether an IP behaves like a normal residential connection or shows patterns consistent with proxy or automated traffic.

For streaming providers, this additional context helps validate enforcement decisions. IPC allows teams to understand whether unusual behavior reflects normal residential usage patterns or something more anomalous, enabling more proportional responses that protect content without unnecessarily disrupting legitimate viewers.

A More Accurate Way Forward for Streaming Platforms

An ISP-issued IP address no longer represents a single household’s activity in all cases. In today’s internet, many residential IPs are quietly reused as part of proxy networks without the knowledge of the subscriber or the ISP.

For streaming providers, recognizing this reality is key to reducing confusion and improving resolution times. Combining time-based proxy intelligence with behavioral context allows platforms to separate real risk from unintended side effects, protecting content while minimizing disruption for legitimate subscribers.

Frequently Asked Questions

Why would a legitimate ISP IP address be mistaken for a proxy?

Proxy detection systems evaluate observable traffic behavior, not IP ownership or intent. If an ISP-issued IP shows patterns such as traffic relaying, geographic instability, or mixed usage consistent with modern residential proxy networks, it may be classified as proxy-like—even when the subscriber and ISP have not knowingly enabled any anonymization service.

Are shared IPs or NAT the reason these blocks happen?

No. Shared IPs and Network Address Translation (NAT) are standard features of residential ISP networks and do not cause proxy classification on their own. Proxy-related flags are triggered by activity that occurs inside the subscriber environment, not by normal ISP infrastructure or IP sharing practices.

How can a residential IP start behaving like a proxy without the user realizing it?

Some free VPNs, browser extensions, or mobile apps use peer-to-peer networking models. When installed, these tools may allow a device to act as a relay for third-party traffic. From the user’s perspective, nothing appears unusual, but externally the IP may exhibit traffic patterns that resemble a residential proxy service.

How can streaming platforms reduce false positives without weakening enforcement?

By adding time-based proxy intelligence and behavioral context, platforms can distinguish between short-lived, historical proxy activity and sustained risk. This allows teams to make more proportional enforcement decisions—protecting licensed content while minimizing unnecessary disruption for legitimate subscribers.

Now Available: IRIS – Unlocking Granular Geolocation Data in France with NetAcuity

Posted on March 25, 2025August 22, 2025 by Digital Element

For decades, marketers have relied on postal codes as a core component of location-based targeting. While this level of data has delivered meaningful insights and campaign results, today’s competitive digital landscape demands even greater precision. That’s why Digital Element continues to innovate, expanding the boundaries of IP geolocation with the launch of IRIS – France’s standardized geographic unit – now available through NetAcuity’s Alternate Area Database.

What Is IRIS?

In France, IRIS (Ilots Regroupés pour l’Information Statistique) refers to statistical blocks used by the French National Institute of Statistics and Economic Studies (INSEE) to collect and analyze data. Each IRIS zone contains approximately 2,000 residents and is designed to represent a coherent area from a demographic and urban planning perspective. While postal codes in France can be large and sometimes inconsistent, IRIS zones offer a standardized, fine-tuned way to understand population characteristics and trends at the neighborhood level.

Think of IRIS as France’s equivalent to Australia’s SA1 or Germany’s PLZ8 regions—purpose-built for statistical analysis, yet perfectly suited for marketers seeking smarter geolocation targeting.

More Granularity, Same Commitment to Privacy

By integrating IRIS into the Alternate Area Database, Digital Element enables businesses to map IP addresses to these smaller statistical units. This upgrade delivers sharper geographic resolution than traditional postal codes, unlocking new levels of campaign precision and audience understanding—without sacrificing user privacy.

IRIS areas are small enough to deliver actionable insight but aggregated enough to ensure individual data remains protected. This makes them ideal for privacy-compliant demographic profiling, content localization, and fraud prevention.

Why It Matters for Your Business

More relevant targeting: Deliver messages tailored to hyper-local communities
Smarter planning: Understand audience distribution and behavior across smaller, more meaningful areas
Greater campaign ROI: Boost conversion rates by aligning offers with the real-world context of your audience

Whether you’re managing digital advertising, localizing content, or conducting market analysis, IRIS gives your team a deeper, more accurate picture of the French market.

Now Available in NetAcuity

IRIS is now available through NetAcuity’s Alternate Area Database and can be licensed on its own or alongside any of Digital Element’s 18 other databases for maximum insight.

And this is just the beginning. Following the successful rollout of SA1 in Australia and now IRIS in France, Digital Element will soon be adding PLZ8 regions in Germany to the Alternate Area Database—further expanding global access to hyper-local IP intelligence.

For a deeper dive into the launch of IRIS and what it means for location-based data innovation in France, be sure to check out our official press release. It highlights how IRIS complements our Alternate Area Database strategy and what’s next as we continue expanding across global markets.

Ready to go deeper with your location targeting in France?
Learn more about the power of IRIS and how it can enhance your marketing, analytics, and security strategies by reaching out to support@digitalenvoy.com.

Unlocking Granular Insights with NetAcuity’s Alternate Area Database

Posted on October 8, 2024August 24, 2025 by Digital Element

Since commerce has gone online, marketers have relied on IP addresses for targeted marketing campaigns. In today’s competitive marketplace, the ability to target marketing efforts with precision is more critical than ever.

Since 1999, Digital Element has been helping marketers target their audiences precisely by postal code globally. This level of detail not only enhances the effectiveness of marketing campaigns but also drives higher conversion rates and better ROI.

While postal codes are granular, advertisers are always eager for even more precise data to gain deeper insights and improve performance of their targeted campaigns, and Digital Element has the answer.

A Deeper Understanding of Your Marketing Campaign

For census purposes, many countries have created a set of alternate areas, aside from postal codes. For example, in Australia, there are Statistical Areas (SA1) defined by the Australian Bureau of Statistics (ABS), that were created to aid in the collection and analysis of statistical data.

SA1s are designed to be relatively small and uniform in terms of population size, typically containing between 200 and 800 people with an average of 400 people per SA1. The SA1 level is the smallest unit in the hierarchy of statistical areas used for census data collection and dissemination. Other countries like Germany (PLZ8) and France (IRIS) have their own similar standardized geographical units.

In the image above, the red lines show the postcodes in Melbourne, Australia and the white lines are SA1s.

In Australia, traditional postal codes can be broad and cover multiple towns with large populations. There are approximately 3,333 postcodes, but with SA1s, this quantity of distinct statistical areas expands to 61,845.

For example, one postcode in the metro Sydney area could contain as many as 40 SA1s. Each SA1’s smaller size allows for more precise targeting and better insights, which is invaluable for various applications. With SA1s, each area is small enough to offer precise data while still being large enough to protect individual privacy.

This balance makes SA1s ideal for detailed demographic analysis and targeted applications. By focusing on smaller, more defined geographic units, companies can deliver personalized content that resonates with the right audience, at the right time, in the right place.

Introducing NetAcuity’s Alternate Area Database- Even More Granularity without Sacrificing Privacy

Digital Element is taking IP-based location targeting to the next level with the introduction of its new Alternate Area Database.

This innovative feature maps IP addresses to individual SA1s in Australia, providing more precise geographic data by aggregating IP addresses from specific areas smaller than traditional postal codes. By leveraging these detailed geographic boundaries, companies can enhance the granularity and accuracy of location-based data without compromising privacy.

The Alternate Area Database can be licensed as a standalone product or in conjunction with NetAcuity’s 18 other databases for more detailed insights.

Looking Ahead: Expanding to France and Germany

The introduction of the Alternate Area Database in Australia is just the beginning. NetAcuity plans to extend this feature to other regions, including Germany and France. In Germany, the focus will be on PLZ 8 regions, and in France, the IRIS system will be utilized. These expansions will further enhance the granularity and accuracy of IP geolocation, providing valuable insights and targeting capabilities across Europe.

Revolutionizing IP Geolocation for Smarter Marketing

NetAcuity’s Alternate Area Database is a game-changer in IP geolocation, offering detailed geographic insights that empower businesses to make more informed decisions.

Whether it’s for precise ad targeting, in-depth demographic analysis, or enhanced cybersecurity, the ability to map IP addresses to smaller, more accurate regions like SA1s unlocks new potential while maintaining alignment with Digital Element’s privacy-centric approach. As NetAcuity expands this feature to other regions, the possibilities for leveraging precise geographic data will only continue to grow.

For more information on Alternate Area Database’s capabilities check out this guide, or reach out to support@digitalenvoy.com to learn more.

Fortifying Digital Defenses: Revolutionizing Account Security with IP Intelligence to Combat Account Takeover

Posted on July 17, 2024August 24, 2025 by Digital Element

Account takeover (ATO) refers to the unauthorized access and control of user accounts by malicious actors.

Such breaches pose significant risks to individuals, organizations, and their sensitive data. These breaches lead to financial losses, reputational damage, and privacy violation. Given the evolving sophistication of cyber threats, traditional security measures alone may not suffice to detect and prevent ATO incidents effectively.

As cyber threats become more sophisticated, security measures need effective rules in place to outmaneuver the bad actor without causing user friction. Leveraging advanced tools that incorporate contextual data, especially IP address data, becomes imperative in leveling-up account security measures and thwarting nefarious activity.

The Growing Threat of Account Takeover (ATO)

In October 2023, three major online services had a flawed implementation of the Open Authorization (OAuth) standard that left millions of users vulnerable for account takeovers on dozens of websites. For users, account takeovers could create life-changing devastation such as credential theft and financial fraud.
With the rise of AI, bad actors have more tools at their fingertips to take over a user’s account. As AI technology progresses, it can create a convincing mimicry of a person’s voice, photo, and even their writing style. These AI “deep fakes” could lead to higher rates of 401(K) account takeover fraud, according to the National Association of Plan Advisors.
In September 2022, TechRepublic shared a report citing SEON data that almost 25% of people in the US had been victims of ATOs and the average value of financial losses was $12,000.

The Critical Role of IP Intelligence in ATO Mitigation

Contextual Understanding
IP address intelligence data offers crucial contextual understanding by providing insights into the geographical origins of login attempts.

This context enables security teams to differentiate between legitimate users and potential threats, facilitating more accurate detection and mitigation of ATO incidents.
Real-Time Monitoring
Platform providers that incorporate IP address intelligence as a contextual dataset enable real-time monitoring of login activities, allowing security teams to promptly identify suspicious behavior indicative of ATO attempts.

Continuous analysis of IP addresses associated with login activities alerts security teams to anomalies so that they can address them with a curated list of customer-specific traffic trends, minimizing risk of successful ATO attempts.
Enhanced Threat Detection
IP address intelligence data enhances threat detection capabilities by enabling the indicators of compromise (IOCs) associated with ATO attacks. For example, monitoring unusual sign-in attempts—people’s habits are predictable—they usually sign in from the same locations and times during the week.

Security professionals can effectively detect compromised accounts by odd sign-in times and from unusual geographies, such as a country where an organization doesn’t have an office or do business.

IP address characteristics also allow for the detection of common ways attackers obfuscate their activities to evade detection, such as the use of VPNs or proxys, botnets, high-risk IP addresses, and IP address location instability. Organizations that integrate IP address contextual data into threat detection algorithms can bolster their defenses against ATO attempts and mitigate risks effectively.
Adaptive Security Measures
Leveraging IP address Intelligence data allows for the implementation of adaptive security measures that respond dynamically to emerging threats. Security systems that equip their threat intelligence feeds with continuous IP address contextual data can adapt their defenses in real-time, thereby staying ahead of evolving ATO tactics and techniques.

This adaptive approach enhances the resilience of account security measures and minimizes the likelihood of successful ATO incidents.
Comprehensive Risk Assessment
Integrating IP address contextual data into a risk assessment framework enables organizations to conduct more comprehensive evaluations of ATO risks.

When organizations have insights into factors such as VPN usage, botnet activity, and IP address location stability, they can assign risk scores to login attempts based on their likelihood of being associated with ATO incidents.

This contextual data enables security teams to prioritize response efforts and allocate resources effectively, thereby enhancing overall account security risk assessment.

Partnering with Digital Element for Superior ATO Defense

Digital Element, the authoritative source of IP intelligence data, offers insights that will enhance your organization’s security measures to detect and mitigate account takeover incidents through valuable contextual information associated with IP addresses.

Digital Element revolutionizes fraud detection with our IP address intelligence, offering sophisticated geographic-based insights.

By analyzing sign-in locations, we empower security teams to identify potential fraud through the lens of geographic origin with precision. Additionally, our comprehensive insights into VPN and proxy IP usage equip cybersecurity professionals with crucial contextual data.

This information is pivotal for uncovering and thwarting malicious actors’ efforts to disguise their fraudulent activities. We’re committed to collaborating closely with your data science and development teams, tailoring our best practices to meet your specific Account Takeover (ATO) mitigation requirements.

Interested in enhancing your security measures? Reach out to us to learn more and to have a free assessment specific to your ATO mitigation needs.

Combatting Residential Proxy Threats: Essential Strategies for Payment Service Providers

Posted on June 19, 2024August 21, 2025 by Digital Element

Payment Service Providers (PSPs) face countless challenges when it comes to safeguarding their clients against nefarious or fraudulent activities while ensuring compliance with stringent regulatory requirements.

A particular point of contention in this complex security matrix is the increasing use of “residential proxies” by malicious actors. This issue introduces a nuanced layer of difficulty for PSPs as they strive to ensure robust security and risk management for their direct and indirect customers.

Understanding Residential Proxies

At the heart of this challenge lies the residential proxy, an intermediary that distinguishes itself from other proxy types by utilizing IP addresses allocated by Internet Service Providers (ISPs), rather than those originating from data centers. This key difference is pivotal as it bestows upon these proxies a veil of legitimacy that can easily bypass conventional security measures designed to filter out less sophisticated threats.

The Threat of Residential Proxies to PSPs

Residential proxies emerge as a formidable threat to PSPs primarily due to their high level of anonymity and their low likelihood of being blocked.

These proxies enable nefarious entities to masquerade their nefarious activities under the guise of legitimacy, rendering traditional detection methods less effective. The operational similarity of residential proxies to mobile proxies exacerbates the problem, with both leveraging legitimate-looking IP addresses from reputable ISPs around the globe, thus complicating the task of distinguishing malicious traffic from benign.

The Importance of Identifying Residential Proxies

The popularity of residential proxies among cybercriminals stems from their ability to imitate the digital footprint of ordinary Internet users. This camouflage facilitates activities ranging from fraud to money laundering, under the radar of usual security protocols.

For PSPs, the ability to pinpoint transactions originating from residential proxies is not just a technical necessity; it’s a strategic imperative that enables the discernment of potentially risky transactions that warrant closer scrutiny or immediate intervention.

Digital Element’s Role in Enhancing PSP Security

Our work with numerous global PSPs at Digital Element has underscored the value of leveraging sophisticated IP Intelligence data, including insights into residential proxies. Our collaborations have shed light on several critical areas where PSPs can benefit from identifying and flagging residential proxies, namely:

Fraud Detection & Risk Assessment – By tailoring IP geolocation and proxy detection mechanisms to specifically target residential proxies, PSPs can significantly enhance their fraud detection capabilities. This approach allows for the accurate identification of suspicious transactions, thereby minimizing the incidence of false positives and bolstering overall security posture.
Regulatory Compliance – The mandate from regulatory bodies for PSPs to actively combat fraud and money laundering places a premium on the ability to detect and mitigate risks associated with residential proxy IP addresses. Incorporating advanced IP geolocation and proxy insights serves as a cornerstone for achieving compliance, ensuring that PSPs can navigate the regulatory landscape with confidence.
Security Measures – The use of residential proxies in perpetrating security threats, such as account takeovers (ATO), highlights the critical need for PSPs to integrate advanced proxy detection in their security frameworks. By analyzing IP addresses and proxy data specific to residential proxies, PSPs can proactively block malicious activities, safeguarding both their systems and their customers’ accounts.

Empowering PSPs Against Cyber Threats

The integration of Digital Element’s IP geolocation insights, with a focus on identifying residential proxies, is paramount for PSPs aiming to fortify their defenses against the sophisticated tactics employed by today’s cybercriminals. This strategic approach not only enhances the integrity of PSPs’ solutions and services but also reinforces the trust that customers place in these online payment providers.

Contact Us for a Consultation

Whether you’re a PSP, working with one, or have specific needs within your own fraud, risk, or security use cases, our dedicated Customer Success Managers (CSMs) are ready to assist. Interested in learning more about our new IP address stability insights? Reach out to support@digitalenvoy.com

Choosing the Right IP Geolocation Granularity: How Digital Element Balances Precision & Usability

Posted on May 17, 2024February 11, 2026 by Digital Element

When it comes to IP address geolocation, the numerous use cases that our customers employ require data to be parsed in many different ways. We often find ourselves playing a game of geographical Goldilocks, looking for the level of IP granularity that is not too big, not too small, but juuuuuust right.

Here are some examples of how challenges with city-level precision in the NetAcuity Pulse IP geolocation database can translate into real-world operational and user-experience issues:

Giving website visitors a drop-down of city names to choose from, and the NetAcuity database returns an overly long list
IP to city-level targeting where the city response is too granular for practical market-level use
Using NetAcuity for Flat File deployments where there are too many rows or IP ranges to ingest due to city-level IP range fragmentation

Based on scenarios like this, Digital Element set out to solve this challenge. To do so, our team mapped small cities and suburbs around the world to the larger metropolitan areas that they fall within. This enables Digital Element customers to target major metropolitan areas without having to identify and manually select every surrounding suburb or neighborhood.

As outlined in our blog The Tricky Science Behind IP GeolocationIP address density in a major city often fails to reflect the true population of its surrounding metropolitan area, particularly when addresses are correctly assigned to nearby suburbs.

Small City Mapping

To meet the needs of our customers’ wide range of use cases and reduce operational complexity, Digital Element introduced Small City Mapping. This capability allows customers to convert an existing “small city” response from the Pulse city field into its associated larger metropolitan city, saving time, simplifying logic, and improving usability.

To demonstrate how this works, let’s use India as our geographic example and apply it to a common use case mentioned above: reducing overly long city selection lists.

Imagine you’re on the web development team for the IKEA India website, building a store locator for visitors. IKEA typically operates stores in major metropolitan areas, so visitors from surrounding cities need to be mapped accurately to the nearest metro where a store exists.

One of India’s 28 regions, Maharashtra (MH), contains approximately 350 cities. Asking users to manually scroll through hundreds of city options creates unnecessary friction.

Using Small City Mapping, visitors whose IP addresses fall within smaller surrounding cities are automatically associated with the closest major metropolitan area, ensuring relevant store locations are displayed instantly.

Here is an example of IP address traffic observed on the IKEA website.

IP Address
1.6.35.225
1.6.35.125
1.6.35.19
1.22.44.22
1.22.52.81
1.22.102.218
1.22.9.152
1.22.80.73
1.22.80.196

The web development team can query these addresses against the NetAcuity database to determine the Region, City, and City Code associated with these IP addresses. Below is what NetAcuity will return.

Start IP	End IP	Country	Region	City	Metro	City-Code
1.6.35.0	1.6.35.255	ind	mh	andheri	356002	148717
1.22.8.196	1.22.8.196	ind	mh	andheri	356002	148717
1.22.80.251	1.22.80.251	ind	mh	andheri	356002	148717
1.22.44.16	1.22.44.63	ind	mh	bandra west	356002	246533
1.22.52.81	1.22.52.81	ind	mh	bandra west	356002	246533
1.22.102.218	1.22.102.218	ind	mh	bandra west	356002	246533
1.22.9.152	1.22.9.152	ind	mh	dharavi	356002	148743
1.22.80.72	1.22.80.73	ind	mh	dharavi	356002	148743
1.22.80.196	1.22.80.196	ind	mh	dharavi	356002	148743

The cities associated with the IP addresses from web traffic were Andheri, Bandra West, and Dharavi. The web development team can then use the Small City Mapping decode file To determine what big cities these three smaller cities map to.

Country	Region	City-Name	Metro-Code	City-Code	Big-Small	Big-City-Name	Big-City-Code
ind	mh	andheri	356002	148717	small	mumbai	34785
ind	mh	bandra west	356002	246533	small	mumbai	34785
ind	mh	dharavi	356002	148743	small	mumbai	34785

As you can see, the IP address ranges all map to Mumbai as the big city. Because these small cities all map to Mumbai, logic can then be built into the website to ensure that visitors from any of the IP ranges that correspond with these cities are shown the Mumbai stores when using the store locator tool.

In any cases where IP address ranges are consecutive, the rows will be consolidated.

Start IP	End IP	Country	Region	City	Metro	City-Code
1.6.34.0	1.6.34.255	ind	mh	mumbai	356002	34785
1.6.35.0	1.6.35.255	ind	mh	andheri	356002	148717

Small City Mapping decode result:

Start IP	End IP	Country	Region	City	Metro	City-Code
1.6.34.0	1.6.35.255	ind	mh	mumbai	356002	34785

How This Enables Modern, Cookieless Use Cases

A/B testing content by market using IP context
Small City Mapping allows teams to test messaging, layouts, or offers at the metro level instead of fragmented city responses. This produces cleaner experiments, more reliable attribution, and consistent market definitions without relying on cookies or logged-in users.

Cookieless geo-targeting with trustworthy measurement
Because NetAcuity uses authoritative IP intelligence rather than user-declared location, organizations can localize experiences while maintaining consistent, privacy-forward measurement, especially critical as third-party cookies continue to disappear.

Minimizing false blocks in live sports streaming
Overly granular or misaligned city-level targeting can lead to accidental content blocks. By mapping suburbs and small cities to their correct metro areas, Small City Mapping helps streaming platforms enforce regional rights accurately while reducing false positives that frustrate legitimate viewers.

How to Access the Small City Mapping Decode File

The Small City Mapping Decode File is available to all Digital Element customers at no additional cost and can be accessed in the following ways:

Downloadable via the Digital Element support portal on the Decode Files page as a .tab or .csv file
Loadable into a local database and usable across NetAcuity deployment options, including Server/API, Flat File, Embedded API, and Cloud Service
Customers using NetAcuity Server/API, Flat File, or Cloud Service can query or dump Feature Code 93 (Decode DB) and Feature Code 26 (Pulse) to automatically populate big-city mappings

Feature Code 93 mirrors the fields in the Small City Mapping Decode File and can be licensed through the Client Success team.

In the coming months, we will be introducing Feature Code 93 which will enable DE customers to make a single query or create a flat file where there is a dedicated field to the existing “pulse-city” and the “decode-big-city”. This new Feature Code will produce an industry-first data set that returns two locations for a single IP address: the small city that the IP address is located, and the larger metropolitan city that it is associated with.

Frequently Asked Questions About Balancing IP Precision with User Needs

How can I A/B test content by market using only IP context?

By using NetAcuity IP geolocation with Small City Mapping, teams can group users into consistent metropolitan markets based on IP address alone. This enables clean A/B testing across defined regions without cookies, logins, or self-reported location data.

Can Digital Element support cookieless geo-targeting?

Yes. Digital Element’s IP-based geolocation enables location-aware content delivery and measurement without relying on cookies. This supports privacy-forward targeting while maintaining reliable geographic attribution.

How does Digital Element reduce false blocks in geo-restricted live streams?

Small City Mapping ensures that IP addresses in surrounding suburbs are accurately associated with the correct metropolitan area. This reduces accidental blocks caused by overly granular city-level enforcement while still respecting regional content rights.

What level of IP granularity does NetAcuity support?

NetAcuity supports country, region, metro, city and postcode y-level targeting, globally. Small City Mapping adds flexibility by allowing customers to operate at the most appropriate geographic level for each use case.

How does Small City Mapping improve user experience without sacrificing accuracy?

Small City Mapping preserves precise IP placement at the city level while allowing organizations to present cleaner, more intuitive experiences—such as simplified city lists, metro-level store locators, or regional content groupings. This balance helps reduce user friction without compromising the underlying accuracy of NetAcuity IP data.

Can Small City Mapping help simplify IP data ingestion and processing?

Yes. By consolidating multiple small-city IP ranges into their associated metropolitan areas, Small City Mapping can reduce IP range fragmentation and row counts in flat files or databases. This makes IP data easier to ingest, manage, and operationalize across analytics, targeting, and enforcement workflows.

Choosing the Right Level of IP Geolocation Granularity

Effective IP geolocation isn’t about choosing the smallest possible data point, it’s about choosing the right one for your business goals. Digital Element helps organizations localize experiences, test markets, and enforce regional rights with confidence, accuracy, and scale.

If you’re evaluating how IP geolocation can support cookieless targeting, reduce false blocks, or simplify market-level decisioning, our team can help you identify the right data and deployment model. Contact Digital Element to speak with Sales and see how NetAcuity fits your use case.

Beyond Geolocation: The Time Factor in IP Address Stability

Posted on February 20, 2024August 21, 2025 by Digital Element

Back in the late 90s when beanie babies, boy bands and the Macerana were winding down, e-commerce was heating up. As more and more people took their spending online, companies went to work, looking for new ways to understand as much as they could about their geographically dispersed audience.

To do that, they started examining how IP addresses could answer the burning question “Where is my audience coming from?”

Concurrently, Digital Element’s plaid flannel-clad founders saw the need for greater tools to understand web traffic and founded the company to do just that.

In the nearly 25 years since, the company has earned over 50 patents related to the advancement of IP intelligence, and has helped organizations worldwide drive greater business intelligence from IP addresses.

In the vein of continued advancement, our R&D team has been busy mining IP address data to define the new set of criteria upon which we can deliver the next generation of IP intelligence. Over the past three years, we have devoted a variety of resources to examining one of the most elusive elements of IP addresses: stability. More specifically, how stable is an IP address at a specific location?

Before we dive into what we’ve found (spoiler alert – it’s eye-opening!) let’s dig into why we went looking in the first place.

In the numerous customer and prospect conversations that we have, we noticed an interesting dichotomy emerge. When it comes to leveraging IP intelligence for audience creation one party puts too much trust in IP address geolocation, while the other party doesn’t trust it at all – “they are too unstable.”

In actuality, both parties are wrong. While it’s true that IP addresses create a great way to match visitors across websites, the data is really only correct if the visitors are looking at both websites at the same time, which is rarely the case.

Why is this? Because IP addresses are unstable. Meaning, that the geo of an IP address that visited website A, may have changed by the time that the same IP address visited website B. Or, said differently, the IP address of a user may have changed between their visits to website A and website B.

So when company A and company B, who invest too much trust in IP address stability, are comparing website data and IP addresses to understand user behavior across their web properties, they should also be examining timestamp information to determine if the user’s traffic was within the same time period. Otherwise, there is a good chance that the traffic was from two different visitors.

On the flip side, those who dismiss IP addresses as too transient are also missing the important point that IP addresses can actually be stable. Especially fixed wifi IP addresses, which happen to account for most of the traffic websites receive.

If you are wondering how that is possible? Consider your own web browsing habits. The vast majority of people are more likely to browse the web while on wifi in a fixed location, like at home, work, cafe, airport, etc… Comparatively speaking, much less traffic originates from people who are on the go (driving, running errands, out with friends/family, etc…) and don’t have wifi access.

Put simply, you are more likely to visit websites when you are on wifi, rather than when you are on a mobile IP connection. And, don’t forget, cellular carriers and mobile device operating systems prefer that you use wifi over cellular data (mobile IP addresses). If you want to test this, simply turn off your wifi on your mobile device, and see how long before your mobile phone is back on wifi. Answer: no more than 1 day.

So if wifi traffic rules the internet, and we have all been thinking about IP addresses wrong, what is the missing piece of data that can help us reconcile these two opposing opinions? The answer is TIME.

The next logical question is “For how long?” To answer this question, we must acknowledge that how we talk and think about IP addresses has to be more nuanced so that it considers the dimension of time in addition to geography. Because IP addresses can be stable in a given location, it is best to look at stability in specific blocks of time, like – ‘less than a week’, ‘less than 1 month’, ‘6 months to 12 months’, and ‘more than 1 year’.

Now that we have established how to talk about IP addresses correctly, let’s reveal what our research found. In the tables below you’ll find a summary of IP address stability by location granularity, and time intervals for the US, and UK.

What this chart shows is that the US and UK are similar within a range of how stable IP addresses are in a given location. Around 6% of IP addresses are expected to remain associated with households for longer than 1 year, and around 20% of IP addresses are constantly moving between households from week to week.

The reasons for the stability, or lack thereof, are complicated but at a high level, it comes down to the whims of the Internet service providers (ISP). A larger ISP that serves multiple countries may have different internal rules for allocating IP addresses vs. one that is only serving one country, for example. Note that this is just one reason among many. Comparing a few large ISPs gives a better picture of the dynamic nature of IP address allocation by ISPs.

Here we have compared Vodafone, British Telecom, and Comcast Cable. As we can see Vodafone behaves completely differently than the other two when it comes to IP allocations to their customers.

As you can see from the numbers, the importance of understanding IP address stability is paramount and can support decision-making across numerous business scenarios. Ultimately; however, what this leads to is the notion that there is much more to IP geolocation than the geolocation piece.

The comprehensiveness of the IP address data that Digital Element provides transcends pure geolocation, offering a wider variety of intelligence that can be used to drive significant outcomes for your business. Interested in learning more about our new IP address stability insights? Reach out to support@digitalenvoy.com

Guide To Choosing the Best IP Geolocation Service for Your Business

Posted on February 2, 2024August 15, 2025 by Digital Element

When looking for an IP geolocation service for your business, it’s important to consider the key factors that are important for your business and your use case.

Many vendors claim to provide some form of IP geolocation data. However, there are vast differences between providers in the technologies they employ and service models they deliver.

In this guide, we will walk you through everything you need to know to choose the best IP geolocation service for your business, and why you should consider Digital Element.

What is IP geolocation?

I P geolocation refers to identifying the physical location of a device connected to the internet using its IP address. Businesses can use this information for various applications, such as improving user experience, personalizing content, managing digital rights, detecting fraudulent activities, and targeting marketing campaigns.

IP geolocation is helpful for businesses that operate online and need to provide location-based services or track the location of their website visitors.

What to look for in an IP geolocation service

With so many options available, how do you choose the best IP geolocation database for your business?In the following section, we’ll dive deeper into these factors and provide actionable tips to help you make an informed decision.

1. Reputation

Perhaps the most important part of selecting any vendor for your business, it’s critical to start by ensuring the IP geolocation service provider has a proven track record of success and a reputation for providing high quality data, reliable service, and exemplary customer support. This is bigger than simply ensuring your business gets results — your own reputation is also at stake.

Ask vendors for a client list, examples of tangible results, and any awards recognizing their superior technology and solutions.

2. Accuracy of data

Data accuracy is one of the essential features to consider when selecting an IP geolocation service provider. Accuracy varies widely among vendors, and depends on several factors, such as the number of data sources, the frequency of updates, and the methodology used to collect and analyze the data. The data’s accuracy and reliability directly affects the service’s usefulness for your business.

Country-level accuracy is generally 95-99.99% for most IP geolocation vendors, whereas city-level accuracy can range from 40-97%. Poor accuracy results in off-target ads and content, or might allow unauthorized access to digital content and services.

You want an IP geolocation service that can provide up-to-date and precise geolocation data, such as real-time ISP and ASN lookup, IPv4 and IPv6 data, and time zone and postal/ZIP code information.

Look for an IP geolocation service with a reputation for providing the most accurate data, which can positively impact your business.

Beyond merely accepting accuracy at face value, it’s important to choose a vendor that can verify its data accuracy with independent review from third-party auditors. This assesses the data itself and the methods used to collect it, and is a great way to prove that a vendor can “put its money where its mouth is.”

3. Granularity

How hyperlocal is the data within my target geographies? Do you return postcode-level geography? If so, do you default to city-center postcodes?

If highly granular city or postcode-level data is important to your business, then it is important to understand that most vendors do not perform well (or at all) at this level. Most either aggregate traffic into large metropolitan areas and/or provide city-center default postcodes which may be 10 or even 100 miles away from web visitors’ actual locations.

ZIP+4 data is especially beneficial to marketers who want to target very specific audiences concentrated in more pinpointed locations within the United States.

4. Technology, features, and functionality

IP geolocation provides various features and functionalities that enable you to get accurate geographical information about an IP address. The API returns essential details such as the country, region, city, postal code, time zone, ISP, and ASN of the IP address.

Additionally, it provides endpoint URLs to retrieve the country flag, calling code, and other essential information such as proxy and VPN details.

One of the fundamental features of IP geolocation is its ability to provide location-based information, which can be used for ad targeting, content personalization, online fraud detection, and digital rights management.

Most IP geolocation vendors simply repackage publically available (free) Whois registration data, and some supplement with user-supplied data. Simple Whois information and/or user-supplied data, however, are not reliable methods for accurate geolocation when used in isolation.

If accuracy, coverage, and granularity are important to your business, select a vendor that employs multiple methodologies, including network infrastructure analysis and user-validated location feedback, as well as has a team of data analysts that double checks automated data collection methods and runs quality-assurance checks.

5. Data Breadth

Besides IP geolocation information, what other datasets do they offer?

Information such as proxy or VPN type; mobile carrier; connection type/speed; home/business user; industry classifications; longitude/latitude; time zone; domain name; ISP; company name; organization name; demographics; and more can be impactful datasets for creating more meaningful user experiences.

6. Ease of integration

Ease of integration is another crucial factor when choosing an IP geolocation service.

You want an API that can be quickly and seamlessly integrated into your existing systems, such as your website, mobile app, or CRM. Look for an IP geolocation API with various integration options, such as REST API, JSON, XML, and CSV. Some IP geolocation services also offer SDKs and client libraries for popular programming languages like JavaScript.

Integration is a massive compliment to accuracy, especially for things such as urban planning and placing locational services. The easier it is to integrate the IP geolocation service, the faster you can start taking advantage of the benefits it provides.

7. Pricing

The pricing model of IP geolocation varies from one service provider to another. While some IP geolocation providers offer a free plan, others require a subscription plan. Pricing depends on various factors, such as the number of API calls, the level of accuracy and precision required, the level of support, and the number of features needed.

Some IP geolocation service providers have a pay-as-you-go pricing model, while others require an annual or monthly subscription. Some providers offer discounts for bulk purchases or special pricing for non-profit organizations or educational institutions.

When selecting an IP geolocation service provider, it is necessary to consider the pricing model and ensure that it is within your budget. Consider the API’s response time, uptime, and latency to provide a smooth user experience.

Looking for the best IP geolocation service? Try Digital Element today.

Whether you need IP geolocation and IP intelligence data for website personalization, fraud detection, first line of defense for cybersecurity, targeted advertising, content localization, or digital rights management, most IP geolocation providers are well adapted to help you get the information you want.

But if accuracy and precision, coverage, and granularity are important for you, Digital Element’s NetAcuity solution stands out for its exceptional accuracy and quality, comprehensive data coverage, and white glove service and support.

Watch the video below to learn more about Digital Element’s capabilities.

Take advantage of the powerful insights we can provide to help you protect and enhance online experiences for your customers. No matter the size of your business, our key features and flexible pricing options can help you best meet your needs.

Click here to schedule a free consultation with one of our experts.

Resources to help you learn more about Digital Element’s capabilities

Digital Element Adds Deterministic IP Address Metadata to Nodify

Posted on January 17, 2024August 21, 2025 by Digital Element

In November, Digital Element announced a new IP address data solution designed to help our customers better understand anonymous traffic, enabling them to make strategic decisions regarding advertising, cybersecurity, DRM, and other use cases.

IPC Characteristics, aka IPC, is the newest addition to our Nodify platform, the industry’s most comprehensive proxy/VPN IP address traffic data. When used together, IPC, Nodify and NetAcuity offer our customers unmatched insights into anonymous traffic, enhancing their ability to understand and manage online activities effectively.

4 Pillars of IPC Metadata

Think of IPC as a vast collection of metadata, meticulously collected, validated and aggregated on a massive scale. This aggregation process unlocks a wealth of valuable insights and information. It has four pillars of metadata, all of which are essential for assessing the relative risk of an IP address.

Activity. This metric signifies the quantity of devices observed by Digital Element connecting to a particular IP address over a period. This type of data provides insight into the type of location where the wifi is set up, i.e. a public building with many devices or a private space with just a few.
Geolocation. IPC identifies how many unique locations have been associated with an IP address. As IP addresses are dynamic, the number of geolocations the IP has been seen provides intelligence about the general area it has been seen in, and is an indication of threat level if it has been seen in multiple countries.
Range. Let’s say an IP address is observed in multiple locations, the next question is what is the distance between those locations. A small average distance may indicate that only one ISP is using it, and it is therefore potentially benign, vs a large average distance which would indicate it could be a proxy.
Persistence. A unique feature to Digital Element, persistence asks the question: how long has this fixed IP address been at the same location? A greater persistence at a given location indicates the general innocuity of that IP address.

Each pillar serves various purposes and applications. For instance, activity helps advertisers with audience targeting. If you’re an advertiser aiming to target households, and the activity level indicates that over 100 devices are connected to certain IP addresses, it suggests that those IP addresses are less likely to correspond to residential locations.

That sample pillar also helps cyber security teams make smart decisions as to when to prompt users for additional authentication. When the activity level is high, it can serve as an indicator that the traffic originates from a public Wi-Fi service, such as at a local café or airport. This information bolsters threat intelligence and helps cybersecurity professionals assess potential risks and take appropriate security measures.

IPC Metadata and Machine Learning

IPC metadata can be a valuable resource for data scientists looking to enhance machine-learning capabilities and improve their models. For instance, it can provide additional features and context that can be used for feature engineering in machine learning models. These features can help improve the accuracy and relevance of the models.

IPC metadata used to identify anomalies or unusual behavior in network traffic. Data scientists can leverage this data to create anomaly detection models that can help identify security threats or system issues.

Deterministic Data

Another important characteristic of IPC metadata is that it is deterministic, not probabilistic. The GPS coordinates come from the mobile devices themselves, meaning the longitude and latitude information is accurate and reliable. Digital Element also captures the data and time when the geolocation data is observed.

Additionally, the sheer volume of data collected increases the accuracy of understanding traffic, identifying anomalies, and making informed decisions in various contexts, such as cybersecurity and personalized content delivery. This massive volume of data leads to more precise insights and improved performance in IP-related applications.

Why Digital Element is Unique

Digital Element’s ability to collect and analyze billions of IP observations is unique in the IP intelligence data space. This extensive dataset forms the backbone of all our products, and enables our customers to glean valuable insights about the traffic that accesses their networks.

Aggregating this data creates metadata lets us determine context such as:

Is this IP address coming from a public or private space?
Can I trust this IP address’s current geolocation? Based on if its dynamic or stable
Is this potentially a proxy IP address?
Does this IP address generally always belong to a given geographic region or is it geographically dynamic?
How much confidence can I have about its given location based on the number of observations at that location?
How much confidence can I have about its given location based on its last seen location?

Let’s see it in action.

The above table shows five unique IP addresses. From the IP characteristics we can obtain nuanced context of each:

Key Takeaways: Example 1 is a stable IP address based on one geolocation observed over 600 times over 46 weeks. This IP address would likely be considered safe by all measures by a cybersecurity firm.

Key Takeaways: Example 2 is also a stable IP address even though it was only stable for 7 weeks. We see that there were over 8 devices from the same geolocation, making it likely it is a household with multiple computers and mobile devices.

Key Takeaways: Example 3 provides intelligence that this IP address is stable when considering the macro geographic location, but is unstable when looking at the city and postal code level, since it has over 20 devices connecting to it. Even though this IP address is considered unstable, it is likely safe due to the fact that the average and maximum distance between all the postal codes is small. This fact indicates that this IP address is likely a regional NAT. It is likely in a rural area where there are not enough IP addresses allocated there (unstable dynamic one).

Key Takeaways: Example 4 (mobile activity) and Example 5 (proxy activity) are clearly proxy IP addresses given the number of observations and devices connected to them being extremely high. However, the key difference is that Example 4 could be a corporate proxy IP address (relatively less malicious) given that it stays within the same country.

Key Takeaways: Example 5 has been seen in 9 countries. This IP address is clearly one that should be blocked when considering access to secure content.

IP Address Intelligence Experts Since 1999
Since our founding we have sought to provide context to anonymous traffic.

We started in the 1990s helping advertisers accurately and non-invasively target audiences based on their IP address. Since that beginning, we’ve been on a mission to provide as much IP address intelligence and data-driven context as possible to deliver even more value across many verticals.

Our product suite includes:

NetAcuity	Shines a spotlight on geography, delivering critical insights into location data
Nodify VPN Characteristics	Provides unique context into VPNs, proxy networks and dark networks
Nodify IP Characteristics	Provides deterministic data about an IP address: Unique context you can’t find elsewhere Enhances insight from NetAcuity and Nodify VPN for a fuller picture.

To learn more about our new IPC database, visit here.

CTV Advertising in 2024: Navigating an Era of Abundant Data and Trust Scarcity

Posted on January 11, 2024August 24, 2025 by Digital Element

CTV viewership continues its upward trajectory, growing both in terms of number of viewers and time spent consuming content. According to a report by MNTN, CTV now accounts for 50% of all TV hours consumed, a jaw dropping 11.5 billion hours.

What’s more, half of all households with wifi now stream TV, according to comScore, which isn’t surprising given the number of options now available to consumers to watch their favorite shows at any time, day or night, that’s convenient to them, and on any device of their choosing.

Those options include ad-supported video on demand (AVOD), free video on demand (FVOD), free ad supported television (FAST) and virtual multichannel video programming distributor (vMVPD).

It’s a truism in advertising: where consumers go, brands must follow. But are advertisers reaping the full benefit of digital advertising when they buy CTV inventory? The data says no, largely due to a lack of standardized measurement and verification.

A report from Xenoss succinctly highlights the lack of common identifiers, myriad measurement methodologies, and complex device identification as key challenges. Its authors discuss the need for ad platforms to pull data from multiple sources to give a complete picture of ad performance, and the challenges of cross-media measurement and data fragmentation.

Meanwhile, DoubleVerify reports that CTV advertisers confront multiple types of ad fraud, including bot traffic, fake apps and fake traffic, and urgently need sophisticated fraud detection mechanisms to combat ad fraud in the CTV environment.

This leads us to the most notable trend for 2024: CTV advertisers will demand assurance that their ads were delivered to real people, not bots, and were seen by the right consumer or household as promised.

Lack of Measurement Stymies CTV Advertising

There’s no denying that the TV advertising landscape is in the midst of a radical transformation. Notably, projections indicate that spending for streaming ads will exceed those of traditional linear TV by 2025. Within the next three years it will account for 68% of total TV ad spend.

For its part, spending on linear TV will decline from $61.31 billion in 2023 to $56.83 billion in 2027, according to Insider Intelligence. In that same time period, CTV ad spend will grow from $25.09 billion to $40.9 billion.

So what are the implications of this shift in focus? To begin, as more ad dollars flow into CTV, the more advertisers will be confronted with the challenges of measurement and the scourge of ad fraud. Without trusted and standard tools, how will they feel confident that the impressions they pay for were actually seen by real users?

This contrasts with linear TV, which had a standard mechanism for buying and measuring TV for 50 years: Nielsen’s panels and the gross rating point (GRP).

Say what you will about the efficacy of linear TV, at least it was standardized, and enabled marketers to compare performance across all publishers.

Three Vectors for Linear TV

The linear TV framework offers three vectors for audience audience targeting:

Content: Marketers select shows based on content — sports, soap opera, news, etc., — which serves as a proxy for the viewers’ demographics. This, of course, is based on assumptions, such as “men watch sports” and “women watch soap operas.”
Time of day: Dayparts help advertisers match products to consumers. For instance, breakfast cereal brands target consumers while they’re likely to be eating breakfast, and fast casual restaurants show their lunch specials at noon time.
Geography: Where a consumer is located helps advertisers hone their targeting further. For instance, a tire company will show regular tires to markets in the south, and ads for snow tires for markets likely to experience winter weather.

Measurement was done through the GRP, which is a metric for gauging the effectiveness of linear television ads. GRP is calculated based on the percentage of the total potential TV viewership that the ad reaches. Specifically, one GRP represents the ad being seen by 1% of the entire potential TV audience.

Digital Expectations for a Critical Digital Channel

The linear model doesn’t translate well to CTV for multiple reasons. To begin, day parts are no longer relevant, as anyone can watch any content at any time. And without an IP address — data that isn’t transmitted in the programmatic bid stream — location is difficult to ascertain. This issue grows more severe as the surge in programmatic TV continues.

There is also the issue of the ad buyer’s expectations. CTV is a digital channel, and its inventory is traded by people who are steeped in the digital landscape. They are marketers who are accustomed to a plethora of attributes for targeting, measuring and optimizing campaigns. These advertisers, and their agencies, are well aware that they are hundred of variables that they should be able to leverage, but can’t, including

IP location address, and all the insight that surrounds it, including locations down to the +4 ZIP code, home vs. business, mobile carrier, device type, among others.
Time spent watching TV, when did they stop watching TV. While automated content recognition (ACR) data is fully opt-in and records both the content and ads played on a smart TV, CTV is consumed on many other device types — computers, tablets or phones — that don’t support it. This reality means there is a gaping hole in measurement. Additionally, ACR data doesn’t capture the location of the viewer, which is a critical data point for marketers.
Precise audience segmentation based on demographics and psycho-demographics (e.g. users in these households who love fashion, or east coast moms who shop at Trader Joes). The city, neighborhood and block can contain a great many types of consumers, which is why digital advertisers place a premium on creating unique audience segments.
Tracking and attribution. Advertisers are keen to track the outcomes of their ad spend. Of the users who saw their ads, how many visited the website or retail outlet? How many conversions or sales did the ad spend generate?

The State of CTV Measurement

CTV measurement has been a topic of concern for advertisers since the channel took off during pandemic-era lockdowns. In response, many CTV and measurement companies are starting to bring solutions to the market.

The challenge is that these solutions vary from platform to platform, making it difficult for advertisers to compare performance across channels. They want standardization in measurement, and are increasingly vocal about that demand.

In some cases, the old way of measuring TV is being shoehorned into CTV. This is an extremely important point, because buyers say they don’t trust such methodologies. That lack of trust, in turn, is putting a damper on ad spend, preventing it from reaching its full potential.

How do we build trust in CTV measurement? We need to resolve the complexities in the current CTV landscape, which include:

A lack of common identifiers. CTV measurement lacks common identifiers, making it difficult to track and measure ad performance across different platforms and devices.
Data fragmentation. Advertisers have little visibility into where their CTV ad runs and who they reach, due to highly fragmented data. This, in turn, makes it difficult to measure and track campaign KPIs.
Inconsistent measurement. Unlike the GRP, CTV is plagued with Inconsistent measurement practices. What’s more, advertisers don’t have transparency into how audiences are measured and how outcomes are attributed to ad spend.
Opaque practices. Ad buyers often think they’re buying premium CTV inventory when, in fact, it can be less than premium or even fraudulent.

The bottom line is that CTV measurement today faces significant challenges for marketers who are accustomed to digital campaigns. At present, CTV can’t accurately determine whether the intended audience for an ad is indeed the one who views it. Panels, although valuable, do not paint a complete picture, as precise geolocation is lacking.

If all panels were to disclose the geographical reach of their data (which is currently not a widespread practice), ad buyers would have a standardized understanding of their viewership, even if different panel measurement companies provide varying insights.

Many ad buyers already rely on multiple measurement companies, and with access to location-based data, they can better comprehend the origins of their viewers and the demographic information provided by the panel company.

Until a standardized approach to television measurement comes to market, advertising will be stymied. That said, given the increasing importance of CTV in reaching and engaging consumers, 2024 will be a year when substantial innovation occurs.

State of Fraud in CTV

Ad fraud in CTV has been a significant concern for advertisers, as nefarious players deploy deceptive tactics, such as bots or fake CTV devices to simulate viewership in order to inflate video ad impressions. In some cases, these sophisticated schemes are the work of organized crime rings.

DoubleVerify’s Global Insights Report found that bot fraud on CTV surged 69% in 2022 compared with the year prior. The number of CTV fraud schemes and variants DV detected annually has tripled since 2020.

The billions of dollars that flow into CTV advertising is irresistible to fraudsters, many of whom have significant technical skills and resources at their disposal to ply their craft. As more dollars move into the CTV space, the greater the opportunity for fraud.

Residential IP proxy networks are another issue of concern for streaming TV providers. Consumers, crime rings and VPNs seeking to circumvent digital rights management (DRM) restrictions are leveraging residential IP proxy networks to circumvent geo-restrictions, a topic we’ve covered in the past. Quality teams need to get a handle on residential IP stuff in order to improve/home targeting.

Our prediction: 2024 will be a year of anti-fraud innovation in the CTV space.

Going Forward

CTV is a critically important channel, so we can expect to see more innovation in both measurement and fraud detection and mitigation. For this reason, experts in the industry are working hard to solve this challenge — Digital Element included. Stay tuned!