Patent: A Controlled System Decides Which Ads Reach Your Screen

By Patentlyze Team · Updated Jun 26, 2026

Google is patenting a system that decides which ad lands on your screen through a chain of isolated processing steps, each one sandboxed so your personal data never has to leave a controlled environment.

What Google's secure ad-selection pipeline actually does

Imagine every ad you see online goes through a behind-the-scenes auction. Right now, parts of that auction involve your data traveling to dozens of third-party servers, which is a privacy headache. Google's patent describes a different setup: a secure, centralized system that runs the whole selection process inside a protected box.

Inside that box, the system runs your ad request through a series of stages, one after another, like an assembly line. Each stage does a specific job (filtering candidates, ranking them, applying the advertiser's custom rules), and the stages pass results to each other over a shared internal channel. Crucially, the advertiser can plug in their own custom logic at each stage without ever seeing your raw data.

The end result is an ad choice that reflects both Google's standard rules and the advertiser's preferences, all without your information being handed around freely. It's Google's attempt to keep ad targeting working while containing the data that powers it.

How the orchestrator chains modules over a shared data bus

The patent describes a secure distribution system that handles ad selection through a structured, multi-stage workflow rather than a single monolithic process.

When a page requests an ad, a component called the customization orchestrator looks up the right workflow for that content platform and kicks it off. The workflow is a defined sequence of customization modules, each of which handles one phase of the selection process (think: eligibility filtering, audience matching, bid ranking).

Each module contains two kinds of building blocks called worklets (small executable code chunks):

• Standard worklets that Google provides and reuses across all advertisers
• Custom worklets that a specific advertiser or content platform has written to apply their own business logic

All modules communicate through a common data bus, a shared internal channel that passes output from one module as input to the next. The orchestrator controls what data flows in and out of each module, which is the key privacy lever: sensitive user data stays on the bus inside the secure system and is never exposed directly to advertiser code.

At the end of the chain, the system surfaces the winning ad and tells the user's device to display it.

What this means for ad privacy and publisher control

Privacy regulations and the slow death of third-party cookies have been forcing the ad industry to rethink how targeting works. This patent shows Google building infrastructure where advertisers can still customize how their ads are selected without getting direct access to raw user data. That's a meaningful technical boundary, even if regulators and users will debate whether it goes far enough.

For publishers and advertisers, the modular design is interesting because it means Google could let each platform plug in its own logic at each stage of the pipeline without rebuilding the whole system. That kind of flexibility, if it ships, would make it easier for Google to onboard different ad ecosystems onto a single privacy-compliant backbone, which is exactly what the company needs as the open-web ad market keeps fragmenting.

Editorial commentary on a publicly published patent application. Not legal advice.