The Unlocked Shelf

Summary

Retail media is the fastest-growing category in advertising, with the largest operators asking major brands to commit billions in annual spend to networks the retailers themselves run. This report examines a basic governance question about those sellers. Does the company publish the industry-standard public file, ads.txt, that declares who is authorized to sell advertising in its name?

On September 12, 2026, Ghost Orchid Labs retrieved and archived the authorization surface of twenty of the largest publicly traded companies operating retail media networks. Every raw server response was preserved and cryptographically fingerprinted at collection time. One company blocked all retrieval in every context and is excluded from every percentage. The full census was re-verified on September 24 and 25, 2026, by independent browser checks and a repeated automated collection. One company changed state between the two dates. The change is recorded in the update below and in the Continuous Audit log. Of the nineteen that answered, verified by both automated collection and independent browser checks:

Update, September 25, 2026. Between the September 12 census and a full re-verification on September 24, one company changed state. Dollar General served no authorization file on September 12. It now publishes a valid one with ownership declared. We are not saying Dollar General read this report. We are saying the door was open on the 12th, and by the 24th someone there decided it was worth the ten minutes to lock it. That is not our characterization. That is their file. The September 12 finding stands as recorded, and the count of companies with no machine-readable answer moved from ten to nine of nineteen. The Internet Archive's last capture of the file before our census, January 27, 2026, records no file. A capture requested on September 25, 2026 records the current one. Both are public.

Among the ten companies publishing valid files, adoption of the standard's governance declarations remains thin. The current ads.txt specification provides two ownership declarations: OWNERDOMAIN, naming who owns the domain, and MANAGERDOMAIN, naming who operates the seller's ad monetization. Of the eight actively selling, four declare ownership. Zero, across every file in the census, declare a network operator.

Why The File Matters

Ads.txt (Authorized Digital Sellers) is a public, one-page text file published at a fixed address on a company's own domain. It lists every company authorized to sell that domain's ad inventory. The standard exists, in the IAB's words, to make it harder for bad actors to profit from selling counterfeit inventory, by letting buying systems reject unauthorized sellers before a bid is placed.

The mechanic is the point. Automated buying systems check the file to filter counterfeit inventory. When the file exists, inventory claiming to be that domain can be validated against it. When the file is absent, there is nothing to validate against. The door is not merely unlocked; the lock is missing.

A company that sells only through its own closed platform has a standard remedy available. Publish a short file declaring that fact. It costs nothing and takes minutes. Walmart's file is the model. It states in plain language that Walmart's programmatic inventory is not available for purchase and publishes the specification's placeholder record to formalize it. One page. CVS Health publishes the identical declaration. A short file is a governance decision. An absent file is the absence of one.

Retail media advertising itself mostly appears as sponsored product listings and display placements on the retailer's own properties, and as audience-targeted campaigns on other publishers' sites. The authorization file governs neither of those directly. It governs whether anyone else can pose as the retailer's inventory in the open market, which is why it matters regardless of how the retailer chooses to sell.

Method

• Population. Twenty publicly traded companies identified from public record as operating retail media networks, spanning general retail, grocery, pharmacy, home improvement, specialty, and marketplace categories.
• Retrieval. Each domain's ads.txt location was requested directly, at the root and www host, following redirects, on September 12, 2026, and again on September 25, 2026.
• Content validation. An HTTP 200 response alone was not accepted as presence. Each body was parsed against the ads.txt record format. Responses returning HTML or other non-conforming content were classified separately, because catch-all servers can return a webpage with a success code where no file exists.
• Governance parsing. Valid files were parsed for record counts, seller relationships, and the OWNERDOMAIN and MANAGERDOMAIN declarations.
• Provenance. Every raw response was archived at collection time. The findings dataset carries a SHA-256 fingerprint, printed below. Any claim in this report decomposes to archived bytes.
• Browser verification. Every domain classified as publishing no file was independently re-checked in a standard browser session on the same day. This pass corrected three initial classifications: two domains serve their file only to browser user-agents while refusing automated retrieval, and one serves an empty file. The findings below reflect the verified state.
• Exclusions. One domain blocked retrieval in both automated and browser contexts without resolving either way. It is classified Unreachable, excluded from every count, and no inference is drawn about it in either direction.

Findings

Any reader can reproduce any single row in seconds by visiting the company's domain followed by /ads.txt in a browser. Classifications reflect the state observed on September 12, 2026, and re-verified on September 24 and 25, 2026. Companies may publish or amend files at any time, and material changes are recorded in the Continuous Audit log.

Reading The Results

Absent. No file exists at the standard locations. Buying systems have nothing to validate against, and inventory claiming to be the domain cannot be distinguished from the real thing by this mechanism. This is the governance gap the standard was created to close.

Empty file. The server delivers a real file containing nothing: zero bytes where the authorization declaration belongs. Like absence and invalid content, it gives buying systems no answer, with the added oddity that someone provisioned the file and left it blank.

Invalid content. The server answers with a success code but returns a webpage rather than a parseable file. To a person spot-checking in a browser, something appears. To software, nothing does. Functionally equivalent to absence, with the added property that it can pass a casual manual check.

Present. A well-formed file exists. This group divides in two. Walmart and CVS Health publish the specification's placeholder declaration, the correct form for a seller offering no open programmatic inventory. The remaining eight files list active seller records, from one to 105. Two of them, Kohl's and Macy's, serve the file only to browser user-agents while refusing automated retrieval, a gating choice that itself narrows who can validate them. Among those actively selling, adoption of the specification's ownership declarations remains the exception. Four declare OWNERDOMAIN, and none declares a MANAGERDOMAIN, the field that names who actually operates the seller's monetization, despite most large retail media networks being operated with or on third-party infrastructure.

What This Report Does Not Say

Precision about the limits of a finding is part of the finding.

• This report does not claim fraud occurred at any named company, and Ghost Orchid Labs has not observed counterfeit inventory trading under any of these names. What was observed, and archived, is the presence or absence of the mechanism designed to prevent it.
• Risk from an absent file is not uniform. A retailer selling exclusively inside its own closed platform faces different exposure than one whose inventory reaches open exchanges. The standard remedy for a closed loop, a short declaratory file, is free, which is why absence is treated here as a governance signal rather than a technical judgment call.
• Automated retrieval alone is not proof of absence. This census learned that directly. An initial automated pass misclassified three domains that refuse non-browser agents, and a same-day browser verification pass corrected the record before the findings were relied upon. Every no-answer classification above is now verified by two independent methods.
• The Unreachable domain may maintain a file; blocking retrieval is not itself a governance failure, and no conclusion is drawn in either direction.
• This census measures one layer, the public authorization surface. It is not a measurement of impression quality, viewability, or invalid traffic, and it is not a substitute for those measurements. It examines the layer those measurements do not cover.

Continuous Audit

This census is a standing record under continuous audit. Observed changes are logged below with their dates; the underlying evidence is fingerprinted and retained.

September 24 and 25, 2026. Dollar General, Absent to Present. No authorization file on September 12. A valid one-record file with an OWNERDOMAIN declaration, confirmed by browser verification on September 24 and repeated automated collection on September 25. The count of responding companies with no machine-readable answer moved from ten of nineteen to nine. Evidence fingerprinted and retained.

September 26, 2026. Context on the Dollar General change. On April 30, 2026, Dollar General announced open-internet activation through The Trade Desk, built on Kevel’s retail media infrastructure. Activation of that kind requires a valid authorized-seller file to function, as buying systems check it before bidding. This record notes the platform announcement and the file’s appearance between September 12 and 24 and draws no causal line between either of those and this census. The sequence is documented; the trigger is not observed.

Revision Record

Revision 1.2, September 13, 2026. Three editorial corrections, no change to any classification, count, or percentage. A limits bullet still referring to two Unreachable domains was corrected to one, reflecting the Kroger resolution recorded in Revision 1.1. A singular-agreement error in Method was corrected. The Amazon row detail now states that the access-denied response was confirmed in both automated and browser contexts, matching the verification standard applied to every other no-answer classification.

Revision 1.1, September 12, 2026. Following the independent browser-context verification pass described in Method, Kohl's and Macy's were reclassified from Absent to Present (files served only to browser user-agents), and Chewy was reclassified from Absent to Empty file. Counts, percentages, and the findings table were updated accordingly. Kroger, initially excluded as unreachable, was resolved the same day by browser verification. No file is served in any context, and it is classified Absent. Corrections to this report are made openly and dated.

Provenance

Citing This Report

Ghost Orchid Labs, The Unlocked Shelf: Supply-Path Governance Among America's Largest Retail Media Operators, Report GOL-RR-2026-001, September 2026. ghostorchidlabs.ai/reports