The Media Buying Stack in 2026: Every Layer, What It Does and What It Costs

An antidetect browser is the part of a media buying setup everyone argues about, and it's 1 layer of 8. Around it sit the proxies that give each profile its own address, phones for accounts that live in apps, numbers for SMS verification, a captcha solver if you automate, the automation itself, a tracker that tells you which campaign made money, and the checks you run before any of it touches an ad account. Each layer has its own price, and a weak one undoes the strong ones.

This piece walks through the stack layer by layer: what each part does, how to choose it and what it costs in October 2026, with prices taken from vendors' own pages on October 22 to 24. I've used Dolphin, Linken Sphere, AdsPower and Multilogin in my own work; the rest is built on what the vendors publish. Where we've gone deeper, the section links to the full article.

Layer 1: the antidetect browser

What it does. It gives every browser profile its own fingerprint, cookies and proxy, so accounts in different profiles don't share a trace. It's how agencies keep client accounts apart and how a team shares profiles without sharing passwords.

What it costs. For 100 profiles on monthly billing in October 2026:

How to choose. Decide by your team size and how much the kernel matters for your accounts, not by the brand everyone in the chat uses. Our real differences between the big 5, the ranked top 15, the pricing comparison of 31 browsers and team bills for 3, 5 and 10 people cover it in detail. To start for free, see the best free antidetect browsers.

Layer 2: proxies

What they do. The antidetect hides your device; the proxy hides your network. Each profile needs its own IP in the country it claims, or the fingerprint and the connection tell different stories.

The 4 types you'll be offered:

• Residential: IPs of home internet connections, priced per GB. The default for ad accounts and warm-up.
• Mobile: IPs of mobile carriers, priced per GB or per port per day. Common for app-based accounts and phones.
• ISP, or static residential: a residential-looking IP that stays the same for weeks, priced per IP per month. NodeMaven puts the case for them plainly: "Static ISP proxies give each account the same IP for weeks or months, so logins, automations, and long-running sessions don't trigger checks on every return."
• Datacenter: cheap server IPs, easy for sites to recognize. Fine for scraping and spy work, not for ad accounts.

Sticky or rotating. A sticky session holds 1 IP for minutes to hours; a rotating proxy changes it on every request or on a timer. Logged-in accounts want the same IP each time; rotation suits scraping.

What it costs, from vendors' pricing pages:

Cheap isn't the same as clean. The price per GB says nothing about how many people used an IP before you. Detection companies remember an IP's history: Fingerprint raises its time zone mismatch flag when "at least 50% of requests from the same IP in the last 7 days" show one. Our NodeMaven review shows what screening IPs before use looks like, and our leaks piece covers WebRTC, DNS and the TCP fingerprint a proxy brings with it.

Layer 3: phones for app accounts

What they do. A desktop antidetect can only imitate a phone inside a browser. Accounts that live in TikTok, Instagram or other apps need a phone: a real one in a drawer or a cloud phone rented on a vendor's servers, each with its own device identity and proxy.

What it costs:

• GeeLark: $0.007 a minute capped at $1.20 a day per phone, or $29.90 a month for a phone that stays on.
• MoreLogin: $0.006 a minute capped at $1.50 a day, or $23 to $25 for 30 days.
• Multilogin: minutes included in every plan, from 60 a month on Pro 10 to 450 on Business 300, on real hardware.
• Incogniton: $3 a phone a month with 30 minutes, then $8 per 1,000 minutes.
• BitBrowser: Android phones billed by time, capped at $1.60 a day, and real iPhone SE devices from $30 a month.

How to choose. Switch phones off between sessions if you pay by the minute, and keep 1 account per phone. Our guides to the best antidetect for Android, the best iPhone antidetect and Multilogin vs GeeLark compare them in detail.

Layer 4: SMS numbers

What they do. Platforms ask for a phone number at signup and sometimes at sign-in, and they limit how many accounts a number can hold. Google says "sometimes phone verification is required to confirm you're a real person" and explains its error message this way: "To protect you from abuse, we limit the number of accounts each phone number can create." TikTok is stricter: "Only one phone number can be associated with one account." SMS services sell numbers that receive these codes, either for a single activation of 5 to 30 minutes or as a rental for days or months.

What it costs. The cheapest in-stock US number on each service's public price list on October 24:

Numbers from other countries cost a fraction of that: 5sim's cheapest UK number for Facebook is $0.10. HeroSMS shows prices by country only after login; its home page lists Facebook numbers from $0.0075.

What to watch:

• SMS-Activate is gone. Its site says it stopped operating on December 22, passed its technology to HeroSMS and warns that any service now using the SMS-Activate name is a scam.
• A low price isn't a working number. SMSPool shows a success rate next to each price: 62% for its US Facebook numbers, 30% for Google. If no code comes, the money goes back: "No SMS within the window? The order is refunded to your balance."
• The refund covers the code, not the account. 5sim's rules say: "Refund for banned accounts is not stipulated."
• Read the terms for where you live. 5sim's terms say its services "are not available for residents of the United States and Russia."

How to choose. If an account asks for a code again, at a new login, for 2FA or for recovery, a number you held for 20 minutes is gone. For accounts you plan to keep, rent the number for as long as the account lives or use a real SIM card; single activations suit tests.

Layer 5: captcha solving

What it does. A captcha appears when a site isn't sure there's a person on the other side, which is why this layer matters mostly once you automate. Most captchas no longer ask anyone to click pictures. Google's reCAPTCHA v3 "returns a score (1.0 is very likely a good interaction, 0.0 is very likely a bot)" and leaves the decision to the site: "By default, you can use a threshold of 0.5." Cloudflare's Turnstile starts with "a series of small non-interactive JavaScript challenges to gather signals about the visitor or browser environment," and in invisible mode it "runs challenges completely in the background with no visible widget." A solver service takes the challenge from your script and returns a token the site accepts.

What it costs, per 1000 solves on the vendors' pricing pages on October 24:

2Captcha's 2 prices for v3 show what a good score is worth: $1.45 for a token scored 0.3 or lower, $2.99 above 0.3. Anti-Captcha says "100% of captchas are solved by human workers from around the world"; 2Captcha says that "if AI confidence is low, the task is passed to verified human workers."

The catch. A solver gets a script past the challenge, not past the reason for it. The v3 score is "based on interactions with your site," and Turnstile reads the browser environment, so a profile that keeps getting challenged has a fingerprint or IP problem that a solver only covers up. If you work by hand, you mostly don't need this layer.

Layer 6: automation

What it does. It repeats the routine: logging in, warming up accounts, filling forms, collecting cookies. Antidetects offer 3 levels: a synchronizer that mirrors 1 window in others, a no-code builder (Dolphin's scenarios, AdsPower's RPA), and an API that Puppeteer, Playwright or Selenium connect to. Many now add an MCP server so AI agents can drive profiles.

What it costs. Mostly nothing extra, but the level you need decides the plan: AdsPower's API starts on Professional, Dolphin's on Starter, Multilogin's on Pro 10, Kameleo's and MoreLogin's on the free plan.

The catch. A script leaves traces a manual session doesn't. Fingerprint detects "whether a Chrome instance is being controlled via an active Chrome DevTools Protocol session," and in our own test, Fingerprint's demo and Castle's test page flagged a script-controlled Chrome every time while the popular checkers called it clean. Keep your most valuable accounts on manual work. Details in How Antidetect Browsers Get Caught.

Layer 7: the tracker

What it does. A tracker records every click with a SubID, receives conversions from the network by postback and shows which campaign, creative and placement made money. Without it, you're reading ad dashboards that don't see the offer's side.

Self-hosted or cloud. Self-hosted trackers run on your own server for a flat license; cloud trackers run on the vendor's servers and price by events. Prices from the vendors' pages:

How to choose. On a small budget a free cloud plan is enough to learn on; once traffic grows, a self-hosted license costs the same whatever the click volume. Our piece on affiliate link management explains why the links you publish should run through a tracker you control. For a team, check the user limit: Keitaro's Starter and Advanced plans are for 1 user and Expert, at 104 EUR, for up to 5, while Binom's license includes unlimited users.

Layer 8: the checks before launch

What they do. They catch the obvious mistakes before a platform does: a time zone that doesn't match the proxy, a WebRTC address that leaks your home IP, a graphics renderer from the wrong operating system.

What it costs. Nothing: public checkers and leak tests are free. But read them for specific signals, not for a score. In our test, a browser run by a script got 100% on BrowserScan and Whoer, and a Chromium posing as Safari got 100 on Iphey. See What Fingerprint Checkers Really Check and the 4 leak checks to run in every profile.

And 1 optional layer: ad intelligence. Spy tools show competitors' creatives and landing pages before you spend on a test; Spy.House starts at $29 a month. See our Spy.House review and how much budget you need to test an offer.

What a stack costs: 3 examples

Monthly prices from the vendors' pages, before any yearly discounts. Usage-based layers depend on volume, so each cell states the volume we priced.

The ranges run from the cheapest option in this article to a mid-priced one: BitBrowser to AdsPower for the browser (RoxyBrowser to AdsPower at 10 people, plus $45 once for Roxy's seats), DataImpulse to Decodo for proxies, MoreLogin to GeeLark for phones, and SMSPool's and 5sim's US prices for numbers. If you automate, check that your plan includes API access; Layer 6 shows where it starts. For comparison, Dolphin{anty} alone costs $524 a month for 10 people, more than the cheapest full stack for the same team.

The rules don't change with the stack

Every layer above exists for legitimate work too: agencies separate client accounts, teams share profiles without sharing passwords, and testers check offers in other countries. The platforms' rules still apply. Meta's terms say: "Create only one account (your own) and use it for personal purposes." Google Ads says "you can't create multiple Google Ads accounts after getting suspended to try to get around Google Ads' policies." TikTok says: "We do not allow advertisers to circumvent, evade, or interfere with our advertising systems and processes." Working through agency accounts and keeping each client's setup separate is the normal way to run many accounts. Using the stack to come back after a ban is what the rules forbid, and no layer in it changes the payment methods, documents and domains that link accounts together.