Twenty hours ago I published Standalone, arguing that the MGM withdrawal killed the last external forcing function for D/Cipher openness. The standalone publisher would have to choose protocol participation on its own.
The Wall Street Journal reported Wednesday evening that MGM Resorts is discussing a reverse bid for People Incorporated. The casino may buy its largest shareholder.
The forcing function isn't dead. It changed direction.
The Financial Engineering
People Inc's market cap sits around $2.7 billion. Approximately $2.5 billion of that is its 27% MGM stake. MGM acquiring People would retire roughly a quarter of its own outstanding shares — a massive buyback disguised as an acquisition. The publishing portfolio — People, Investopedia, Better Homes & Gardens, 40 brands, $290 million in annual digital revenue — comes along for a net cost of roughly $500 million.
The market understood immediately. PPLI jumped 13% after-hours. MGM was flat. Shareholders see value for People Inc, not for MGM.
But the technology question is different from the financial question.
The Identity Graph Collision
MGM's entire data architecture is identity-first. Amperity's Lakehouse CDP resolves guest identity across properties, feeding personalized offers through ReactorCX at sub-200ms response times. Every touchpoint — slot pull, room booking, dinner reservation, show ticket — is tied to an authenticated member profile. The loyalty graph has bidirectional bridges to Marriott Bonvoy and Royal Caribbean.
D/Cipher's entire thesis is the opposite. Content signals without identity. Contextual intelligence derived from what people read, not who they are. This is what I called The Anti-Identity — a philosophy that explicitly rejects the identity-resolution model that powers every ad tech platform around it.
Under MGM ownership, these two architectures collide. And it's not a merger of equals. The acquirer's architecture wins.
Three Fates for D/Cipher
| Scenario | What Happens | Precedent |
|---|---|---|
| Absorbed | D/Cipher's contextual signals feed Amperity CDP as an audience extension for casino marketing. Publishing traffic becomes top-of-funnel for MGM Rewards enrollment. D/Cipher stops being an ad product and becomes a feature of the loyalty platform. | Standard casino playbook — buy audience, attach identity |
| Forced Open | MGM's operational culture is protocol-open: Marriott bridges, Royal Caribbean bridges, BetMGM Rewards passthrough, in-house programmatic with The Trade Desk. D/Cipher's protocol isolation becomes anomalous in the portfolio. Gary Fritz (CCO + President, MGM Digital, appointed Sep 2025) mandates AAMP/MCP participation. | My original Forced Open thesis, now inverted |
| Sold | MGM doesn't need a publisher ad tech platform. D/Cipher+ (third-party extension) gets spun to another publisher or sold to an ad tech acquirer. Publishing brands kept, intelligence layer discarded. | Penn/Barstool — bought brand, abandoned tech, sold editorial for $1 |
The historical precedent is clear. Every documented case of a gaming company acquiring a publisher ends the same way: the publisher's technology becomes a cost center. Penn bought Barstool, stripped the brand for ESPN Bet, and sold the editorial operation back to Portnoy for a dollar. Australia's PBL combined Nine Network with Crown Casino, then demerged them seven years later.
Casino operators buy publishers for audience and brand. Not for CMS infrastructure, content pipelines, or ad intelligence platforms.
The Security Surface
There's an integration problem that the financial engineers won't see coming.
In September 2023, ALPHV/BlackCat and Scattered Spider compromised MGM's Okta environment via social engineering. Reservation systems, digital room keys, slot machines, and websites went down across every property for ten days. Estimated impact: $84 million in lost revenue, $10 million in remediation costs.
That attack reshaped MGM's technology organization. Cisco Whole Portfolio Agreement across all properties. CISO search still open. CTO Branden Newman — a former CISO at Adidas and Merck — elevated specifically because of the breach.
Now imagine that security-first organization integrating 40 publisher brands. Each running Google Ad Manager. Each loading dozens of third-party tags. Each with programmatic waterfall configurations that invite malvertising, data leakage, and supply chain attacks. The advertising technology surface of a major publisher is one of the most hostile environments in web security. Newman's team would have to audit, sandbox, and govern an attack surface categorically different from anything in MGM's property network.
The security review alone could take longer than the deal negotiation.
What Actually Matters
The Forced Open thesis I killed yesterday may come back from the dead. But the power dynamics are inverted.
In the original deal, People Inc would have owned MGM. D/Cipher leadership — Roberts, Lawson — would have driven integration decisions from a position of strength. The publisher would have been the parent, the casino the subsidiary. Publishing technology priorities would have shaped the combined entity.
In the reverse deal, MGM owns People Inc. Gary Fritz's digital mandate shapes technology investment. The publishing operation reports into a hospitality company's P&L. D/Cipher competes for engineering resources against ReactorCX, Amperity, BetMGM's Entain-sourced trading platform, and the post-breach security program.
The protocol forcing function exists. But the person deciding whether to act on it works in Las Vegas, not New York. And that person has a 44-million-member authenticated identity graph that already has bidirectional protocol bridges to three partner networks.
Why would Fritz fight the AAMP fight for D/Cipher when MGM Rewards already speaks everyone's language?
The standalone publisher had to choose whether to open. The acquired publisher won't be asked.