Adalytics\u2019 report contains a long list of the advertisers whose Google search ads it reports being able to observe displayed on US Treasury OFAC SDN sanctioned, Iranian, and\/or pornographic websites \u2014 including the following public bodies, companies, organizations and politicians:<\/p>\n
The United States Treasury; the European Commission; political fundraising search ad campaigns for Senator Ted Cruz, Senator Amy Klobuchar, Congressman David Trone, Congresswoman Lauren Boebert, House Minority Speaker Hakeem Jeffries, the National Republican Senatorial Committee (NRSC), Republican National Committee (RNC) and Democratic Legislative Campaign Committee (DLCC), and the Democratic Congressional Campaign Committee (DCCC); the US Department of Homeland Security, Federal Bureau of Investigation (FBI), US Secret Service, Department of Defense (Military OneSource), US Intelligence Community, National Security Agency (NSA), General Services Administration (GSA), and US Centers for Medicare & Medicaid Services (healthcare.gov); US Army, Air Force, Coast Guard, National Guard, Space Force, the British Royal Air Force, the Dutch Ministry of Defense, and the Belgian Ministry of Defense; hundreds of major and Fortune 500 brands, including Apple, Lego, Deloitte, Accenture, KPMG, Microsoft, Amazon, BMW, Home Depot, Uber, Google, Meta, Samsung, Paramount+, TikTok, Pinterest, Snap Chat, and Snowflake;\u00a0Ad tech vendors such as Human Security & DoubleVerify; non-profits such as United Jewish Appeal, International Fellowship of Christians and Jews, One for Israel, American Cancer Society, St. Jude Children\u2019s Research Hospital, Save The Children, and the British Heart Foundation; several major media publishers, such as the Wall Street Journal, New York Times, Washington Post, The Guardian, The Financial Times, The Globe & Mail, The Economist, Business Insider, USA Today, Axios, Hearst Magazines, and Morning Brew.<\/p>\n
If you read that list closely you\u2019ll have noticed that Google\u2019s own search ads<\/em> were even spotted by Adalytics in compromising placements \u2014 which begs the question whether Google\u2019s ad buyers even know how Google\u2019s adtech works?<\/p>\n On reviewing the report, Laura Edelson, an assistant professor of computer science at Northeastern University whose research interests include algorithmic auditing and transparency, agrees it appears as if Google itself may not even have a full view of what\u2019s going on inside its ads black box. \u201cI don\u2019t think that anyone at Google thinks, you know, \u2018aha, what a great place to run our ads \u2014 an Iranian-state owned enterprise!\u2019 That is not true. So, clearly, they do not have visibility into how their own systems work,\u201d she suggested.<\/p>\n \u201cI don\u2019t know if that lack of visibility is intentional or not. But, one way or another, they have lost the ability to verify their own compliance with US law. And so I think that\u2019s where if they cannot do this \u2014 and they\u2019ve demonstrated they can\u2019t \u2014 they certainly need to give advertisers, at a minimum, the ability to verify that advertisers<\/em> are not violating US law.\u201d<\/p>\n Google\u2019s third party ad network may be less well known (and visible) than search ads running on Google.com and other Google-owned domains but the GSP has been criticised as a black box risk before. \u201cThe biggest downside is the lack of transparency and control,\u201d wrote Search Engine Journal<\/a> in an article published last year which proposed to bust some \u201cmisconceptions\u201d about the GSP (such as advertisers mistakenly assuming the network would only serve their ads on smaller search engines using Google\u2019s index). \u201cThere is limited data about where your ads are displayed and you can\u2019t prevent ads from displaying in placements with poor performance or controversial content,\u201d the author, marketing consultant Amy Bishop, also warned at the time.<\/p>\n Adalytics\u2019 research goes further than informed concerns over potential risks for advertisers \u2014 by highlighting multiple, concrete instances where it was able to trigger the display of ads in places where buyers of these campaigns are unlikely to have wanted them to appear. (And, certainly, where Google\u2019s own publisher T&Cs clearly seem to prohibit display.)<\/p>\n TechCrunch was able to recreate some of Adalytics\u2019 findings. For example we observed Google Search Partner ads for consumers goods (diaper brand Charlie Banana); luxury brands (Prada, Burberry); political campaign funding campaigns (Mike Johnson, see screengrab below; Amy Klobuchar); and entertainment and media companies (Disney, the FT, the WSJ) being served through a Google search widget embedded on a number of adult content websites \u2014 with obvious reputational risk for associated advertisers. (And, as noted above, per Adalytics the list of brands and advertisers exposed to this risk is a lot longer than the handful of examples we directly observed.)<\/p>\n An ad for Congressman Mike Johnson showing on a Russian porn website alongside a NSFW pop-over that the site displayed next to Johnson\u2019s ads which we\u2019ve pixelated for viewer safety (Screengrab: TechCrunch)<\/p>\n<\/div>\n During testing, we were also repeatedly served pre-scripted search queries on (random) topics on pop-unders triggered when we clicked on the Google-powered search widget embedded on a number of adult content websites. (Note we did not have to type anything in the search box for this to happen \u2014 a simple click on the embedded widget triggered a pre-filled search query that was opened in a separate, concealed (pop-under) browser tab.)<\/p>\n Examples of pre-filled search queries we were served in this way included \u201cseo audit services\u201d, \u201ccompanion pet insurance\u201d (see below screengrab) and \u201cdmp program\u201d \u2014 topics which are entirely unrelated to the contents of the porn site serving them but appear to be popular keyword terms for buyers of Google\u2019s search ads.<\/p>\n The latter two pre-filled search queries returned links to Google search ads for insurance firms Fannie Mae and Felix Cat Insurance (see below), among others.<\/p>\n Example of a pop-under, pre-filled with the search term \u201ccompanion pet insurance\u201d, which was served by an Iranian porn website (visible in the browser tab to the left) after we clicked on an embedded Google search widget (Screengrab: TechCrunch)<\/p>\n<\/div>\n These pre-filled pop-unders look like naked instances of attempted ad fraud by a GSP \u2014 where users of the porn site in question would not even have typed a relevant query to trigger the display of search ads. (Presumably the intent is that the user will subsequently, either accidentally and\/or out of curiosity, click on one of the ad links and, in so doing, generate ad revenue for the publisher.)<\/p>\n The automatic re-direct being deployed in the above instance was to the following URL: \u201csearch.howtolosebellyfat.shop\/search\/\u201d \u2014 the choice of term used in the link presumably also selected for its potential to lure attention \u2014 a web property that Adalytics\u2019 report<\/span> confirms uses the Google Custom Search Engine.<\/span><\/p>\n<\/div>\n It\u2019s worth noting that we were unable to reproduce (nor did we attempt) all of Adalytics\u2019 findings \u2014 for example, searches we tried on some of the flagged GSP websites for a number of major consumers goods brands (including Apple) did not yield display of their Google search ads. Whereas Adalytics says it was able to trigger Apple ads in problematic spots.<\/p>\n Image credits: Adalytics<\/p>\n<\/div>\n Its report, which runs to 219 pages, contains scores of screenshot examples featuring major brands \u2014 including an instance of Apple search ads being served on gpsm.ru, a Russian website Adalytics notes is explicitly mentioned on the OFAC SDN sanctions list; and another <\/span>of Apple search ads being served on iasco.ir, the aforementioned Iranian steel company\u2019s website it says is also explicitly on the OFAC SDN sanctions list. It also recorded several instances of Apple iPhone search ads being served on adult content websites.<\/span><\/p>\n Adalytics suggests discrepancies between the search ads it was able to observe and document in the report vs what we could verify subsequently, via our own testing, could be related to the fact of its research bringing the brand safety issues to light. It posits that the report, which was shared under embargo ahead of publication with a number of its industry contacts, as well as with journalists, may have been passed to affected advertisers and\/or to Google \u2014 which could have led to implicated actors doing damage limitation by curbing display of their search ads to problematic sites (such as by opting out of the GSP) ahead of the report going live.<\/p>\n \u201cWe already see sites being taken down\/de-monitized,\u201d Adalytics founder Krzysztof Franaszek told us last week.<\/p>\n Once Google was informed of Adalytics\u2019 upcoming research Franaszek also reported further instances of sites identified in the report having their search ads (and, indeed, their embedded search functionality via Google\u2019s widget) blocked server side \u2014 including adult content sites pornobaza24.top, Forum Porn and comixxx.pro. (Google subsequently confirmed to us it had taken action to remove sites violating its publisher T&Cs against adult content once it was made aware of them.)<\/p>\n Ad campaigns can (and do) also change. So it\u2019s possible some of the ad campaigns that were running on GSP when Adalytics carried out its tests were no longer live when we checked \u2014 such as, for example, if an advertiser\u2019s campaign budget had already been maxed out.<\/p>\n For the record, in our tests last week, we were unable to reproduce Adalytics\u2019 findings related to ads being shown on the website of the sanctioned Iranian alloy steel company mentioned in the report \u2014 such as FBI and US Army jobs ads. We also couldn\u2019t reproduce its finding of US Treasury (aka US Mint) ads being shown on the website of a Russian company that\u2019s under US Treasury OFAC sanctions under US Presidential Executive Order 13685.<\/span><\/p>\n But we were able to observe FBI jobs ads being served on a Iranian website called Arshad Sara (see screengrab below). We also observed FBI careers ads being served on the far right news website, Breitbart.com.<\/p>\n An ad for FBI career opportunities being served on an Iranian website (Screengrab: TechCrunch)<\/p>\n<\/div>\n Reached for a response to problematic placements of its ads documented in the report, a spokesperson for the FBI declined comment \u2014 saying we should direct questions to Google \u201cregarding its platform and systems\u201d.<\/p>\n \u201cWhen I look at this report, the first question I ask is why is this happening? And what it really looks like is that whatever due diligence process that Google has for the program to run these ads, clearly, the vetting is not working,\u201d Edelson continued in a phone call with TechCrunch to discuss Adalytics\u2019 findings. \u201cThere are websites on here that are the websites of directly sanctioned entities \u2014 and, here, I\u2019m thinking particularly of the Iranian state-owned enterprises \u2014 so that is just incredibly clear cut. There\u2019s no way maybe someone misunderstood what that website was. It\u2019s not really borderline. That\u2019s just a matter of US law. There\u2019s actually no getting around it.<\/p>\n \u201cThere are other websites where Google has made representations to advertisers about where their ads will and will not appeal. And, clearly, the process to verify that is not working either. And this is why it really appears to me to be a very high level failure of vetting on Google\u2019s part.\u201d<\/p>\n \u201cGoogle makes a lot of representations that advertisers and users should trust us,\u201d she added. \u201cBut I think this is where you really see the problem of the lack of transparency of their systems. Because they\u2019re asking people to trust them and clearly, clearly<\/em>, that trust is not warranted. <\/span><\/p>\n \u201cNot again, when entities which are on a US sanctions list are able to run Google search ads. <\/span>So I think that\u2019s where something in their processes has clearly gone very wrong. <\/span>And if Google wants to start rebuilding trust with the US government, with the public, with advertisers, they need to be a heck of a lot more transparent around where their ads are running, who their partners are, and who they\u2019re doing business with. <\/span>Because whatever vetting they\u2019re doing has clearly broken down on a very deep level.\u201d<\/span><\/p>\n The findings could force regulators to rethink their hands-off approach to the adtech sector, suggests Edelson \u2014 who previously served as chief technologist in the US Department of Justice Antitrust Division. \u201cThe credulity that regulators have given tech companies \u2014 it\u2019s no longer sustainable,\u201d she argued. \u201cWe\u2019re not talking about a niche player making a very obvious mistake, as this is; we\u2019re talking about the largest distributor of ads in the world.<\/p>\n \u201cIf Google can\u2019t get this right, if Google is not getting this right \u2014 and let me say that: Google could<\/em> get this right, they\u2019re just not \u2014 that\u2019s where Google has decided, somewhere along the line, they didn\u2019t invest the money they should have invested in compliance. And these very obvious kinds of mistakes are happening.\u201d<\/p>\n \u201cThe black box of adtech has meant that companies just haven\u2019t had to invest a lot of time and money in regulatory compliance. I know they talk about how much they do\u2026 but whatever they\u2019re doing it\u2019s not working. And they\u2019ve been able to hide that because of a lack of transparency of all kinds of adtech systems and that\u2019s where we need to start demanding transparency.<\/p>\n \u201cRegulators need to demand transparency, advertisers need to demand transparency. Of course advertisers have very little power in this equation. So that\u2019s where, I think very clearly, regulators need to step in.\u201d<\/p>\n \u201cThis is where you really start to see the power that Google as a dominant firm, can exact on the ad market,\u201d Edelson also told us. \u201cBecause if you talk to advertisers, and say, hey, are you happy with the lack of transparency that Google provides? Are you happy not knowing where your ads run? I challenge you to find someone who says yes\u2026 This is not something that customers want. This is something that Google has the power to decree \u2014 because advertisers don\u2019t really have a choice.\u201d<\/p>\n Asked whether the findings suggest there\u2019s been a failure by antitrust regulators to tackle the scale of the power imbalance in the adtech market Google has dominated for decades, she responded by describing it as \u201ccertainly a consequence of when antitrust enforcement is not brought to bear on a market that has clearly gone wrong\u201d. \u201cI think it gives weight, at least, to antitrust enforcement, that is<\/a> currently in progress<\/a>,\u201d she also said.<\/p>\n \u201cIf you want to say what is the cost to advertisers, what is the cost to consumers of Google\u2019s very dominant position in this market, it is not only measurable in prices,\u201d she added, referencing the standard of harm competition authorities have traditionally focused on. \u201cIt\u2019s measurable in things like this \u2014 that [could] lead to us sending dollars to the Iranian government. I think that that\u2019s a cost beyond, you know, fractions of a penny to advertisers \u2014 a cost that all of society bears and we should think very carefully about.\u201d<\/p>\n For its part, as well as claiming it can find no evidence of ad revenue being shared with sanction entities identified in the report, Google says it\u2019s committed to complying with all applicable sanctions. Although it also suggests it\u2019s been challenging to keep up with the rate at which Russian parties specifically have been added to sanctions lists since the invasion of Ukraine in February 2022. (On ads, Google also says it has paused ads serving in Russia since the Ukraine invasion \u2014 including for Programmable Search Engine (ProSE) with Adsense for Search, which implies it\u2019s not currently possible for Russian entities to generate ad revenue via Google\u2019s partner programs.)<\/span><\/p>\n The adtech giant also told us it maintains a variety of measures to prevent, detect, and remediate unauthorized abuses of its services that violate its policies, including sanctions policies \u2014 without providing any detail on the types of measures it applies.\u00a0<\/span><\/p>\n Google\u2019s publisher terms, meanwhile, are written in such as way as to imply an outsourcing of compliance responsibilities by requiring advertisers and publishers to affirm compliance with applicable sanctions and export regulations \u2014 and to agree to not cause Google to violate these regulations. If it finds an account that violates its policies Google adds that it takes action to revoke access to its tools.<\/p>\n Also discussing Adalytics\u2019 findings in a call with TechCrunch, Jamie Barnard, CEO of Compliant, a SaaS pitching brands and digital media buyers on tools to support compliance across the media supply chain, predicts the report will trigger a wave of advertisers (at least temporarily) turning off Google search ads as a contingency measure \u2014 to shrink their immediate risk of exposure to reputational concerns while they assess next steps.<\/p>\n \u201cOrdinarily, I think, brands would have assumed a degree of brand safety \u2014 because, essentially, Google is running that. But, if Adalytics\u2019 research is right, then there are clearly sites \u2014 and not just one or two but scores of sites \u2014 within the Google Search Partner Network which advertisers would not want to buy media on,\u201d he told us. \u201cWhen the report is published brands\u2019 first question is going to be have we switched off the Google Search Partner Network? If we haven\u2019t, then we need to switch it off immediately while we investigate the potential safety risks.\u201d<\/span><\/p>\n \u201cThis is a brand safety issue fundamentally,\u201d Barnard added. \u201cAn issue of transparency and brand safety \u2014 and quite a serious issue. There are unintended consequences of buying on Google search.\u201d<\/p>\n There\u2019s a further risk for Google\u2019s media buyers to consider which he also highlights \u2014 related to an automated ad campaign type Google offers that utilizes its AI technologies to design, target and serve out customers\u2019 marketing across its suite of online properties. This product, which is called Performance Max (or PMax), lets customers run a single ad campaign across all Google\u2019s ad inventory \u2014 including search ads. And including the GSP.<\/p>\n Currently, there appears to be no way for media buyers of PMax campaigns to opt out of the GSP.\u00a0 So the report raises an apparently unavoidable reputational risk for customers of Google\u2019s fully automated ad offering.<\/p>\n \u201cThere are implications for brands using Performance Max ads. Or at least considerations,\u201d suggested Barnard. \u201cIt\u2019s an alarming situation for an advertiser. So I would imagine they will seriously have to rethink their next move\u2026 <\/span>The fundamental issue here is it\u2019s black box media\u2026 Because you don\u2019t know who\u2019s in the [GSP] network, and you can\u2019t verify who\u2019s in the network after your ads run, then you\u2019re compromised. You have no idea where your ads are going to go.\u201d<\/p>\n The research could force Google to \u2014 at least \u2014 provide more transparency for advertisers over where their ads are running in order to assuage brand safety concerns, Barnard went on to suggest. \u201cOtherwise, advertisers will simply opt out,\u201d he predicted.<\/p>\n He raises additional concerns about how Google designs the choices it offers advertisers \u2014 saying he already knows of a number of advertisers who have opted out of Google search ads over brand safety concerns only to be opted back, inadvertently, via PMax. While, even for more vanilla Google search ad campaigns (i.e. that aren\u2019t submitting to Google\u2019s fully automated solution), he describes the process of opting out of the GSP as \u201cstill quite hard\u201d.<\/p>\n \u201cI imagine there will be scores of advertisers out there who didn\u2019t know that they were opted in [to the GSP]; don\u2019t understand the Search Partner network; have no idea who\u2019s in it; think that they\u2019re buying media on Google websites,\u201d he suggested. \u201cIn fact, a lot of their media will be appearing on non-Google sites. And not just non-Google websites \u2014 evidently non-Google websites that you wouldn\u2019t want to be buying media on. And this is not just global multinationals; any local sole trader who\u2019s buying Google Search [ads] to promote their local businesses was probably expecting to appear [only] on Google\u2019s websites.\u201d<\/p>\n How Google designs these choices for ad buyers could attract attention from regulators in the European Union, he posits \u2014 noting: \u201cThe European Commission is getting deeply concerned about dark patterns in general.\u201d<\/p>\n \u201cI think the most likely place that action will happen next is Europe,\u201d Edelson also predicted on the likelihood of regulators stepping in.<\/p>\n The Commission oversees Google\u2019s compliance with two recently implemented updates to the bloc\u2019s rulebook for web firms: Namely the Digital Services Act (DSA), where Google Search has been designated a very large online search engine<\/a> (VLOSE), meaning it\u2019s subject to rules including algorithmic transparency and accountability provisions; and measures combating the use of unfair dark patterns; and the Digital Markets Act (DMA), where Google is designed as a gatekeeper and regulated core platform services<\/a> include its ads delivery system and search engine.<\/p>\n The EU has extensive powers to sanction violators of these regimes, including the ability to levy fines of up to 6% or 10% (or even more) of global annual turnover, respectively. Although the deadline for gatekeepers to comply with the DMA doesn\u2019t kick in until early March. But the DSA has been in force on VLOSE since late August.<\/p>\n The bloc\u2019s lawmakers are also in the process of hammering out agreement on a risk-based framework for applications of AI<\/a> which the Commission proposed back in April 2021<\/a>. Where adtech uses of AI should fall on the planned high risk (i.e. triggering some legal obligations) or low risk (just self regulation) axis is one question Adalytics\u2019 findings might help to reframe. As it stands, the draft EU AI Act doesn\u2019t look like it would do much to put guardrails on ad placement algorithms.<\/p>\n Responding to concerns highlighted by Adalytics\u2019 research, EU lawmaker Paul Tang, a Member of the European Parliament, urged the bloc\u2019s regulators to bust out powers they already have as a result of their new oversight role on Big Tech \u2014 calling for them to audit Google\u2019s ad algorithms. \u201cGoogle\u2019s advertising algorithms demand scrutiny,\u201d he told TechCrunch. \u201cThe EU Commission must wield its audit powers to demand transparency and accountability about the secret $10.5BN* in ad spend every year through PMax and other ad bidding algorithms.\u201d<\/p>\n Offering an industry perspective, Giovanni Sollazzo, CEO of demand side platform Aidem \u2014 which bills itself as a \u201cprivacy-first\u201d, safety-focused DSP (and also claims to differentiate its offering by delivering \u201cradical transparency\u201d for its ad-buying customers) \u2014 describes Google\u2019s push into \u201cfully automated AI\u201d (aka PMax) \u201cwithout any oversight capabilities\u201d as \u201ca nightmare\u201d.<\/p>\n \u201cIt should be impossible to place ads on websites affiliated with nations and entities under US sanctions, such as Russia and Iran,\u201d said Sollazzo, responding to questions via email. \u201cThe fact that this is happening without advertisers\u2019 knowledge point to a deficit in monitoring and reporting capabilities provided by Google.\u201d<\/p>\n \u201cIf I were the FTC\/DOJ, I would investigate how Google\u2019s defaults are enabling this whole mess; and Google\u2019s market dominance allow Google to push it to unwilling advertisers,\u201d he added.<\/p>\n Aidem was already not running GSP ads due to the lack of reporting transparency clashing with company policy, per Sollazzo. \u201cWe never run ads without placement level reporting, and GSP provided no domains report,\u201d he noted, adding: \u201cAs additional step, we have advised all our clients to stop all PMax campaigns due to the concern of having GSP hidden in the PMax mix.\u201d<\/p>\n Steps he suggests Google could take to clean up shrink brand safety risks with the GSP include reverting it to opt-in, instead of opt-out across all Google Ads \u2014 including PMax. It could also require publisher KYC (Know Your Customer) before placing ads on GSP when there\u2019s no linked AdSense account to the publisher GSP account. Additionally Sollazzo calls for \u201cfull transparency with advertisers about domains where their ads are placed; and providing domain blocklists capabilities\u201d; as well as: \u201cA comprehensive audit of the GSP network to identify and remove any publishers that violate the brand safety guidelines or are on sanction lists.\u201d<\/p>\n![\"Example](\"https:\/\/techcrunch.com\/wp-content\/uploads\/2023\/11\/Screenshot-2023-11-21-at-18.38.26.png?w=680\")
<\/p>\n![\"Adalytics](\"https:\/\/techcrunch.com\/wp-content\/uploads\/2023\/11\/Screenshot-2023-11-23-at-13.58.59.png?w=657\")
<\/p>\n![\"Google](\"https:\/\/techcrunch.com\/wp-content\/uploads\/2023\/11\/Screenshot-2023-11-21-at-18.57.11.png?w=680\")
<\/p>\n\u201cHigh level vetting failure\u201d<\/h2>\n
Brand safety and bot fraud in the frame<\/h2>\n