An Interview with Adalytics: An Insider's Look At The Latest Google Ad Fraud Allegations
VAB Leading Conversations

An Interview with Adalytics

An insider's look at the latest Google ad fraud allegations 


A second analysis from Adalytics alleges significant ad fraud and breach in transparency from Google/YouTube. In the wake of these latest revelations, many marketers want to know more about Adalytics, what its aim is, why this analysis is so critical for advertisers to understand, and what may be next. VAB’s Executive Vice President, Danielle DeLauro sat down with Krzysztof Franaszek, PhD of Adalytics to answer those questions and more.

Danielle DeLauro

EVP


Krzysztof Franaszek, PhD

Founder


For those who aren’t fully familiar with Adalytics’ first analysis reported on by the Wall Street Journal in late June, the analysis found that nearly 80% of Google’s video-ad placements on third-party sites violated its own standards.  In the wake of that, many in the advertising industry started asking who is Adalytics? Can you tell us a bit about Adalytics and why have you released these reports? 

Thanks, Danielle. I’m happy to speak with you. Sure, to share some background on Adalytics, we are a next generation ad quality and transparency SaaS platform. We help brands secure transparency and control over their media investments. As part of our commitment to proactively protect our advertiser clients, we release thought leadership when we identify systemic issues that affect brands and their media investments. We’re aware that many ad verification vendors issue public research reports, but those legacy vendors do not disclose the sources of the issues they identify. Our independence supports our willingness to attribute various problems in digital media supply chains, which are key points of differentiation for Adalytics.


You mention “advertiser clients.” When those in the industry reads analyses like these, often one of the first questions that’s asked is “how was the work funded?”  Can you clarify which organizations are paying for this research and analysis? 

Yes, one of our most important differentiators from other vendors in this space is that we are not financially conflicted. We only accept payment from media buyers, and we do not accept payments from ad tech vendors or platforms, as those vendors tend to be the primary sources of risk to media buyers. We are deeply committed to maintaining our independence and uncompromised ability to protect the interests and investments of the advertisers and media buyers that we serve.

Ok, so let’s dive into this just-released second report. Can you please describe what you uncovered and the methodology for your analysis?  

Sure, so the topline is that YouTube ad campaigns from all media agency holding companies and many Fortune 500 and FTSE100 brands are being served on “Made for Kids” YouTube channels. Furthermore, ad campaigns that employ demographic and behavioral (interest) ad targeting appear to still serve on “Made for Kids” YouTube channels.

So, when these adult-targeted campaigns landed on “Made for Kids” inventory, what was the user engagement with those ads?

The viewers of “Made for Kids” YouTube inventory who click on ads appear to then land upon the websites of the advertisers. Those advertisers – with exceptions like Lego and other brands that would anticipate children visiting their website – do not appear to ask for informed parental consent before setting ad trackers and sharing meta-data about the consumer. 

Given the digital tracking that must’ve been in place on this inventory, what is the implication here?

This means that brands may—even unwittingly—have in their possession child-derived meta-data obtained without parental consent. This unwanted meta-data could raise legal/compliance concerns and render buyers’ own databases less useful.

But surely media buyers have the option of eliminating any ad presence on these “Made for Kids” channels, right?

Yes, one might think that, however media buyer surveys suggest that it is very difficult, if not outright impossible, to avoid having ads served on “Made for Kids” inventory using YouTube’s existing ad buying controls. Even Google and YouTube product ads that can only be purchased by people over the age of 18 (YouTube TV NFL Sunday Ticket) were observed as serving on videos that were labeled as being “for toddlers”. Generally speaking, we found that no mitigation strategy was 100% effective in preventing a brands’ ad from being served on “Made for Kids” YouTube inventory. We observed buyers who deployed extensive keyword exclusion lists, lengthy channel blocklists, content suitability inventory filters, demographic and behavioral targeting to adults, and other tactics. None of these tactics were completely successful in preventing ads from being served on “Made for Kids” content. The only approach we found to be somewhat successful is the use of very narrowly defined inclusion lists of YouTube channels.

That prompts me to ask a quick question on methodology - How were you able to determine whether the end user is a child under the age of 13?

The analysis focused exclusively on ads placed in the YouTube.com website and the YouTube iOS and Android mobile apps. It generally excluded the YouTube for Kids mobile app or the Google Video Partner network. In part, this is why the second report is in some ways more alarming. Some brands or agencies may have opt-ed out of the Google Video Partner network, but the issues identified in this second report appear to affect every YouTube media buyer without exception.

Although it states in Google’s policies that they do not use demographic or behavioral targeting for kids’ channels, they do allow for contextual targeting. How are you sure these brands weren’t contextually targeting their content?

In our experience, we observed YouTube ad campaigns that were 100% demographically and behaviorally/interested targeted, but still had ads served on “Made for Kids” YouTube channels. Furthermore, some of the brands appeared to employ keyword exclusion blocklists that contained words such as “kids” and “children”, yet their ads were still served on channels that contain the words “for kids” or “for children” explicitly in the YouTube channel titles. This raises concerns about how robust, effective, or thoroughly vetted YouTube’s ad placement control software is. Our report’s methodology section explains in detail how brands can analyze their own placement, demographic, and audience reports, and we encourage them to do so.

Through your analysis, were you able to determine what specific data Google is allegedly collecting about children?

We’ve seen a significant level of detail, such as IP address, user agent, timestamps, videos viewed, some websites or apps visited, and both persistent and ephemeral unique identifiers. The Federal Trade Commission’s (FTC) website explains that “Personal information” under COPPA includes “a persistent identifier that can be used to recognize a user over time and across different sites, including a cookie number, an IP address, a processor or device serial number, or a unique device identifier”.

These are serious accusations. Are you implying that Google is breaking the law? Have any privacy or lawyers that specialize in COPPA (Children’s Online Privacy Protection Act) reviewed your report and findings? If so, what was their feedback?

No, our report explicitly states that this study should not be construed as a legal commentary. It’s meant to be viewed as a highly preliminary observational analysis of publicly available information and empirical data. It is worth noting that the report may also be of interest to brands as it relates to potential financial or reputational risk; the findings do not exclusively emphasize COPPA or legal compliance.


This conversation begs the question - why has no one else caught this? Ostensibly the FTC has audited Google to ensure that they are following the consent decree. Have you passed along your findings to the FTC?

Last year, the FTC told Congress that it has no dedicated COPPA staff and devotes between 8-10 full time employee hours to investigation and enforcement of COPPA matters. It appears that few of those employees are technically inclined rather than lawyers. We do not know whether the FTC has audited Google to ensure that they are following the consent decree.


Bringing the focus back to the marketer, I am sure that after hearing this and reading the analysis, every YouTube marketer is wondering how or if this affects them. According to your analysis, how widespread is this issue on YouTube? How many advertisers do you believe are impacted?

In our analyses and work with both brands and agencies, we have yet to come across a single brand or agency whose ads were not served on “Made for Kids” YouTube channels. For every brand or agency that spends upwards of $1,000 USD on YouTube ads, we observed evidence of ads served on “Made for Kids” videos and clicks originating from viewers of those specific channels. As such, we advise everyone to assume they were affected. The question(s) then becomes “How much was my brand or agency affected?”, and secondly “What is my organization’s risk tolerance?”


Speaking of risk tolerance, what is the responsibility of advertisers when it comes to the collection of data on kids? This seems like it could have consequences well beyond advertising.

Beyond the obvious possibility of wasted ad spend and erroneous “performance” metrics mis-leading marketers’ media investment decisions, the problem with ads being served on “made for kids” channels is the potential ethical, legal, reputational, and compliance risks created when viewers of “made for kids” content clickthrough to an advertiser’s website.  The vast majority of advertisers’ websites appear to place ad trackers and targeting cookies on a visitor’s device. As such, when a YouTube ad campaign generates thousands of “made for kids” YouTube channel ad clickthroughs, the brand is unknowingly acquiring, processing, and transmitting potentially child derived meta-data.

If a brand thinks they may have accidentally collected data or if they want to act out of an abundance of caution, what would you advise they do?

We would first ask them to assess their level of exposure – how many clicks did their brands’ YouTube ad campaigns generate on “Made for Kids” YouTube channels? For Performance Max, reporting is limited, so they may be unable to gain insight into historical placement data to quantify exposure. Secondly, we’d encourage them to speak with their General Counsel and Chief Information Security Officer (CISO). As I mentioned, brands should ask themselves what their level of risk tolerance is from a legal and reputational point of view regarding the processing of un-consented children’s data. If the General Counsel or CISO decide that the brand has potentially acquired or transmitted potential child-derived ad data in excess of their risk tolerance threshold, consider engaging in a data deletion or scrubbing process.

Let’s talk about verification, which ostensibly is put in place to avoid these breaches. YouTube is MRC accredited for brand safety and invalid traffic and verified by 3rd party vendors such as IAS and DoubleVerify.  Do you know if they have expressed similar concerns? If not, why?

We cannot comment on behalf of IAS and DoubleVerify. While there is good reason to believe some of the media buyers whose ad campaigns were delivered on “made for kids” YouTube channels work with IAS and DoubleVerify, we do not know if these firms have privately counseled their clients on the risks of advertising on “made for kids” channels on YouTube. To the best of our knowledge, the MRC does not consider (demographically and behaviorally) targeted ads being served to children or clicked on by children as a specific form of “Invalid Traffic”. We encourage the MRC to review its definition of “Invalid Traffic” in light of the issues raised in this report.

Your reports illustrates significantly higher fraud, privacy, and reputational risks for advertisers both inside and outside the Google walls than the reported numbers from the legacy auditors and digital verification companies. Why do you think that is?

This goes back to our business model to work entirely in the service of media buyers. We do not accept payments from ad tech vendors or platforms. This gives us the independence and latitude to identify and surface fraud, privacy, and reputational risks in various ad tech platforms, whereas legacy auditors or verification vendors may be bound by financial and contractual restrictions they have with the platforms they are supposed to audit. Secondly, our platform has certain technological and intelligence capabilities that other auditors and verification vendors simply lack. 


With a host of legal, financial and reputation implications at play here, what reaction have you received from brands and agencies since the report was released? Have agencies evaluated this risk previously or flagged them for clients?

Brands themselves have reacted very favorably to our research. We continuously research novel threats to their media investments and alert our clients to those emerging threats and advise them on how to avoid them.


Do you believe these risks exist elsewhere in the advertising ecosystem? Should we expect additional reports to be released in the near future?

Yes, categorically those risks exist. As part of our mission to provide brands with the highest levels of transparency and control over their media investments, we are currently working on several additional reports that explore other systemic issues that pose reputational, legal, and performance risks to those investments. If any brands are interested in proactively protecting their media investments, we encourage them to get in touch and trial our SaaS platform.


You have questions. We have answers.

Get immediate access to our Insights library.

Get Access