An Interview with Adalytics
A second analysis from Adalytics alleges significant ad fraud and breach in transparency from Google/YouTube. In the wake of these latest revelations, many marketers want to know more about Adalytics, what its aim is, why this analysis is so critical for advertisers to understand, and what may be next. VAB’s Executive Vice President, Danielle DeLauro sat down with Krzysztof Franaszek, PhD of Adalytics to answer those questions and more.
Danielle DeLauro serves as VAB’s executive vice president and works directly with the CEO to determine VAB’s strategic vision and set the internal agenda and direction for all departments within the organization. She led the VAB through a comprehensive transformation into a marketer-first, insights organization that inspires companies to reimagine their media strategies for the modern digital and videocentric world. Prior to joining VAB, she spent her career at advertising agencies developing cross-channel media strategies for a range of high-profile brands across multiple categories. She was named one of Cynopsis’ Top Women in Media for 2020 and has previously been recognized among Advertising Age’s 40 Under 40.
Krzysztof Franaszek, PhD
Dr. Krzysztof Franaszek is the founder of Adalytics, a research and verification company focusing on empirical assessments of ad tech, campaign performance, and media supply chain transparency. Dr. Franaszek did his doctorate in computational biology at Cambridge University as a Gates Scholar, and was a Soros Fellow at Harvard Medical School and MIT. His research on ad tech related cybersecurity and sanctions issues has informed the work of the US Senate Intelligence committee. Dr. Franaszek has published research on ad tech intermediary fees, detecting domain spoofing, auditing verification and IVT detection vendors, assessing brand safety technology, putative ad tech violations of US Treasury sanctions, detecting “Made for Advertising” networks, and analyzing GDPR and consent violations by ad tech vendors. His independent research and findings have been covered by AdExchanger, Wall Street Journal, Adweek, Business Insider, Propublica, CyberScoop, Digiday, Marketing Brew, USA Today, Forbes, the New Humanitarian, TechCrunch, and Politico. His research has also been cited in several books and publications.
Thanks, Danielle. I’m happy to speak with you. Sure, to share some background on Adalytics, we are a next generation ad quality and transparency SaaS platform. We help brands secure transparency and control over their media investments. As part of our commitment to proactively protect our advertiser clients, we release thought leadership when we identify systemic issues that affect brands and their media investments. We’re aware that many ad verification vendors issue public research reports, but those legacy vendors do not disclose the sources of the issues they identify. Our independence supports our willingness to attribute various problems in digital media supply chains, which are key points of differentiation for Adalytics.
Yes, one of our most important differentiators from other vendors in this space is that we are not financially conflicted. We only accept payment from media buyers, and we do not accept payments from ad tech vendors or platforms, as those vendors tend to be the primary sources of risk to media buyers. We are deeply committed to maintaining our independence and uncompromised ability to protect the interests and investments of the advertisers and media buyers that we serve.
Sure, so the topline is that YouTube ad campaigns from all media agency holding companies and many Fortune 500 and FTSE100 brands are being served on “Made for Kids” YouTube channels. Furthermore, ad campaigns that employ demographic and behavioral (interest) ad targeting appear to still serve on “Made for Kids” YouTube channels.
The viewers of “Made for Kids” YouTube inventory who click on ads appear to then land upon the websites of the advertisers. Those advertisers – with exceptions like Lego and other brands that would anticipate children visiting their website – do not appear to ask for informed parental consent before setting ad trackers and sharing meta-data about the consumer.
This means that brands may—even unwittingly—have in their possession child-derived meta-data obtained without parental consent. This unwanted meta-data could raise legal/compliance concerns and render buyers’ own databases less useful.
Yes, one might think that, however media buyer surveys suggest that it is very difficult, if not outright impossible, to avoid having ads served on “Made for Kids” inventory using YouTube’s existing ad buying controls. Even Google and YouTube product ads that can only be purchased by people over the age of 18 (YouTube TV NFL Sunday Ticket) were observed as serving on videos that were labeled as being “for toddlers”. Generally speaking, we found that no mitigation strategy was 100% effective in preventing a brands’ ad from being served on “Made for Kids” YouTube inventory. We observed buyers who deployed extensive keyword exclusion lists, lengthy channel blocklists, content suitability inventory filters, demographic and behavioral targeting to adults, and other tactics. None of these tactics were completely successful in preventing ads from being served on “Made for Kids” content. The only approach we found to be somewhat successful is the use of very narrowly defined inclusion lists of YouTube channels.
The analysis focused exclusively on ads placed in the YouTube.com website and the YouTube iOS and Android mobile apps. It generally excluded the YouTube for Kids mobile app or the Google Video Partner network. In part, this is why the second report is in some ways more alarming. Some brands or agencies may have opt-ed out of the Google Video Partner network, but the issues identified in this second report appear to affect every YouTube media buyer without exception.
In our experience, we observed YouTube ad campaigns that were 100% demographically and behaviorally/interested targeted, but still had ads served on “Made for Kids” YouTube channels. Furthermore, some of the brands appeared to employ keyword exclusion blocklists that contained words such as “kids” and “children”, yet their ads were still served on channels that contain the words “for kids” or “for children” explicitly in the YouTube channel titles. This raises concerns about how robust, effective, or thoroughly vetted YouTube’s ad placement control software is. Our report’s methodology section explains in detail how brands can analyze their own placement, demographic, and audience reports, and we encourage them to do so.
We’ve seen a significant level of detail, such as IP address, user agent, timestamps, videos viewed, some websites or apps visited, and both persistent and ephemeral unique identifiers. The Federal Trade Commission’s (FTC) website explains that “Personal information” under COPPA includes “a persistent identifier that can be used to recognize a user over time and across different sites, including a cookie number, an IP address, a processor or device serial number, or a unique device identifier”.
No, our report explicitly states that this study should not be construed as a legal commentary. It’s meant to be viewed as a highly preliminary observational analysis of publicly available information and empirical data. It is worth noting that the report may also be of interest to brands as it relates to potential financial or reputational risk; the findings do not exclusively emphasize COPPA or legal compliance.
Last year, the FTC told Congress that it has no dedicated COPPA staff and devotes between 8-10 full time employee hours to investigation and enforcement of COPPA matters. It appears that few of those employees are technically inclined rather than lawyers. We do not know whether the FTC has audited Google to ensure that they are following the consent decree.
In our analyses and work with both brands and agencies, we have yet to come across a single brand or agency whose ads were not served on “Made for Kids” YouTube channels. For every brand or agency that spends upwards of $1,000 USD on YouTube ads, we observed evidence of ads served on “Made for Kids” videos and clicks originating from viewers of those specific channels. As such, we advise everyone to assume they were affected. The question(s) then becomes “How much was my brand or agency affected?”, and secondly “What is my organization’s risk tolerance?”
Beyond the obvious possibility of wasted ad spend and erroneous “performance” metrics mis-leading marketers’ media investment decisions, the problem with ads being served on “made for kids” channels is the potential ethical, legal, reputational, and compliance risks created when viewers of “made for kids” content clickthrough to an advertiser’s website. The vast majority of advertisers’ websites appear to place ad trackers and targeting cookies on a visitor’s device. As such, when a YouTube ad campaign generates thousands of “made for kids” YouTube channel ad clickthroughs, the brand is unknowingly acquiring, processing, and transmitting potentially child derived meta-data.
We would first ask them to assess their level of exposure – how many clicks did their brands’ YouTube ad campaigns generate on “Made for Kids” YouTube channels? For Performance Max, reporting is limited, so they may be unable to gain insight into historical placement data to quantify exposure. Secondly, we’d encourage them to speak with their General Counsel and Chief Information Security Officer (CISO). As I mentioned, brands should ask themselves what their level of risk tolerance is from a legal and reputational point of view regarding the processing of un-consented children’s data. If the General Counsel or CISO decide that the brand has potentially acquired or transmitted potential child-derived ad data in excess of their risk tolerance threshold, consider engaging in a data deletion or scrubbing process.
We cannot comment on behalf of IAS and DoubleVerify. While there is good reason to believe some of the media buyers whose ad campaigns were delivered on “made for kids” YouTube channels work with IAS and DoubleVerify, we do not know if these firms have privately counseled their clients on the risks of advertising on “made for kids” channels on YouTube. To the best of our knowledge, the MRC does not consider (demographically and behaviorally) targeted ads being served to children or clicked on by children as a specific form of “Invalid Traffic”. We encourage the MRC to review its definition of “Invalid Traffic” in light of the issues raised in this report.
This goes back to our business model to work entirely in the service of media buyers. We do not accept payments from ad tech vendors or platforms. This gives us the independence and latitude to identify and surface fraud, privacy, and reputational risks in various ad tech platforms, whereas legacy auditors or verification vendors may be bound by financial and contractual restrictions they have with the platforms they are supposed to audit. Secondly, our platform has certain technological and intelligence capabilities that other auditors and verification vendors simply lack.
Brands themselves have reacted very favorably to our research. We continuously research novel threats to their media investments and alert our clients to those emerging threats and advise them on how to avoid them.
Yes, categorically those risks exist. As part of our mission to provide brands with the highest levels of transparency and control over their media investments, we are currently working on several additional reports that explore other systemic issues that pose reputational, legal, and performance risks to those investments. If any brands are interested in proactively protecting their media investments, we encourage them to get in touch and trial our SaaS platform.
You have questions. We have answers.
Get immediate access to our Insights library.