New Made for Advertising rules—what marketers need to know following online controversy

The Media Rating Council is preparing to issue updated standards later this month on how verification firms and other ad tech players should detect and prevent domain spoofing and trading on “made for advertising” sites in the wake of recent reports by research firm Adalytics on both issues. The updated Invalid Traffic Detection and Filtration standards were in the works before those reports came out, said Ron Pinelli, the MRC’s senior VP of digital research and standards. But the move comes as verification companies, and by extension the MRC that accredits them, come under fire for failing to report issues found in the most recent Adalytics report. Check out the latest Ad Age events and award programs That report found Forbes operated a little-known www3.forbes.com subdomain for seven years, labeled by at least one research firm as “made for advertising,” with a heavy ad load and mostly paid traffic. Adalytics also found Forbes mis-declared ads that served on the subdomain as regular Forbes.com ads in programmatic auctions. Forbes shut down the subdomain earlier this month after being notified of the Adalytics study. The Forbes issue was first reported by The Wall Street Journal. The updated MRC standards will likely require verification vendors, such as Human, DoubleVerify, Integral Ad Science and Oracle Moat, to identify and prevent cases like what happened with Forbes. Open to debate is whether they already were required to report what happened with Forbes under current invalid traffic rules. While advertisers and agency executives interviewed by Ad Age directed blame at Forbes, they also found fault with verification vendors for not alerting them to the problem. Behind the controversy The www3.forbes.com subdomain had a very different visitor profile from the main site, according to Similarweb. The main domain was visited more by younger people and subscribers who also visit other business sites. The subdomain was visited by older readers who tend to visit tabloid sites and arrived as paid traffic via clicks from Meta, Outbrain and Taboola ads. Traffic to the subdomain never amounted to more than 1%-2% of Forbes overall traffic, according to Similarweb. However, given the heavy and frequently refreshed ad load Ad Age was able to observe on the subdomain before it was shut down, its share of site impressions could have been much higher. Forbes blamed the mid-declaration in auctions on a coding glitch by its Prebid server provider Media.net. The subdomain represented approximately 1% of the Forbes user base, according to the publisher. Media.net fixed the coding error last month after the research was brought to Forbes’ attention, according to the two companies. The mis-direction occurred through four supply-side platforms, but not through others, according to Adalytics. While the Forbes subdomain operated for seven years, according to web archives cited by Adalytics, the research firm could only trace the mis-direction back to 2021. Media.net declined to say how or when the coding error happened, but a spokesman said the company corrected the problem as soon as it was notified by Forbes in late March, without being told it was related to an Adalytics study. The Media.net spokesman said the company had no incentive to spoof the domain or support an MFA site, because it was paid a flat monthly fee by Forbes, not a share of revenue or based on impression volume. The subdomain pages where ads were served on the subdomain couldn’t be found through organic search because of “noindex” metatags in their source code. That’s a practice other MFA sites have used, allowing them to show very different experiences to visitors who navigate directly to pages, such as an advertiser checking log files, rather than through paid ads. “These pages weren’t being hidden,” a Forbes spokeswoman said in an email statement. “They just were not optimized for search due to how this page was intended to operate. This is a common practice in the industry in terms of ‘not indexing’ every article or page.” The spokeswoman added that “because we value the trust of our partners, and we want to eliminate any potential confusion, we shut down the subdomain, which was an insignificant part of our business.” How Forbes got past Trade Desk The Forbes subdomain appeared to elude safeguards that worked for The Trade Desk (TTD), and by extension the Walmart Connect demand-side platform it also operates, against other MFA sites. Both traded in ads from the subdomain, according to Adalytics. In a prior study in March from Adalytics, TTD and Walmart Connect stood out among the biggest platforms that managed to avoid all MFA trading. But they did end up trading the Forbes subdomain. That happened despite the subdomain being on a TTD block list, according to a person familiar with the matter, who blamed the problem on verification vendor Human failing to detect the subdomain at both the SSP level and directly with The Trade Desk. “The Trade Desk has a policy that nothing’s supposed to come forth from a supply-side platform if it hasn’t been cleared by Human, and Human is supposed to catch domain spoofing,” said one advertiser executive. “It didn’t catch any of this.” Walmart and TTD both declined to comment. Human did not respond to requests for comment. Advertisers see substantial issues Three advertisers and one agency executive, who spoke to Ad Age on the condition of anonymity, pegged their spending or client spending on the subdomain at between 10% and 25% of their Forbes online spending, and for one campaign as high as 90%. None were aware of the subdomain’s existence prior to hearing of it from Adalytics. And none of them wanted their ads running on what they see as an MFA site. “We wanted to advertise on Forbes.com,” said one marketer executive. “We made a conscious effort to do that. It’s very disheartening to see that it hadn’t happened.” The executive said the company paid DoubleVerify to detect invalid traffic and doesn’t believe the verification company delivered on that. Prior to the Adalytics report, the company had heard nothing from DoubleVerify about ads intended for Forbes.com showing up on the www3 subdomain, the executive said. Whether a site qualifies under industry definitions as “made for advertising” may be a gray area, but the Forbes issue was clearly domain spoofing covered by existing MRC standards and accreditations, the executive said. “This is probably the highest level of fraud, one could argue.” Another advertiser executive who uses Integral Ad Science for verification said the company “never captured any of it. When I open up my logs from The Trade Desk or [Google DV 360], both quickly show [www3.forbes.com] delivery, but it’s never flagged anywhere in IAS as anything bad.” Integral Ad Science (IAS) declined to respond to requests for comment. The advertiser planned to seek refunds from Forbes, IAS and other parties in the supply chain, and to find any other publishers that have been running similar www3 subdomains that are likely MFA sites and block the sites in their entirety. “I just don’t want to run the risk of ending up on junk content,” the executive said. An analysis by Ebiquity found 18 clients who had bought Forbes inventory but also had ads served on www3.forbes.com. “For them that amounts to approximately 20% of spend, which is very significant,” said Ruben Schreurs, the consulting firm’s chief strategy officer. Yet, clients Ebiquity worked with said the level of invalid traffic reported by verification vendors “was zero or near zero,” Schreurs said. “What we know is that they are not following the MRC documentation with regards to what they are flagging as being invalid traffic.” DoubleVerify’s assessment DoubleVerify sees it differently. “We measured the domain data accurately and shared this with affected advertisers via their analytics,” said a spokesman for Double Verify (DV). “Our customers had full transparency into exactly where their ads ran, irrespective of what the publisher declared or the auction represented.” But DV did not consider it domain spoofing or invalid traffic. “Although we identified the sub-domain mismatch in Forbes’ case, we would not classify this as spoofing or fraud in accordance with industry-aligned standards,” the spokesman said. “Should these standards expand to encompass new characteristics, they will be factored into our approach.” While DV declined to comment on specific publisher MFA classifications, the company said customers have “full transparency into DV’s assessment of MFA sites by severity level and can employ our tools to take action within their media plan.” New MRC standards The MRC’s Pinelli said DV and other accredited vendors probably should have identified the Forbes mis-match as invalid traffic under existing standards, or at least brought it to the attention of the publisher and other customers they serve. An upcoming revision will make that clearer. The MRC actually started developing updated invalid traffic standards in 2022 following a prior report by Adalytics finding Gannett had mis-identified inventory for some of its properties, such as USA Today, when it was actually going to other sites the company owns, and vice versa. “The vendors at that time read it as domain spoofing only if they were pretending to be someone other than who they are,” Pinelli said. “In this case, they were pretending to be themselves” or at least another Gannett property. “At the time, we said our standards need to be more explicit, and you should at least compare that information and say does this look legitimate? Does this make sense? At the minimum, you should go to the publisher and say this is happening,” Pinelli said. But the MRC’s most recent proposed update was only drafted and circulated for review late last year, he said, with the comment deadline last week. Following any changes in response to comments, Pinelli expects the final update to be issued and take effect later this month. “What we think vendors should do is look at what’s in the Prebid, or what’s in the bid’s URL, and compare that to where the ad is landing,” Pinelli said. “If those two are different,” he said, “they should consider that IVT. And we’re going to write that update.” That should have been happening since the Gannett situation two years ago, Pinelli said. “Shame on us for taking a while to put that update in there. I wanted to do it right away,” he said. But as an earlier version of the proposed update circulated for comment, other issues were identified, including around MFA sites. “It got bigger,” Pinelli said. “So our update is about this, and MFA and privacy and a bunch of stuff.” In the meantime, Pinelli said the MRC is inquiring with vendors about why they didn’t label what Forbes did as invalid traffic, or whether they did report or invalidate any of the trades, plus trying to discover how big the issue was. “My disappointment is that I would think the vendors on their own would say they should be looking at all the available information to make these decisions,” Pinelli said. “What I’m learning is it’s not that simple. I’m guessing I need to say, ‘Vendor, you need to do this.’” Media measurement blog Tracking TV, social and digital updates Click here

New Made for Advertising rules—what marketers need to know following online controversy

Featured Stories