How probe of ads on inappropriate content is sparking transparency, ad tech reforms and refunds

Google issued a rare repayment to advertisers following Adalytics’ report on ads appearing alongside child sexual abuse material (CSAM), Ad Age has learned. The report—coordinated with a probe by two U.S. senators—prompted swift promises of new safeguards and increased transparency about where digital ads appear. While Adalytics and other critics argue the changes don’t go far enough, even skeptics acknowledge a significant shift. Adalytics’ investigations into ad tech and digital media have often drawn attention and denials but little action. However, last month’s revelations about CSAM have led to real consequences, including advertiser refunds and commitments to stricter oversight. Data-Driven Marketing Playbook Join us May 22 in NYC to explore how data powers marketing Learn more here Alongside Google, Amazon has also provided refunds to advertisers whose ads appeared on the sites imgbb.com and ibb.co, which had been reported to host CSAM. Amazon also has begun providing increased visibility, long sought by some advertisers, into the precise page URLs where their ads run. And ad verification vendors DoubleVerify and IAS are also promising to make it easier for advertisers to steer clear of user-generated content and peer-to-peer content sharing sites, as well as taking their own steps to provide data on page-level URLs of where ads run. Those moves are in turn increasing pressure on others in the industry to follow suit. It clearly made a difference this time that not only was the problem something no one in the industry had tolerance for— ads supporting child porn—but also that the latest Adalytics report came in clear collaboration with U.S. Senators Marsha Blackburn and Richard Blumenthal, who sent letters of inquiry to four companies and two industry watchdogs. As of early March, Amazon and Google, two companies targeted by the letters, had issued refunds for placement of ads on imgbb.com and ibb.c, according to people familiar with the matter. That’s similar to refunds issued following some other Adalytics reports. The amounts are small, only around $100 from Amazon, and smaller still from Google, according to one advertiser. An Amazon Ads spokesperson confirmed that the company has refunded all advertisers whose ads appeared on the imgbb.com/ibb.co websites. “We regret that this occurred and took swift action to block these websites from showing our ads,” the spokesperson said. “We have taken additional steps to help ensure this does not happen in the future. This affected a tiny portion of advertising spend for a small number of advertisers.” Transparency and brand control More substantial are moves on transparency and advertiser control. The Adalytics report cited a lack of transparency into the page-level URL placements of ads in log data, which allows advertisers to check specific ad placements for problems or violations of contract terms. According to advertisers, some of whom had been seeking such URL-level log data from Amazon for years, the company has begun making it available in recent weeks. Amazon Ads confirmed that it’s strengthening brand safety detection through a combination of internal tools and third-party providers. This includes domain-level transparency through inventory reports and Amazon Marketing Cloud, as well as URL (page-level) reports. These reports are integrated with third-party verification providers DV and IAS, and are also available through Amazon’s Traffic Events API. Amazon’s steps also include other controls through DV and IAS, with an option to onboard additional third-party vendors and the ability for advertisers to upload customized allow or block lists of sites. Top marketers, brands and agency ventures Ad Age Datacenter’s definitive rankings of the biggest U.S. and global advertisers and agency companies Click here DV and IAS, also targeted in the Adalytics report and by the senators’ letters, are in the process of making page-level ad placement detail available or improving access to such data, the companies have said. It’s a work in progress, and for now it involves custom data delivery for advertisers who request it from DV, according to people familiar with the matter. But DV is in the process of integrating such data into dashboards used by advertisers who subscribe to its Pinnacle service, these people said. Once advertisers start getting all that page-level data comes further work in finding third-party analytics firms that can help digest it and spot any problems with ad placements from it. Amazon praised, with limitations The page-level transparency of Amazon’s DSP won praise from Jonathan D’Souza-Rauto, biddable product lead at digital agency Kepler Group, in a LinkedIn post, but he said privacy-related restrictions have meant clients still generally can’t see 10% to 25% of the pages where their ads land. A privacy threshold calls for at least two users to be served an ad on a unique URL for Amazon to include it in log data, D’Souza-Rauto said. Amazon also strips out users’ query parameters from the log reports, which helps with privacy too, he said. Amazon faces problems that other DSPs providing page-level transparency run into, he said, because some publishers block the detailed data. And Amazon’s owned and operated inventory is also excluded, so advertisers won’t see which pages of Amazon, IMDb or Twitch their ads were served on. “It’s definitely a step in the right direction for all things transparency in programmatic,” D’Souza-Rauto said of Amazon’s moves. However, he said that he believes user privacy could still be preserved and fuller page-level data delivered. “If you’re running a more curated approach, like an inclusion list, then I’d expect the percentage [of URLs Amazon blocks from reporting] to be a bit lower,” he said in an interview. “But where this Adalytics piece has come from is advertisers running more open and blindly.” Pressure rises on TTD, Google Moves by Amazon, DV and IAS are in turn stepping up pressure on others to follow suit, even The Trade Desk, which was cited in the report as not being observed to serve ads to imgbb.com or ibb.co in recent years. Some advertisers had been under the impression that TTD provides URL-level data, but it does so only at the domain or home page level. Others have called on TTD to provide more detailed page-level data on where it places ads, but the company hasn’t done so yet, according to people familiar with the matter. TTD declined to comment. Advertisers may be able to get such URL-level data by using tags on ads placed via TTD but, at this point, they can’t get such detail directly from TTD. Google’s DSPs stopped monetizing imgbb.com and ibb.co last year, according to the company. The company has provided refunds for ad placements in prior years, according to people familiar with the matter, although the amounts are small and, in one case, dated back to 2022. Google, after demonetizing ibb.co in January 2024 and “demand restricting” imgbb.com in July 2024, demonetized the latter completely on Feb. 5, a Google spokesman said, after learning of the senators’ CSAM inquiry. During a six-month period ended Jan. 31, 2025, imgbb.com was only served $7.02 worth of ads via Google. Media measurement blog Tracking TV, social and digital updates Click here Two advertisers, who spoke to Ad Age on the condition of anonymity because they weren’t authorized to speak to the press, said they’ve also been pressing Google for page-level URL data on ad placements but haven’t gotten it yet. It’s more of a mixed bag with Google, said another person familiar with the matter, who noted large enterprise clients can get such data, but the vast majority of DV360 users still can’t. “Advertisers can access campaign reporting in the Google Ads [user interface] about where their ads run,” said the Google spokesman in a statement. “This includes site and URL-level reporting depending on the ad inventory and campaign type. On DV360, advertisers can generally access site and URL-level reporting as well (in some cases, they may have to request more granular placement data, including URL-level placements, from their sales partners through our Data Transfer File service). We continue to explore ways to provide advertisers with even more transparency about where their ads run.” DV and IAS take action Ad verification vendors DV and IAS have each come out with product enhancements and advisories designed to increase ad placement transparency or make it easier for advertisers to avoid risky sites entirely. DV in a blog post said that beyond providing URL-level reporting on demand and working to provide it within its Pinnacle service, it will extend that data later this year to external platforms where advertisers can integrate their data and apply advanced analytics. DV also has created two new content categories for advertisers, one labeled “Highly Illicit: Do Not Monetize” and another labeled “Peer-to-Peer Sharing and Streaming.” Arguably, imgbb.com and ibb.co qualify as both, as the sites are designed to allow people to upload images or video to unique URLs that can be shared but also set to expire in as little as five minutes. IAS, for its part, is expanding its Global High-Risk Exclusion List, which already includes sites flagged by the U.S. Treasury Sanctions List and similar national lists in Japan and the U.K., plus the Google Copyright Takedown List. The company also reviewed five years of reports from the National Center for Missing and Exploited Children (NCMEC) and cross-referenced its list with its existing block lists. As a result, it’s incorporating new domains into its high-risk block list applied to every advertiser campaign. IAS notified all of its advertising customers using its Signal platform to activate this feature. IAS in 2023 already had launched a User Generated Content category, which would cover sites such as imgbb.com and ibb.co, to prevent ads from running on any sites that allow UGC content that isn't moderated. And it’s notified every Signal customer to activate that feature. An IAS spokeswoman pointed out that the company implemented full URL reporting by default for every customer using its brand suitability technology, and that URL-level reporting has been available since 2021. “The definition of Brand Suitability is defined by each customer,” according to a company statement. “We are continuing to drive adoption to support our customers with this level of transparency.” Advertisers raise questions But these steps by DV and IAS also have left advertisers with questions about how site blocking capabilities actually work, or in some cases why they don’t. Two advertisers who said they had opted to exclude all UGC sites in their buys via IAS still had ads show up on Fandom.com pages with racially insensitive or sexually explicit content last year, as reported by Adalytics and independently observed by Ad Age. One of those advertisers subsequently learned via Adalytics that their brands’ ads had appeared on imgbb.com and ibb.co, an executive told Ad Age, adding that the company is in the process of phasing out IAS. A spokesperson for IAS declined to comment on whether or how these UGC exclusion problems might have happened. For some advertisers, the CSAM experience also has opened their eyes to the limitations of what verification vendors can do. Tracking the latest Omnicom-IPG merger news and analysis Within the maze of accreditations ad tech providers receive from the ad industry’s quality watchdog, the Media Rating Council, none is actually accredited to detect brand safety issues at the content level, i.e. for every page and every URL on a site where ads appear. GumGum has an MRC accreditation for content-level brand safety monitoring for ads transacted through its ad exchange, but not across all sites. DV has MRC accreditation for property-level brand safety monitoring, but it’s unclear exactly how that works, i.e. what percentage of pages on a site are monitored, how often and how many pages would need to show brand safety problems, such as displaying ads against pornography, for a domain to be labeled unsafe. One advertiser told Ad Age that their company was surprised to learn DV’s brand safety coverage appears to be done on a sampling basis and that the company has been unable to find out how the sampling logic works. A spokesman for DV didn’t respond to an Ad Age query on these questions. IAS declined to comment on how its sampling logic works. ‘Tip of the iceberg’ Despite a relatively substantial industry response to the Adalytics report and senators’ letters regarding CSAM, problems are far from solved, some people said. “I think this is the tip of the iceberg,” said a marketer executive, referring to findings of ads serving with CSAM images at imgbb.com and ibb.co, adding that other sites with similar problems are also likely to be found. One question the company’s senior leadership is asking, the executive said, is how companies certified for brand safety by Trustworthy Accountability Group or Media Rating Council ever allowed such things to happen. “This is quite a huge area for us,” the executive said. “We’re signing deals and having our legal team look for valid proof of concept that it’s actually going to work.” The executive expects the company to push in months ahead for better answers from ad tech companies, the MRC, TAG and other industry organizations about why brand safety technology often doesn’t work as expected and how providers are being audited. “The methodology doesn’t seem to be standard,” the executive said, “because there’s a long list of different issues we’ve had.” Adalytics sees the need for more While progress since the report is welcome, it’s not enough, said a spokesperson for Adalytics in a statement. “It is a positive sign that many ad tech vendors are reviewing some of their media inventory partners and discussing upgrades to their software to provide advertisers with page URL transparency,” the statement reads. The statement added that some vendors, including those that have served U.S. government ads on a website known to host CSAM, still have not publicly stated whether they will refund advertisers for ad delivery against content that doesn’t meet written standards. “Some accredited verification vendors have publicly stated that they cannot and do not actually analyze every adjacency where their paying customers’ ads serve,” the Adalytics spokesperson’s statement reads. “Advertisers claim they have been unable to get answers from these vendors or from accreditation groups as to how the vendors’ sampling methodologies work. For example—are the verification vendors checking one in 10, one in 500 or one in 10,000 page URLs? Are they only analyzing publisher domains where more than one million ads serve in a month?” The focus of Adalytics’ research has been on the open web, because open source data is more readily available there. But “walled garden” social platforms also show up regularly in public records of CSAM complaints, such as those reported annually by the National Center for Missing & Exploited Children, according to the Adalytics statement. Google, for example, finds and removes huge amounts of CSAM annually, amounting to 2.8 million pieces of content, nearly 600,000 reports to NCMEC and 366,000 accounts facing enforcement action by the company globally in the first half of 2024 alone. How long those accounts and posts stayed live and how many ads appeared against them isn’t clear. A person familiar with the matter said CSAM links on YouTube generally come down before they accumulate many views or ads get served. But YouTube log files that advertisers receive don’t provide detail on whether their ads appeared against objectionable content before it was removed. In a small experimental video campaign Ad Age ran late last year, YouTube provided log files for where ads showed up. In cases where YouTube took down channels where ads ran (most likely because of content piracy issues and not because of CSAM in this case), the placements showed up in log files only as “channel no longer available.” The URL link showed only “This Channel Was Removed Because It Violated Our Community Guidelines” without other details on the nature of the violation. Google did not provide refunds in any of those cases. In other cases, the YouTube channel name in the log report and content on the URL changed significantly from what was displayed when the ads ran.

How probe of ads on inappropriate content is sparking transparency, ad tech reforms and refunds

Featured Stories