Google’s huge but obscure network of search partners—used, perhaps unknowingly, by thousands of advertisers including such titans as Procter & Gamble Co., big banks and U.S. law enforcement and military recruitment advertisers—included at least until yesterday Iranian, Italian, Vietnamese and other porn sites and websites of companies subject to U.S. sanctions, according to an investigation by research firm Adalytics.

Many findings of the study, including the appearance of numerous U.S. brand ads served via searches on porn sites apparently aimed at Iran and Italy, were independently verified by Ad Age prior to the report’s publication.

The study was an outgrowth of work for Adalytics clients, two of whom spoke on the condition of anonymity. It was prompted by another client searching for why brand ads were appearing on Breitbart, another Google Search Partner, even though the controversial right-wing website was on the company’s exclusion lists, according to Krzysztof Franaszek, CEO of Adalytics.

Ad Age was not able to independently confirm appearances cited in the report, and documented by screenshots, of recruiting ads from the Federal Bureau of Investigation, U.S. armed forces branches and other government entities appearing on an Iranian site, iasco.ir, belonging to a sanctioned company, the Iran Alloy Steel Co., and a Russian site, gpsm.ru., belonging to a company that helped build the bridge between Crimea and Russia.

The Ad Age search came after Adalytics’ attorney had informed the U.S. Justice Department of the issue, according to Franaszek, after which the department may have contacted Google.

Besides brand ads, searches in recent weeks by Adalytics on the allegedly sanctioned Iranian and Russian sites also showed recruiting ads for the FBI, National Security Agency, Department of Homeland Security and numerous non-profit and political campaigns. Those included ads for the re-election campaigns for Sens. Ted Cruz (R-Texas) and Amy Klobuchar (D-Minnesota) and Democratic Minority Leader Rep. Hakeem Jeffries (D-New York). An ad for the campaign of House Speaker Mike Johnson (R-Louisiana) turned up on a Russian porn site, according to Adalytics.

The Adalytics report mentions dozens of advertisers whose brands appeared in search results on questionable Google partner sites, and hundreds of brands were likely exposed, according to Franaszek.

The Justice Department and offices of the legislators did not respond to requests for comment.

Another Google partner site, kidzsearch.com, a search engine aimed at children, as of last week at times showed Google search results and Google Shopping product display ads in response to queries by Ad Age on such terms as “beer” and “whiskey.”

By Monday evening, within 12 hours of when Google was contacted for comment by journalists, porn sites that had been serving Google ads and were brought to Google’s attention either had their Google search widgets removed or rendered inoperative. Search bars powered by Google no longer functioned at all for the Iranian site iasco.ir and Russian site gpsm.ru, both associated with companies named in U.S. sanctions.

By Tuesday morning, searches for alcoholic beverage products on kidzsearch.com no longer yielded product ads.

Google’s response

Google did not deny that its search network ads were served by sites found by Adalytics and brought up by Ad Age, but noted that the sites in question were all part of a subsection of the GSP program, the Programmable Search Engine (ProSE) product, which Dan Taylor, VP of Global Ads for Google, described in a statement as “a miniscule part of our Search Partner Network” where the sites generally do not share in Google revenue.

Taylor described ProSE as “a free search tool we offer to small websites so that they can present a search experience directly on their sites. Ads may appear based on the user’s specific search query: They are not targeted to, or based on, the website they appear on. Websites who merely implement ProSE do not get any ad revenue from those sites.”

Taylor added: “Limited information already shared with us did not identify ad revenue being shared with a single sanctioned entity.”

Google did not have a chance to review the full Adalytics report before publication. But, Taylor said, “Adalytics has established a track record of publishing inaccurate reports that misrepresent our products and make wildly exaggerated claims.”

Adalytics has released several reports on Google in recent months, including one in August in which it claimed to find low-quality ad inventory running through the Google Video Partner Program. “As we’ve stated repeatedly, Adalytics used a flawed methodology to make wildly inaccurate claims about Google Video Partners,” a Google spokesman said at the time.

How Google Search Partners work

Some ProSE sites may participate in the 51% revenue share that other GSPs get, but they would also have to apply to be part of the AdSense program, and that was not the case with website examples shared by Ad Age, according to Google. Google, however, still receives revenue from any clicks on those ads.

All Google search campaigns are opted into partner sites by default unless the advertiser unchecks a box permitting use of the network. The GSP network includes big Google-owned sites such as YouTube, Gmail and Maps; some lesser search engines such as Ask.com and Excite, and apparently thousands of others.

Google does not disclose which sites are in the network before or after campaigns, exactly where a brand’s search ads were served or where the clicks came from. With Google’s increasingly popular and heavily promoted AI-driven Performance Max product, opting out of Google Search Partners is not an option.

So advertisers may not know their ads are showing up on unsavory sites, how much if any of their money goes to those placements, or even what sites are in the GSP ecosystem.

Adalytics found answers to the latter question, according to its report, using publicly available web crawler archives to find JavaScript code embedded in site URLs to locate what sites are Google Search Partners.

In all, Adalytics found more than 36,000 such sites, and Franaszek said he looked for clues such as “porn” in names, sites with .ir or .ru domains indicating Iranian or Russian origin, or sites that had been repeatedly documented by Google as violating copyright protections on content.

Franaszek said he found numerous cases of the latter in the GSP ecosystem, in addition to some of the porn sites violating Google Search Partners terms of service, including prohibition of using automated pop-under windows or pre-populated search queries aimed at generating unintentional clicks.

Google’s rules for GSPs also prohibit a wide array of listed pornographic content that several of the participating sites also featured. But it doesn’t make any official promises to advertisers.

Google’s online documentation for advertisers states: “By creating a campaign for the Search Network, you acknowledge that our policies meet any image and reputation standards you may have for your company.”

However, Google’s disclosure also states: “Google Ads doesn’t provide information detailing the website where your ad was shown on the Search Network.” Nor does Google allow independent third-party verification on pixels or JavaScript tags by such vendors as DoubleVerify or Integral Ad Science on search ads.

Giant and opaque

Google search is the biggest part of the biggest media company in the world, generating $168.5 billion in revenue globally last year, roughly twice as much as the entire U.S. TV market.

It’s unclear how much of that comes from Google Search Partners, but Franaszek said he has heard estimates that they make up 6% to 8% of that revenue, which would be $10 billion to $13 billion annually.

Chris Moulton, search lead for agency Traction, estimates GSP is at least 10% of spending for many advertisers. Another agency executive said spending on GSP sites amounts to only about 1.5% of client spending.

Even at the lowest level, it would be a $2 billion business globally.

However, it also appears likely that the biggest players in the GSP, such as YouTube and Gmail, get most of the partner revenue, and, per Google, that the smaller ProSE players don’t get a share at all.

Google “heavily pushes” using the search partner network, including reducing advertisers’ “optimization score” and recommending use of the network in its recommendations tab should they opt out, Moulton said.

He said Traction has at times been able to opt out of individual sites in the GSP network if the Google rep working on the account is part of a large advertiser team and the client knows exclusions can be applied.

“This is a manual process,” he said, “and we have no way to verify that it is actually completed on the back end.”

The other agency executive said they haven’t seen firsthand any indication of client search campaigns going to porn or other problematic sites. Nor have they tried to opt out of any GSP sites, though they heard it’s possible.

Agency executives said they are able to track the performance of GSPs vs. Google platforms at a macro level but do not get micro-level data from Google on what ad spend went to which site, information that is available from Microsoft for search.

DoubleVerify’s ads showed up on porn sites

Unlike other Google display and video products, search has no oversight from third-party verification companies such as DoubleVerify, Integral Ad Science, Oracle’s Moat or Human Security.

Indeed, at least one of those companies was an apparently unwitting participant in displaying its ads via Google Search Partners on porn sites forumporn.org and comixxx.pro against searches last week on such phrases as “bot fraud,” “brand safety” and “brand suitability.”

A search on forumporn.org for “brand safety” on Monday, for example, showed a DoubleVerify ad served by Google that led to a landing page about “Protecting Brand Safety and Suitability Online.”

Copy on the landing page said:

“The volume of unsafe and unsuitable content online represents a reputation minefield for global advertisers. From inflammatory rhetoric to terrorism and fake news, the dynamic and unpredictable nature of the digital realm makes it critical to ensure brand-content alignment. DV’s comprehensive brand safety and suitability solutions protect your brand’s equity and reputation — across all media environments.“

DoubleVerify did not comment by deadline.

While Google search isn’t monitored by DV or other third parties, Google does run checks to root out click fraud and regularly refunds small amounts of money, according to agency executives, though it doesn’t detail how or where it finds the fraud.

Google Ads search click reporting is accredited by the Media Rating Council, according to an asterisked notation on the MRC website. However, the MRC declined to comment on exactly what that accreditation or related audits cover pending publication of the Adalytics report.

Retailer GSP use ‘a major pain point’

A marketer client of Adalytics who had been briefed on the report but spoke on the condition of anonymity said retailer use of Google Search Partners is “a major pain point for us.”

The marketer has been lobbying to get retail media partners to turn off GSP or Performance Max search campaigns using the company’s brands, which don’t do much search advertising of their own.

“There’s reputational risk in being on porn sites,” the marketer said. “We all know that.” But that’s less of an issue than the fact that the company is subject to legal agreements with the federal government not to advertise its products to children where any click or ad view is a potential violation.

“If a [demand-side platform] is putting me on websites built for kids, I’m violating a legal agreement I’ve submitted to,” the marketer said. “That is an order of magnitude more concerning to me than any kind of reputational risk, because all of that is going to be a low-volume problem.”

Retailers, which have not agreed to the same restrictions with federal regulators that brand advertisers have on marketing sugary foods and drinks or alcoholic beverages to children, do run search campaigns on brand keywords to drive people to landing pages featuring those products.

“This issue is, because I’m not funding it, I often don’t see it,” the marketer said. “Target is running CPC-based search ads to drive traffic. They buy that ad to drop you into a search page on their site, which triggers 15 CPM-based sponsored product ads that I paid for. That, in and of itself, is another crock of shit that we all deal with.”

Target representatives did not respond to email requests for comment by deadline.

Retailers tend to use Performance Max, which steers dollars toward cheaper GSP search clicks, the marketer said, adding that suppliers have been pushing retail media networks to stop using Pmax because of the lower-quality GSP clicks it generates. “My biggest concern,” the marketer said, “is retailers running arbitrage campaigns who have no incentive to listen to me.”

While numerous retailers were seen to have ads displayed against search queries on GSP porn sites last week, Target was the most active advertiser on many brand name and general category terms for packaged-goods brands.

Target also had a range of Google Shopping display ads against the keyword “candy” on Google partner site kidzsearch.com. From a search for “beer” on the children’s search engine, the leading result was Target’s Google Shopping display ad showing a 24-pack of Michelob Ultra.

By Tuesday, after Ad Age reached out to Google and Target for comment, searches for “beer” on the children’s search engine showed no sponsored results.

Agency and marketer concerns

“What a cesspool,” said Traction CEO Adam Kleinberg of the Adalytics report’s findings. “It’s like they learned nothing from the YouTube fiasco a few years ago.”

A marketer client of Adalytics, who was briefed on the report’s findings in advance, said one concern is that marketers who “aren’t extremely operational in the day to day” and leave decisions to media agencies are highly unlikely to turn off GSPs, so they will get opted in by default.

“The second thing is the fact that it’s a black box,” the marketer said. “You don’t have any publisher or inventory reports.”

Those two aspects are at least public, the marketer said. “For me the biggest area of concern is that even when we have [keyword exclusions] or safety measures in your overall search strategy, you’re still appearing in sites that are non-brand-safe and [Office of Foreign Asset Control] sanction sites.”

In response to the research, the company is in the process of developing global standards to avoid problems with GSP sites in the future, the marketer said.

Legal issues unclear

Adalytics in its report disclaims any inference of legal wrongdoing by Google or advertisers. And the legal issues involved are unclear. Doug Wood, general counsel of the Association of National Advertisers, declined to comment on the findings because his firm, ReedSmith, represents many of the companies potentially involved.

“I didn’t see this as a legal issue,” said Jamie Barnard, former general counsel of Unilever and now CEO of Compliant, a firm that tracks compliance of brands and digital media with laws and regulations globally. “The real issue here is simply one of brand safety and transparency,” Barnard said, since many brands are opted into being GSPs without knowing what sites are in the network.

Advertising on potentially sanctioned Iranian or Russian sites might be of particular concern to BNP Paribas, a French-based bank whose ads appeared from searches on iasco.ir, according to Adalytics, which pointed to an $8.9 billion settlement and five years of probation handed down by a U.S. judge in 2015 over charges the bank violated sanctions against Iran, Cuba and Syrian entities. A spokeswoman for BNP Paribas did not respond to an email request for comment.

Google’s statement suggests that no money on iasco.ir flowed through to the Iranian company.

P&G was in, but Unilever out?

Among the hundreds of brands whose ads could be found on searches on questionable GSP sites by Adalytics and Ad Age were several of P&G’s, whose Olay, Gillette, Venus, Bounty, Charmin, Crest, Native and Mielle Organics brands were among those whose ads were served from searches on some of the porn sites.

Those searches on such sites as forumporn.org, porncoven.org, comixxx.pro and pornocriceto.org ranged from brand name searches to searches for “paper towels” or “whitestrips before and after” (the latter also being a search phrase automatically generated in a pop-under window by one of the porn sites, according to Adalytics).

It’s not clear whether P&G brands didn’t opt out of GSPs or whether they couldn’t because they used Performance Max, but Franaszek pointed to coding associated with campaigns from Crest and Native that suggested they were using PMax.

“Brand safety is an important part of our advertising ecosystem,” a P&G spokeswoman said in an e-mail “We have clear standards and protocols that guide our actions when these standards are not met.” 

Given the hundreds of brands whose ads could be found in response to GSP search queries in recent weeks, it’s more a matter of finding ones that weren’t opted in than those that were.

But one company whose brands appeared in almost no searches on its key brand names or categories where it does business was P&G rival Unilever. The lone exception was the company’s Living Proof brand, which appeared in searches for “shampoo” from GSP porn sites.

Unilever executives didn’t respond to a query on whether the company had opted out of GSPs or Performance Max.

Not a complete surprise

Problems with GSP sites didn’t come as a complete surprise to a former executive of one large advertiser, who said he’d worked on an extensive study of the company’s exposure to problematic Google partners and other actors in digital media with help from a former National Security Agency official among others.

That work found many Google partners and some independent influencers with ties to organizations that had been involved in efforts to disrupt the U.S. presidential election in 2016. Funds from advertisers helped fund those efforts, the executive said the research indicated, but they were small amounts. However, the executive described it as “horrifying” when the company was able to track where some of the money ended up.

Even so, the executive said he got pushback about taking corrective measures, in part because implementing a full range of exclusions and safeguards would dramatically increase media costs. Ultimately, the executive said the company was content to cover its requirements by relying on third-party verification and brand safety controls—even though those don’t cover search.