The recent Adalytics report on ad tech vendors serving ads on a website that hosts child sexual abuse material (CSAM) underscores the need for transparency and diligence by the industry. While some have dismissed the findings as a 0.xxx% scenario, this is a case of once being too many. The homicide rate in the US is only 0.0075%, but as a society, we do everything to prevent them and punish offenders. The industry has a moral responsibility to do better.
Social media chatter has called for different measures to prevent such occurrences, one being an enforcement role by an independent industry body (like IAB Tech Lab) to monitor and police the industry and another being broader research and analysis on a regular basis to root out such violations. The enforcement role has its own liability and tort issues, as evidenced by the ongoing X vs. GARM lawsuit, and it’s easy for an industry to ask an independent body to enforce rules when all the liability is on the enforcer. There are robust technical solutions that can be brought to bear to largely solve the digital ad industry’s supply chain issues, but the more significant problem is the lack of industry resolve to vigorously stamp out the issues within the supply chain once and for all. For example,
We initiated an industry research program partnering with academic researchers at two large US universities to address similar supply chain scenarios focused on fraud and other policy violations. Still, after trying for 2 years, we did not find enough advertiser participants willing to collaborate. And don’t even get me started on how difficult it was to obtain the necessary data to support this research from vendors.
We finally abandoned the research project last year due to insufficient advertiser participation and vendor support.
I write this with a heavy heart because we serve the industry by developing technical standards, guidance, and frameworks to ensure transparency and a clean supply chain. Yet these are not enough. The industry must do more to prevent these issues or at least account for them when they occur.
We need the industry to step up.
First, we need companies to adopt the transparency standards created and ensure they are enforced and reported against by all their business partners.
Second, companies must perform stringent due diligence when onboarding inventory to their platforms. In this specific case, investigating sites with notified alerts at the National Center for Missing & Exploited Children (NCMEC) for brand-suitable content and legitimate transparent business ownership accompanied by requiring full URL disclosure in bidstream transactions could have helped avoid ad placements on the sites.
Here are Tech Lab’s suggestions for better transparency and diligence best practices that are already available to follow:
- Strict Exclusion Lists from sources with alerts/notifications for illegal activities e.g. NCMEC in this case, but there can be more sources for other activities
- Inclusion Lists: These may be obvious, but buying strictly using inclusion lists is tried and true. Sticking with and limiting buying to advertiser provided inclusion lists is a solid safe way to adhere to brand policies.
- Media inventory onboarding due diligence: Supply Side Platforms (SSPs) should ensure they do not onboard sites in exclusion lists on their platforms. They must also perform further due diligence to ascertain the legitimacy of the business, like checking WHOIS information and not do business with entities whose ownership is unknown. There are also other methods like government-issued business identifiers and bank checks to ensure the legitimacy of a business partner
- Buy-side Exclusion criteria: Demand Side Platforms (DSPs) must ensure they strictly apply exclusion criteria
- Full URL disclosure in the bid stream. DSPs should reject a bid with no URL or app identification. Advertisers should require their vendors (DSPs and measurement providers) to report on this.
- Require Supply Chain Object so you are aware of the full chain of custody
- Authentic business identity in bidstream: Having a reliable, preferably authenticated business identification of every entity in the bidstream including publisher is another way to bolster controls. Ads.cert signature along with a country/region provided business identifier will go a long way in discouraging bad actors.
These suggestions are just some immediate best practices supported by available standards and resources today. We would love to hear more about what practices companies are following today and what more can be done.
I also want to draw attention to developers of new private ad systems at browsers and OS providers. They have decided against disclosing full URLs in advertiser reporting and to third-party technology providers during buying transactions, citing privacy concerns. These modifications regarding URL disclosure will only open up more opportunities for fraud and issues such as this.
Knowing exactly where an ad is being shown is a hard requirement for complying with advertiser policies and legal, ethical, and moral obligations.
The IAB Tech Lab is open to taking a more active role in monitoring the ecosystem with more advanced technical frameworks to expose supply chain issues. I am eager to hear suggestions on what we can do as an industry to create better controls over where the ads are being shown: Is it more research? Is it more guidance about mandatory requirements for the bidstream? Is it a robust compliance program with teeth (e.g. compliance badge stripped, notice sent to supply chain partners) to ensure that specific minimum requirements are followed to prevent this from happening in the future? Is it a Tech Lab supply chain monitoring and reporting technology framework?
The Tech Lab has the resources to develop these tools, in fact Supply Chain Integrity is on our 2025 roadmap, but the industry must be resolved to adopt and enforce them.
Let us know what will drive change for the better.
Shailley Singh
COO & EVP, Product
IAB Tech Lab