Adalytics Explained

When I first met the founder of Adalytics, Krzysztof Franaszek, in the lobby of the New York Marriott Marquis at Programmatic I/O, I did not know what to expect. I looked him up on LinkedIn and wondered why this Harvard, MIT, and Cambridge-educated dude who studied medicine and health sciences wanted to talk to me about programmatic advertising.

I thought our hasty meeting would be about the basics of programmatic since Krzysztof was an outsider trying to break into a convoluted and complex industry. Within thirty seconds, I knew that this guy meant business. 

After determining that we completed all socially obligatory small talk requirements, he whipped out his laptop and dove into log data that would make even the most seasoned ad tech vets blush. Krzysztof comes across as genial and academic, which disarmed me initially, but as we got deeper into the esoterics of ad tech, he spoke faster and became increasingly inquisitive. This guy had an absolute hunger to learn more about this industry, but I wasn't fully aware of the motivations behind the desire then.

I had to quickly context switch from sage ad tech wizard to humbled product manager, barely keeping up as Krzysztof started diving into complex supply path analysis and network traffic inspections while spitballing question after question. He threw out findings and stats while his eyes searched my face for any hint of a reaction that may tell a story that the words coming out of my mouth were not. 

We concluded the meeting. Although I felt my answers were unsatisfactory, I think he still appreciated the insight. I walked away from that conversation a bit dizzy and fatigued—the same way I would feel after delivering a presentation I was woefully underprepared to give. 

I've thought about this meeting with Krzysztof and subsequent chats with him every time I review yet another research report he puts out that grabs the headlines and emotions of an entire industry.

How many other industry professionals lent their insight to Krzysztof? Do they aid his research in order to better the programmatic ecosystem for everybody? Do they want to undercut competition? Do they want a tip-off on his next research subject and a head start to clean up potential issues before they become public? Whatever the reason, Adalytics ultimately benefits.

Each dense report by Adalytics reveals a new controversy that draws admiration and criticism alike. I am writing this as his latest report has once again sparked a flurry of news coverage (even outside the trades) and public discourse from ad tech pundits, culminating with inquiries from government officials.

In this newsletter, I will examine Adalytics' latest findings and the motivation behind its work. I will also analyze why Adalytics creates divisiveness among industry professionals and offer opinions on why these controversies keep happening.

Adalytics Strikes Again

The latest update from Adalytics highlights the saddest finding yet: anonymous image upload websites displayed ads from a major advertiser next to CSAM (Child Sexual Abuse Material) and displayed ads from additional advertisers alongside other sexually explicit content.

Adalytics also found that some of the top names in ad tech and their clients financially supported these websites via advertising. Additionally, Adalytics reveals that well-known brand safety verification vendors "were seen measuring or monitoring ads on various explicit pages" on the websites.

This is a reprehensible revelation, and I want to acknowledge that fact first and foremost. Unfortunately, the ordeal is a stain on the reputations of all the vendors observed in the Adalytics reports, even if it happened without their knowledge. But I want to note that none of these companies had a chance to defend themselves before the report came out — a topic we will return to.

Like most Adalytics reports, this report presents its findings via screenshots of web pages with ads and the source of those ads derived from network traffic. The company employed two methods in its research.

The first reviewed entries from a service called urlscan.io, which archives historical instances of a webpage by using a bot to take a screenshot of a webpage and store network traffic. The second method is directly observing the web pages in question and using a web browser’s built-in inspection tools to observe network traffic.

Network traffic reveals every single call to servers from a page. Various entities host these servers, which return information that makes up a web page—images, ads, code, etc. Advertising vendors also return pixels or tiny image files to track information about any given transaction. The image file itself is irrelevant, but the request to load it provides vendors with information about an environment. 

The network traffic and visual evidence from screenshots and direct observation are how Adalytics discovered that the ad tech companies served alongside explicit content. If you know the domain owned by an entity, you know they were on the page, and if you see the payload they returned, you can infer to what extent (with reasonable, but not always absolute, certainty) they participated in an ad transaction. 

Inspecting pages like this is something anybody can do with minimal training. You can go to any website today, right-click a page, click the network tab, refresh the page, and see all the nonsense on any page displaying advertisements. So why does it seem like Adalytics is the only one pointing out these pernicious findings?

Adalytics Criticisms

Adalytics often draws criticism with each published report, with some people questioning the motivations behind the work. The sensational nature of the reports is undoubtedly self-serving, at least to some degree. It serves as marketing to drive buyers straight into the warm embrace of a crusader who seems to uncover things that nobody else can. 

But what do critics expect? Pure, unadulterated altruism? Adalytics is a for-profit company that found a successful niche to occupy — mainly because it's unencumbered by conflicts of interest or business dealings with the vendors and platforms it investigates.

Although, the company can be perceived as disingenuous, which could fuel criticism. From the Adalytics About page:

While this statement could be true, it's not mutually exclusive to the part not said: another motive for publicly posting research is to drive more clients to the service. The other reason Adalytics divides opinions is that they divide the industry into two teams: buyers vs. everybody else. Back to the About page:

So, rather than helping the supply side and ad tech vendors clean up their act, Adalytics decided to focus on only one variable of the programmatic equation, much to the detriment of all the suppliers, platforms, and technology vendors that power digital advertising. However, this is a prudent decision due to misaligned incentives at play. 

Platforms and vendors earn more by maintaining scale. Any "cleaning up" of the supply that runs through a system will inherently limit the overall amount of supply to sell. Less inventory to sell means less revenue in the long run. However, if a platform or system does not preemptively clean up its act, it risks losing clients and business in the future and rightful public condemnation.

It’s like having a thirty-year-old roof on your home—you know you have to replace it, or it will cost you big time, but you're willing to risk a leak that could damage your home significantly for now. The smart move is to bite the bullet and invest in a new roof, but you let it ride so you don’t take the short-term financial hit.

The missing aspect of this analogy is that our metaphorical leak only damages your home (business). In the case of Adalytics’ latest report, real people are indirectly harmed by inaction. The Canadian Centre for Child Protection (C3P) identified a missing child depicted in the material turned over by Adalytics. Let that sink in for a moment.

Contrast this with buyers who (on top of logical, humane reasons) have every business incentive to ensure that their ads reach real humans and do not run alongside explicit material — the former lowers their overall costs, and the latter preserves their brand image.

This is why you will never hear buyers criticize Adalytics. They rightfully deserve that their partners do not serve their advertisements to bots, on MFA sites, or next to explicit content. But by serving only a single customer type (buyers), it's no surprise that Adalytics draws ire from everyone else. 

But what about the brand safety vendors meant to prevent this? Many ad tech players may reside in an oblivious state of complacency since they fork over vast sums of money to not worry about these risks (or at least provide plausible deniability). Rather than worrying about a glut of dangerous supply metastasizing within their infrastructure, they pay others to do the worrying for them (or so they thought).

The brand safety vendors’ story typically remains the same with every new report: Adalytics is misinterpreting how their technology works and how settings are configured. Other times, they say Adalytics employs flawed methodologies and incomplete analysis, things the vendors would have cleared up if Adalytics had shared reports before publishing them, potentially causing reputation damage. We'll explore these two other knocks on Adalytics in the next section.

Colossal Reputation Damage

Programmatic advertising inherently requires all participants in the ecosystem to work together — but there is a delicate balance of love/hate playing out where frenemies must work together to achieve success.

Ad tech breeds fierce competition and conflicts— impression discrepancies, clawbacks, SSPs trying to be DSPS, DSPs trying to be SSPs, virtue signaling privacy changes that financially benefit one party and incapacitate others—the list goes on and on. But at the end of the day, everyone must get along with everyone else for this machine to work and for all to capitalize.

Adalytics could rub people the wrong way because it exposes the Internet's programmatic underbelly to the world. Issues resolved behind closed doors are now a spectacle that can threaten the livelihoods and businesses of those involved. 

When one side of a two-way digital advertising partnership discovers an issue, those two parties typically work together privately to resolve the underlying problem and compensate or refund the harmed party accordingly (and I hope they also alert authorities if any real-world harm is discovered.)

These resolutions often include detailed breakdowns of what happened and equally detailed descriptions of changes in operations, processes, or technology that assure the aggrieved party that the original issue will never happen again.

Adalytics breaks this model wide open by displaying the issue for the world to see, analyze, and condemn. It's the digital equivalent of tar and feathering someone in the town square. However, much like tar and feathering, these acts are carried out without any type of judicial process (formal or informal). Should you burn the witch without letting them first state their case?

The problem is that Adalytics typically reveals things that are apparent if you only look. But sometimes, like the brand safety vendors previously contended, there may be more to the story.

This criticism of Adalytics was on full display in the ID bridging fiasco the company sparked. Adalytics allegedly observed Colossus SSP altering user IDs, insinuating they could inject known higher-value user IDs into an ad request to earn more revenue. 

If you put people on blast in public, you better be 100% sure you are right, and Adalytics experienced its first taste of legal blowback from its outlaw public shaming tactics. Colossus SSP sued Adaltyics for defamation. From the press release accompanying the lawsuit filing:

The press release highlights Adalytics’ ulterior motives for posting its research publicly, which is one of the main criticisms of the company. It goes on to mention the other recurring critique — that Adalytics never discussed the issue with Colossus before publishing to give them a chance to explain.

However, Krzysztof recently explained on the Marketecture podcast that this could give someone time to scrub evidence, which happened following his most recent report. If you try to visit the urlscan.io links referenced in the most recent Adalytics report, you will find that they mysteriously disappeared. 

In the case of Colossus, they contend that they might not be to blame:

It is possible that intermediaries could alter user IDs, and this is not something that Adalytics could independently verify via public data or information. Adalytics mentions this in the report and relies on publicly available documentation of the intermediary to make assumptions. Society and rational people typically follow an innocent-until-proven-guilty ethos, and some may contend that Adalytics caused reputational damage without all the facts — I know Collosus would agree. 

The fact that Adalytics does not have to participate in the programmatic ecosystem may be its greatest superpower. Some companies may be unable or unwilling to call out bad actors publicly in a world where every company is connected via OpenRTB, entwined in contracts, or represents clients you have to work with.

For example, if a DSP discovers bad behavior from an SSP, publicly calling them out could be a poor business decision. What if that SSP represented other unique (and clean) inventory their clients need that is unavailable elsewhere? The DSP would hesitate before calling them out publicly for fear of having access to the unique supply shut-off, even if it would be for the greater good of the programmatic ecosystem.

Adalytics can afford to ruffle feathers without fear of business retribution, but Colossus may prove the aggressive marketing strategy of publishing research is not immune from legal scrutiny.

The Programmatic Underbelly

Whether you agree with their tactics or not, Adalytics does reveal real fundamental and systemic problems with programmatic advertising. It is abhorrent that advertising could fund services that distribute CSAM. It is ridiculous that well-established financial brands create made-for-advertising variants of their websites. It is unacceptable for anyone to alter programmatic metadata maliciously or mistakenly. So why does this keep happening? 

Programmatic advertising captures and sells attention at an unimaginably massive scale through complicated digital plumbing. The scale can duplicate at several stops in the programmatic supply chain before reaching the buyer, adding to the madness. The sheer number of publishers and intermediaries involved makes understanding everything that passes through a system improbable only to the most fastidious and determined participants. 

This is why publishers, platforms, and advertisers implement operational processes and technology to prevent and identify missteps. However, the bad things that can happen usually have to happen first before anyone cares. 

I began my career at the tail-end of an era often called "the Wild West" of advertising technology. This time was back when viewability and bot traffic ran rampant, and verification vendors either did not exist or were by no means a requirement. As advertisers became increasingly sophisticated, the demand for independent technology to pre-filter, measure, and verify inventory increased and eventually became obligatory.

Advertisers caught suppliers peddling bot traffic, non-viewable ads, or ads served on spoofed domains and imposed clawbacks (asked for their money back). Consequently, the business incentive for suppliers to clean up materialized, leading to the rise of companies like DoubleVerify, IAS, and HUMAN, as well as new technical standards to prevent these things, like ads.txt and sellers.json. 

After over a decade of cat-and-mouse between fraudsters and advertising technologists, you would think programmatic advertising would be a pristine land of viewable ads next to safe content with extremely low ad loads. Yet, as evidenced by every new Adalytics report, the problems persist. 

Is the scale of programmatic advertising too massive to ensure unilateral brand safety free of all fraud? Do these verification vendors that everyone pays to prevent these very things not live up to their expectations? Is the lack of sharing information on issues solved behind closed doors not allowing us to improve the health of the overall ecosystem? These are all questions that the work of Adalytics forces us to ask.

In a logical and transparent ad system, buyers could have avoided the most recent issue discovered by Adalytics by using a simple allow list of domains. However, with the rise of “black box” performance systems that urge buyers to relinquish control to machines and sometimes don’t even provide URL-level reporting, simple solutions may not exist or be overlooked.

The nature of capitalism pressures digital advertising participants to constantly seek the highest return on ad spend and the vanity metrics to prove it. Programmatic advertising platforms and their clients need the scale and tools to accommodate these lofty goals, so at some point, everyone in the supply chain can miss or ignore the potential consequences of the relentless pursuit of performance as long as their KPIs meet expectations.

Thanks to Adalytics, you can bet that all ad platforms will now have much tighter supply review policies and unilaterally ban any anonymous image upload site. Brand safety vendors are already changing their tools and policies as a result of the latest report, and other companies caught up in the mix are quickly terminating related accounts and taking steps toward future prevention.

If this happened via some backchannel emails, policy updates and technology changes may have only been implemented at a single company. But Adalytics' public reporting (love it or hate it) accelerated fixing a part of programmatic advertising across the ecosystem. Only a select few may know the next nefarious dealing lurking in the programmatic underbelly if someone catches it before Adaltyics, which doesn't lead to improving the overall system.

Love them or hate them, Adalytics's work ultimately improves the programmatic ecosystem (and humanity with its last report). Even if Krzysztof's public tactics ultimately benefit Adalytics financially in the form of more attention and clients, a rational person cannot argue that the content of his reports (if true) provides valuable insight to create a more ethical and efficient system overall.

The unfortunate possible side effect is undeserved reputational damage and, at worst, destruction of livelihood. Depending on intentionality, the punishment may fit the action. But maybe living in fear of being the subject of Adalytics' next report is what everyone needs to clean up their acts.

Adalytics has created an ad tech Sword of Damocles ready to fall on those who don't take our industry's unsavory realities seriously, along with the real-world harm they could cause.

But it's hard to shed a tear for companies earning millions and sometimes billions of dollars from advertising, especially if the issues Adalytics reveals are intentional or the result of gross negligence. Inexcusable issues continue to materialize, so public shaming may be the only mechanism to drive real change.