A handful of ad blocker companies are earning big bucks for not blocking ads from hundreds of advertisers, including big names like LinkedIn, Reddit, Amazon, and even Google.
While the practice of companies paying to bypass ad blockers has been quietly growing for several years, it recently hit a new milestone. Based on recent estimates, ads from a select group of advertisers are appearing on the screens of up to 200 million ad blocker users worldwide thanks to a program called Acceptable Ads.
Several popular ad blockers participate in the Acceptable Ads program, including AdBlock Plus, perhaps the most popular ad blocker in the world.
Hundreds of advertisers also participate in the Acceptable Ads program, and those that receive more than 10 million additional ad impressions per month due to participation in the Acceptable Ads normally pay a licensing fee of 30% of the additional revenue created by whitelisting its Acceptable Ads.
The problems arise from how the Acceptable Ads program is actually implemented.
When a user is considering installing AdBlock Plus or one of the other ad blockers that participate in the Acceptable Ads program, it isn’t obvious that ads from certain advertisers will not be blocked. The information is there, somewhere, but it is easy to miss.
This problem is exacerbated by the fact that as of today, every ad blocker in the program opts users into the Acceptable Ads program by default. Most users are likely to expect that the ad blocker they install will actually block all ads.
Adblock Plus, one of the largest players in this program, boldly promises “no annoying ads” at the top of its website, while acknowledging the “Acceptable Ads” issue in smaller font.
Leaving it up to the user to figure out what is going on here and how to fix it seems like a bad design at best.
This is particularly so for privacy-oriented users. Such users rely on ad blockers to protect them from data harvesting and the trackers that most ad networks install on a device when they display their ads.
As more and more people install ad blockers, the impact of these questionable practices grows.
Senator sounds the alarm in January, 2020
This has become a big enough issue that on January 14, 2020 Senator Ron Wyden wrote to the Federal Trade Commission (FTC) urging an investigation into what he called, “unfair, deceptive, and anti-competitive practices in the ad blocking software industry.”
Note: You can see the Senator’s entire letter here.
Timeline of Significant Events
Based on our research, below is a timeline of significant events. You can see how a decision in 2011 to allow ads in exchange for payment has morphed into a multi-million dollar venture that tracks and displays ads to millions of “ad blocker” users.
2011: AdBlock Plus starts displaying ads in exchange for payment.
October 2015: Acceptable Ads program is opened to competitors.
October 2015: AdBlock (an unrelated ad blocking company) is sold to an anonymous buyer, joins the Acceptable Ads program, and releases an update that automatically sets users to receive acceptable ads.
2017: Acceptable Ads Committee (AAC) is established as an “independent body”.
2019: uBlock ad blocker is purchased by AdBlock; starts transitioning to use of Acceptable Ads.
March 2020: eyeo GmbH announces Acceptable Ads reaches up to 200 million users.
Why “Acceptable Ads” are a threat to your privacy
Online ads can pose significant privacy threats. Most of the ads you see come from advertising networks. In addition to the ads themselves, the advertising networks frequently install trackers on your device.
These trackers allow the ad networks to gather all sorts of information about your online activities. The end result is a database of information that often includes very private details gleaned from the trackers. This database, or user profile, can be used to predict which of their ads is most likely to get you to buy something, also known as targeted advertising.
Or they can sell the data to another ad network to increase the size of their database about your online activities.
But “Acceptable Ads” will protect you from all this, right?
Not necessarily.
The Acceptable Ads requirements only specify certain visible characteristics of ads that are acceptable. They do not prevent program participants from placing trackers on a user’s device.
The AcceptableAds Exchange (AAX) is an ad exchange that only serves Acceptable Ads.
If you visit the opt-out page on the AAX website, you will find the following:
We may collect Web viewing data from your browser over time and from non-affiliated websites, to deliver more relevant advertising to you based on preferences or interests inferred from the Web viewing data.
This process is known as interest-based advertising.
We enable consumers to opt out of our collection, use and transfer of this data for interest-based advertising purposes.
Beyond this, a review of the Acceptable Ads guidelines says nothing about preventing tracking. So no, allowing Acceptable Ads does not protect you against tracking by those ads.
Online ads aren’t simply ads. They’re actually surveillance tools that strangers use to abuse your privacy. This description from the Electronic Frontier Foundation sums it up nicely:
Nothing is so creepy as ads for a product you looked into earlier following you from site to site, then from app to app, as you are tracked and retargeted by a desperate vendor’s algorithm.
–Cory Doctorow, July 2019
Who is paying for their ads to be displayed?
One thing we discovered early in our investigation was that not all advertisers involved in the Acceptable Ads program are actually paying to have their ads displayed. To understand the situation better, we checked out the Monetization section of the AdBlock Plus site and learned several things:
- Entities that gain more than 10 million additional ad impressions per month due to their participation in the Acceptable Ads initiative are required to pay a large licensing fee.
- Around 90% of the participants in the initiative do not have to pay a fee since they don’t get enough additional ad impressions.
- There is a link to the Acceptable Ads proposals forum (located on the AdBlock Plus website), where you can see who has been accepted into the program.
We were shocked by what we found in the forum.
There were 1,019 topics in the discussion forum. Aside from a handful of announcements and notices, the rest of the forum covered domains that applied to be whitelisted (exempted from blocking) so their ads would be displayed by the ad blockers that are members of Acceptable Ads.
While the posted topics show that the Acceptable Ads team rejected many applicants that didn’t meet the guidelines, and deleted many that were no longer active or no longer met the guidelines, there are still hundreds of domains that are whitelisted (not blocked).
Digging through the 1,000+ topics we found whitelisted domains belonging to numerous well-known companies such as Amazon, Dell, Google, LinkedIn, Microsoft, Quora, Reddit, Taboola, and Yelp. Between all the participating advertisers, we estimate that there are between 600 and 700 whitelisted domains.
Note: While domains related to these organizations are all whitelisted according to forum entries, we cannot tell which sites are currently receiving enough ad impressions through this system to actually be paying a fee.
These “ad blockers” are getting paid to allow Acceptable Ads
According to the Acceptable Ads website, the following ad blockers are part of the Acceptable Ads program:
- AdBlock Plus
- AdBlock Browser
- AdBlock products
- AdBlock Premium products
- uBlock products (not uBlock Origin)
- Crystal products
We checked AdBlock, AdBlock Plus, and Crystal. All now display Acceptable Ads by default. Presumably, uBlock, which was acquired by AdBlock Plus last year, will do the same.
We don’t like this approach at all, since an ad blocker should block all ads by default.
Happily, you do have some options to protect yourself.
How can you protect yourself?
You have a couple of different options for protecting yourself from ads that are whitelisted in the Acceptable Ads program.
1. Choose an ad blocker that doesn’t participate in the program.
There are various ad-blocking options that don’t make exceptions for advertisers willing to pay a fee to continue to appear on your screen. Two that we like are AdGuard, and uBlock Origin (this is different than uBlock products, which do whitelist ads).
The following is a screen capture of a page with an ad from an AAC-whitelisted domain:
In the image above, AdBlock Plus is active, but it supports Acceptable Ads, so the ads are not actually getting blocked.
In this image, uBlock Origin is active. It does not support Acceptable Ads, and you can see the ads are now blocked.
As you can see, switching to an ad blocker that isn’t in the Acceptable Ads program will let you avoid the whole mess.
There are also VPN ad blockers you can consider. With a VPN ad blocker, you will get the benefits of a VPN and ad blocker in one simple app on your device.
2. Learn how to opt-out of seeing Acceptable Ads.
By default, ad blockers that are part of the Acceptable Ads program are set to display ads that comply with AAC guidelines. However, every member of the Acceptable Ads program does give you the option to opt-out of this behavior.
While we think opting-in to see ads is a much more user-friendly and privacy-respecting approach, the ability to opt-out is better than nothing.
Going forward: more transparency, awareness, and accountability
It has often been said that personal data is a hot commodity, a new gold rush, with big advertisers cashing in. Our research indicates this trend is undermining the ad-blocking industry.
Advertisers are quietly paying off ad blocking companies to gain access to screens, track users, and fundamentally undermine the true purpose of an ad blocker. Meanwhile, the average user is likely oblivious to all this as “Acceptable Ads” are enabled by default and few people have time to read through privacy policies and modify settings.
The honorable approach would be to block all ads by default. If users still wanted to allow “acceptable ads” on their devices, the privacy and security consequences for doing so should be transparently explained beforehand.
However, we acknowledge that most users would probably not consent. After all, allowing these “acceptable ads” undermines the purpose of an ad blocker, while also surrendering your private data to advertisers and anyone they share the data with.
Additionally, taking a page from the GDPR and CCPA regulations, there should be some mechanism for accountability to ensure compliance. Admittedly, this is also tricky as advertisers (and their ad-blocking partners) may reside in overseas locations outside of respective legal jurisdictions.
At Restore Privacy, we only stumbled across this issue when conducting research for our best ad blocker roundup (we do not recommend any ad blockers that allow acceptable ads). Given the severity and scope of the problem, we felt compelled to dig deeper and publish our findings in this report.
2020 Cybersecurity Statistics, Threats, and Mitigation Options
Leave a Reply