A handful of ad blocker companies are earning big bucks for not blocking ads from hundreds of advertisers, including big names like LinkedIn, Reddit, Amazon, and even Google.
While the practice of companies paying to bypass ad blockers has been quietly growing for several years, it recently hit a new milestone. Based on recent estimates, ads from a select group of advertisers are appearing on the screens of up to 200 million ad blocker users worldwide thanks to a program called Acceptable Ads.
Several popular ad blockers participate in the Acceptable Ads program, including AdBlock Plus, perhaps the most popular ad blocker in the world.
Hundreds of advertisers also participate in the Acceptable Ads program, and those that receive more than 10 million additional ad impressions per month due to participation in the Acceptable Ads normally pay a licensing fee of 30% of the additional revenue created by whitelisting its Acceptable Ads.
The problems arise from how the Acceptable Ads program is actually implemented.
When a user is considering installing AdBlock Plus or one of the other ad blockers that participate in the Acceptable Ads program, it isn’t obvious that ads from certain advertisers will not be blocked. The information is there, somewhere, but it is easy to miss.
This problem is exacerbated by the fact that as of today, every ad blocker in the program opts users into the Acceptable Ads program by default. Most users are likely to expect that the ad blocker they install will actually block all ads.
Adblock Plus, one of the largest players in this program, boldly promises “no annoying ads” at the top of its website, while acknowledging the “Acceptable Ads” issue in smaller font.
Leaving it up to the user to figure out what is going on here and how to fix it seems like a bad design at best.
This is particularly so for privacy-oriented users. Such users rely on ad blockers to protect them from data harvesting and the trackers that most ad networks install on a device when they display their ads.
As more and more people install ad blockers, the impact of these questionable practices grows.
Senator sounds the alarm in January, 2020
This has become a big enough issue that on January 14, 2020 Senator Ron Wyden wrote to the Federal Trade Commission (FTC) urging an investigation into what he called, “unfair, deceptive, and anti-competitive practices in the ad blocking software industry.”
Note: You can see the Senator’s entire letter here.
Timeline of Significant Events
Based on our research, below is a timeline of significant events. You can see how a decision in 2011 to allow ads in exchange for payment has morphed into a multi-million dollar venture that tracks and displays ads to millions of “ad blocker” users.
2011: AdBlock Plus starts displaying ads in exchange for payment.
October 2015: Acceptable Ads program is opened to competitors.
October 2015: AdBlock (an unrelated ad blocking company) is sold to an anonymous buyer, joins the Acceptable Ads program, and releases an update that automatically sets users to receive acceptable ads.
2017: Acceptable Ads Committee (AAC) is established as an “independent body”.
2019: uBlock ad blocker is purchased by AdBlock; starts transitioning to use of Acceptable Ads.
March 2020: eyeo GmbH announces Acceptable Ads reaches up to 200 million users.
Why “Acceptable Ads” are a threat to your privacy
Online ads can pose significant privacy threats. Most of the ads you see come from advertising networks. In addition to the ads themselves, the advertising networks frequently install trackers on your device.
These trackers allow the ad networks to gather all sorts of information about your online activities. The end result is a database of information that often includes very private details gleaned from the trackers. This database, or user profile, can be used to predict which of their ads is most likely to get you to buy something, also known as targeted advertising.
Or they can sell the data to another ad network to increase the size of their database about your online activities.
But “Acceptable Ads” will protect you from all this, right?
Not necessarily.
The Acceptable Ads requirements only specify certain visible characteristics of ads that are acceptable. They do not prevent program participants from placing trackers on a user’s device.
The AcceptableAds Exchange (AAX) is an ad exchange that only serves Acceptable Ads.
If you visit the opt-out page on the AAX website, you will find the following:
We may collect Web viewing data from your browser over time and from non-affiliated websites, to deliver more relevant advertising to you based on preferences or interests inferred from the Web viewing data.
This process is known as interest-based advertising.
We enable consumers to opt out of our collection, use and transfer of this data for interest-based advertising purposes.
Beyond this, a review of the Acceptable Ads guidelines says nothing about preventing tracking. So no, allowing Acceptable Ads does not protect you against tracking by those ads.
Online ads aren’t simply ads. They’re actually surveillance tools that strangers use to abuse your privacy. This description from the Electronic Frontier Foundation sums it up nicely:
Nothing is so creepy as ads for a product you looked into earlier following you from site to site, then from app to app, as you are tracked and retargeted by a desperate vendor’s algorithm.
–Cory Doctorow, July 2019
Who is paying for their ads to be displayed?
One thing we discovered early in our investigation was that not all advertisers involved in the Acceptable Ads program are actually paying to have their ads displayed. To understand the situation better, we checked out the Monetization section of the AdBlock Plus site and learned several things:
- Entities that gain more than 10 million additional ad impressions per month due to their participation in the Acceptable Ads initiative are required to pay a large licensing fee.
- Around 90% of the participants in the initiative do not have to pay a fee since they don’t get enough additional ad impressions.
- There is a link to the Acceptable Ads proposals forum (located on the AdBlock Plus website), where you can see who has been accepted into the program.
We were shocked by what we found in the forum.
There were 1,019 topics in the discussion forum. Aside from a handful of announcements and notices, the rest of the forum covered domains that applied to be whitelisted (exempted from blocking) so their ads would be displayed by the ad blockers that are members of Acceptable Ads.
While the posted topics show that the Acceptable Ads team rejected many applicants that didn’t meet the guidelines, and deleted many that were no longer active or no longer met the guidelines, there are still hundreds of domains that are whitelisted (not blocked).
Digging through the 1,000+ topics we found whitelisted domains belonging to numerous well-known companies such as Amazon, Dell, Google, LinkedIn, Microsoft, Quora, Reddit, Taboola, and Yelp. Between all the participating advertisers, we estimate that there are between 600 and 700 whitelisted domains.
Note: While domains related to these organizations are all whitelisted according to forum entries, we cannot tell which sites are currently receiving enough ad impressions through this system to actually be paying a fee.
These “ad blockers” are getting paid to allow Acceptable Ads
According to the Acceptable Ads website, the following ad blockers are part of the Acceptable Ads program:
- AdBlock Plus
- AdBlock Browser
- AdBlock products
- AdBlock Premium products
- uBlock products (not uBlock Origin)
- Crystal products
We checked AdBlock, AdBlock Plus, and Crystal. All now display Acceptable Ads by default. Presumably, uBlock, which was acquired by AdBlock Plus last year, will do the same.
We don’t like this approach at all, since an ad blocker should block all ads by default.
Happily, you do have some options to protect yourself.
How can you protect yourself?
You have a couple of different options for protecting yourself from ads that are whitelisted in the Acceptable Ads program.
1. Choose an ad blocker that doesn’t participate in the program.
There are various ad-blocking options that don’t make exceptions for advertisers willing to pay a fee to continue to appear on your screen. Two that we like are AdGuard, and uBlock Origin (this is different than uBlock products, which do whitelist ads).
The following is a screen capture of a page with an ad from an AAC-whitelisted domain:
In the image above, AdBlock Plus is active, but it supports Acceptable Ads, so the ads are not actually getting blocked.
In this image, uBlock Origin is active. It does not support Acceptable Ads, and you can see the ads are now blocked.
As you can see, switching to an ad blocker that isn’t in the Acceptable Ads program will let you avoid the whole mess.
2. Learn how to opt-out of seeing Acceptable Ads.
By default, ad blockers that are part of the Acceptable Ads program are set to display ads that comply with AAC guidelines. However, every member of the Acceptable Ads program does give you the option to opt-out of this behavior.
While we think opting-in to see ads is a much more user-friendly and privacy-respecting approach, the ability to opt-out is better than nothing.
Going forward: more transparency, awareness, and accountability
It has often been said that personal data is a hot commodity, a new gold rush, with big advertisers cashing in. Our research indicates this trend is undermining the ad-blocking industry.
Advertisers are quietly paying off ad blocking companies to gain access to screens, track users, and fundamentally undermine the true purpose of an ad blocker. Meanwhile, the average user is likely oblivious to all this as “Acceptable Ads” are enabled by default and few people have time to read through privacy policies and modify settings.
The honorable approach would be to block all ads by default. If users still wanted to allow “acceptable ads” on their devices, the privacy and security consequences for doing so should be transparently explained beforehand.
However, we acknowledge that most users would probably not consent. After all, allowing these “acceptable ads” undermines the purpose of an ad blocker, while also surrendering your private data to advertisers and anyone they share the data with.
Additionally, taking a page from the GDPR and CCPA regulations, there should be some mechanism for accountability to ensure compliance. Admittedly, this is also tricky as advertisers (and their ad-blocking partners) may reside in overseas locations outside of respective legal jurisdictions.
At Restore Privacy, we only stumbled across this issue when conducting research for our best ad blocker roundup (we do not recommend any ad blockers that allow acceptable ads). Given the severity and scope of the problem, we felt compelled to dig deeper and publish our findings in this report.
So I’ve been using Ublock Origin for a few years now. But I always wondered if there is not something similar for the infamous cookie banner that is flashed at surfers from the EU?
In your example of the CoinGecko website, uBlock Origin indeed blocks ads. But the cookie banner is flashed at the bottom right of the screen :
When I click on “(Read more)”, I read about “collection of anonymised data”, etc. But I cannot select just functional cookies. Is there a browser add-on that will block non-functional cookies (a.k.a. advertising, analytics, etc) ?
Acceptable Ads is a good program, it provides a guideline on the format and layout of online ads. The overseers define acceptable ads as unobtrusive and clearly marked. Only large publishers of ads with high impression are charged for the vetting service.
But being just good is not enough–nowadays ads are not just annoying obtrusion but are trackers and malware as well. The Acceptable Ads program does not seem to address the threat of trackers and malware, so it is not recommended to allow Acceptable Ads.
UPDATE:
There is some mention of non-tracking acceptable ads on Acceptable Ads, Adblock Plus and Adblock websites so I installed Adblock Plus and Adblock on mobile and desktop to check.
Indeed there is a setting to enable only non-tracking acceptable ads on desktop but none whatsoever on mobile. Non-tracking refers to ads that respect Do Not Track request as well as self-hosted ads.
This does make Acceptable Ads a bit better—but non-tracking should be the standard not optional.
Adguard is a great adblocker. I’ve been using it for a while and recently decided to buy a lifetime license (they were – or still are – offering a 30% discount). It always had an option to allow “acceptable ads”, but you can also choose to block everything (it asks you to choose the first time you set up the adblocker and if you change your mind, you can change it easy through the settings). Its extension also has this option…
AdGuard refers to it as useful ads (search ads and self promotion ads). They’re not the same as AdBlock Plus (ABP) Acceptable Ads.
Hi Sven & Anybody
I Know this is not the right place for this type of Question, but it really is interesting to me: when you register for an account, and you type in some password, how do they know if the password is weak or not, if it contains this or that type of letter etc? Isn’t it strange, because we think that the passwords are secret and encrypted?Thanks.
Password strength meter on websites measure strength based on checklist usually character length, mixture of upper and lower case letters, numbers and special characters. As an analogy, if a password meter specifies that the password be related to birds, then the password cannot be cow. The meter does not know if the password used is seagull or pelican, unless the code is malicous.
Hey there!
I’d like to suggest you an app called “blokada” to block tracking and ads on smartphones.
Explain us full settings of ublock origin
Lazy Ninja! LOL Go to https://github.com/gorhill/uBlock#ublock-origin and study it yourself. Or, just install it and get the benefits without knowing or understanding the inner workings! 😉 懶忍者！
Check out the Hated One’s video on it: https://youtube.com/watch?v=2lisQQmWQkY
Hey Samurai! I know of his channel and I think he is a banner geek! That said, the way he does the video makes me want to barf onto my keyboard because it acts as an emetic (https://www.merriam-webster.com/dictionary/emetic). Impossible to follow due to him feeling the need to impress views by how fast and jittery he can click on stuff!!! LOL But thanks for the feedback nonetheless! Cheers, George
For most people, the following guide should be enough:
– go to uBlock Origin extension setting in Firefox or Chrome, and turn on ‘allow in private / incognito’
– click on uBlock Origin icon near address bar and open ‘Dashboard’ then go to ‘Filter List’
– select these filter lists for uBlock Origin:
* Ads: To remove ads, choose either EasyList or AdGuard Base. If on smartphone or tablet, add AdGuard Mobile
* Privacy: To remove trackers and spyware, choose either EasyPrivacy or AdGuard Tracking Protection
* Annoyance: To remove navigation bars, pop ups and banners, choose both Fanboy’s Annoyance List and AdGuard Annoyance List
– you can remove the built in list and multipurpose list if you want. Might be redundant.
Hi Sven Taylor. you could do a review of the eraser programs. For example, the MiniTool Partition Wizard, eraser, dban, Permadelete_Portable, hwipe, HDShredder, etc. programs. Some are free payments others which of all those recommended because some takes longer than is recommended 7pass or 35, 3, etc. The time it takes to delete because you notice that some take longer and others less, which versions are more stable, etc. Sorry for my English since I am using the google translate.
Thanks for the suggestions.
Hi, Sven. You could add to the list above the software called “Prevent Recovery”. It’s free and you can chose many types of erasing method. Also it has an option to create fake files in case someone tries to use a recovery software on your hard drive.
When replacing your old PC or hard disk, your data need to be destroyed for protection of privacy and security. There are many eraser softwares such as DBAN, BleachBit, Piriform CCleaner, Heidi Eraser, shred…
DBAN is once the most popular software for free usage. But it was bought by Blancco and currently is not maintained. If you need good one then should try nwipe. It is free software and could be installed in many Linux distros.
https://github.com/martijnvanbrummelen/nwipe
https://github.com/PartialVolume/shredos.2020.02
In enterprise environment, certificates are required. Then you should look for solutions like Blancco Drive Eraser, BitRaiser Drive Eraser, Active Killdisk.
Prevent Recovery is another great eraser. It has many methods and you can also create fake files in case someone tries to recovery its contents
The best options are Ublock Origin and Privacy Badger combined
Hi H! I agree that those 2 are banner and do a great job.
I’ve tried out A LOT of extensions over the last few months. Most are BS, IMO, but there are a few you may want to check out as a flanking action/augmentation to your minimalist approach… as good as Ublock Origin and Privacy Badger are.
1) https://decentraleyes.org/
2) https://github.com/cowlicks/privacypossum (I use this in addition to Privacy Badger.)
3) https://github.com/Cookie-AutoDelete/Cookie-AutoDelete
4) https://www.eff.org/https-everywhere
In addition to all the above (including what you use) which are all free, I bought:
1) https://adguard.com/en/welcome.html (Installed as an app that covers all of my computers.)
2) https://vpn.ac/ (Out of all the VPNs that Sven T. recommends, I chose this on as it works very well and is “the road less traveled!” The others I didn’t try out, nor intend to, as they are too “Hollywood” for my taste. LOL)
Hope this helps you add some things that will assist in your journeys into the WorldWideWeb!!!
Cheers, George
This is a great, and one of the most in-depth articles on this subject and demonstrates that EYEO (adblock plus, adblock, etc.) is nothing more than an extortion racket. They steal audiences and then sell them back. The fact that the largest media/tech companies are paying huge fees to effectively fund ad blocking is by itself is shameful.
Moreover, this is nothing more than forcing ads on ad block users as most don’t know how to “opt-out”. The Senator has it spot on- these are deceptive business practices- consumers are being abused. I would think the more educated, technically savvy population are onto this scheme and dropping these ad blockers for better ad blockers that don’t participate in this scheme.
Beyond seeing ads, the fact these blockers are tracking and selling personal data is at it’s core, is deceptive and bordering on criminal.
Advertisers are probably not aware of this- but ad blockers will blame the brand, then the publisher when ad are being forced upon them. All advertisers should be aware the harm this could cause to their brands.
Some clues to the “anonymous buyers” would be interesting.