Some more questions and comments on the attribution cartel came up after my AdExchanger piece on What Happens When The Attribution Cartel Meets Advertising’s Halo Effect? ran.

Doesn’t the attribution cartel have better privacy properties than other ways of measuring advertising?

In theory, yes. Attribution cartel proponents claim that their system makes it prohibitively hard to match the person who saw an ad (impression) to the person who bought something (conversion).

But all the big problems with the attribution cartel are still there if you assume

• the design is perfect

• the design is implemented perfectly in large browser codebases

Designing a system without meaningful protection from fraud creates incentives to do fraud. And adfraud is not a “victimless” problem. The Big Tech companies assume adfraud isn’t a problem, because it’s revenue-positive for them and the costs fall on other players—but in practice, a high-fraud environment means not only that legit sites are under-compensated and advertisers fed misleading data, users are at greater risk. (I covered that problem in The Hidden Dangers Of Privacy-Preserving Attribution – And A Smarter Solution.)

The mathematical properties of this one proposal in isolation aren’t enough to justify a claim that it “provides better privacy.” It has to be understood in context. Like the man said,

A process cannot be understood by stopping it. Understanding must move with the flow of the process, must join it and flow with it.

Put the Attribution proposal up on a poster, award it a math prize, and I’ll give it a round of applause. But don’t put it out on the real Internet where it will cause all kinds of grief. And it could still have design or implementation problems after all that. Remember TURTLEDOVE came out on January 16, 2020 and the “Malicious match key provider attack” didn’t happen until March 24, 2023. (Google “Privacy Sandbox” timeline)

Can organisations the size of attribution cartel member companies really keep so much fraud a secret?

The Big Tech companies love to run yet another season of the layoffs reality show, and inside knowledge of attribution fraud would be like an immunity idol on Survivor, right? Squirrel away one notebook (make a few copies) and you’re resting and vesting as long as you can stay quiet.

But complex reporting fraud issues can happen without any one person seeing the big picture. That’s because the revenue-positive bug effect is a thing. Any large software system will have more tickets than people (or bots) can actually fix. Some are going to end up in backlog for a long time. And when you’re talking about ads, the bugs that go to the head of the list are those that have a big negative revenue impact. Revenue-positive bugs are low priority.

The highest-priority and politically easiest bugs to fix will be those that make the attribution cartel reports different from the “Performance Max” or other Big Tech algorithm. Failure to show a halo effect for ads on legit sites might not even get flagged as a bug. The most obvious example is the whole pivot to video situation, but it can even happen at legit publishers. Gannett had a long-running, likely revenue-positive, bug that caused ads to be erroneously reported as running on the wrong site.

The difference between the Gannett bug and a hypothetical revenue-positive bug for an attribution cartel member is that outside researchers could see Gannett’s.

I don’t claim that the attribution cartel members will be able to do technothriller-level secret-keeping, but they won’t have to. Complexity and incentives will take care of it.

What’s the halo effect? It turns out that in a world where social science results are hard to replicate, and marketing results even harder, one consistent effect is that ads work better in trusted contexts.

• Comscore: The Halo Effect: How Advertising on Premium Publishers Drives Higher Ad Effectiveness

• Moat Analytics Reveal that Quality Journalism Eclipses Industry Benchmarks for Attention

• Newsworks: High-attention media delivers greater profits for advertisers

• The Trade Desk: The value of advertising on premium media

Meanwhile, the attribution cartel companies are all about doing things the other way around: getting the most lucrative possible ad onto the cheapest, crappiest possible content. (ICYMI, ad “safety” at Google keeps getting worse, and the Meta ad scams are bad enough that there’s now bipartisan legislation to combat predatory online scams.)

I wrote that from an advertiser point of view, because AdExchanger, but the attribution cartel is a risk to everyone.

• It’s not just a problem for advertisers who want accurate reports, as Rick Bruner wrote on LinkedIn.

• It’s not just a problem for the publishers who deserve a fair share of the revenue for the advertising results they help drive.

It’s bigger than that. Attribution reports help decide whether advertising budgets get spent on legitimate ad-supported resources that benefit the people being advertised to—or if Big Tech can divert ad money to support slop, misinformation, scams, privacy violations of all kinds, and some of the worst people on the Internet.

If you just read the headlines, it looks like Google’s “Privacy Sandbox” project to centralize control of advertising within the browser is over. But the process continues, now with Apple and Meta involved too.

The time to deal with it is now, before attribution cartel reports become part of an easy or default path to justify spending good advertising money in bad places.

By the way, I thought I might be the first person to mention Shrimp Jesus on AdExchanger, but it turns out that Shrimp Jesus has already been in AdExchanger. They keep up with this stuff. So check it out: What Happens When The Attribution Cartel Meets Advertising’s Halo Effect?

Previously: Attribution and consent, why I’m turning off Firefox ad tracking: the PPA paradox, a Terminator ending for Google “Privacy Sandbox”?, Performance Max Preserving Attribution, Attribution cartel update, Attribution cartel Q and A

Read the whole thing. As far as I can tell, here’s the list of things to check.

• Google Consent Mode (version 2, that is. If you set up version 1, it’s past time to upgrade. Googlers can’t get promoted by keeping old stuff working, so do your part)

• Consent Management Platform (which must support the above)

• Google Analytics

• Google Ads

• Google Marketing Platform

Now remember to set up “Basic vs. Advanced Consent Mode”.

And “Consent Mode reflects your CMP—it does not override it. And each Google platform must be configured to act on those signals.” See the list above.

There’s no “consent mode” in the law, but “consent mode” has to be upgraded—because of code churn on the Google side—and a CMP to configure, and multiply by the number of different Google services you’re using. Yes, this is a lot of Jira tickets, or whatever you use. And if you get one wrong, you lose the compliance game.

This set of changes is due before June 15, 2026. But don’t worry. Google will put out another set any day now.

No, Google doesn’t set up their services to keep sites on the right side of the law by default. No, they don’t even have one illegal/legal switch that you can flip for all the Google services at once. They put work on the advertisers, publishers, and app developers.

When Google tells 404 Media,

This report is based on a fundamental misunderstanding of how our products work. We honor opt-out provided by advertisers and publishers as required by law.

they might be correct, in a sense. If advertisers and publishers read the right documentation and do what it says, or hire the right team of compliance nerds, then maybe it is possible to use Google services in a way that complies with the law. But often people leave things set up in a way that…

• passes more information to Google

• is technically illegal

…and Google can be shocked to discover non-compliance along with regulators.

The conclusion to Vercellone’s LinkedIn post explains.

CMP, Consent Mode, and each Google platform must be configured as a system—not in isolation. Misalignment at any layer = compliance and measurement gaps.

A normal company wouldn’t be able to get away with dumping all this work on others. If one plumber hooked up your water heater to shock you in the shower, you could call a different plumber. Plumbers have to compete, and they read the building code for you.

But Google, because monopoly, just gets to sit back and do monopoly stuff. Google has figured out how to avoid consequences of CCPA-style privacy laws, while still getting a lot of the extra personal data that comes with breaking the law, and putting all the costs, and the risks of non-compliance, onto publishers, app developers, and advertisers. Google shifts the compliance tax onto smaller companies, just as Amazon did with the risks of operating delivery vans on a micromanaged, tight schedule.

Well played, Google.

Naturally, this whole disappointing situation has, as they say, important lessons for policy makers. Drafting a CCPA-clone, or near clone, privacy bill is copying a game level that Google has already beaten. Future laws can and should offer a compliance tax cut to legit companies. More: what California got wrong on privacy laws

It’s Google Ads Safety Report {PDF) time for all who celebrate, and, excuse me, but yikes.

The report is down to three pages from the six they put out last year, and this time it’s mostly a Google Gemini fan post. (Yes, the same LLM that’s behind the 91% right AI Overviews feature.)

I’m going to repeat the point I had last time: if a company is trying to brag on exposing people to less bad stuff, and they’re reporting the amount of bad stuff they blocked, they’re losing. When you ask how many rat turds are in the chocolate chip cookies, and the answer is “we swept up 99 million rat turds at the bakery last year!” that doesn’t make you want a cookie any more.

Look at your spam folder some time. A lot of stuff in there that’s obviously going to get blocked, because lots of people who are bad at doing crimes on the Internet try to do crimes on the Internet (maybe they bought a software package or training course that doesn’t work). The number blocked is always going to be high and not a good indication of the actual safety level. The meaningful metrics to report are on how much of the bad stuff got through—which Google never puts in these reports, because they let a lot through. By design. Features of Google’s ad system, such as Ads Transparency Center and the trademark policy, are set up to give an advantage to deceptive advertisers.

So, the numbers aren’t that helpful, but let’s compare to the 2024 report (PDF) anyway.

2024: 5.1 billion ads removed, 9.1 billion restricted

2025: 8.3 billion blocked or removed, 4.8 billion restricted

So if you add it up, they caught 14.2 billion in 2024 and 13.1 billion in 2025.

Are people really making 1.1 billion fewer policy-violating ads? If the number being made were going down, then why do legit small businesses keep getting priced out, as seems to have been the case in 2025?

2024: 39.2M+ advertiser accounts suspended.

2025: 24.9M+ advertiser accounts suspended.

What about bad sites? In 2024, Google took “site-level enforcement action” against 220,000 publisher sites. Update: there is a “publisher sites actioned” number for 2025, which is at “245k+”.

Pages are probably hard to compare across years, since it has gotten so much easier to vibe CMS a normal-looking article page. So I would expect more. But:

2024: 1.3 billion pages taken action against

2025: 480 million plus

Google’s biggest problem still seems to be sending people to malware from search. There is a “Malware or Unwanted Software” number for 2025, which is at “2M+”

For 2024, “Malicious or unwanted software” was at 19.3M.

Are malware operators really cutting back on Google Search campaigns, or is Google just catching fewer of them? A real “Ad Safety Report” would check in with security firms to see if their customers are getting more or fewer malware installs from search.

But even on the numbers that are easiest to make Google look good on, they’re not doing so well year to year. That’s not a surprise—safety is losing a game that they Google didn’t design for safety to start with.

Anyway, if you are keeping a file on why your household or workplace has ad blocking set up to protect people from Google ads, save both PDFs along with the FBI alert.

(And yes, from the state legislature point of view, this is a good reason why we need working Right to Know: inquiring minds (have a right to) know)

But there’s the possibility of a “works on my machine” feed. Not going to mention a specific company here, but I spotted a feed on an HTTPS site but with HTTP localhost links.

    <title>Funded Startup Blog</title>
    <link>http://localhost:5150/blog</link>
    <description>Awesome technology and business insights from our innovation journey</description>
    <item>
      <title>Our thing works with some other company's other thing</title>
      <link>http://localhost:5150/blog/please-googlebot-dig-these-keywords</link>

See the problem? The links work fine when they preview on localhost with the dev server running, but on the real Internet, not so much. And the feed is technically valid, just not really working.

So for now I am doing this.

def fix_url(source, dest):
    "For sites that leave localhost links in the production RSS feed"
    "Replace the scheme and netloc"
    sp = urllib.parse.urlsplit(source)
    dp = urllib.parse.urlsplit(dest)
    if dp.netloc.startswith("localhost:") or dp.netloc.startswith("127.0.0"):
        logging.info("fixing localhost link to %s" % dest)
        return urllib.parse.urlunsplit([sp.scheme, sp.netloc, dp.path, dp.query, dp.fragment])
    return dest

This is not going to be right in all cases (it doesn’t work if they use a different virtual host for the feed) but for what I have found so far it’s better than letting the localhost links be.

The second assumption is a little tougher to give up. Read The Internet’s Most Powerful Archiving Tool Is in Peril from Aram Zucker-Scharff.

Whatever you think about our machine learning overlord corporations, there’s no doubt that they are sucking immense value from journalists and giving almost none of it back. The only tool media companies really have in their arsenal is blocking.

I used to be able to assume that I could link to something from here, and if the original went away, I could swap in an Internet Archive link. For example, in Before surveillance capitalism and surveillance advertising, there was surveillance marketing I found what I think is the earliest use of the term—not by academics or privacy advocates, but by Mark Cameron in Marketing Magazine.

But now any halfway awake web publisher is going to block archives, Common Crawl, and other services, to try to keep their pages away from the deeply unsympathetic AI tycoons. (If you want a recipe for risotto, go to the library or find a legit human-tested recipe site.)

So that means if I link to something but I don’t have a local copy, it need to be an error. This way, if making an archive.org link doesn’t work, I can put up the local copy if it’s a government work or out of copyright for some other reason, or replace the link with a fair use excerpt.

I’m not going to automate it, since a lot of sites are going to be good enough at avoiding scrapers that they could avoid whatever I could set up. But now there’s one more task to add to the new page build process.

(Updated 19 Apr 2026)

What’s attribution and why does it matter?

Attribution is the process of correlating events, such as exposure to advertising, to an outcome, such as a sale. Usually people say “impressions” for the event and “conversions” for the outcome. See Digital Attribution Primer (PDF) from IAB.

The current state of attribution can be split into two tracks, paywalled vs. free: Paywalled is more scientific, and the free kind is what advertisers get from Google and Meta. More on that: Big Tech is squeezing advertising jobs and companies

Attribution matters because it guides advertising decision makers in determining where ad budgets get spent. Ad money can support legit sites and other resources that help the people being advertised to, or end up supporting parties that work against the interests of the people being advertised to.

How is the attribution cartel defined? Who’s in and who’s out?

The cartel members are some well-known companies that agree to operate an ad tracking scheme that will not require consent or be subject to objections or opt-outs. To get a peek of how this would work, a recent version of Firefox shipped with both an attribution tracking preference (on by default) and Global Privacy Control. But turning on GPC did not turn off attribution tracking.

A non-member is any company where consent, objections, and/or opt-outs apply to all of their personal data practices.

What would be the impact of the attribution cartel on web publishers and advertisers?

Giving large platform companies control of attribition would tend to aid their current tendency to shift more advertising onto low-trust content and AI-generated slop. What Happens When The Attribution Cartel Meets Advertising’s Halo Effect?

Is “attribution cartel” a negative or pejorative term?

No. The term “attribution cartel” reflects a Neutral Point of View. The attribution cartel meets all the generally accepted criteria for a cartel, according to their own meeting notes.

• The members are, at the same time, partners as well as competitors.

• The members of a cartel are independent of each other…there have to be at least two participants and they determine their interests autonomously.

• The members of a cartel know each other; they have a direct relationship, in particular they communicate with each other.

A negative term would be something like “attribution racket” or “attribution conspiracy”. It is recommended to avoid using those, and also to avoid terms biased in the other direction such as “attribution community”.

What’s Apple doing in the cartel? Aren’t they all privacy and stuff?

A lot of individual developers at Apple have been trying to protect their users from privacy problems on the web and from sneaky practices by iOS apps for quite a while. But in the big picture, management can justify participation in the attribution cartel by how it will move ad spend into Apple’s own ad system. Just out: Apple Gets Serious About Its Advertising Business by Lara O’Reilly. They’re limiting non-cartel tracking while building up an Apple Business tool that integrates Apple’s own attribution tracking, which you can still turn off but it’s buried under “advanced” somewhere.

The idea is to drive more money into App Store ads instead of to legit sites. If Apple didn’t control attribution, their app store ads would show a negative halo effect, because the App Store is full of fraud, so in the long run they need to either clean up or take control of attribution measurement.

The Attribution proposal looks complicated. Who’s going to run all that nerd stuff?

The point is to integrate into a system that both places ads (on slop and right-wing bullshit, naturally) and reports back that the decision to place ads there was the optimal thing to do. See, for example, Meta Is Launching An Easy Button For CAPI. The “open web” attribution data will feed into a system that shows how low the ROI for open web is compared to Meta’s whatever latest lawful but awful thing is.

But, technically, do the cartel members really need consent?

Questions like this help explain why the idea of g—like the real-world equivalent of one number for “intelligence” in Dungeons and Dragons—is bogus. See IQ is largely a pseudoscientific swindle (Argument Closed) by Nassim Nicholas Taleb. Google is the best example. So every time Google gets caught doing some kind of crime, their immediate response is something like, well, actually, if you were as smart as us you would be able to see that we went right up to the line of what’s a crime, but technically we didn’t cross it. Rachel Myrow at KQED asked, What Is the Point of California’s Privacy Laws if Big Tech Ignores Them? and the response from Google was,

This report is based on a fundamental misunderstanding of how our products work. We honor opt-outs provided by advertisers and publishers as required by law.

Google took this approach to the antitrust cases, too, and we’ll see how that works out for them. They set up an intricate box inside which they may or may not be doing crimes, but you need to be Google level smart to understand the contents of the box. When a counterparty has limited processing power, and understands that their capacity to understand Google is always going to be less than Google’s ability to increase the complexity of what’s inside the box, the counterparty has to fall back on the useful heuristic of just assuming that the box contains a crime. High g doesn’t necessarily mean a high score in the communications or market flavors of “intelligence”.

There’s sort of a version of falsus in uno, falsus in omnibus effect going on here. When a cartel member’s obvious choices have a high crime level (for example, sticking malware links into search results), then a counterparty can use that to assign a predicted crime level to the company’s more impenetrable actions. Having high g and high propensity to crime is like being good at dealing three-card monte: your win percentage is going to be high, but most people in a position to choose whether or not to play will choose not to play.

Attribution cartel members will be able to prove to themselves and to each other that “they don’t need consent” and are allowed to ignore objections and opt-outs, but they’re not trustworthy enough to prove it to non-members of the cartel.

How did the attribution cartel end up at W3C?

At the time that Google was choosing where to host their “Privacy Sandbox” proposals, W3C was still part of MIT, and had a really minimal antitrust policy. And Google managed to get a bunch of obvious anticompetitive tricks in pretty early on. It could have turned into a real mess, but fortunately the Competition and Markets Authority in the UK got involved. (see Google “Privacy Sandbox” timeline)

Meta has been expelled from IAB Sweden because of their persistent fraud problem but W3C, even though it is now a separate legal entity and has upgraded the antitrust policy, still has a kind of old-school Internet “assume good faith” attitude, which doesn’t work for the kind of companies that are members of the attribution cartel.

Why did the CMA release Google from their “Privacy Sandbox” commitments when Google was still active in the attribution cartel?

Good question. James Rosewell, in a LinkedIn post writes,

The government appear to have interfered and guided the CMA to go slow on enforcement. That’s not what UK voters and tax payers expect from government, no matter the party in control.

If Rt Hon Rachel Reeves is serious about economic growth she needs to take advice from the people that know how to deliver it.

After all the CMA’s 2019 study into digital markets found the cost to every household in the UK due to the excessive costs of digital marketing from Google and Meta Facebook’s control over advertising was £500 per household per year.

That’s over £1000 today per household per year.

What’s the Eurostack angle again?

The attribution cartel issue becomes important when you look at possible interactions between news sites that cover politics and the Big Tech companies that have their own political points of view. Right now, the attribution cartel members aren’t as loud about their politics as, say, “X” (the former Twitter) but it’s not going to be realistic to rely on them to be impartial. Facebook Charged Biden a Higher Price Than Trump for Campaign Ads, and the Trump administration is doing substantial advocacy for the attribution cartel members, the bill for which will come due at some point.

Research shows that ads perform less well on “toxic” or brand-unsafe contexts, but in the current political environment the attribution cartel members will tend to avoid “brand safety” measures in the same way that ad agencies do: FTC Orders WPP, Publicis, and Dents to Stop Alleged Brand Safety Collusion. For the attribution cartel, this would mean assigning more favorable attribution numbers to pro-Trump or anti-EU content.

How should state privacy laws handle the attribution cartel?

The big asks are the same as for any other adtech/martech. We need an effective right to know (RtK), and we need the right amount of private right of action.

State legislators mainly need to be looking at the impact of the system, and the potential harms, and considering those independently of whether the system is labeled with “privacy” terms. Just claiming the “privacy” label, or mathematical properties of a system in isolation, should not let it avoid the same legislative attention as other systems. Or more.

It helps to look back at the Facebook housing discrimination saga, which started in 2016 and took a while before Meta actually started obeying Federal law. Real-world privacy harms are harder to track down when Big Tech obfuscates them. State legislatures need to make sure we have effective RtK including inferences, and a common sense level of private right of action.

When in doubt, keep the law simple and general and leave as much up to the jury as possible. (The Flo case was common sense one, bullshit documents zero.)

More: More attribution cartel Q and A

Greg Kroah-Hartman told Steven J. Vaughan-Nichols that as of about a month ago, AI bug reports are not just slop. Now we have real reports. All open-source projects have real reports that are made with AI, but they’re good, and they’re real. All open source security teams are hitting this right now. And Thomas Ptacek writes, Vulnerability research is cooked.

Vulnerabilities are found by pattern-matching bug classes and constraint-solving for reachability and exploitability. Precisely the implicit search problems that LLMs are most gifted at solving. Exploit outcomes are straightforwardly testable success/failure trials. An agent never gets bored and will search forever if you tell it to.

Even if you believe that the LLMs will eventually be able to fix security issues in an automated or semi-automated way, there’s still a period of time coming up when much more human bug fixing will be needed to deal with the “flood.” Any codebase (open source or proprietary) comes with a short position in maintenance programmers, and all this LLM bug report news means the short squeeze is on.

Things seen pretty quiet over at the attribution cartel. It’s not secret like the lysine thing was—they have a GitHub repository at w3c/attribution: Attribution API and everything. They’re still going, as far as I can tell, but not getting a lot of ink.

The attribution cartel is learning from the failure of Google’s “Privacy Sandbox”. Where Google’s 2019-2025 project was noisy, the attribution cartel is quiet. Where Google tried to do a full ad stack in one browser, the attribution cartel is doing one key piece of the stack across multiple browsers. So far, it seems to be working. My best guess as to why is, as they say, all this. The companies involved have so flooded the zone that dumping one more load can happen without attracting much attention. With the whole “AI” infringement situation, the fraud and malware crisis on search and social, and Big Tech’s economy-wide trust collapse in general, it’s not a surprise that this thing is moving but not raising much of a stink.

So what’s so bad about the attribution cartel?

Fraud part 1: Designing attribution tracking without fraud protection wastes advertisers’ budgets and deprives legit sites of revenue.

Fraud part 2: What’s worse is that fraud creates incentives to “front-run” conversions, so adds more incentives for risky data practices. For example, a future fraud operation would be able to “win” attribution by running a covert speech-to-text app using smart TV microphones to identify households already about to buy. Turning on the mic isn’t part of the “Attribution” proposal but “Attribution” provides the incentive and cash-out mechanism to give more players a reason to do it. (More: The Hidden Dangers Of Privacy-Preserving Attribution – And A Smarter Solution)

Failure to pass attribution to trusted legit sites: What Happens When The Attribution Cartel Meets Advertising’s Halo Effect?

Boundary testing probably best describes the Google “Privacy Sandbox” saga and is happening again. On August 22, 2019, Google pitched “Privacy Sandbox” as an alternative to fingerprinting. The deal was if people accept some in-browser adtech, then Google won’t have to fingerprint them. After the project had gotten some momentum, though, Google changed their policy to allow (and for practical purposes, encourage) fingerprinting. The “Privacy Sandbox” project may have been completely sincere from the point of view of the individual Googlers advocating for it in public—but it was part of a program of centralization of power.

There is a lot of online advice about how to handle boundary testing. See Why People Push Boundaries & How to Protect Your Peace by Brooke Sprowl. In general, it’s good to clearly communicate the boundary and consequences for violating it as early as possible. Thanks to early and creative development of spam filters, the Internet of the late 1990s and early 2000s did a much better job with setting and enforcing boundaries on acceptable email practices than today’s Internet is doing on modern Big Tech schemes. But there’s still time to get out in front of this one. On the optimistic timeline for the attribution cartel, widely adopted privacy tools are already set up to block it before the browser origin trials start.

Breaks Right to Know: A common feature of privacy laws is right to know (RtK). Sometimes called a data subject access right. Policy makers and Big Tech have different interests here.

• Big Tech wants to profile you and deliver deceptive,ICMYI: Mark Cuban’s FTC comment. Why are online platforms like Google, Facebook and others accepting these ads? By definition, the use of images from Shark Tank are copyright violations and they all have technology available to identify fraudulent ads that they choose not to use (emphasis added) personalized ads and offers. (they have to, because growth stocks) This goes for everything from small-time personalized/surveillance pricing up to fraud and large-scale political misinformation.

• The drafters of privacy laws typically want to expose deception and discrimination, so they give us a variety of RtK options. Although RtK can be time-consuming, it’s effective as part of a research program or for some kinds of lawsuits.

The attribution cartel recognizes that a well-designed RtK will expose a lot of illegal or actionable practices. So the “Attribution” proposal hides discrimination by moving measurement into complex ML systems. Right now the “Attribution” proposal covers only measurement, not ad placement. But it measures high-discrimination and low-discrimination placement choices on an equal basis.

For example, say an employer has disability and language prejudice in the hiring process, and uses two demand-side platforms to run ads for seasonal employment. One DSP uses a conventional ad placement methodology. The other DSP uses ML to avoid running ads to people with disabilities and speakers of certain languages. The “Attribution” proposal lets that discrimination ML hide in the same way that it lets a front-running attribution fraud operation hide. If someone suspects that they aren’t getting certain job or housing ads, the conventional adtech system gives them a thread to pull on, and sometimes they can make a case out of it. Adding “privacy-preserving” math to attribution tracking obfuscates the evidence, allowing Big Tech to keep serving the advertisers who prefer to discriminate.

Forum shopping: Attribution cartel members chose to work in a forum where Big Tech is present, but advertising experts and smaller competitors are not. Current best practices on how to measure advertising results (check out Geo RCT Guide from Central Control and discussions of attribution requirements at the IAB Tech Lab’s Project Rearc) don’t match up very well with the capabilities that the attribution cartel offers. That’s not surprising—Central Control is working for their clients, as are many IABTL members, and the attribution cartel is working for the attribution cartel.

Platform oligopoly is built in. Key features of the proposed system assume a power imbalance between large platform and small advertiser. One example is the so-called “privacy budget.” If an advertiser makes a mistake on one query, they can be locked out of future queries regarding the same ads. A large monopoly or oligopoly company—the kind of firm that can fail to provide user support and make users go to the Attorney General for account issues—can enforce this kind of one-sided requirement on a smaller advertiser, but in an environment where advertiser, publisher, and intermediary companies are of similar size, that doesn’t work. The power imbalance built into the “Attribution” proposal would lock us in to a centralized, oligarchic Internet future.

Attribution reporting criteria don’t match market norms. When people participate in markets, they want trusted counterparties to have more information, while protecting information from being disclosed to parties they don’t trust. For example, you probably want your local newspaper to have more information on you than some random site that your uncle sends you a link to, or a creepy social site you click on a link to. The attribution cartel doesn’t match this expectation, so facilitates commodification of ad contexts.

User research: Jereth et al. found similar perceived privacy violations for a browser-based advertising system as for conventional third-party cookies. and Martin et al. found misalignment between privacy-enhancing techniques and the privacy that people expect. Some users found conventional cookie tracking more acceptable than the more complex system. [F]or improving services across contexts, consumers judged the use of raw data as more appropriate compared to using inferences based on that same raw data.

Environmental impact: Protests against data centers in the USA are somehow one thing that a divided nation can agree on. The attribution cartel is proposing burning a lot more cycles than conventional adtech/martech—not to get privacy as experienced by people, but in order to add some mathematical properties that (see user research above) people don’t want. (W3C already had a big argument over proof of work for identifiers—W3C overrules Google, Mozilla’s objections to identifiers—and the attribution cartel is setting things up for another round of sustainability debate.)

Single country dependency. At a time when more and more IT decision makers are looking for alternatives outside the USA (France to ditch Windows for Linux to reduce reliance on US tech—that’s a big project.) Play La Marseillaise. Play it! the attribution cartel is going the other direction.

The attribution cartel ate somebody’s pet cat in Ohio! Just seeing if you were paying attention. (Watch, this is going to be the one fact from this page that makes it into the “AI Overview.” Oops.)

“Pivot to Video” again…really? Laura Hazard Owen at Nieman Journalism Lab said it best. News publishers’ pivot to video was driven largely by a belief that if Facebook was seeing users, in massive numbers, shift to video from text, the trend must be real for news video too — even if people within those publishers doubted the trend based on their own experiences… (Making decisions based on authoritative numbers from Big Tech has been tried, and publishers and advertisers are not solidly in fool me twice, shame on me territory. Read the whole thing.)

Previously: Suspicion and slop in the rugpull economy. I checked the Costco site and compared prices:

• Kirkland Signature Ultra Shine Liquid Dish Soap $9.99

• Dawn Platimum Advanced Power Dishwashing Liquid $11.59

Both 90 oz. bottles. (11.59-9.99)/9.99 = 16% price premium for the big-time brand.

Back in 2012, Consumer Reports compared big brands to store brands and found an average of 25% in savings. which means that the big brands had an average 33% price premium then.

The peak surveillance advertising years have been terrible for the big, heavily advertised brands. Meanwhile we have seen growth in A-list store brands—Costco seems to be disciplined about not releasing a Kirkland contender unless they can do it at a comparable quality level to the leading brand in the category.

Maybe

• other signals of quality (online reviews?) are relatively stronger compared to brand advertising?

• investments in surveillance advertising have displaced R&D, resulting in less differentiated brands on average?

P&G did not come in to the surveillance advertising era with a data or IT disadvantage, but surveillance advertising has not been good to them. So now, what’s the plan here? (If it’s personalized/surveillance pricing that’s not going to work any better imho.

<link href="https://blog.zgp.org/.well-known/myterms.json"
      rel="terms-of-service"
      type="application/json">

By way of a short recap, a big part of the problem of tracking and targeting is information asymmetry. When a brand appears to know more about you than you’ve consciously shared, it triggers the same evolved instincts we use to detect threat, manipulation, or social imbalance. In evolutionary terms, that’s not a ‘conversion opportunity’. That’s a red flag to our stone-age minds.

What is designed as ‘relevance’ is not the same as trust (implicit as it is).

Personalization and trust tend to have a negative correlation. Rory Sutherland uses the example of a wedding ceremony. You don’t go around and tell people one by one that you’re together, you make a big deal of the celebration. And possibly the worst-personalized advertising medium, Little League sponsorships, is the best at trust building. Leagues keep photos and records, making team sponsorship a bad deal for a fly-by-night company and a good deal for a business that expects to offer win-win products or services in the long term.

Where did it all go wrong? Michael Farmer, in Why Have Most Advertisers Suffered From Slow Brand Growth Rates Since 2009? Ten Major Reasons, points out the problem of advertiser growth since 2009, when 2/3rds of major advertisers saw their sales growth rates fall to well below the nominal GDP growth rate of 4.7% (2.4% inflation plus 2.3% real growth).

A legitimate company like P&G (2009-2024 CAGR 0.6%) can, to use a polite expression for slop ads, create fast cycle content to drive traffic, but a scammer can always do it better. A scammer can use the best AI slop service and surveillance advertising available this minute, but P&G is always going to be a number of steps behind, because of the levels of approval needed to use some new AI slop service or ad personalization scheme. Often, by the time a big company can get on something, it has already been superseded or EOLed.

Any advertising medium that’s

• worth paying for from the seller side and

• worth paying attention to from the buyer side

has to be based on something that a legit seller can do better than a deceptive seller. Too often, legit companies are trying to compete with deceptive ones in a “move fast and break things” fight that they will lose. Christina Garnett writes,

Customers are more selective because we taught them to be. Their trust is thin because we diluted the very concepts that once signaled honesty and care. They can see when outrage is manufactured, when vulnerability is scripted and when belonging is offered only to drive metrics.

The tricks aren’t tricking anyone anymore. Consumers just feel manipulated.

P&G can make better dish soap than other companies, but they’re at a disadvantage in AI slop and surveillance advertising. Brian Jacobs writes,

If you believe everything you’re told, advertising is really very straightforward. Give your budget to META (insert the name of your favourite platform here). Send over your objectives and brief. META (or whoever) will deploy a magic AI tool, which will design a selection of ads. The alternatives will be pretested. They will then place the winning execution across their individual channels.

Meta advertising works better for a random drop-shipper than for an established firm with an actual detergent research lab. Meta ads work fine for a while, if the point is to trick people into voting for crooks or buying crap. A recent Meta success story, the “fastest growing company in history”, is a weight loss scam that makes up physician testimonials and uses face-swapped patient photos. (See The back story behind the first “$1.8 Billion” dollar “AI Company” by David Marcus.)

Meta’s personalized advertising is auction-based, and we have known since 2006 that auction-based ad platforms eventually bid up rates to extract all the profits from the advertisers that use them (Jakob Nielsen’s analysis applies not just to search, but to other auction-based designs including RTB and social). If typical advertisers on Meta’s sites and apps were anywhere near as successful as the outliers that make the news, then The “Passive Income” trap ate a generation of entrepreneurs wouldn’t be a thing. And it’s not just the small-timers. Relying on auction-based advertising is showing up as a problem for well-funded firms too. Allbirds are canaries in the Meta coal mine, along with Oddity Tech, which went all in on personalized cosmetics on Instagram.

The winners in the surveillance advertising game are the Big Tech platforms that design for scams and the scammers they enable. In The Myth of the Unwanted Internet, Julian Morris asserts that the Internet “solved for trust” by adding user-tracking features. But that doesn’t describe the Internet as we currently experience it. In fact, we’re in an economy-wide trust collapse because of decisions to add surveillance features that give deceptive companies advantages over legitimate ones. A 2025 FTC report showed a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024—before the change of administration to one that’s more friendly to large, deceptive companies. Thanks to decisions by politicians to prioritize “innovation,” the scammers even have their own payment platform, “crypto ATMs” and music scene.

It’s time for a more market-aware approach to privacy legislation and regulation. Instead of making the unrealistic assumption that surveillance advertising has some kind of economic benefit that needs to be balanced with user privacy interests, we have to recognize that consumers and legitimate companies are not on opposite sides, but cooperating players in a game with the goal of making win-win deals. The opponents are the Big Tech companies and the scammers. And the problem isn’t specific data practices that could be replaced by clever but pointless math. Privacy people need to bring more and thicker PDFs to the privacy bill hearings. More: advertising personalization: good for you?

Instead, the big prediction market news is ‘Gamblers on POLYMARKET vowing to kill me if I don’t rewrite Iran missile story’… by Emanuel Fabian at The Times of Israel. Journalists were offered bribes and received threats over changing a news story that was key to resolving a prediction market contract. The big connection between news organizations and prediction markets is not competition, as Prof. Robin Hanson suggests, or a source of one more ticker on a crowded news screen, but dependency. A prediction market needs an outside source of information, or “oracle” to resolve contracts, which for most kinds of world events markets means a news site.

The Times of Israel situation is a much larger scale version of a problem that we ran into with bug futures. The cost of resolving a contract is high relative to the value of the contract. That applies to both really small incentivization market issues (does this patch fix this bug?) and big picture markets. Previous criticism of war markets, such as Gamblers can now bet on the outcome of wars – and that’s a problem, by Karoline Thomsen and Douglas Guilfoyle, focuses on the problems of corrupting decision makers and incentivizing leaks. But insider trading is a feature, not a bug. Prediction markets tend to blend into incentivization markets. Prof. Andrew Gelman writes,

To put it another way, the ideal for a prediction market is for it to have high stakes (so that it’s costly to try to manipulate the price) with bettors being people with no influence on the outcome. But such a market will be a ripe target for people who can influence the outcome and for insider trading.

In general, the possibility of insider trading is a win for prediction markets—and a good argument for why there should be more prediction markets—because they could disincentivize people from forming the kind of large, untrustworthy organizations whose members are likely to participate in insider trading. But the oracle problem is a lot bigger. The solution we came up with has two parts.

First, pay the oracle, a lot. Reporting from a war zone is obviously costly and risky, but resolving any market is usually going to cost a pretty high fraction of the money at risk. So we imposed high oracle fees, which are paid by the winners and disclosed up front.

Second, make it easy for traders to avoid the oracle fees by getting out of their positions. So you end up with a market that trades in a narrower band of prices (there are no worthless positions. Even a bet on an impossible event is worth about the same as the oracle fee, because the holder of the winning side would rather get their 90% now than hold out for 100% minus a 10% oracle fee at maturity.)

Oracle fees are easy for an internal bug futures market or other internal corporate prediction/incentivization market, but for markets on news events, where the oracle is an outside source, markets need other options.

• Public sector oracles. Government bodies such as United Kingdom Maritime Trade Operations and the Bureau of Labor Statistics already produce oracle-ready information. And prediction markets provide an anti-corruption and counterintelligence check on those. It’s hard to tell if a government agency has a foreign spy, but an insider trading problem will be more likely to show up in the market numbers. (For example, the current US administration is obviously leaky, and prediction market trading patterns help people decide whether to share information with it.) So there is a good case for the public sector to provide oracle-friendly event reports.

• A copyright-like oracle right for news organizations. Article One, Section 8 of the United States Constitution just says securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries, so an oracle right would probably work here. Partnerships between news companies and prediction markets are a thing, but there’s still a free riding problem that an oracle right would help address. If a news site is not opposed to prediction markets on principle, it has lots of incentives to seek oracle deals, including because of the money talks bullshit walks effect. Total money at stake in contracts for which this site is an oracle could be a useful qualitative news metric, and a news site that can’t be a reliable oracle is probably unreliable in other ways too.

News site revenue is a hard problem, and diversifying revenue is a big deal. Although a lot of people like micropayments, and the ability of a site to get micropayments is a useful crowdfunded quality check, micropayments have a fundamental problem. Much of the value provided by a news site is the stories that didn’t happen. Nobody would pay to read “City Council Didn’t Steal Everything In Town Because a Reporter Was At The Meetings” but that (unwritten) story is worth more to the town than the alternative.

It seems like the viable options are either an actively enforced ban on prediction markets, which would limit the number of people with the resources and incentives to bribe or threaten reporters, or an enforceable oracle right, which would give the news organization additional money to keep reporters safe and honest, and an incentive to stay accurate and useful as an oracle in order to keep oracle deals. Otherwise, traders on free-riding prediction markets, whether legal or illegal and tolerated, have the ability to subvert the news sites they use, but the news sites have no funding for their defense.

The long answer is that a dirty business has gotten dirtier. Not only have the ads gotten heavier (I went to the New York Times to glimpse at four headlines and was greeted with 422 network requests and 49 megabytes of data. It took two minutes before the page settled.) and added more aggressive data usage as they refresh on the page, the business side is all in on the low-trust economy, too.

Advertising’s hottest club is “principal buying” or “principal media”—big agency holding companies functioning not just as agencies to buy ad space on behalf of clients, but trading ad space for their own account before the client sees it. Nick Manning explains.

This has been going on for decades, especially in markets like Asia Pacific, Eastern Europe and Southern Europe. Broadly speaking, what’s happened over time is that those practices [were] imported into the U.S. around 2010-2011.

The thing that’s made it happen more recently is that the [agency] groups started to see their other revenues decline, and this is one way of arresting that decline — but it’s also easier to do this because you don’t have to win new clients, you don’t have to pitch, you don’t have to employ any more people. You just have to set up the financial machinery to do it.

A decades-old practice is getting more attention now, because of two stories.

• Paperwork that has come out in a lawsuit by a former WPP employee.

• A beef between another large holding company, Publicis, and a “demand-side” adtech firm, The Trade Desk, with each company accusing the other of non-transparent practices (and IMHO they’re both right).

Covered in The Rise Of Principal Media And The End Of The Agencies As We Knew Them by James Hercher. Companies that are in a position to get a peek at principal buying from both sides—as both owners of ad-supported contexts and buyers of ads—aren’t sold on it.

WPP’s legal disclosures reveal that none of its top 20 biggest clients participate in principal media – despite the fact that many of WPP’s largest brand accounts are themselves the purveyors of principal media deals on the supply side, including Paramount, Comcast, Uber, Amazon, Google and Sony.

These brands stand to gain the most from principal media, which rewards pure volume. They’re also very knowledgeable about the practice, which is perhaps one reason they avoid it when they have their buy-side hat on.

More info in The Trade Desk-Publicis Fight Is Really a War Against Transparency by Jay Friedman and Publicis vs. The Trade Desk isn’t really about transparency – it’s about who gets the margin by Ronan Shields.

When something isn’t easy to measure, price becomes the proxy. So, the world’s largest agencies now essentially pitch for free and operate on razor-thin disclosed margins.

To survive, they have to generate profit from hidden fees and undisclosed arrangements.

Marketers, in turn, reward this by continuing to hire and rehire the agencies that play the game most aggressively.

This forces increasingly complex schemes and systems, which pulls time, energy, and talent away from the thing the agency was theoretically hired to do in the first place: drive brand growth.

Michael Farmer has more info on how big agencies have failed to keep the rates up for the legit side of their businesses: Price premiums are the ultimate measure of successful professional relationships. Holding Companies have failed to achieve them

Besides brands, the other big losers from this whole mess are the long-suffering legit ad-supported sites, whose business model is like selling fresh artisinal donuts to a market that makes a point of not being able to tell a donut from a turd. More on that problem in The SEO parasites buying, exploiting and ultimately killing online newsbrands by Rob Waugh. Sites typically go from being viable outlets, still valuable enough to be bought for large sums, to being filled with AI-written articles and casino links, before simply being abandoned.

The same site refers to stories on Phoronix and others, too. At least they link to their source material. The sad part is that even though this site is missing an ads.txt file, it does have ads showing up for at least one real consumer electronics brand and one real business event.

TechCrunch does have the story that the error message seems to be about, so maybe either there was an error in the crawler, or TechCrunch was able to block the crawler, or I happened to visit while TechCrunch was in the process of catching this site doing this.

I’m not going to name the site because first of all, the company that runs it has a lot of domain names, and second, now that they have their automatic slop CMS going, they can always get more. The point of writing this is not, look, I found a slop site, everybody add it to your blocklist. The point is that the advice to use a blocklist to keep your ad from showing up on crap sites was always bogus—even before widespread use of LLMs, editing a blocklist for one brand or agency was always a losing race against all the crap site makers in the world registering domains.

Looking back at advertising history, getting ads into legit contexts is the original role of an ad agency. Back when the advertising options were basically signs and newspapers, a manufacturer couldn’t read all the local newspapers, so they needed a trusted set of eyes to keep up with which newspapers really reach the people they claim to, and handle the process of placing insertion orders and paying invoices. Agencies only started making the actual ads later. Yes, sellers of ads space tried to subvert agencies, and sometimes succeeded, but the expectation was that the agency works for the advertiser. (Part of the reason for the crisis that big agencies are in now is the shift from agency agency to inventory flipper.)

The slop situation should be an opportunity for agencies. (Not an opportunity to make slop—a dedicated platform tool will do it better.) The Forum on Information and Democracy has details, in the new report The online advertising market needs urgent, structural reform to support democracy and journalism.

Advertisers lack control over where their ads appear and what exactly it funds. This leads to significant resource wastage on platforms that promote low-quality or misleading AI-generated “made for advertising” (MFA) websites that would otherwise reach news publishers.

Legit sites are more effective than slop as an advertising medium, but slop is the default.ICYMI: Google is Robbing You… and You Can’t Stop Them by Collin Slattery If the default is running on slop, then a brand or agency can get attention by doing the opposite.

Just announced: the new Navigator Award. They’re looking for ad-supported sites to nominate brands and agencies.

The Navigator Award gives publishers a way to recognize the brands and agencies that have made a real, intentional effort to show up in trusted news and publisher environments, especially where blanket approaches to brand safety and suitability would have made it easier to stay away.

Who is successfully avoiding the slop mongers and making a real impact?

Groups of Unknown Drones Spotted Over US Base Housing B-52 Bombers by Dmytro Shumlianskyi. These drones did not resemble commercially available models—they were high-tech, had a significantly greater range, and were resistant to electronic countermeasures. (Related: Surveillance risks and the TIDALWAVE report)

Pakistan’s solar boom is helping it save billions during the ongoing energy crisis by Adele Peters. Pakistan gets almost all its oil and gas from the Middle East, where U.S. and Israeli bombing of Iran have caused crude prices to blow past $150 a barrel and tankers can’t get through the Strait of Hormuz. But it has one edge in the crisis: a rapid, recent shift to solar power.

Germany Mandates ODF for Public Administration in Sovereign Digital Stack by Bobby Borisov. Germany has mandated the Open Document Format (ODF) as the standard for public administration documents within its new sovereign digital infrastructure framework, the Deutschland-Stack. Published by the Federal Ministry for Digital and State Modernisation, the framework sets technical standards for a unified, interoperable digital environment across all government levels. It explicitly requires ODF and PDF/UA as document formats, excluding proprietary alternatives from official use.

Lina Khan was right by Victoria Song. The FTC’s Meta lawsuit was often framed as an abstract attempt to rein in Big Tech. But in the end, the acquisition’s human cost was obvious—and an example of precisely why antitrust law matters.

90% of crypto’s Illinois primary spending failed to achieve its objective by Molly White. The cryptocurrency industry super PACs dumped $14.2 million into the Illinois primaries. 90% of that – $12.8 million – was wasted, in that it went to opposing Democratic candidates who won their primaries.

How China Aligned Itself with Saudi Arabia’s Vision 2030 by Hesham Alghannam. As for the localization of the renewable energy industry in Saudi Arabia, in July 2024, China’s Envision Energy entered into a joint venture with the PIF and the Saudi manufacturer Vision Industries, a private company, to build a turbine factory in the kingdom….Saudi Arabia also signed two other joint ventures with Chinese companies to manufacture and assemble equipment and components for solar power.

IBM and Ogilvy end 32-year creative partnership by Luz Corona. (All the Linux advertising I remember from the Linux boom was for IBM.)

‘New era for street vendors’: Mamdani names top advocate as NYC’s vendor czar by Arya Sundaram. Our street vendors are not a problem to solve — they are a community to support, the mayor said in a statement.

How Brazil’s innovative ‘Pix’ payment system is angering Trump and Zuckerberg by Vitoria Barreto. [Paul Krugman] emphasised that Pix is achieving what cryptocurrency boosters claimed, falsely, to be able to deliver through the blockchain—low transaction costs and financial inclusion.

Outpost Moved its Servers to the E.U. by Ryan Singel. Just to be clear, Outpost has never had a data request, subpoena or National Security Letter dropped on us for our data or any member publisher’s data. But we still thought this was a prudent step given the current political environment.

Beavers can turn streams into carbon stores – we measured how much by Joshua Larsen, Annegret Larsen and Lukas Hallberg. So when beavers dam rivers, they can also fundamentally change how carbon is stored in river landscapes.

Federal Cyber Experts Thought Microsoft’s Cloud Was “a Pile of Shit.” They Approved It Anyway. by Renee Dudley, with research by Doris Burke. For years, reviewers said, Microsoft had tried and failed to fully explain how it protects sensitive information in the cloud as it hops from server to server across the digital terrain. Given that and other unknowns, government experts couldn’t vouch for the technology’s security.

How Can Governments Pay Open Source Maintainers? by Terence Eden. When I worked for the UK Government I was once asked if we could find a way to pay for all the Open Source Software we were using. It is a surprisingly hard problem and I want to talk about some of the issues we faced.

Bogdan’s Blog – Windows 8 Was Peak Microsoft and I will die on this hill I know it’s a hot take, and some of y’all might already be reaching for your keyboards, but I don’t care. I used Windows 8 on my desktop, used it on a janky 2-in-1 laptop, and had a blast with both. Dare I say, it might’ve been the snappiest, most responsive version of Windows ever released.

The analysis of 86 public companies across 17 sectors, using 15 years of public revenue data from 2009-2024 reveals a striking disconnect between modern marketing theory and actual revenue performance. Massive digital spending has failed to drive meaningful revenue expansion for most brands over the 15 year time span.

Some brands that spend a lot on modern advertising are growing more slowly than the economy as a whole. In Holding Companies Need High Level Strategic Plans, Not Just Announcements of New Structures and Cost Reduction Targets. Independent Agencies Will Take Advantage…, Michael Farmer writes,

Public data tells us that the 2009-2024 sales growth rate of 40 out of 60 major advertisers has been very depressed, averaging (as a group) only 2% per year for 15 years.

By contrast, the market had real GDP growth of 2.4% per year plus inflation of 2.3% per year — so the benchmarked nominal GDP growth rate was 4.7% per year.

Imagine! The group of 40 out of 60 big-spending advertisers grew at less than half of the nominal GDP growth rate for 15 years.

Dr. Fou suggests adfraud and under-investment in brand-building advertising as contributing factors. Another problem may be that money spend on surveillance advertising tends to crowd out investments in product improvements, or require disinvestment in products and services, much as sports betting tends to crowd out investments by households. Trader Joe’s peanut butter cups have milk chocolate, no ads, and no ingredients list drama.

The future timeline in which the role of marketing decision-makers is reduced to, effectively, interacting with an “AI”-based central planning system is already partly here. In Orwellian “Doublethink” and Programmatic Advertising, Farmer writes,

Programmatic is successful in generating income for Big Tech, particularly for Google, Meta, Amazon, data providers and martech infrastructure owners. Anyone beholden to or involved with Big Tech sees programmatic advertising as “good.” (What must be ignored is that the publishers and agencies are being starved of revenue by Big Tech…and agencies will be eventually squeezed out by Big Tech.)

Eventually could be soon. According to some documents that came out in discovery, at least one of the major agency holding companies is disturbingly reliant on “proprietary media trading” as their pricing power declines. Tom Denford writes, in 3 Things Marketers Must Do After the WPP Disclosures,

At the same time, the leaked “Project Claridges” presentation, released in ongoing litigation, shines a light on $1bn of what WPP calls a “non‑product related income” engine built on rebates, content deals and, most significantly, proprietary media trading. That disclosure doesn’t just affect WPP, it validates what many CMOs have long suspected about the wider holding‑company model.

Maybe surveillance advertising is working, and working so well that the Big Tech companies are capturing all the value created by it?

But it doesn’t look that way. Meta and Google are taking the kinds of high-profile risks of doing obvious crimes that a legitmately growing company shouldn’t have to. IAB Sweden just voted to expels Meta over crime issues, which is not the kind of thing that industry organizations just do to a major member. If we were on the timeline where Big Tech were making sustainable revenue from their advertising oligopoly, they would have been able to reverse fraud-friendly decisions and smooth this kind of thing over. Instead, because the companies are forced to juice their stock prices without enough legit revenue to justify it, the tricks continue. For example, they’re consolidating ownership of how ads are measured by putting obfuscated ad reporting into web browsers.The surprising part is that Apple is still going along with that one. It seems like they would have taken the opportuntity to squeeze Meta and Google, like they’re squeezing the laptop business by releasing a bargain-priced but good Mac OS laptop right when everyone else is dealing with the RAM shortage.

Surveillance advertising hasn’t been good for brands, agencies, or the people it tracks. (Even the literature that proponents cite doesn’t really support it, if you read the body copy.) It’s going to be harder and harder to justify the risks. Oh well, see you in the comment files for the next state privacy law.