Cross-posted from the Google Online Security Blog

It’s pretty tough to read the New York Times under these circumstances:

And it’s pretty unpleasant to shop for a Nexus 6 on a search results page that looks like this:

The browsers in the screenshots above have been infected with ‘ad injectors’. Ad injectors are programs that insert new ads, or replace existing ones, into the pages you visit while browsing the web. We’ve received more than 100,000 complaints from Chrome users about ad injection since the beginning of 2015—more than network errors, performance problems, or any other issue.

Injectors are yet another symptom of “unwanted software”—programs that are deceptive, difficult to remove, secretly bundled with other downloads, and have other bad qualities. We’ve made several recent announcements about our work to fight unwanted software via Safe Browsing, and now we’re sharing some updates on our efforts to protect you from injectors as well.

Unwanted ad injectors: disliked by users, advertisers, and publishers

Unwanted ad injectors aren’t part of a healthy ads ecosystem. They’re part of an environment where bad practices hurt users, advertisers, and publishers alike.

People don’t like ad injectors for several reasons: not only are they intrusive, but people are often tricked into installing ad injectors in the first place, via deceptive advertising, or software “bundles.” Ad injection can also be a security risk, as the recent “Superfish” incident showed.

But, ad injectors are problematic for advertisers and publishers as well. Advertisers often don’t know their ads are being injected, which means they don’t have any idea where their ads are running. Publishers, meanwhile, aren’t being compensated for these ads, and more importantly, they unknowingly may be putting their visitors in harm’s way, via spam or malware in the injected ads.

How Google fights unwanted ad injectors

We have a variety of policies that either limit or entirely prohibit, ad injectors.

In Chrome, any extension hosted in the Chrome Web Store must comply with the Developer Program Policies. These require that extensions have a narrow and easy-to-understand purpose. We don’t ban injectors altogether—if they want to, people can still choose to install injectors that clearly disclose what they do—but injectors that sneak ads into a user’s browser would certainly violate our policies. We show people familiar red warnings when they are about to download software that is deceptive, or doesn’t use the right APIs to interact with browsers.

On the ads side, AdWords advertisers with software downloads hosted on their site, or linked to from their site, must comply with our Unwanted Software Policy. Additionally, both Google Platforms program policies and the DoubleClick Ad Exchange (AdX) Seller Program Guidelines, don’t allow programs that overlay ad space on a given site without permission of the site owner.

To increase awareness about ad injectors and the scale of this issue, we’ll be releasing new research on May 1 that examines the ad injector ecosystem in depth. The study, conducted with researchers at University of California Berkeley, drew conclusions from more than 100 million pageviews of Google sites across Chrome, Firefox, and Internet Explorer on various operating systems, globally. It’s not a pretty picture. Here’s a sample of the findings:

• Ad injectors were detected on all operating systems (Mac and Windows), and web browsers (Chrome, Firefox, IE) that were included in our test.
• More than 5% of people visiting Google sites have at least one ad injector installed. Within that group, half have at least two injectors installed, nearly one-third have at least four installed.
• Thirty-four percent of Chrome extensions injecting ads were classified as outright malware.
• Researchers found 192 deceptive Chrome extensions that affected 14 million users; these have since been disabled. Google now uses the techniques we used to catch these extensions to scan all new and updated extensions.

We’re constantly working to improve our product policies to protect people online. We encourage others to do the same. We’re committed to continuing to improve this experience for Google and the web as a whole.

Posted by Nav Jagpal, Software Engineer, Safe Browsing

Cross posted from Think with Google.

Last month at the IAB’s annual leadership meeting, viewability—a metric that shows whether an ad was actually viewed—was the topic on everyone’s mind. This is hardly a surprise. According to the “5 Factors of Viewability” research that we published in December, more than half of ads online today never even have a chance to be seen—something we can and must change. 

As many of you know, we’ve long been advocates of the industry adopting viewability as a currency, a common metric to help both marketers and publishers improve their business results.

And we’ve already come a long way. Forward-thinking publishers are introducing ad units designed for maximum viewability, and thousands of advertisers have taken advantage of viewability-based buying on the Google Display Network since we rolled it out last year. Brands and agencies are prioritizing viewability in their buys, and are seeing that doing so drives better results. 

In fact, in tests we ran this month, advertisers measuring viewability based on the MRC standard for display ads with our Active View technology found that viewable ads saw conversion rates improve by as much as 50%. These viewable ads, with a minimum of 50% in view for a minimum of one second, drove a brand lift of 10.3% while non-viewable ads didn't contribute to lift at all. The business impact to buying based on the MRC standard is real.

While we have made some progress, there is still significant work for us to do as an industry to establish viewability as a currency. The conversation has started to devolve from a collective agreement to tackle the viewability issue to debates over viewability rates and how to value viewable buys. It’s a bit like arguing over whether a recipe needs one egg or two while ignoring the fact that the oven has caught on fire. We are so close to effecting real change on this issue; let’s not lose our nerve now.

It is imperative that we, as an industry, take three major steps:

1. Focus on counting viewable impressions; viewability rates don’t matter

Marketers are not saying that they want a percentage of their campaign to be seen; rather, they are saying they want to pay only for viewable impressions. In this request, viewability rates don’t matter, but the actual number of measured viewable impressions does. 

We believe the industry needs to aspire to 100% viewability, full stop. This means buying and selling only viewable impressions. I understand this is a significant challenge, one we're working to solve on our own media properties; without a solution, however, viewable impressions cannot become a currency for the industry.

2. Adopt a single standard for viewability

It’s critical that our industry accepts a single viewability standard, common to all. Without that, it will be impossible to determine the true value of a viewed impression; create scale; or optimize, pace, and forecast inventory effectively. 

Through collective discussion and analysis, our industry and the MRC worked hard to build and agree on a standard definition of viewability, one that we support. But since doing so, not all of us have supported it, with some advertisers and publishers recently suggesting new definitions. What we cannot do as an industry is resort to building around multiple standards. 

The way to move forward now is to accept the long-discussed, hotly debated, yet proven standard set by our industry. There will be plenty of opportunities for our industry to make adjustments and updates as our understanding of viewability evolves, but we’ll never have that opportunity if we don’t collectively take this first step and establish a true currency. 

3. Resolve discrepancies in measurement 

Discrepancies and low measurability rates are not acceptable, yet today they exist when publishers and advertisers compare viewability vendors. To put an end to these discrepancies, we must not only adopt a common standard but also ensure a shared process and method of measurement. A liter of water is always the same regardless of who does the measurement. The same should be true for viewable impressions.

To get here, we must integrate measurement technology directly into ad serving, with viewability data appearing directly alongside other campaign metrics, accurately reconciled for buyers and sellers.

Looking ahead at viewability

As a technology, viewability is still in its earliest stages; there are many exciting opportunities for us to solve collectively. For example, viewability on mobile will be crucial as consumers spend more and more time on their smartphones. Secondary engagement metrics such as viewable time and audibility (after all, video is about sight, sound, and motion) can start to offer an even fuller picture of an ad’s effectiveness. But our industry won’t get there if we’re still debating the standard itself. 

The best technologies are those that delight their users and then just get out of the way. We’ve come to expect this, for example, in instantly mapping out a route in a new city on our phones or having lunch delivered with just a few taps. My hope is that a year from now, viewability will be a true currency—and just as expected and as simple for everyone. 

-
Neal Mohan, 

Vice President of Display and Video Advertising Products