Identity Resolution Goes The Way Of The Cookie

0:08Welcome to The Big Story, a roundtable featuring members of the AdExchanger editorial team. Every week we bring you an in-depth discussion of key developments in digital marketing and media.

0:23Today's episode is sponsored by Basis, the leading intelligent operating system for autonomous advertising. Its enterprise AI solution transforms campaign briefs into strategies and media plans that integrate directly into omnichannel activation. You can learn more at basis.com.

0:44Today we're going to be covering two very of the moment topics. Apple's crackdown on identity resolution providers and the proliferation of AI slop filled with display ads on the open web. First, Apple made it official this week with a blog post outlining its decision to block identity resolution providers from syncing identity on Safari. And on the same day, Decrypt Ads released a report into just how common it is to see brands placing ads on AI slop. To talk through both of these issues, we are bringing on Decrypt Ads' Zach Edwards. Zach is a longtime cybersecurity and ad tech researcher. Decrypt is his new startup, and as a security and privacy-focused researcher, he also has a strong point of view and insight into what Apple is doing.

1:31Welcome, Zach.

1:32Zach Edwards: Thank you so much. It's an honor to be here. I will continue with the intros then. I'm Sarah Sluice, our editorial director. Also on the podcast today is James Herscher, who wrote about Apple yesterday and over the course of the past couple of weeks, and Anthony Vargas, who covered the Decrypt ads report. Hey, everybody. Great. And two other notes before we start. I want to share what's on my calendar that could be on yours in coming months. I will be at our Top Woman event in a couple of weeks on November 3rd in New York City. And I hope to see some of the honorees and your biggest supporters there, the Chelsea Piers.

2:09We're celebrating all the ambition and accomplishments of the very talented people in ad tech and media. It's really fun. Probably the most glam ad tech event out there. And we're just going to like plant that. Um, and also just to add to your calendar, we've got CTV world's March 30th and 31st in New York city. We've also got ad exchanger connect in Vegas in May. They're both on our website. Check them out for details to come. You can use Sarah MBL most valuable listener for a 10 % discount on early bird rates. I asked marketing to do that. I hope you use it. Um, so let's get started. James, give us the rundown of the Apple blog post, everything leading up to that.

2:52And then we're going to get Zach to give his his intel and insight into that that post. Oh, man, the rundown. So. So, yeah, I mean, I guess to sum up from the very beginning, iOS, new iOS launched about a month ago, blocked a handful of prominent advertising technology. and sort of identity data companies. And this was, you know, everyone was sort of waiting in the dark to see where this was going. Apple had never really done a session about it, had never published a blog post or guidance or anything. So there was, you know, really everyone involved was just looking at one thread between back and forth between the trade desk and Apple.

3:38And, you know, what was new was a couple of days ago, the WebKit, Apple engineering team, sort of a trio of leaders, software engineer leaders over there, published a blog post blocking identity resolution infrastructure, which there's not like a list or something, but it sort of, it seems like, you know, a whole vast, many categories of ad tech, MarTech, CDPs, really any companies that sort of touch on identity data and, you know, not even just like ID providers, but companies that have that data themselves and are third parties. You know, this really sort of lays down the line that Apple is going to root this out literally at the domain level, take very strong steps to prevent really any kind of cross site tracking on the web.

4:35And so I think too, when we go back to that first GitHub interaction, it was like, oh, well, maybe this is some kind of mistake, you know, because all of Trade Desk was blocked and then part of it was restored. And, but maybe there was some uncertainty around. I didn't even get lost in that sort of separate, the Trade Desk particular like quicksand pit or something because yeah, like the Trade Desk main ad serving domain was originally included this back and forth with the trade desk seemed like was, you know, their leading engineers sort of making the case like, oh, I think you've tagged the wrong domain and really like, you know, kind of giving up on like, okay, UID, that was one of the ones that's blocked.

5:20And that is still blocked. The trade desk kind of cookie matching domain blocked, but they did get their main ad server domain pulled from that list. So they are allowed to serve ads again. And I feel like, and maybe, maybe Zach, you've got your intel, but like reading the GitHub, it was just like this very kind engineer, you're like, oh, like you might've made a whoopsie. Like what's the ETA on that? And then I feel like with this blog post, they're like, no, this was not a whoopsie. This is actually our strategy and intent to block all identity resolution providers. They're saying it's, you know, they blocked cookies.

5:55This is worse than cookies. And now we're blocking this too. I'm really curious what you think of this, Zach.

6:06Zach Edwards: Yeah, I think this is classic Apple where they really actually do care about privacy, even though there's a lot of things that they're doing, which there's absolutely reasons to be critical of them. For years now, they've done stuff with Safari and WebKit, which the ad tech industry has been like, oh, my goodness, the house is on fire. Oh, my goodness, they've just stolen the car. Oh, my goodness. And they're just slowly pulling out opportunities for targeting and different types of tracking. And so I think for me, this is not surprising that Apple has acknowledged that there's this giant identity resolution industry that has been getting around a lot of their tracking protections.

6:50Zach Edwards: And when you think about what Apple has done here, I think it's important to also compare it to what Google had done with the privacy sandbox. And the entire industry, we spent years talking about changes that Google was potentially making. They purposefully, in my opinion, allowed the privacy sandbox to be regulatory captured by the UK CMA. So they basically had to defer to this government body when there's never been in the previous instances or since then. An example where Google happened to unfortunately get captured in this way and had to have to defer to a government agency. And I think that there's it's important for us to acknowledge that of Google fought tooth and nail with every single antitrust decision, every single DOJ argument that was being put forth.

7:46Zach Edwards: And suddenly the CMA, this privacy sandbox, which let's be honest, as an ad tech business, they never wanted implemented, somehow got killed. I think that to then be in an environment where that happened and then Apple, instead of going through this long process where they have done it in the past with the app tracking transparency, the intelligent tracking protection, they've gone through this. They've done big main stage presentations about their privacy tech, and it's tended to just drag things out for them. And so it appears to me in this instance that they purposefully basically got all their ducks in a row and then made a decision to cold launch or cold start this new privacy product basically with no heads up on it.

8:36I do think too that it is also a big difference between Google and Apple here is that Google has this, you know, like stakeholder responsibility and not just in like a mission statement way, but like in a way that like many regulatory bodies are, you know, have like a very scrutinous eye on at every moment. and they can't just disrupt publishers and disrupt ad tech and all these whole categories, whereas Apple can just sort of do that. And I think Apple just genuinely doesn't care. I've heard from a lot of the ad tech people affected who I think their angst and anger is that, okay, Apple ruins web advertising to push advertising to apps, where Apple profits greatly.

9:24It gets a 30 % cut of everything. It gets no like cut in Safari, which all sort of like makes sense. But I personally just feel like Apple doesn't care. Like these are just, I think it's more likely that, you know, these decision makers at WebKit have seen some like research that showed, you know, bad actor-y kind of misuse of maybe like say IDFAs or like their tools. There's been some like, you know, interesting stuff published recently like and and you know they just decided like no like we've crossed some line or something like that but it's something apple could do and just google could never do yeah and if you look at like the apple the language in the apple blog post it's like part of the reason it seems maybe they don't care about the impacts to the ad tech industry is they're painting the ad tech industry in a very negative light it's like they're these are all bad actors they're terming it as like the tracking industry you know just like trying to make it sound as shady as possible.

10:21So it's like, you know, what, what, I guess, what kind of, what kind of, uh, concern do you have to devote to the tracking industry when you're blocking it? You know, none, I guess.

10:32Zach Edwards: And the reality is Apple has the IDFA framework in mobile. And so I think it's fair for people to say they could be self-preferencing or they may be doing this, but the teams for the last couple of decades, it's been pretty clear. It's two separate teams. There's a WebKit Safari team that makes lots of very privacy conscious decisions. And then there's an Apple app team that makes very different decisions that facilitate tracking in a different way. And so while I think that it's interesting that people are saying that there's a potential conspiracy or there's some self-preferencing, I think it's also pretty fair to say those two environments have operated very differently for quite some time.

11:16Zach Edwards: And so to be surprised that they continue to do that is... You can make the same argument, though, for Google Chrome, that the Chrome team and the ads team were quite separate. We know they were kind of only allowed to talk to each other, I feel like, in very, very formal ways that were dictated by their higher ups. I think the Chrome team, like in terms of, you know, the privacy sort of like, you know, conspiracies about the privacy sandbox and sort of chess moves. But I think the Chrome team wanted privacy sandbox, like wanted a lot of the, you know, had privacy goals that they wanted to do.

11:54And, you know, maybe like, you know, they are probably they probably feel jealous of WebKit, who can just kind of, you know, move like a speedboat or something and like make a decision. I think they really it's been a long time thing that the Chrome folks begrudge the Google like, you know, having Google on their back.

12:11Zach Edwards: Yeah. And in terms of Chrome and Google ads not coordinating, I'm sure that they're they're basically policy was make sure to CC a lawyer. So this is all about internal legal advice and we can exclude it from ever being leaked in a discovery motion. I so I do I I hear I think Zach what I'm hearing from you is Apple's intentions are pure it's different than the IDFA and the app environment because there is Apple has more of a stake on that side of the business than an ad than in the Safari side but I still am wondering why now because UID has been around for half a decade you know a lot of these trackers have been around for quite a long time.

13:02So it feels a little bit out of the blue, maybe unless you put on your 3D chess or tinfoil hat. Yeah. So let us. Yeah.

13:13Zach Edwards: And I'll put my tinfoil hat on. I love to do that, in fact. And when you look back at past Apple announcements about privacy changes like CNAME cloaking. So one of my favorite things that they did, and I think it's very relevant for all of the organizations that are coming up with first-party data schemes. When Apple made their announcement that they were going to have bounce tracking protection and CNAME cloaking protections, they essentially said there's been a major report that's been released. And essentially, an academic report came out that highlighted all of this different tracking and basically efforts people were making to get around third-party barriers and pass data in a first-party context.

13:56Zach Edwards: And I don't think many people have spoken enough about earlier this year, there was a huge and very important piece of research put out about identity resolution providers from several academics, from someone at Deepsea, from Christoph at Analytics. And I don't know about everyone else, but when I see some of the literal best ad tech researchers in existence coming out and saying, hey, there's a problem with identity resolution providers. We've literally looked at years of data and listed out all of the issues that they're seeing. One, I assume that there's probably other research behind the scenes and people that have been doing this and potentially sharing details privately with Apple.

14:43Zach Edwards: And two, whenever you have serious folks explaining these types of harms, there will be people listening. And if they have responsibility to put up defenses, trying to do that. And so I think it's more of a situation where ad tech has created their own ID scheme. These hashed ID schemes are novel. They've mostly been introduced since people were proposing the deprecation of third party cookies. But hashed ID schemes, especially the pre-bid and the variety, are unsafe at scale. Period. End of story. They are basically anyone who has a large amount of these hashed emails can de-anonymize them or hashed PII.

15:27Zach Edwards: These people that are setting up these frameworks, oftentimes they don't salt the IDs, they're not rotating them. And so month after month, the same user, when they log into one of these websites, a persistent string of data, a user ID is being broadcast for them. That's just intrinsically unsafe for people. it's not how google's mobile id was set up it's not how apple's idfa was set up and ad tech folks being somewhat surprised that these static ids being shared in unsafe ways are now the focus of efforts to try and block them i think it's maybe and also like to put that in sort of layman's term too i think like with the hashed id problem there is there is i think like an emerging sort of like research on you know all these like mobile and web rtb protocols pass a lot of data that is hashed which is like not encrypted but just sort of like mathematically protected and like you said that it means that it can be sort of trivially broken if you have a like a large number of them and they pass like very sensitive data and it's like i guess it wouldn't be feasible or you know It would be too expensive to properly encrypt it.

16:44When you say salting them, that is a method where you add numbers to it. You add noise to the ID so they can't be re-identified and parsed. But yeah, I think it just hasn't occurred to people. I don't know what it is. Is it AI that has made this hashing trivial? or just people have kind of realized that this data, which looks obscure, like random numbers or something like is, in fact, like an easily interpreted lots of like PII being passed.

17:18Zach Edwards: Yeah, I was going to say, I think that your regular person, your average person on the street has no idea that this is happening. And ad tech has been doing this and hoping that somehow this process that they're doing, it continues to be allowed to be occurred and that they aren't required to explain this in clear ways to users. And I think that Apple just looks at the way data moves and the way people are tracked in a very different way. And they're not looking at it from a publisher stakeholder perspective or an ad tech stakeholder perspective. They're really looking at it from a user data perspective.

17:59Zach Edwards: And can that one device be persistently tracked through mechanisms that that person has minimal control over? If so, there will potentially be defenses built by Apple to block that technique. Before we kind of move on from the whole discussion of like, why now? Like, I just want to, I'm wondering, like, because we hear the anti-competitive arguments applied to Apple in much the same way that we do with Google. And you can say what you will about who has more pure intentions and that kind of thing. But it does seem to be the case that Apple is basically damning these practices by third parties, but it still has its own mechanisms internally for doing this kind of stuff within its own walled garden.

18:43So I guess when you look at the anti-competitive concerns that could arise from that, one of the things we were wondering about is, like is it possible that apple is just looking at what's going on with google and like the idea that like the u.s government had what a lot of people felt was a very you know airtight antitrust case against google uh and it's ad tech business and that eventually just ended up with google essentially getting a slap on the wrist could that be like a motivator for apple just be like all right like anti-competitive concerns be damned we're gonna go ahead with whatever our strategy is around all this stuff and just, you know, we're not fearful of big repercussions as a result.

19:25Zach Edwards: Yeah. I mean, I think that's a really good way to think about it. And I hypothesized that Apple basically was going to eventually make a Safari for Android. And we know that basically Safari is relegated to only WebKit devices. And there's been plenty of reasons why they haven't ever done that but stepping into these new competition areas is what you would do if you felt like government had no teeth and i think it's absolutely fair to say that big tech should not be afraid of government investigations at this point because the ramifications are mostly financial and and they just basically cash a check for bad behaviors so um i think apple too has sort of a different like I personally think Apple's like vision of privacy is very like business centric and not individual centric like it like Apple it doesn't really matter like if that individual with the phone even has like a very clear idea that like Facebook and Instacart and the New York Times are like working together and like I'm being passed and traffic and you know and and is okay with it like that's like what's a problem is that more than one business is seeing this data whereas like Amazon from Apple's point of view, I think could commit horrific, like personal privacy violation.

20:46Like Apple, Amazon could do things like with wanton abandon that people would feel like was a privacy issue, but which does cross is no Apple line because Amazon is not sharing that data with any other businesses. Like that is really the problem.

21:01Zach Edwards: That's exactly right. And, and I don't think it's entirely fair to say Apple does this in their app environment. They literally do the opposite. They do not expose PII of users, and they've built a lot of tools to prevent it. And so I think that their IDFA, all of the mobile advertising IDs, we know these are the primary ID used by data brokers. If you want to get out of data broker files and these location data sets, you block your mobile advertising ID. So a lot of folks know that what Apple has created with their IDFA is used for harms and is used as a join key for persistently tracking people.

21:45Zach Edwards: But I think the core difference is there's that consent wall and there's various logic associated with it. And so I think that it's absolutely fair for people that are impacted by this to point out inconsistencies, but it is just structured differently. The way that Apple has set up the IDFA's API, where someone has a consistent pop-up and they control whether that data is accessible, is different than the way AdTech has structured this. And so if AdTech is serious about wanting to do user IDs and persistent IDs, I think they're going to also have to get more serious about talking about consent dialogue boxes and communication to user and trying to bridge that gap where currently it's just too easy right now to say users don't know this is happening.

22:42Zach Edwards: And there's a lot of stuff that is behind the scenes that they wouldn't want to happen if they knew it was. So I've got a final question for this segment. So I, let's say I'm the CEO of one of these companies that does identity resolution. What am I asking by head of product, head of engineering about how we can respond and what we can do to still have our business go on? What's going to be the next move from AdTech? And that's the funny part. So when I look at the current solutions, you look at a lot of folks that are creating ID server side solutions. That's the whole rage. Let's create a server-side solution.

23:25Zach Edwards: And so they say, okay, to do this, we need to set up either a custom subdomain. So we're going to do a CNAME sync into our own data. Apple has literally had CNAME cloaking detection for six plus years. And so that right there, immediately Apple is going to be able to detect that. What people have done since that six years is instead of using a subdomain, they use a subfolder. So now it's a same origin policy. So instead of having www.espn.com and tracking.espn.com, and maybe that tracking is CNA mapped into a third party tool, they're trying to do it all under their main subdomain and instead mapping it to a subfolder.

24:10Zach Edwards: And so this concept of a tech company saying, I found the solution, I'm going to pass data in a consistent format instead of over a subdomain CNAME map to a partner, instead to a folder CNAME map to a partner. And it's basically the same thing people were doing six years ago with a little bit more technical pizzazz, hoping that somehow it's not easily seen within the data flows. And I've got news for them. Basically, the moment Apple steps up and says, OK, we're going to be looking at same origin identity resolution cookies and looking at basically these publishers that consistently pass data to a specific directory.

24:52Zach Edwards: factory and now those connections are going to be broken and so instead of you basically now sending to a third party or trying this other technique now google or now apple is blocking a first party uh basically ingestion because they know it's part of a c named data flow and so there's a kind of half-life to it where like you know they made the first announcement we got like six years out of it they made this announcement like maybe we're trying to like figure something mouse squeak like two or three more years out then i'm gonna be like nah it feels like hiding in different places like different domains different folders different places different places to observe the data yeah it's a cat and cat and mouse game and the cat can see basically everything the mouse is doing and it's just slowly putting their pieces in place to block that mouse in whatever escape route they've planned.

25:47Okay. So this is fairly bleak then. And earlier before I asked this question, you were like getting consent. I mean, but can you, if something's blocked, it doesn't really matter if you get consent for it, right?

25:59Zach Edwards: Yeah. And that's part of it where the solution for ad tech is not new data transfers via obscure folders or, ooh, let's rotate a bunch of domains. We'll start using hundreds of domains like traffic distribution systems do. That's not a solution. Ad tech will eventually be stopped by these larger network players. So I definitely see it as ad tech needs to get serious about consent, safer ID schemes, and spend less time trying to find side channels. Okay. Well, with that, we're going to take a break on this segment here from our supporter of our podcast. And then we're going to talk about the new cat and mouse game, which is sites with AI slop that are trying to get display ad revenue, the research that's acted.

26:51So stay with us for the second segment.

27:01I'm Sarah Sluice, Editorial Director of AdExchanger. And with me today is Michael Olson, EVP of Client Development at Basis, which is supporting our podcast this month. We're going to talk about something that doesn't get enough attention, paying invoices. What is the cost of slow financial reconciliation and who is the most impacted? Hi, Sarah. Thanks for having me. The cost is time, cash flow, and trust. When financial reconciliation takes too long, payments get held up and finance teams, whether they're in agencies or ad brands, are just chasing down numbers. People are spending a ridiculous amount of time figuring out why two systems do not match.

27:46Agencies probably feel it the most because they're stuck in the middle carrying the float. They have the client asking questions on one side and media partners on the other. The longer it takes, the more time everyone spends fixing the past instead of focusing on performance and health and growth of the business. So you outlined a very frustrating problem. I would not want to be that person chasing down invoices. Is this primarily a technology problem, a workflow problem, or a people problem? It's all of the above, but I'd lean towards mostly a workflow problem, the industry definitely doesn't have a shortage of technology or data.

28:28We have a shortage of systems that actually work together. And when they don't, people end up filling in all the gaps manually. They end up downloading spreadsheets, comparing reports, sending emails, chasing down discrepancies. It's a mess. Technology is obviously part of that answer, but another piece of software by itself just simply doesn't fix it. It's imperative for technology to actualize omni-channel data monthly and push to reconciliation systems. As an industry, we have to connect the tech stacks interoperably, end-to-end, and then allow the technology to do the heavy lifting to align the data between the contracts, media plans, media transactions, and the payments.

29:13Okay. So it sounds like technology and workflow can make this just a bit easier. What does automated reconciliation look like? A lot of automation talk right now. And if I'm thinking about the future agentic state, ideally reconciliation just happens. AI is constantly looking at delivery, spend, invoices, payments, and then flagging issues as they happen. instead of somebody finding them three weeks later. And in a lot of cases, it should be, the AI should be able to fix those issues without a person ever touching them with the correct harnesses in place. People should only have to get involved when something unusual happens, which is the human oversight.

29:57That gets away from this huge month end exercise that costs a lot of time and resources and much closer to knowing where you stand financially at any given time. This is the ideal state Basis is going towards for our connection with Prisma Bug Media Ocean, a platform used by numerous agencies for financial reconciliation. Okay, so it sounds like by connecting those two different platforms and adding agentic AI, we can make it a lot easier and people won't have to chase down invoices all the time like they used to. So thank you so much for sharing with us what that would look like. And thanks to Basis for supporting our podcast.

30:34Thanks for having me, Zara.

30:40welcome back we're here to talk about ai slop with ads anthony take it away yeah so zach you and i talked about this study that the cryptads did uh where basically you had uncovered uh 2 000 plus um recipe websites that were using uh fabricated author and creator personas um and you know, we're for the in large part or almost entirely AI generated content. And, you know, obviously, like taking a playbook, a page out of the playbook for the for MFA sites where like, you know, they're just cluttered with ads and, you know, all that kind of good stuff. So walk us through a little bit, you know, just like how this kind of how this all came across your radar and how you put the report together.

31:27And then we'll dig in a little bit more.

31:29Zach Edwards: Yeah, thank you. So I think that the way that we approached this was through a couple of hypotheses. It was essentially that people who set up AI slop websites are likely to set up multiple AI slop websites. We also work under the impression that someone who sets up an AI slop website in one niche potentially does it in other niches. So if you find someone operating an AI recipe website, they may have a sports website or a local news website. And so we're approaching our research where we're trying to understand who out there is creating AI slop. And so we fundamentally said one of the easiest ways is with AI recipes, because you can visually see these ugly ass food that they're putting on their websites that no one in their right mind would eat.

32:21Zach Edwards: And so for us, it was it was an easy way to do this with not even having to use fancy technology, literally a manual check. We could confirm something was AI. And so we said this is a great place to start. Yeah. And just to just to kind of jump in there, like you you've shared with me a whole bunch of like URLs and basically like everyone I tested at random. It was like within seconds of landing on the site. It was obvious that this is just like a low effort. AI-generated website with AI-generated images, AI-generated author profiles. In some cases, they might have been real pictures, but sourced from stock image providers, or stolen from real chefs, or even in some cases, slightly edited images of celebrities like you highlighted in there.

33:04So continue.

33:05Zach Edwards: Yeah, and Haunted Emily Blunt is basically an alleged chef that we found, and she's got pictures on the website, social media profiles, pretty much all of them, she's frowning and cooking. So it's basically what you would not expect from one of the most approachable actors that's out there. So there's basically, it's like shooting fish in a barrel to find these sites and when you identify them. And so in order to have some sort of finite list of not only AI recipe websites, but ones which create other risks by who they're working with, we focused on the ad partners that they're declaring within their ads.txt files.

33:49Zach Edwards: And so basically the way that this works, those ads.txt files list partners they declare. Sometimes those partners may not actually be still integrated on the websites, but it still gives you that idea of who they were working with at some point. And so we have a rigorous process of DeGript ads where we've essentially tried to map the location of every ad system in the world. And from that, we have around 300 ad systems that we're associating with Russia, China, Cyprus, various privacy jurisdictions, and other risky jurisdictions like Turkey or Ukraine, where it's not necessarily an adversarial country in all ways, but there is a lot of malicious threat actors who set up infrastructure in those locations.

34:40Zach Edwards: And so we started this process by taking those 300 ad tech companies based in those risky locations and then looking at all of the publishers that they work with and narrowing it down by keywords to just specific recipe websites. And that filtering process basically gave us 400 domains, which were working with basically companies in Russia and China who had recipe keywords and therefore were potentially AI recipe websites. I then basically manually confirmed all of those 400 websites, opening up multiple pages. And as you were mentioning, Anthony, it's very obvious when you open one of these sites, what's AI and what's not.

35:22Zach Edwards: And then I essentially used decrypt ads and a feed builder that we have to create technical fingerprints for these sites and the operators. And as I'd mentioned, when you find one AI website, it's usually connected to multiple AI websites. And that operator will oftentimes keep on spinning up websites every day or every week. They're creating more websites. So you've got to have basically technical fingerprints for stuff that they're doing consistently and a way to track when new sites in their network come online. And so that's really what we do at Decrypt Ads. It's a giant research database that not only has the ad tech data, the ads.txt, sellers.json, all that good stuff, appads.txt, but it also has DNS data.

36:09Zach Edwards: It also has who is registrar data, SSL certificate data. And we're trying to pull in more data in other contexts so you can create these really complex fingerprints and track one specific actor as they spin up more and more websites. And so really our report is basically what it looked like when we expanded from 400 potential domains, creating 190 technical fingerprints to then over 2100 final domains that were associated basically with AI recipe websites and the publishers behind them who then also had other niches as well. So it's basically a big dumpster fire. Cheers. So in terms of dumpster fires, I feel like, you know, in ad tech, we've seen this movie before, right?

37:02There's been the made for advertising sites, the slideshows, the toolbars, like it's a familiar problem. Will that make it easier to play whackable this time because everyone's ready to stamp it out? Or do you think there's, it will be tricky for any particular reason? Yeah.

37:22Zach Edwards: And definitely, I think that it's going to be tricky. MFA websites are growing much faster than people are slowing them down. But Google two weeks ago had a really important policy announcement. And it was basically about the search ranking of websites. And a website now can be downranked in search if they're being deceptive with their authors. And that is a huge change because the vast majority of these MFA authors, especially the ones that are being deceptive, their goal is to bring in organic traffic. They're being highly aggressive on social media. They're just slamming them with content spam.

37:59Zach Edwards: And they're doing everything they can to rank these sites so that when someone searches a meatloaf recipe, they get one of the AI slop recipes and not a meatloaf recipe from a major publisher. And so Google basically stepping up and saying, if you're found to have deceptive authorship information or ownership details, and we will consider that to be a quality indicator and thus downrank your site, it is the right direction. But there, of course, are numerous other search engines. There's AI search tools, which are, of course, being exploited left and right. And there's just one opportunity after another for these AI slot folks to still make money.

38:42Zach Edwards: And so I think it's not only for big tech to be trying to come up with solutions. How can the search engines of the world, the AI chatbots of the world, how can they deprioritize these sites? But we also need folks like the FTC, which has a Section 5 unfair and deceptive framework. It's a core part of why the FTC was created, was to try and stop unfair and deceptive advertising. And this would be a perfect example of that at scale. And so my hope, and I think a lot of folks hope is also that maybe government at some point steps in and starts to put some stronger frameworks around what they're saying is appropriate and also holds accountable some of the folks that are doing this and really being flagrantly deceptive.

39:31Zach Edwards: And I think finally, it's the SSPs that sign up these sites. When an SSP has a thousand publishers or more that are AI slop websites, and they come back with a response to research like this saying, hey, it's everyone's right to publish in whatever way they see fit. and basically just their own version of AI slop coming back on this. I think it's a testament to where we are. And I think that we have to look at SSPs as organizations who aren't always looking out for the best interests of people who are buying their inventory. And they have a lot of those SSPs. Zoic is a good example. A couple of years ago, Zoic had a big scandal where they unfortunately had to let go a bunch of their staff.

40:22Zach Edwards: They had to remove a bunch of their affiliates and partners because they alleged that there was some inappropriate processes in their sign-up flows for new customers. And I think that that's something that every SSP faces. They've turned on a new product or they've turned on a new process. They've had a new wave of people sign up, of publishers sign up, and maybe those publishers are doing something that's inappropriate, inauthentic. In my opinion, SSPs need to take action or else eventually all of that inventory from that SSP is going to start being seen in some sort of negative light. And so my hope is that SSPs take some responsibility, start to require their publisher partners to actually disclose AI authorship and AI writing.

41:14Zach Edwards: but based on the responses to y 'all's work and our report it does not seem like it's happening anytime soon yeah anthony i guess so i think it's um to kind of sum up the answer to my question it's you know it's going to be tricky in ways that are familiar and unfamiliar ai is going to throw us a few new curveballs and i think anthony it was interesting you reached out to all these SSPs that were selling this inventory. Definitely, I would say less familiar names to me. Not a lot of the headline SSPs, which I think I'm going to give credit to a lot of the major SSPs that they weren't part of that because I think in the past, we often would see this type of inventory find its way to pretty much every SSP.

42:04So I think it was a different category of SSP, not maybe ones with lower brand awareness, lower market adoption. So, you know, tip of my hat to that. But then of the ones that you reached out to, I think it spanned the range from a company that maybe was on a very small percentage of the sites that was like, we're removing them right away. And then on the other hand, you know, companies that were like, we actually think this content is great i i that's to be a very short paraphrase yeah yeah like exactly like you know i got i got the range of feedback from like oh we have like a you know maybe like a little bit over 10 of these we'll take them off immediately and then like in the cases where it was like the ssp was implicated with like hundreds or more websites it's like wait why are you calling this ai slop isn't that like an inherently like biased like phrase to refer to this and like you know why are we saying this is bad inventory and it's like you know i hear the argument generally of like you know there's plenty of like questionable content on the internet and like you know maybe some of this like you know you know we're going a little bit too far and throwing the baby out with the bathwater when we criticize all ai generated content but then like you know exactly like i was saying before like when i would visit these like sites at random that zach shared with me these were not high quality sites they were very obviously just kind of like slapped together You know, like the recipes weren't all that appealing.

43:30It was the kind of thing like, I mean, like maybe I'm like a little bit more averse to like AI content than like most people. But it was the kind of thing where like if I ended up on the site just by clicking a link on social media, I would see what was on there and just immediately be like, this is a bad website. I'm leaving. And like I wouldn't even see any of the ads or like any of that stuff.

43:49Zach Edwards: And I think it's really important to give those SSPs credit. Create your contact with your content with AI. Go nuts. Make entire websites with AI content. But the core difference is you don't then get to create an about page where you say, I'm a Midwestern mob who loves cookies and making hot pot for my family. No, you're a teenager based in Morocco, based on your social media disclosures. There is something truly wrong if an SSP says this is OK behavior. when those examples were showcasing, they were not just AI content. It was someone who was pretending, creating whole teams of chefs, giving them fake backstories about the fancy places they worked, the colleges they went to.

44:38Zach Edwards: And they're basically alleging this fancy chef who went to the Culinary Institute of America and worked in three Michelin chef starred restaurants is the person who's vetting these recipes. No, dude, that's bullshit. And that's, I think, the real problem. And I think that that's the line for me is go nuts on AI content creation. Just have some sort of disclosure that says this website uses AI content and don't have an owner or an about page, which is just full of blatant lies. And I think the SSPs that are up shit creek without a paddle. So don't lie with AI and don't besmirch the name of Midwest moms and their cookie recipes.

45:23Zach, I feel like we can't end on a higher note than that. So thank you so much for joining us, giving insight into Apple, what's ahead with decrypt ads and marketing AI slop. And thanks to our listeners for tuning in. See you next week.

45:38Zach Edwards: Cheers. Thanks, everybody.

45:46This episode is sponsored by Basis, the leading intelligent operating system for autonomous advertising. Its enterprise AI solution transforms campaign briefs into strategies and media plans that integrate directly into omni-channel activation. Learn more at basis.com.