The answer to fighting ad fraud goes further than regulators’ proposals

In my twenty-plus years in the advertising industry, I’ve learned, among other things, that advertisers copy what works — and so do scammers. My startup, InfoHawk, recently traced a deepfake campaign selling a fake Alzheimer’s cure that ran across several ad networks and SMS, and implicated 35 different service providers, from domain registrars to video hosts.

Scaled access to ad data is how you find networks like that and push them off the whole supply chain, not just one channel. But as tensions around ad fraud mount, some regulators are now asking: how much of the ad ecosystem should be visible, and to whom?

The U.K.’s online safety regulator, Ofcom, is finishing a consultation on new rules that would require the largest platforms and search engines to tackle fraudulent advertising under the Online Safety Act 2023. Ofcom’s proposals are serious, including advertiser verification, bans for repeat offenders, moderation with performance targets and priority reporting channels for trusted flaggers.

InfoHawk submitted a public document as part of the consultation period, the core argument of which focused on a particular recommendation that stood out to me: a public ad library "that has the principles, functionalities and information categories needed to enable experts to quickly identify fraudulent advertising, so it can be taken down.”

I led the effort at Facebook (now Meta) to build its Ad Library, the first large-scale ad library of its kind, so I’m glad to see this. Public ad libraries do real good. Someone who realizes too late that an ad was a scam can find it again and report it. A journalist can search for sketchy crypto pitches and write a story that forces a response. Transparency changes behavior.

But there’s another group of users that public libraries serve badly, and it’s the group that could do the most damage to scammers because they, in theory, work at scale. That group includes brand protection and security firms hunting impersonators, researchers trying to measure how prevalent scams actually are and trusted flaggers feeding takedowns back to platforms. They don’t need to look at five ads; they need to look at five million, repeatedly, over time.

Today, though, they mostly can’t. Some libraries omit whole countries. Some leave out click-through URLs, or show them for only a subset of ads. Almost all rate-limit access so aggressively that systematic analysis is impractical.

To be fair to the platforms, much of that limiting is deliberate and not unreasonable. Unrestricted bulk access is a gift to bad actors. More transparency for everyone can also mean a better playbook for fraudsters.

The answer isn’t to choose between openness and lockdown. It’s to build two doors. The first door is the public library. Keep it open, simple and reliable, with sensible limits. The second is an enhanced-access tier for qualified organizations.

The latter would offer higher API rate limits or allow listed access, richer metadata such as advertiser details that reveal coordinated networks, and removed ads kept on record so repeat offenders can be traced. None of this is technically hard. When we’ve asked platforms for this kind of access, the responses have varied widely. That tells me the barrier is will and process, not engineering.

Who should get through that door? You cannot automatically assume academics or nonprofits are good actors, so I’d resist limiting it to those (and I say that knowing full well I’ve helped launch a nonprofit to bring transparency to social media scam ads). Some of them lack the resources to use the data, and in some places nonprofit status is trivially easy to fake (and we’ve seen bad actors register nonprofits specifically to get free ad credits). Commercial firms protecting brands are often the most effective users.

A better approach is for platforms to set and publish objective criteria, with regulators requiring that the process exists rather than dictating who qualifies. One simple bright line would help: access is for detecting, reporting, measuring or disrupting harmful ads, not for planning or generating ad creative.

The two doors should also be linked. If a platform tightens public access limits, it should have to open the enhanced route at the same time. Otherwise, tighter limits simply make fraud harder to find.

Right now, it is nearly impossible for anyone outside a platform to tell whether stated policies are actually enforced. Every scam ad erodes trust in the ads that pay for everyone’s work. An industry that wants to keep regulators from designing its systems for it should want credible independent measurement, and it should build the door before someone else does.

This op-ed represents the views and opinions of the author and not of The Current, a division of The Trade Desk, or The Trade Desk. The appearance of the op-ed on The Current does not constitute an endorsement by The Current or The Trade Desk.