We tested a tool to confuse Google’s ad network. It works and you should use it.on January 6, 2021 at 9:58 am

Positioned now on both sides of an advertising transaction, we were ready to observe the life cycle of an ad click from end to end. We invited individual volunteers to download AdNauseam and visit our site. Soon we had recorded a few dozen successful AdNauseam clicks–billed to our team’s advertiser account and credited to the publisher account. AdNauseam was working.

But this only proved that Google did not discard the very first click on an ad generated by a brand new AdNauseam user recruited specifically for the experiment. To silence the skeptics, we needed to test whether Google would learn to recognize suspicious clicking over time.

So we ran the experiment with peoplewho had already been using AdNauseam for some time. To anyone watching for very long, these users stick out like a sore thumb, because with AdNauseam’s default settings they appear to be clicking on 100% of the ads they see. Users can adjust the click rate, but even at 10%, they’d be way outside the norm; most people click display ads only a fraction of 1% of the time. This test, then, was designed to check if Google would disregard AdNauseam clicks from a browser with a long-standing record of astronomical click rates. If Google’s machine learning systems are so clever, they should have no trouble with that task.

ILLUSTRATION CREDIT: MUSHON ZER-AVIV

We tested this in two ways.

First, with people: we recruited long-standing AdNauseam users to go to our website. We also invited new AdNauseam users to use the clicking software for a week in the course of their normal web browsing, in order to establish a history, and then to participate in the test.

Second, with software: we conducted an automated test using a software tool called Selenium, which simulates human browsing behavior. Using Selenium, we directed a browser equipped with AdNauseam to automatically surf the web, navigating across sites and pages, pausing, scrolling, and clicking ads along the way. Basically, this let us quickly build up a record of prolific clicking activity while tightly controlling variables that might be relevant to whether or not Google classifies as a click as “authentic.” We set up four of these automated browsers and ran them respectively for one, two, three, and seven days. At the end of each period, we sent the browsers to our experimental site to see whether AdSense accepted their clicks as legitimate. The Selenium browser that ran for seven days, for example, clicked on more than 900 Google ads, and almost 1,200 ads in all. If Google’s systems are indeed sensitive to suspicious clicking behavior, this should have set off alarm bells.

Most of our tests were successful. Google filtered out clicks on our site by the automated browser that ran for three days. But it did not filter out the vast majority of the other clicks, either by ordinary AdNauseam users or even in the higher-volume automated tests, where browsers were clicking upwards of 100 Google ads per day. In short, Google’s advanced defenses were not sensitive to the sort of clicking behavior typical of AdNauseam use.

Google’s advanced defenses were not sensitive to the sort of clicking behavior typical of AdNauseam use.

Soon we had $100 in our AdSense account, enough to trigger Google to mail us a check. We weren’t sure what to do with it. This money wasn’t ill-gotten, by any means. We were just getting back our own money that we had invested in the advertiser account–less the 32% cut banked by Google.We decided not to cash the check. It was enough to know we’d proved that–for now, at least–AdNauseam works. The check was like a certificate of success.

---

Nevertheless, our experiment can’t answer some other important questions. If you use AdNauseam, how do the clicks it makes affect the profile Google has built on you? Does AdNauseam successfully shield individuals, and the populations they may be sorted into, from being targeted for advertising? (After all, even if you use the extension, Google can still collect masses of data from your email, search history, and other sources.) Even answering our simple original question–whether the software works at all–required substantial effort. Answering those other questions would require insider access across many more nodes in online advertising.

In fact, we can’t even know conclusively why our test worked–why Google did not detect these AdNauseam clicks. Was it a failure of skill or a failure of will?

A failure of skill would mean that Google’s defenses against automated ad-clicking are less sophisticated than the company claims. However, as flattering as it would be to conclude that our small team outmaneuvered one of the most powerful companies in history, that seems farfetched.

A more likely explanation is a failure of will. Google makes money each time an ad is clicked. If advertisers found out they were being billed for phony clicks, that would of course undermine confidence in the online ad business. But advertisers can’t validate those suspicions unless they can look from both ends of the market, as we did. And even if they could, Google’s market dominance makes it hard for them to take their business elsewhere.

In a statement, Google spokeswoman Leslie Pitterson wrote, “We detect and filter the vast majority of this automated fake activity. Drawing conclusions from a small-scale experiment is not representative of Google’s advanced invalid traffic detection methods and the ongoing work of our dedicated technology, policy, and operations teams that work to combat ad fraud every day.” She added, “We invest heavily in detecting invalid traffic–including automated traffic from extensions such as AdNauseum [sic]–to protect users, advertisers, and publishers, as ad fraud hurts everyone in the ecosystem, including Google.”

AdNauseam might adapt to skirt Google’s counteroffensive, but an arms race will obviously favor Google.

If, contrary to Pitterson’s claims, the results of our experiment do hold up at scale, it may be bad news for advertisers, but it’s good news for internet users. It means that AdNauseam is one of the few tools ordinary people currently have at their disposal to guard against invasive profiling.

All the same, it is a temporary and imperfect defense. If Google finds a way–or the will–to neutralize AdNauseam, then whatever utility it has might be short-lived. AdNauseam might adapt to skirt Google’s counteroffensive, but an arms race will obviously favor Google.

Read More