At the last minute, the hearing was cancelled, and I won’t be able to testify at the rescheduled session. Rather than let my draft written statement languish, I’m taking this opportunity to post the prepared testimony I had planned to offer:
By all indications, Google AdWords features far more advertisers than competing PPC platforms such as Yahoo Search Marketing and Microsoft adCenter. (Consider: Search for "thinkpad x60 power supply" at Google, and there are six relevant ads from vendors who actually sell that product. Search at Yahoo Search or Microsoft Live Search, and there are various ads from indexers and aggregators, but only one or two from vendors directly selling the product. Other searches for offbeat, unusual or region-specific keywords show similar patterns.)
Why do more advertisers choose Google? Because more users search at Google, Google can offer wider ad distribution than any single competitor. So if an advertiser had to choose just one ad platform, Google would be the natural choice.
But in principle advertisers can easily use multiple ad platforms. Ads are trivially small plaintext data, and In principle ads can be copied from platform to platform without restriction. So why don’t more Google advertisers use Yahoo, adCenter, and others too?
To use the Google AdWords API, a software developer must accept Google’s AdWords API Terms & Conditions. The T&C’s include the following requirement:
"Any information collected from an input field used to collect AdWords API Campaign Management Data may be used only to manage and report on AdWords accounts. Similarly, any information or data used as AdWords API Campaign Management Data must have been collected from an input field used only to collect AdWords API Campaign Management Data. For example, the AdWords API Client may not offer a functionality that copies data from a non-AdWords account into an AdWords account or from an AdWords account to a non-AdWords account." (emphasis added)
Sure enough, searching the web for commercial tools to synchronize PPC campaigns or to export data from Google to competing platforms, I found none.
The "May Not … Cop[y] Data" Prohibition: Effect on Advertisers
The quoted restriction prevents advertisers from easily exporting ads from Google to a competing paid search provider. Consider: The essence of an export procedure is to copy data from an AdWords account to a non-AdWords account — exactly what the restriction prohibits.
Indeed, available export procedures are strikingly complex. For example, to import a Google AdWords campaign into Microsoft adCenter, Microsoft offers a 17-step procedure (with some steps made more complicated by the presence of multiple sub-steps).
Microsoft’s procedure is necessarily convoluted because Google’s "may not … cop[y]" restriction prevents Microsoft, or any other vendor, from writing a tool that connects to the Google API, downloads an advertiser’s ads, and uploads those ads directly to, e.g., Microsoft adCenter. Instead, advertisers must download data manually, reformat it to match adCenter’s requirements, and upload it to Microsoft — just as Microsoft’s lengthy procedure specifies.
For many advertisers, Google’s restrictions on data export impose an ongoing burden even beyond the advertiser’s initial signup with a competing PPC provider. Consider an advertiser that changes its ads or keywords often — perhaps selling seasonal merchandise, or experimenting with alternative advertising strategies. Such an advertiser would typically prefer to make changes in one place, and have the changes automatically propagate to all the advertiser’s PPC platforms. If Google remains the advertiser’s primary PPC provider, the advertiser would probably want to make changes in Google’s interface, then have other PPC platforms optionally automatically copy those changes. But Google’s "may not … cop[y]" restriction applies equally to ongoing resynchronizations. If an advertiser made daily changes to its Google campaigns, it would have to daily repeat the manual export/import process — a task that would be both time-consuming and prone to error.
In short, the net effect of the quoted restriction is to reinforce the tendency of small to medium-sized advertisers to "single-home" — to use only Google AdWords, to the exclusion of competing platforms.
At their peril do advertisers rely solely on Google: If advertisers get stuck using only Google, for lack of any easy and efficient way to buy some traffic elsewhere, Google can charge prices higher than competing platforms. Of course Google can’t raise prices infinitely; at some point, advertisers would overcome the lock-in, accept manual export, and copy ads to competitors. But Google’s "may not copy" restriction increases the costs of multi-homing — letting Google charge that much more than competitors, without advertisers facing compelling incentives to look elsewhere.
The "May Not … Cop[y] Data" Prohibition: Effect on Competing Ad Platforms, on Publishers, and on Users
By encouraging small to medium-sized advertisers to advertise only with Google AdWords, Google’s API restriction reduces the number of advertisers using competing ad platforms. This harms competing platforms in two distinct ways. First, it reduces competitors’ coverage — preventing competitors from featuring relevant ads that pertain to obscure user searches. (Consider the power supply example from the first paragraph of this piece — better and more useful ads at Google.) With fewer relevant ads, the competing platform offers users an inferior service — inviting users to look elsewhere, and reducing the likelihood of a paid click that would earn the platform an advertising fee.
Second, by reducing the number of advertisers bidding for advertising positions at other platforms, the quoted provision dramatically reduces revenue at those platforms. My December 2006 Optimal Auction Design in a Multi-unit Environment estimates the revenue benefits of additional advertisers based on publicly-available data and estimates of market fundamentals. The intuition is straightforward: When many advertisers seek positions for a given search term, they must bid higher to avoid being outbid and receiving inferior listing position. Conversely, when only a few advertisers seek positions, prices can be strikingly low since even a low bid earns a prominent position.
Google’s API restriction also reduces the value of advertising inventory held by third-party publishers. Consider a publisher seeking to sell its sponsored search or other text ad inventory to a provider of sponsored search services. In general, Google can afford to pay more because Google’s revenue per search is higher than competitors’. But how much will Google offer? Google maximizes profits by narrowly outbidding competitors; anything higher is waste. So the weaker competitors become, the lower Google can bid — and the less revenue publishers receive for the traffic they sell. Google’s "may not copy" API restriction serves a role in weakening competing platforms — keeping advertisers using Google alone, and hence reducing competing ad platforms’ ability to pay for publishers’ inventory.
End users also suffer from Google’s restriction on copying ads. Were it not for Google’s restriction, more advertisers would sign up to use competing ad platforms — increasing the usefulness of Yahoo Search and Microsoft Live Search for the users who choose those services.
Google’s Response
I forwarded these concerns to Google in March, and I managed to get in touch with Doug Raymond, product manager for AdWords API. Doug offered three rationales for the restriction. The list below summarizes his arguments (black) and my responses (blue).
Google: The quoted provision only applies to third-party developers. Individual advertisers remain free to write software that exports their Google campaigns.
Small to medium-sized advertisers don’t want to be developers. Rather, they want to use code that others write. That’s exactly why the AdWords API offers a concept of developers, rather than requiring that every advertiser write its own code.
As a leading provider of centralized computing services, as distinguished from small programs individual users build themselves, Google well knows the benefits of rigorous design by competent professionals.
Google: Advertisers can extract their data in other ways, e.g. a comma-separated-value (CSV) file.
Manual export is convoluted, slow, and error-prone. API-based access would be faster, easier, and more reliable.
The existence of an inferior alternative does not justify imposing restrictions that prohibit superior implementations.
In other contexts (detailed below), Google has made strong requests for, and commitments to, data portability.
In other contexts, Google emphasizes the benefits of streamlined, automated data transfer — never viewing convoluted manual procedures as an acceptable alternative.
Google: Third-party developers ought not have free access to advertiser data.
Google’s AdWords API already offers an appropriate security model to limit developers to serving those AdWords advertisers that have specifically granted such permission. In short, a developer needs a password to access an advertiser’s account.
Google’s Position on Data Portability in Other Contexts
Google’s prohibition on AdWords API data export stands in sharp contrast to Google’s position on data portability in other contexts. Indeed, Google has previously taken a firm position in favor of data portability. Some specific examples: In a November 2006 interview at the Web 2.0 Summit, Schmidt specifically promised that "We [Google] would never trap user data." Schmidt added that "If users can switch it keeps us honest." Just last month, Google CEO Eric Schmidt called for open access to (and indexing of) social network data — telling IBM’s Business Partner Leadership Conference "People should be able to move from place to place, and their data is available everywhere" and "open is best for the consumer." Well-known Google blogger Matt Cutts summarized Google’s commitment to data openness with the catchy title "Not trapping users’ data = GOOD" and a long list of Google products that support data export.
I credit that Schmidt’s statements refer to other kinds of data — search engines’ records of users’ search history, and a wide assortment of data held by social networks. But the same principles plainly apply to access to search ads: Just as consumers benefit from being able to move their data as they see fit, so too do advertisers benefit from flexibility.
Moreover, it strains credibility for Google to ask social networks to share their data with Google, while Google simultaneously imposes contractual roadblocks preventing others from accessing Google data.
Next Steps and Google’s Other Restrictions
Google already faces antitrust scrutiny for its striking growth and market share. In that context, it’s particularly hard to defend the restriction at issue — a barrier to competition, without any apparent pro-competitive purpose. Regulators might reasonably require that Google remove the quoted provision — letting third-party developers export and synchronize AdWords data if advertisers so desire. This would be a trivially straightforward requirement — just a sentence to be stricken from Google’s AdWords API T&C’s. Because Google’s existing APIs already provide the required data, Google would not need to add any new code or any new API functions.
Other AdWords API restrictions also deserve scrutiny. For example, Google insists that advertising tools collect AdWords instructions through separate fields not used for other ad platforms — blocking simplification via a single interface to streamline advertisers’ decisions. Google prohibits advertising tools from storing Google data in a single relational database along with data for other ad platforms — increasing the complexity of designing a system to manage campaigns on multiple platforms. And Google prohibits reports that compare Google ad performance data (e.g. costs and profits from advertising at Google) with data from other ad platforms — hindering advertisers’ efforts to evaluate competitors’ offerings. I gather Google defends these restrictions on the grounds that they purportedly prevent advertiser confusion. Perhaps — but their more obvious effect is to increase the costs and complexity of using competing ad platforms. Perhaps I’ll consider these restrictions in greater detail in a future article.
Meanwhile, I’m struck by Google’s calls for data portability in other contexts. With Google’s ongoing request that other companies provide data to Google, perhaps Google will return the favor by abandoning its "may not copy" restriction — ideally promptly and unilaterally, without requiring that regulators force Google’s hand.
Microsoft considers alternatives to expand its presence in online advertising, especially text-based pay-per-click advertising. Google dominates, and it is unclear how Microsoft can grow, despite considerable technical and financial resources. Microsoft considers a set of alternatives, each with clear benefits but also serious challenges.
I served as cocounsel in trademark holder class action litigation challenging Google and its partners using domain names that are typographic variants of trademarks in order to show advertising.
Vulcan Golf, LLC, et al., v. Google, Inc., et al., No. 07 C 3371 (N.D. Ill.)
I present and critique pay-per-click ads that don’t deliver what they promise. I consider implications for search engine revenues, and I analyze legal and ethical duties of advertisers and search engines. I offer a system for others to report similar ads that they find.
Read Google’s voluminous Adwords Content Policy,
and you’d think Google is awfully tough on bad ads. If your company
sells illegal drugs, makes fake documents, or helps customers cheat drug
tests, you can’t advertise at Google. Google also prohibits ads for
fireworks, gambling, miracle cures, prostitution, radar detectors, and
weapons. What kind of scam could get through rules like these?
As it turns out, lots of pay-per-click advertisers push and exceed
the limits of ethical and legal advertising — like selling products
that are actually free, or promising their services are “completely
free” when they actually carry substantial recurring charges.
One scam Google doesn’t prohibit — and as best I can tell, does nothing to stop — is charging for software that’s actually free. Search for “Skype” and you’ll find half a dozen advertisers offering to sell eBay’s free telephone software. Search for “Kazaa” or “Grokster” and those products are sold too. Even Firefox has beentargeted.
Each and every one of these ads includes the claim that the specified
product is “free.” (These claims are expressed in ad titles, bodies,
and/or display URLs). However, to the best of my knowledge, that claim
is false, as applied to each and every ad shown above: The specified
products are available from the specified sites only if the user pays a subscription fee.
These ads are particularly galling because, in each example, the specified program is available for free elsewhere on the web,
e.g. directly from its developer’s web site. Since these products are
free elsewhere, yet cost money at these sites (despite promises to the
contrary), these sites offer users a particularly poor value.
Often these sites claim to offer tech support, but that’s also a ruse: Tests confirm there’s no real support.
Although sophisticated users will realize that these sites are bad
deals, novice or hurried users may not. These sites bid for top search
engine placement — often appearing above search engines’
organic (main) results. Some proportion of users see these prominent
ads, click through, and get tricked into paying for these otherwise-free
programs. Claiming a refund takes longer than it’s worth to most
users. So as a practical matter, a site need only trick each user for an
instant in order to receive its fee.
The “completely free” ringtones that aren’t
Ringtone ads often claim to be “free,” “totally free,” “all free,”
“100% complimentary,” and available with “no credit card” and “no
obligation” required. These claims typically appear in pay-per-click ad
bodies, but they also often appear in ad titles and even in ad domain
names, of course along with landing pages.
Often, these claims are simply false: An ad does not offer a “totally
free” product if it touts a limited free trial followed by an
auto-renewing paid service (a negative option plan).
Other claims are materially misleading. For example, claiming “no credit card required ” suggests that no charges will accrue. But that too is false, since ringtone sites generally charge users through cell phone billing systems, unbeknown to many users who believe a service has no way to impose a charge if a user provides no credit card number.
Each and every one of these ads includes the claim that the specified
product is “free” (or some other claim substantially similar, e.g.
“complimentary”). In most cases, subsequent language attempts to disavow
these “free” claims. But in each case, to the best of my knowledge,
service is available only if a user enters into a paid relationship
(e.g. a paid subscription) — the very opposite of “free.” (Indeed, the
subscription requirement applies even to unlimitedringtones.com, despite
that ad’s claim that “no subscription [is] required.” The site’s fine
print later asserts that by requesting a ringtone registration, a user
“acknowledge[s] that [he is] subscribing to our service billed at $9.99
per month” — specifically contrary to site’s earlier “no subscription”
promise.)
Vendors would likely defend their sites by claiming that (in general) their introductory offers are
free, and by arguing that their fine print adequately discloses users’
subsequent obligations. This is interesting reasoning, but it’s
ultimately unconvincing, thanks to clear regulatory duties to the
contrary.
The FTC’s Guide Concerning the Use of the Word ‘Free’ is exactly on point. The guide instructs advertisers to use the word “free” (and all words similar in meaning) with “extreme care” “to avoid any possibility that consumers will be misled or deceived.” The guide sets out specific rules as to how and when the word “free” may be used, and it culminates with an incredible provision prohibiting fine print to disclaim what “free” promises. In particular, the rule’s section (c) instructs (emphasis added):
All the terms, conditions and obligations upon which receipt and retention of the ‘Free’ item are contingent should be set forth clearly and conspicuously at the outset of the offer … in close conjunction with the offer of ‘Free’ merchandise or service.
In case that instruction left any doubt, the FTC’s rule continues:
For example, disclosure of the terms of the offer set forth in a footnote of an advertisement to which reference is made by an asterisk or other symbol placed next to the offer, is not regarded as making disclosure at the outset.
Advertisers may not like this rule, but it’s remarkably clear. Under
the FTC’s policy, ads simply cannot use a footnote or disclaimer to
escape a “free” promise made earlier. Nor can an advertiser promise a
“free” offer at an early stage (e.g. a search engine ad), only to impose
additional conditions later (such as in a landing page, confirmation
page, or other addendum). The initial confusion or deception is too
strong to be cured by the subsequent revision.
Advertisers might claim that the prohibited “free” ads at issue come
from their affiliates or other partners — that they’re not the
advertisers’ fault. But the FTC’s Guide specifically speaks to the
special duty of supervising business partners’ promotion of “free”
offers. In particular, section (d) requires:
[I]f the supplier knows, or should know, that a ‘Free” offer he is promoting is not being passed on by a reseller, or otherwise is being used by a reseller as an instrumentality for deception, it is improper for the supplier to continue to offer the product as promoted to such reseller. He should take appropriate steps to bring an end to the deception, including the withdrawal of the ‘Free’ offer.
It therefore appears that the ads shown above systematically violate
the FTC’s “free” rules. Such ads fail to disclose the applicable
conditions at the outset of the offer, as FTC rules require. And even
where intermediaries have placed such ads, their involvement offers
advertisers no valid defense.
Ads impersonating famous and well-known sites
Some pay-per-click ads affirmatively mislead users about who is advertising and what products are available. Consider the ads below, for site claiming to be (or to offer) Spybot. (Note text in their respective display URLs, shown in green type.) Despite the “Spybot” promise, these sites actually primarily offer other software, not Spybot. (Spybot-home.com includes one small link to Spybot, at the far bottom of its landing page. I could not find any link to the true Spybot site from within www-spybot.net.)
In addition, search engine ads often include listings for sites with names confusingly similar to the sites and products users request. For example, a user searching for “Spybot” often receives ads for SpyWareBot and SpyBoot — entirely different companies with entirely different products. US courts tend to hold that competitive trademark targeting — one company bidding on another company’s marks — is legal, in general. (French courts tend to disagree.) But to date, these cases have never considered the heightened confusion likely when a site goes beyond trademark-targeting and also copies or imitates another company’s name. Representative examples follow. Notice that each ad purports to offer (and is triggered by searches for the name of) a well-known product — but in fact these ads take users to competing vendors.
Google’s responsibility – law, ethics, and incentives
Google would likely blame its advertisers for these dubious ads. But Google’s other advertising policies
demonstrate that Google has both the right and the ability to limit the
ads shown on its site. Google certainly profits from the ads it is paid
to show. Profits plus the right and ability to control yield exactly
the requirements for vicarious liability in other areas of the law (e.g.
copyright infringement). The FTC’s special “free” rules indicate little
tolerance for finger-pointing — even specifically adding liability
when “resellers” advertise a product improperly. These general rules
provide an initial basis to seek greater efforts from Google.
Crucially, the Lanham Actspecifically contemplates injunctive relief against a publisher for distributing false advertising. 15 USC § 1125(a)(1) prohibits false or misleading descriptions of material product characteristics. § 1114 (2)
offers injunctive relief (albeit without money damages) where a
publisher establishes it is an “innocent infringer.” If facing claims on
such a theory, Google would surely attempt to invoke the “innocent
infringer” doctrine — but that attempt might well fail, given the scope
of the problem, given Google’s failure to stop even flagrant and
longstanding violations, and given Google’s failure even to block
improper ads specifically brought to its attention.
(See e.g. World Wrestling Federation v. Posters, Inc., 2000 WL 1409831,
holding that a publisher is not an innocent infringer if it “recklessly
disregard[s] a high probability” of infringing others’ marks.)
Nonetheless, the Communications Decency Act’s 47 USC § 230(c)(1)
potentially offers Google a remarkable protection: CDA § 230 instructs
that Google, as a provider of an interactive computer service, may not
be treated as the publisher of content others provide through that
service. Even if a printed publication would face liability for printing the same ads Google shows, CDA § 230 may let Google distribute such ads online with
impunity. From my perspective, that would be an improper result — bad
policy in CDA § 230’s overbroad grant of immunity. A 2000 DOJ study seems to share my view, specifically concluding
that “substantive regulation … should, as a rule, apply in the same
way to conduct in the cyberworld as it does to conduct in the physical
world.” But in CDA § 230, Congress seems to have chosen a different
approach.
That said, CDA § 230’s reach is limited by its exception for
intellectual property laws. § 230(e)(2) provides that intellectual
property laws are not affected by § 230(c)(1)’s protection.
False advertising prohibitions are codified within the Lanham Act (an
intellectual property statute), offering a potential argument that CDA §
230 does not block false advertising claims. This argument is worth
pursuing, and it might well prevail. But § 230 cases indicate
repeated successes for defendants attempting to escape liability on a
variety of fact patterns and legal theories. On balance, I cannot
confidently predict the result of litigation attempting to hold Google
responsible for the ads it shows. As a practical matter, it’s unclear
whether or when this question will be answered in court. Certainly no
one has attempted such a suit to date.
Notwithstanding Google’s possible legal defenses, I think Google ought to do more to make ads safe as a matter of ethics.
Google created this mess — by making it so easy for all companies,
even scammers, to buy Internet advertising. So Google faces a special
duty to help clean up the resulting problems. Google already takes
steps to avoid sending users to web sites with security exploits, and
Google already refuses ads in various substantive categories
deemed off-limits. These scams are equally noxious — directly taking
users’ money under false pretenses. And Google’s relationship with these
sites is particularly unsavory since Google directly and substantially
profits from their practices, as detailed in the next section.
Even self-interest ought to push Google to do more here. Google may
make an easy profit now by selling ads to scammers. But in the long run,
rip-off ads discourage users from clicking on Google’s sponsored links
— potentially undermining Google’s primary revenue source.
Who really profits from rip-off ads?
When users suffer from scams like those described above, users’ money goes to scammers, in the first instance. But each scammer must pay Google whenever a user clicks its ad. So Google profits from scammers’ activities. If the scammers ceased operations — voluntarily, or because Google cut off their traffic — Google’s short-run revenues would decrease.
Users
service fees Scammers advertising fees Google
How Google Profits from Scammers
Consider the business model of rogue web sites “selling” software
like Skype. They have one source of revenue — users buying these
programs. Their expenses tend to be low: they provide no substantial customer service, and often they link to downloads hosted elsewhere
to avoid even incurring bandwidth costs. It seems the main expense of
such sites is advertising — with pay-per-click ads from Google by all
indications a primary component. The diagram at right shows the basic
money trail: From users to scam advertisers to Google. When users are
ripped off by scammers, at least some of the payment flows through to
Google.
How much of users’ payments goes to Google, rather than being retained by scammers? My academic economics research
offers some insight. Recall that search engine ads are sold through a
complicated multi-unit second-price auction: Each advertiser’s payment
is determined by the bid of the price of the advertiser below him. Many
equilibria are possible, but my recent paper with Michael Ostrovsky and
Michael Schwarz offers
one outcome we think is reasonable — an explicit formula for each
advertiser’s equilibrium bid as a function of its value (per click) and
of others’ bids. In subsequent simulations (article forthcoming),
Schwarz and I will demonstrate the useful properties of this bidding
rule — that it dominates most other strategies under very general
conditions. So there’s good reason to think markets might actually end
up in this equilibrium, or one close to it. If so, we need only know
advertisers’ valuations (which we can simulate from an appropriate
distribution) to compute market outcomes (like advertiser profits and
search engine revenues).
One clear result of my recent bidding simulations: When advertisers
have similar valuations (as these advertisers do), they tend to “bid
away” their surpluses. That is, they bid almost as much as a click is
worth to them — so they earn low profits, while search engines reap
high revenues. When a user pays such an advertiser, it wouldn’t be
surprising if the majority of that advertiser’s gross profit flowed
through to Google.
A specific example helps clarify my result. Consider a user who pays
$38 to Freedownloadhq.com for a “free” copy of Skype. But Freedownloadhq
also received, say, 37 other clicks from 37 other users who left the
site without making a purchase. Freedownloadhq therefore computes its
valuation per click (its expected gross profit per incoming visitor) to
be $1. The other 10 advertisers for “Skype” use a similar business
model, yielding similar valuations. They bid against each other,
rationally comparing the benefits off high traffic volume (if they bid
high to get top placement at Google) against the resulting higher costs
(hence lower profits). In equilibrium, simulations report, with 10
bidders and 20% standard deviation in valuations (relative to valuation
levels), Google will get 71% of advertisers’ expected gross profit. So
of the user’s $38, fully $27 flows to Google. Even if Freedownloadhq’s
business includes some marginal costs (e.g. credit card processing
fees), Google will still get the same proportion of gross profit.
One need not believe my simulation results, and all the economic
reasoning behind them, in order to credit the underlying result: That
when an auctioneer sells to bidders with similar valuations, the bidders
tend to bid close together — giving the auctioneer high revenues, but
leaving bidders with low profits. And the implications are striking: For
every user who pays Freedownloadhq, much of the user’s money actually
goes to Google.
In January I estimated
that Google and Yahoo make $2 million per year on ads for
“screensavers” that ultimately give users spyware. Add in all the other
terms with dubious ads — all the ringtone ads, the for-free software
downloads, ads making false statements of product origin, and various
other scams — and I wouldn’t be surprised if the payments at issue
total one to two orders of magnitude higher.
Towards a solution
Some of these practices have been improving. For example, six months
ago almost all “ringtones” ads claimed to be “free,” but today some
ringtones ads omit such claims (even while other ads still include these
false statements).
Recent changes in Google pricing rules seem to discourage some of the
advertisers who place ads of the sort set out above. Google has increased its pricing
to certain advertisers, based on Google’s assessment of their “low
quality user experience.” But the specific details of Google’s rules
remain unknown. And plenty of scam ads — including all those set out
above — have remained on Google’s site well after the most recent round
of rule changes. (All ads shown above were received on September 15,
2006, or later.)
Google already has systems in place to enforce its Adwords Content Policy.
My core suggestion for Google: Expand that policy to prevent these
scams — for example, explicitly prohibiting ads that claim a product
is “free” when it isn’t, and explicitly prohibiting charging users for
software that’s actually free. Then monitor ads for words like “free”
and “complimentary” that are particularly likely to be associated with
violations. When a bad ad is found, disable it, and investigate other
ads from that advertiser.
To track and present more dubious ads, I have developed a system
whereby interested users can submit ads they consider misleading for the
general reasons set out above. Submit an ad or view others’ submissions.
These problems generally affect other search engines too — Yahoo,
MSN, and Ask.com, among others. But as the largest search engine, and as
a self-proclaimed leader on ethics issues, I look to Google first and
foremost for leadership and improvement.
Google’s (Non-)Response
When Information Week requested a comment from Google as to the ads I reported, Google responded as follows:
When we become aware of deceptive ads, we take them down. … We will review the ads referenced in this report, and remove them if they do not adhere to our guidelines.
A week later, these ads remain available. So Google must have
concluded that these ads are not deceptive (or else Google would have
“take[n] them down” as its first sentence promised). And Google must
have concluded that these ads do adhere to applicable Google policies,
or else Google would have “remove[d] them” (per its second sentence).
Google’s inaction exactly confirms my allegation: That Google’s ad
policies are inadequate to protect users from outright scams, even when
these scams are specifically brought to Google’s attention.
All identifications and characterizations have been made to the best
of my ability. Any errors or alleged errors may be brought to my
attention by email.
I thank Rebecca Tushnet for helpful discussions on the legal duties of advertisers and search engines.
Originally posted October 9, 2006. Last Updated: October 16, 2006.
Read Google’s voluminous Adwords Content Policy, and you’d think Google is awfully tough on bad ads. If your company sells illegal drugs, makes fake documents, or helps customers cheat drug tests, you can’t advertise at Google. Google also prohibits ads for fireworks, gambling, miracle cures, prostitution, radar detectors, and weapons. What kind of scam could get through rules like these?
As it turns out, lots of pay-per-click advertisers push and exceed the limits of ethical and legal advertising — like selling products that are actually free, or promising their services are “completely free” when they actually carry substantial recurring charges. For example, the ad at right claims to offer “100% complimentary” and “free” ringtones, when actually the site promotes a services that costs approximately $120 per year.
An example misleading ad, falsely claiming ringtones are “complimentary” when they actualy carry a monthly fee.
In today’s article, I show more than 30 different advertisers’ ads, all bearing claims that seem to violate applicable FTC rules (e.g. on use of the word “free”), or that make claims that are simply false. I then analyze the legal and ethical principles that might require search engines to remove these ads. Finally, I offer a mechanism for interested users to submit other false or deceptive ads they find.
This article uses data from SiteAdvisor, a company to which I serve as an advisor.
Much of the computer security industry acts like spyware is immaculately conceived. Somehow it just appears on computers, we are led to believe, and supposedly all we can do is clean up the mess after it happens, rather than prevent it in the first place. I disagree.
Now, we all love Google. I use Google’s search site all day every day, and I enjoy their downloadable applications too. So I have the greatest respect for Google’s core service. But there’s another side to their business. Indirectly, Google and other search engines make big money from spyware, through paid search advertising that infects users who don’t know any better or don’t understand what they’re getting into.
Consider a Google search for “screensavers”:
The colored icons next to search results were inserted not by Google, but by the SiteAdvisor client application, based on the results of SiteAdvisor’s automated tests for each listed site. Six of Google’s ten sponsored links get “red” or “yellow” ratings — generally indicating unwanted advertising through spyware or, in some instances, high-volume commercial email. But without SiteAdvisor (or some similar protection), users would have no idea which sites were safe; they’d be at great risk of clicking through to an unsafe site, ultimately risking installation of unwanted software.
Screensaver Advertisers’ Business Model
Google surrounds its “screensavers” search results with ten ads selected from interested Google advertisers. Whenever I see a company buying an ad (online or offline) for a “free” product, I ask myself: How do they make money? With few exceptions, companies only buy online advertising when they expect to get something directly in return. (There are exceptions — dot-com bubble “eyeball” purchases, Fortune 500 “brand building,” perhaps some free ads offered by the Google Foundation.) But in the case of these screensaver providers, they’re almost certainly making money somehow if they can afford to pay Google’s high pay-per-click prices.
So how do Google’s screensaver advertisers make money? Most of Google’s screensaver advertisers really do offer screensavers that are “free” in the sense that users need not provide a credit card number. But they’re not free in the sense of being available without substantial adverse effects. Quite the contrary: Users must put up with various forms of intrusive advertising.
Let’s look at funscreenz.com, a top-ten Google advertiser for “screensavers.”
Funscreenz.com is owned by BestOffersNetwork, which is another name for notorious “adware” company Direct Revenue. Recall Direct Revenue’s Newsweek profile – plenty of users (and multiple lawsuits) alleging that their software installs improperly and, in many cases, without consent. I’ve previously documented Direct Revenue installed in tricky popups, via false claims of purportedly-required add-ons, and through exploits without any consent at all.
Of course Funscreenz is not alone. Also in top “screensavers” Google results are ads for Claria, Ask Jeeves, and various adware bundlers (who distribute changing or multiple advertising programs). One top Google “screensaver” advertiser sends 15+ emails per week to those who provide an email address to get a screensaver. Results at Yahoo and MSN are similar.
Estimating Search Engine Revenues from Spyware Infections
Every time a user clicks through a search engine ad, the search engine gets paid. Google doesn’t ordinarily say how much advertisers pay. But Yahoo (which does) charges about $0.25 for a “screensavers” click. Let’s do some math. Of the users who click through to screensavers.com, suppose 10% actually download a screensaver – a conversion rate most web sites would celebrate. Then screensavers.com needs to earn $2.50 per download ($0.25/10%) just to break even. That’s a lot of money per download. But they’re buying the ads anyway, and they’re savvy decision-makers. So we can deduce that this site grosses at least $2.50 per download.
How much money do search engines make from these ads? Some initial back-of-the-envelope estimates: According to Yahoo’s keyword inventory tool, “screensaver” (and its hundred most common variants) received about 2.3 million searches in December 2005. Suppose 20% of those searchers clicked on paid links. (That’s conservative, since ads fill more than half of typical users’ screens.) As estimated above, suppose Yahoo collects $0.25 per paid click. Then Yahoo made about $115,000 in December 2005 from “screensaver” and variants. Throw in Google, with its bigger market share, and “screensaver” likely yields about $250,000 of revenue per month.
Of course, not all “screensaver” ads ultimately yield spyware. But from SiteAdvisor’s tests, it seems at least 60% push spyware, spam, or similar unwanted materials. So Google and Yahoo’s “dirty” revenue, from dubious screensavers ads, is probably about $150,000 per month.
But “screensaver” is only one of many terms that commonly leads to spyware and adware. I’ll look at other risky keywords in future articles, as I try to measure the prevalence of this problem in greater detail. Reviewing traffic data from Yahoo’s inventory tool, I’m confident that similarly-affected keywords total at least fifteen times the traffic to “screensavers.” Then Google and Yahoo make about $2.2 million per month, or $26 million per year, through this spyware-pushing advertising. That may not be big money to them, but to my eye it’s a lot.
Clearly there are quite a few estimates here. Send email for methodological improvements and alternative data sources.
Closing Thoughts
As with so many great Internet inventions, the bad guys have stormed the gates of search engines. Now is the time to start fighting back. That doesn’t mean search engines should blacklist every company I ever criticize, but some “adware” vendors are so shady that search engines could proudly refuse their money. Responsibility starts at home. More on search engines’ possible strategies in a future article.
Google claims to be on the right side of the spyware problem. Its May 2004 Software Principles set out lofty (if somewhat vague) standards for installation notice consent. Its Google Toolbar installer gives impeccable disclosure and obtains true, meaningful, informed consent. (See page 7 of my FTC Comments(PDF).) And Google is a victim of spyware: I’ve tested and studied a number of programs that add bogus search results and advertisements to Google.com results, tarnishing Google’s brand and siphoning advertising revenues that would otherwise accrue to Google.
Yet Google is far from blameless in the spyware battle. Of particular concern: Numerous blogs hosted at Google’s Blogspot service contain JavaScript that tries to trick users into installing unneeded software. At one such blog, users are offered a misleading popup that falsely claims "You have an out of date browser which can cause you to get infected with viruses, spam, and spyware. To prevent this, press YES now." If a user declines, the user is shown a second popup instructing "Click Yes to upgrade," followed by the first popup again. If the user declines a second time, a further popup claims "We strongly recommend you upgrade … Click YES Now!" See screenshots below.
If a user presses yes, the user receives certain extra software, often including software that many users would call spyware. The screenshots above show an attempted installation of Elitetoolbar. I have also observed similar popups attempting to install software from Crazywinnings (repeatedly falsely claiming "you have to click yes to continue" if users initially decline the installation) and from Direct Revenue. See a video of the repeated Crazywinnings installation attempts. See also additional screenshots (1, 2, 3, 4) of other software installations and/or other infected Blogspot pages.
Who’s Responsible, and Who’s Able to Stop This Mess?
The popups at issue come from a service called iWebTunes.com. iWebTunes recruits blog authors by giving them music to add to their blogs or other web sites. But as users view the resulting blogs, iWebTunes shows software installation popups to attempt to foist extra programs onto users’ computers. These programs likely pay iWebTunes a commission for each resulting installation.
Users have reported unwanted software offered by Blogspot sites since at least September 2004. See a September 15, 2004 blog post complaining of spyware received from iWebTunes. I reported these problems to Google staff last week, including a specific example of an infected site. But so far Google has taken no action to stop the misleading popups on this site or others. A recent Blogspot tech support response admitted the problem, at least generally, but offered no specific approcah or timetable for resolution.
What should Google do? Google already disallows JavaScript within Blogspot.com posts. (Screenshot.) Apparently Google considers embedded JavaScript too risky — too likely to trick, deceive, or otherwise take advantage of users. But Google oddly allows JavaScript to be added to Blogspot headers and navigation bars. This decision should be reversed. Disallow the JavaScript interface by which iWebTunes gets added to Blogspot pages, so Blogspot pages can no longer trigger misleading JavaScript and ActiveX popups from iWebTunes or elsewhere. Of course some JavaScript code is entirely harmless — like the scripts that embed Google AdSense ads, comments, or polls. But Google should hesitate to permit JavaScript from unknown or known-hostile sources.
So Google is in a natural position to stop this problem. But it’s not the only company that could take action here. As I pointed out earlier this month, VeriSign plays a key role in authorizing ActiveX security warnings like that shown above: The misleading popups are only shown if they carry valid digital certificates, and VeriSign is the primary issuer of such certificates. VeriSign’s existing rules disallow using VeriSign-issued certificates “to distribute malicious or harmful content of any kind … that would … have the effect of inconveniencing the recipient.” I consider the programs above to be harmful for their addition of unwanted software including toolbars, silent auto-updaters, and systems that track and transmit certain personal information. Especially when combined with the popups’ false claims ("… out of date browser" and "you have to click yes") and especially in light of the other misleading circumstances of installation, I see ample basis to conclude that the popups are malicious. These software installation attempts are therefore arguably prohibited by existing VeriSign rules. But I’ve seen little sign of VeriSign acting to enforce its rules. VeriSign’s code signing site offers no obvious standards or procedures for assessing or reporting violations.
More on Google and Spyware: Sponsored Link Advertising from So-Called Spyware Removers
These misleading Blogspot popups are not Google’s only ties to spyware companies. Eric Howes has posted a warning he calls Google & Anti-Spyware Products: Be Wary of Paid Search Results. Eric and others have put together a list of “rogue/suspect” anti-spyware applications that are at best useless (failing to detect or remove bona fide spyware) and at worst malicious (installing new spyware of their own). Comparing current Google advertisers for a search on "spyware" with Eric’s impressively detailed list yields surprisingly numerous matches.
According to Google’s Software Principles, companies should "keep good company" by avoiding doing business with those who don’t meet ethical standards. Yet Google somehow continues to show ads for — and accept advertising payments from — companies whose supposed anti-spyware tools merely take advantage of users’ spyware worries. Google has made some progress at cleaning up the most dishonorable advertising for anti-spyware searches, but its AdWords advertising remains a poor, unreliable source for consumers to find reputable, high-quality anti-spyware applications.
Google offers interested users a version of its search engine restricted by a service it calls SafeSearch, intended to omit references to sites with “pornography and explicit sexual content.” However, testing indicates that SafeSearch blocks at least tens of thousands of web pages without any sexually-explicit content, whether graphical or textual. Blocked results include sites operated by educational institutions, non-profits, news media, and national and local governments. Among searches on sensitive topics such as reproductive health, SafeSearch blocks results in a way that seems essentially random; it is difficult to construct a rational non-arbitrary basis for which pages are allowed and which are omitted. Full article.
The authors are studying exclusions from search engine search results, and have found some 113 sites excluded, in whole or in part, from the French google.fr and German google.de compared with google.com. Learn more about the situation and context, test the exclusions for yourself, and submit further sites suspected to be excluded. Full article.
