With the brand safety scandal raging on since March of this year, one term that keeps cropping up as a potential solution is ‘whitelisting’. ExchangeWire delves into whether whitelisting really is the white knight the industry needs to fend off the bad guys. First published in issue 02 of ExchangeWire's The Wire print publication.

What is whitelisting?

As you’d expect, it’s the opposite of blacklisting. Rather than building a list of disapproved URLs, your campaign targeting is based on a list of approved URLs to help keep brands safe and reduce the possibility of nonhuman traffic. That’s the basic definition; but of course true whitelist implementation is more complex. Marc Goldberg, CEO, Trust Metrics, explains to ExchangeWire that they are looking at domains and apps for safety, quality, and fraud signals and they build custom whitelists for their customers from that data.

Why consider it?

Marc Goldberg, CEO, Trust Metrics

Whitelisting is an obvious solution for sensitive brands. “Each brand has different safety criteria and thresholds of sensitivity”, explains Goldberg. “A whitelist, in our eyes, is custom to each brand. Pharma companies, for example, have a tendency to become very specific where they want be adjacent to, due to the fact they have real legal risks associated with the promotion of their medicines.”

JPMorgan Chase notably moved to whitelisting following the brand safety scandal in March of this year, moving from appearing on 400,000 sites a month, to just 5,000 per month, all of which had been pre approved by JPMorgan.

When the only other option is pulling out of platforms entirely, which was the response from many brands following YouTube’s brand safety issue being brought to light, then whitelisting is a viable option.

“Whitelisting can also help reduce nonhuman traffic”, explains Trust Metrics’ Marc Goldberg. “When you start looking at some of the domains in these exchanges, you can see that some of these sites are just designed to steal advertising dollars. Be inclusive, not exclusive. By creating a whitelist, you will avoid sites like these.”

Quality, not quantity

At ExchangeWire Live in New York in March, both Susan Schiekofer, chief digital investment officer, GroupM and Mitch Weinstein, SVP, ad operations, IPG Mediabrands, debated the benefits of moving fully over to whitelists:

“I think I’m ready to go to whitelist for everything”, announced Schiekofer.

“It’s not the worst idea. How many new sites that are entering the supply chain on a daily basis are sites we want to be on?”, asked Weinstein hypothetically.

“And, if it’s a good site with quality journalism, great, we’ll put them on the whitelist”, agreed Schiekofer.

But, surely, a key advantage to the open marketplace is scale of inventory and that would make a whitelist very limiting. TrustMetrics’ Marc Goldberg doesn’t agree. “If you still believe that supply is infinite, then sure, it will limit you”, he argues. “If you are starting to realise that nonhuman traffic and fake publishing sites have confused the situation, you just need a reset of what scale is. When you create a whitelist, by definition you won't be including everything. The limits of a whitelist will be different by brand and scale can be achieved.”

The grey areas

Susan Schiekofer, Chief Digital Investment Officer, GroupM

Of course, there are brands out there specifically going after quantity over quality. “We do have clients who have a much higher tolerance for risk”, said GroupM’s Susan Schiekofer. “Such as clients who are much more focused on performance marketing and getting the highest number of impressions for the lowest cost. The more parameters you put on the type of inventory you get, the higher the CPMs could be, which could affect modelling outputs.”

Pre-approving at the publisher domain level also doesn’t block your ads from appearing against potential unsavoury content and doesn’t protect you in walled garden environments, such as Google and Facebook, where you would expect your brand to be safe. For example, there could be a controversial page on Facebook with over a million followers. “Even if we’re not running our ads on that Facebook page”, said GroupM’s Susan Schiekofer, “theoretically, if somebody likes that page, our ads could be somewhere near a news article running in their feed. It’s theoretical, and very limited and very small, but it’s a scenario we need to consider.”

Marc Goldberg, CEO, Trust Metrics highlights that whitelisting is only a first step and context and intent are so important in this scenario: “You don't flag The New York Times because they did a movie review of 'Straight Outta Compton' and quoted a few lyrics, and you don't approve [photo-entertainment website] theCHIVE because they have three articles on credit repair.”

“News sites are not universally acceptable”, continues Goldberg. “Some buyers don't consider the nuance between brands and industry. You can't create a ‘global whitelist’ and transact on it without considering your clients’ needs.” Trust Metrics created the News Trust Index for this reason; to help brands include news, but also make sure they are not appearing on fake news, conspiracy, hate, or highly controversial partisan sites, if that is a concern.

More whitelisting means more spoofing

Steve Indich, General Manager, US, Beamly

“One problem with programmatic is masked URLs”, said Steve Indich, general manager, US, Beamly at ExchangeWire Live. “You don’t always know and there is only so much tech can do, so how do you push it?” Speaking of his client, global beauty behemoth Coty, Indich said they already use whitelists in certain circumstances and they don’t target news content, but they still find their ads there, as a result of spoofing. “Then you start going down the rabbit hole and uncovering the reasons why you’re appearing there. How well do you keep up with the different ways fraudsters are finding to get around that?”

One of many threats to programmatic, domain spoofing, or masking, dupes media buyers into thinking they are buying inventory on genuinesite.com when, in fact, they’re buying it from fakesite.com. This can happen anywhere, even on premium sites like the Guardian and The New York Times. It happens at the bid request level and it’s pretty easy for fraudsters to take advantage. The notorious Methbot was one such example of spoofing at extreme scale.

Media intelligence advisor and principal consultant at Method Media Intelligence, Shailin Dhar, believes that whitelisting doesn’t get rid of the problem at hand, as it will push networks to start spoofing domains. “It is one layer of defence”, explains Dhar, “but if there is only whitelisting you will start seeing a huge rise in spoofed domains.”

Publishers think buyers should be more aware of where they’re putting their money. Publishers, in particular premium publishers, get frustrated with buyers for allowing themselves to be fooled in the first place. Paul Bannister, EVP, strategy, CafeMedia said on stage at ExchangeWire Live: “We have people emailing saying, ‘we’re buying your mobile inventory on the open market and we’d love to strike a deal’. We don’t put any inventory on the open market, so I don’t know what you’re buying, but it’s not us.” If it would cost a buyer £10 CPM with a publisher directly, and they can get it on the open market for £0.10 CPM, then the buyer needs to be suspicious.

Whitelisting won’t eliminate this issue – in fact, the increased spoofing it would create would just make it harder to police. “We look for outliers, anomalies for premium publishers at very low market CPMs”, explains Dhar. “As soon as there’s more noise in that space, where more people get the Guardian for £0.50 and £0.75 CPM, as well as CPMs of £5 and £10, it’s hard to discern what’s genuine, and implementing spoofing tech will be much more difficult than just basic fraud detection.”

The publisher’s responsibility

Premium publishers need to give buyers full disclosure of their practices, to make sure whitelists are effective. “A lot of owned and operated publishers (O&Os) go off-platform in many places”, explained GroupM’s Susan Schiekofer. “For an O&O, it’s understanding that, when you syndicate your inventory, you need to disclose the list of where you go and not everybody discloses it.”

“Another place you have to be careful of is retargeting”, said Schiekofer. “When you send an IO to a publisher, the planner assumes retargeting will occur on their owned and operated sites, but the O&O plans to distribute it out through the DSP – you have to be really careful with the language and understanding.”

The end of domain spoofing?

IAB Tech Lab have been working on an anti-spoofing tool called 'ads.txt'. The tool is intended to provide buyers with data to allow them to filter out impressions pretending to be from a premium publisher, as well as unauthorised sellers of premium inventory. Publishers place a text file containing all the exchanges they work with onto their domain – the buyer would then crawl that site specifically to collect the list. It’s a good start, but as Dhar confirms: "There’s no perfect or permanent solution to detecting [spoofing].” Some argue that the fraudsters already have seats on the exchanges anyway; so it’s difficult to see how it would work in practice. On top of that, ads.txt doesn’t cover the biggest money-making aspect of domain-spoofing: display-to-video arbitrage, whereby an arbitrageur could represent an in-video display banner as a video ad and slip through the net.

The best of both worlds

Method Media Intelligence’s Shailin Dhar believes a whitelist combined with campaigns targeting the open marketplace would be an effective approach, as the whole point of programmatic is to reach the open internet: “A whitelist should be for premium campaigns, where you say: 'This is my list of sites. I will be a paying higher CPM, as I know I trust these sites, but also have an open campaign to feed my whitelist continuously.' You have to add to your whitelist as you don’t want to limit the amount of potential customers.”

Are whitelists the answer? In isolation, no. However, in a world where brands are increasingly concerned about where their ads may be appearing, it can provide an extra layer of security to build a more robust antifraud strategy. Brands should enter the realm of whitelisting with their eyes open: CPMs will increase, but so should performance; it’s also a time-consuming process and requires continuous upkeep; and you can’t just adopt a one-size-fits-all approach; customisation will be key. However, ultimately, a multilayer approach may be the only way to stay ahead.