The investigation published by The Times of London last week is generating exactly the kind of advertiser panic that the adtech industry has been dreading. Reporters found advertisements from AT&T, Verizon, Johnson & Johnson, and dozens of other major brands running alongside extremist, hateful, and pro-terror content on YouTube. The brands didn’t know. Their agencies didn’t know. The automated systems that placed those ads had no mechanism for knowing, because the open exchange programmatic infrastructure is not designed to know.
AT&T has pulled its YouTube spend. Verizon has pulled its YouTube spend. Johnson & Johnson has suspended advertising. The UK government has pulled ads from Google’s platforms. This is not a news cycle story. This is a fundamental confrontation between how programmatic advertising works and what brand advertisers have been told it can safely do.
The instinct in trade press coverage is to frame this as a YouTube-specific problem — inadequate moderation of user-generated content, poor content classification, a platform that monetized harmful content because it wasn’t looking closely enough. That framing lets the rest of the programmatic industry off the hook. The mechanisms that created the YouTube brand safety failure exist throughout the open exchange ecosystem. Addressing it requires confronting how programmatic advertising works, not just how one platform failed to moderate its content.
How Ads Ended Up on Extremist Content
The path from brand advertiser to extremist video is worth tracing in technical detail, because understanding the mechanism is necessary for understanding the fix.
YouTube monetizes video content through Google’s advertising infrastructure, primarily through TrueView pre-roll and display ads. Brands can purchase YouTube inventory through Google Ads with targeting parameters: demographics, interests, geographic areas, and content category exclusions. They can also purchase through programmatic exchanges that include YouTube inventory. Brand safety tools — keyword blocklists, content category exclusions — are the primary control mechanism.
The problem is that keyword blocklisting is an inadequate control for a platform with hundreds of hours of video content uploaded every minute. A keyword blocklist prevents an ad from running on a video whose title or metadata contains flagged terms. It does nothing about a video whose title is benign but whose content is extremist, whose creator has rebranded a channel to evade previous restrictions, or whose associated content — the playlist it appears in, the community it’s part of — is harmful without the individual video triggering keyword flags.
Content category targeting adds another layer of exclusion, but YouTube’s content categorization is machine-driven at scale and the categories available to advertisers are broad. “News and Politics” is not an exclusion that meaningfully separates quality journalism from extremist political video.
The deeper issue is that brand advertisers were buying YouTube as a brand-safe premium video environment, when the reality is that YouTube is a user-generated content platform with a programmatic monetization layer and content moderation capabilities that do not scale to the volume of content being published. The mismatch between the sales narrative and the operational reality is the heart of the scandal.
Why Open Exchange Programmatic Has the Same Problem
The YouTube brand safety issue is an illustration of a broader principle: open exchange programmatic buying is not inherently brand-safe, and the controls that brands apply to it are insufficient.
Any time a buyer purchases inventory through an open exchange — whether display, video, or native — they are buying from a supply pool that is not uniformly reviewed. Domain spoofing, MFA (Made for Advertising) sites, and content categorization errors are endemic to the open exchange. The ad verification vendors that buyers rely on for brand safety — DoubleVerify, Integral Ad Science, comScore — provide post-bid and pre-bid tools that filter known bad inventory. But “known bad” is the key qualifier. New domains, rebranded channels, and content that evades category detection are invisible to pre-bid safety scoring until they accumulate a history.
DoubleVerify’s brand safety measurement documentation explains the categories their system detects and the mechanisms for pre-bid filtering. The gap between what the tools can detect and what actually exists in the supply chain is real and cannot be papered over by more sophisticated keyword lists.
Why Keyword Blocklists Are Inadequate
The go-to brand safety tool in programmatic buying is the keyword blocklist: a list of words and phrases that, if found in the URL, page title, or other metadata of a potential ad placement, cause the DSP to suppress the bid. The logic is intuitive and the implementation is simple. The limitation is fundamental.
Keyword blocklisting is a reactive, text-matching approach applied to metadata rather than content. It is effective at preventing ads from running on pages where the problematic nature is obvious from the URL or title — a page titled “How to Build a Bomb” will trigger keyword filters. It is ineffective against content where the problematic elements are in the video or article body rather than the title, where channel names are innocuous, where content evades detection by using coded language, or where an otherwise legitimate publisher carries content that is problematic in specific sections.
More sophisticated contextual analysis — natural language processing applied to page content, video transcript analysis, image recognition for video frames — is the direction the industry needs to move. Some of this technology exists in prototype form. None of it is operational at programmatic scale today.
What a Real Brand Safety Audit Looks Like
For the brands now reconsidering their programmatic strategies, “what do we do” requires more than pulling spend from YouTube. It requires a structured review of every programmatic channel and the brand safety controls applied to each.
The starting point is an audit of current brand safety measures: which keyword blocklists are in use, how recently they were updated, how the brand’s category exclusions are configured in each DSP, and which third-party verification partners are integrated and what their coverage is. Most organizations conducting this audit for the first time will find gaps — blocklists that haven’t been updated in months, category exclusions that are overly broad or narrowly drawn, verification tools running on some channels but not others.
The next layer is a placement-level review. For any campaign that has been running on open exchange inventory, post-bid brand safety reporting from an accredited measurement vendor provides a view of where ads have actually been appearing. This is uncomfortable data for some brands to see, but it is necessary. Organizations that have been buying YouTube and broad open exchange video without running placement-level audits have been operating on hope rather than verification.
The structural response — beyond audits — requires rethinking how open exchange programmatic budget is allocated for brand-sensitive campaigns. Whitelist buying, where ads run only against a defined list of approved publishers, is the most conservative approach: it dramatically limits reach but provides real placement control. Private marketplace deals with premium publishers provide brand safety in a programmatic-efficient structure. Direct IO buying eliminates the programmatic variable entirely for the most brand-sensitive messages.
The IAB’s brand safety guidance provides a framework for evaluating brand safety practices, though the guidance is necessarily general — the specific application to video platforms and user-generated content environments is still developing in response to the current situation.
The Industry Accountability Question
The YouTube scandal will accelerate several conversations the industry has been avoiding. Transparency — buyers knowing what content they are actually funding — is the core issue, and it requires structural changes to how programmatic supply is verified and categorized.
The advertisers pulling spend are sending a market signal: brand safety is not a nice-to-have that can be addressed with token keyword lists. It is a fundamental requirement, and platforms and exchanges that cannot provide it at the required confidence level will lose brand budgets. That is the appropriate market response.
The solution set is not comfortable: whitelist buying reduces scale, PMP deals require publisher relationships, and the open exchange volume that programmatic built its growth story on is not compatible with the brand safety requirements that major advertisers are now articulating. The industry will need to make structural choices about where scale comes from if open exchange brand safety cannot be meaningfully improved.
Frequently Asked Questions
How did major brand advertisements end up on YouTube extremist content? Brands purchased YouTube advertising through automated programmatic channels with keyword-based brand safety exclusions. Those exclusions failed to identify content categorized as extremist in channels and videos where the titles and metadata didn’t trigger keyword flags. YouTube’s content moderation system, operating at scale across user-generated content, did not detect and demonetize the problematic content before brand ads ran against it.
What is whitelist buying and how does it differ from standard programmatic? Whitelist buying restricts ad delivery to a predefined list of approved publishers or websites. Rather than buying against audience segments across the open exchange, whitelist campaigns bid only on impressions from verified, pre-approved domains. This provides strong placement control but significantly limits reach and increases CPMs. It is the most conservative brand safety approach in programmatic.
Are third-party brand safety tools effective in preventing this type of brand safety failure? Third-party brand safety tools like DoubleVerify and Integral Ad Science provide meaningful improvement over no verification, but they are not comprehensive solutions. Pre-bid brand safety scoring is based on historical content analysis of known domains — new or rebranded channels, fresh content, and sophisticated evasion can slip through. Post-bid reporting identifies where ads ran but doesn’t prevent the impression from serving. For the highest brand-safety-sensitive campaigns, whitelist buying or private marketplace structures provide more reliable control.
What should brands demand from their agency and DSP partners in the wake of this situation? Brands should require placement-level reporting — not just aggregate brand safety scores but actual domain and placement data for where their ads ran. They should require integration of accredited third-party brand safety measurement on all programmatic campaigns. They should push for contractual brand safety guarantees with defined credit provisions for violations. And they should have an honest internal conversation about whether the reach and cost efficiency of open exchange programmatic buying is compatible with the brand safety requirements of their specific products and audiences.