Note: Free, limited access is available now — create your DecryptAds account and run your very first supply-chain search in under a minute!
What is DecryptAds?
DecryptAds is an ad-tech transparency platform that maps programmatic supply chains so that researchers and the public can trace hidden flows of ad tech data, compare against disclosures, and publish evidence-backed findings.
Why Now?
We founded DecryptAds because we care about programmatic advertising and know it powers the open web, keeping a wide range of content free while paying creators to do what they love.
The Hidden Scope of the Problem
Nearly 300 ad-tech companies in our corpus are registered in sanctioned, adversarial, or financial-secrecy jurisdictions and they appear in the declared supply of many of the sites and apps people use (almost certainly without knowing) every single day.
This happens because the entire “Know Your Customer” (KYC) process in ad tech is generally considered to be a near impossible task because it works across the scale of the Internet itself, or at least that’s what the ad tech industry would like everyone to think. However, our team has found that by associating the country various ad tech companies are associated with (i.e. where they are legally founded, have significant staff, or are headquartered) one can begin to get a sense of the geographical risk involved, which immediately starts to paint a very specific picture when compared against the broad scope of sites and apps some of these companies are monetizing.
In support of this, DecryptAds’ data provides a first-pass sense of geographic risk. It uses a keyword match against the address a company discloses in sellers.json (grounded in OFAC, U.S. Executive Order 14117, and FATF / financial-secrecy frameworks), so treat these buckets as hints to pursue further, not strict determinations.
Early on in our analysis, our team realized that while there are programmatic ad tech companies all over the world, only certain countries check the proverbial box of elevated risk when one of these global companies are registered there. As such we have categorized our ad tech geo risk data into the following buckets*:
- Sanctions: Russia. (81 ad tech companies)
- Adversary: China and Hong Kong. (84 ad tech companies)
- Secrecy Haven: Cyprus, Panama, Seychelles, British Virgin Islands, Jersey, and Gibraltar. (24 ad tech companies)
- Elevated Risk: Turkey, Ukraine, United Arab Emirates, Nigeria, and Pakistan. (98 ad tech companies)
Note: The jurisdictions shown are those that actually had a matching company; each tier is defined by the frameworks above. Numbers shown are as of this writing and likely to increase.
That’s Wild, So… What is Programmatic Advertising?
For many people, this term does one of two things: either it makes your eyes glaze over or it prompts a million questions. What the term essentially references however, are the text, image and video ads which are being bought and sold through complex auctions over the internet. These ads show up on publisher websites, apps and connected TV experiences and are part of a system with trillions of user data points flowing like a firehose with millions of advertisers and thousands of ad tech companies vying for your attention.
This is also sometimes referred to as “Real Time Bidding” (RTB), the “bidstream”, or any number of other obscure names for the same ad tech systems. Most of this ad tech technology is also locked away in obscure transparency files (ads.txt, app-ads.txt, sellers.json, buyers.json, adagents.json). Here at DecryptAds our team has built a platform that regularly hunts for these files across the globe and layers new context over them while enriching the results with other, novel datasets. We’ve even baked in a rather slick interface for manual hunts, made every feature accessible via API for programmatic use cases, and taken an AI-native approach by ensuring our launch comes with a readily-accessible MCP server, allowing our users to interact with our data using their preferred AI agents and/or tools.
Exploring Our Data
Our team has built a series of never-before-seen research tools*, but it’s still going to take good old-fashioned elbow-grease to help folks understand how to explore this data and why it’s critical to get more people involved in this line of work. That is especially true when the very same programmatic advertising systems which power the relatively open Internet we all know and love are (either directly or indirectly) facilitating a wide range of harmful activity, a problem set which has only gotten worse over the last several years.
A non-inclusive list of these harmful activities includes ad tech powering:
- global tracking systems following people and individuals,
- the delivery of targeted malware payloads and scams,
- support of ad fraud (which prints money for various threat actors),
- money laundering,
- assisting “AI slop” artists in cashing out their “Made for Advertising” junk websites which serve to steal time from the average person who stumbles across their low quality content, harming advertisers who inadvertently place ads on these garbage sites.
*Jump in to start exploring our tools and data by creating an account right here!
Our Newest Feature: The Legal Dossier
In response to the critical need to rapidly parse and evaluate the complex web of data involved here, DecryptAds has recently launched a restricted-access, in-beta research tool we are calling the “Legal Dossier”, which is currently only available for researchers and enterprise partners.
This tool utilizes public resources to explore and map ad tech companies, their corporate structure(s), ownership, leadership, and more. That data is then enriched and provided in a simple-to-ingest format for a Know Your Customer (KYC) report.
Data Brokers Behind an Ad Tech Mask
Many ad tech companies, whether openly or not, are also operating as global data brokers. While this used to be a quiet industry secret, thanks to new data broker registration frameworks which have come online in California, Vermont, Texas and Oregon we can finally unravel which ad tech companies are participating in these data sales, and then map their websites and apps to where they are collecting said data.
These registries also let us flag which ad-tech companies appear on various states’ data-broker rolls, allowing us to surface those sites and apps where certain overlaps of interest may appear.
As of today DecryptAds matches against the California (CPPA) and Texas registries in-tool; with the Oregon and Vermont figures below being registry totals. As our own in-app map notes, these registry matches are, and should be treated as, overlap signals (i.e. leads to investigate, not proof a company collects data on a given site). That said, our data broker data shows that even with the transparency brought on by these new registries, there is still an inconsistent data broker registration process in need of attention. As an example: 62 unique ad tech companies have registered as data brokers, but none in all states, as the following breakdown shows, with varying numbers observed for companies in:
- California (49),
- Oregon (29),
- Texas (24),
- and Vermont (16).
Importantly, these new data broker processes have forced ad tech companies to disclose details about their clients, the types of data they are collecting for sale, and combining these new insights with other public programmatic advertising transparency files provides an unprecedented look into the data flows from websites and apps into the hands of global data brokers.
While the programmatic ad tech industry prefers to keep its little secrets, here at DecryptAds* our mission is to bring those very issues to light so that the public can see what is being done with their data.
Quiet Removals: The Ad Tech Canary-in-the-Coal-Mine
The sellers.json standard exists to provide a file for ad tech companies to list their partners, however when there is a problem, those same partners are quietly removed from those same files, often without any public fanfare or clear explanation despite this being an of-interest signal to any observer in this space.
DecryptAds monitors for this very thing, providing an easy-to-read (and ingest) “Quiet Removals Feed”* to help identify when companies are being (or have been) removed from multiple sellers.json files. While this can be for innocuous reasons, such as a company simply shutting down, it can also serve as a fantastic pivot for researchers and auditors to discover websites and apps that may have been involved in a policy violation that resulted in their subsequent removal.
If you’re an advertiser or ad tech researcher, having a ready list of publishers who may have had recent problems is a great opportunity to check against to see where any ads you bought were on that source so that you might move forward with a refund demand, a process that we all know rarely happens automatically. Taking that a step further, our “Quiet Removals Feed” can serve as a foundational basis for the start of a great ad fraud investigation.
The Internet’s (And Advertisers’) “AI-Slop” Problem
As our team was first delving into the expansive data now at our fingertips, it became clear that ad tech has a pervasive AI slop problem. One that is only getting worse at a speed that many have yet to fully appreciate. “Made for Advertising” websites have always been a problem that steals hard-won user attention (and advertiser money), but with AI-sourced content creation combined with unprecedented efforts to hide the true ownership of the garbage websites hosting it, there’s a nearly unlimited series of opportunities available to hunt for these sites*.
A hunt that demands one start with the right data, and more importantly: the proper context.
Worse, those same problems have spread to the various app-based ecosystems as well, which is why DecryptAds also provides app data sourced from Google Play, Apple, Roku, Fire TV, and Samsung TV**. Our team has worked hard to make it easy to skim and search this data to understand both these apps’ programmatic advertising partners (inclusive of data brokers and potentially risky foreign partners) as well as these apps’ own disclaimers to the app stores themselves (a rather handy and informative comparison, if we say so ourselves).
DecryptAds transforms this (and more) data into a signal you can act on*: our platform rates any site on a 0 to 100 risk score against a variety of Made-for-Advertising traits (including, but not limited to: ad density, chumbox and refresh behavior, editorial identity, and pub-ID reuse across a portfolio), so that you can separate real publishers from generative slop at a glance.
Policy Leads the Way: The Need for Client-Side Exposure of the Supply Chain Object
As it stands, even the most sophisticated enterprise, military, or government organization capable of tracking everything happening to users on their network, who know exactly when a given user is sent a malicious payload or ad, still don’t know which ad tech companies touched that impression (i.e. which may have/could have been involved in the targeting). All of that is still hidden away server-side for ad tech companies to hoard and quietly parse for themselves, leaving valuable insights locked away from those who need (and could best use) them.
As such, DecryptAds will also be supporting policy solutions that would require the ad tech industry to expose something known as the “Supply Chain Object” (Google primer on SCO) client-side, instead of hiding it away server-side in a fashion only available to ad tech companies.
Over the coming months our team will, of course, continue to roll out new features, novel investigations, and work behind-the-scenes to train the next generation of programmatic ad tech researchers… but we know that this alone is not enough.
This All Sounds Amazing, What’s Next?
Depends on what you’re after:
- Practitioners: If you or your organization would like to check us out, then simply create a free account.
- Enterprises: If your company/organization would like access to our most impressive features, then feel free to reach out and/or book a demo!
- Researchers & Journalists: If you’re interested in delving deeper and publishing your findings, then simply request research access.
- Policy & Data Partners: If you’d like to move policy forward or assist in our mission, please head over to our Contact Page or reach out directly.
For everyone else, you can start your journey and dive in with your very own DecryptAds account here, or jump in and join these critical conversations by following us on LinkedIn, X/Twitter, Bluesky, or Mastodon.
Disclaimer: Signals on DecryptAds are indicators for investigation and should be treated as such, not as accusations of wrongdoing.
Frequently Answered Questions (FAQ)
-
What is an ads.txt or sellers.json file?
Public files publishers and ad systems use to declare who's authorized to sell their inventory and who their sellers are. DecryptAds crawls these sources (and many more) as part of our transparency initiative.
-
What is a “quiet removal” in ad tech?
When an ad system silently drops a partner from its sellers.json file, often after a problem though occasionally for legitimate reasons, with no announcement. DecryptAds flags these events across the files for researchers, auditors, and the ad tech industry to use for investigative purposes.
-
What is a Made-for-Advertising (MFA) site?
A low-value site built to farm ad impressions rather than serve readers. DecryptAds provides its users with a 0 to 100 risk score that takes MFA traits (and many others) into consideration.