Ad Verification With a Proxy: A Step-by-Step Check

In short: Ad verification is checking that a campaign ran on the terms the advertiser bought: placement, creative, landing page and market. To check it, load the placement in that market from a static address on an internet provider’s network, in a browser never signed in to the ad platform. Record every run the same way (screenshot, redirect chain, time, address used) and compare runs. Where your record and a partner’s report differ, you have a finding.

Ad verification, in the words of the industry guideline that set it out, is “a process which attempts to verify that one or more attributes of a served online ad have been executed in a manner consistent with the terms specified by the advertiser or agency”. This guide covers the part an advertiser or agency can run itself: loading a placement from the market it was bought for, and keeping a record that holds up when a partner disputes it. ProxyJam sells static residential (ISP) proxies, the kind this guide describes for ad verification, and the product side is on our ad verification page. Our editorial policy explains how articles like this are sourced and corrected.

What does an advertiser need to see?

Four things, and a partner can get each of them wrong without the advertiser noticing from the office. The Interactive Advertising Bureau (IAB) and the Media Rating Council (MRC) organise their Guidelines for the Conduct of Ad Verification (2012) around five service lines: site context, geo-targeting, ad placement, competitive separation and fraud detection. A check by hand covers them through these four.

• Placement. The page the ad appeared on, its position there and what sat next to it. An ad sold as a slot on one site that turns up on an unrelated one, or beside content the brand excluded, is a placement failure.
• Creative. The exact asset and copy that was served. A swapped or outdated creative shows up here, and so does a competitor’s ad in a slot sold as exclusive, which the guideline calls competitive separation.
• Landing page. Where a click on the ad leads, through every redirect. The final page should be the one the advertiser approved, selling the same product.
• Geo targeting. Whether the market that was bought was served. The guideline is frank about locating visitors by IP address: results that separate US from non-US traffic “are often quite accurate, those below DMA level are questionable”. A DMA is a US television market, which is larger than most cities.

A single check cannot tell you how much of the campaign went right. Delivery share, reach and invalid-traffic rates come from the campaign’s own measurement. A check by hand answers a narrower question: was this served, here, at this time?

Why is the office the wrong place to check from?

The office is in one market and the campaign usually is not, so the geography is wrong from the first request. Ad systems also know the advertiser. A browser signed in to the ad platform, or an address with the advertiser’s history on it, may be served something other than what the audience gets. The check means something only when the ad system treats the request as one from the audience.

How do you choose the market and the network?

Choose the country the campaign bought, then a network an ordinary household there would use, then keep the address fixed.

The market

Our catalogue is sold by country, with a named provider behind every address. If the campaign targets a country, an address in that country answers the question. If it targets one city, no proxy product can promise a vantage point inside it, ours included. The IAB/MRC guideline itself treats IP location finer than a television market as questionable, so a city-level finding needs the campaign’s own measurement. For the United States, the US ISP proxies page lists the 24 named carriers our addresses are registered to.

The network

Use an address registered to an internet provider, the kind of network a household in the market would be on; an ISP proxy is that kind of address served from a data centre. The MRC’s invalid-traffic standard lists “known invalid data-center traffic” among the general invalid traffic that measurement filters by routine means, and the Trustworthy Accountability Group (TAG) produces a Data Center IP List each month so that its members can filter such addresses. A check from a hosting range may be served nothing, served a filler, or not counted at all, and an empty slot of that kind tells you nothing about the campaign. An address on an internet provider’s network removes that one ambiguity. It does not make the check invisible, and a verification check has no reason to be. Residential against datacenter proxies walks through the public registration record such filters read.

Keep the address fixed

Use the same address for the same market on every run. Verification is a comparison: this week against last week, one placement against another. If the address moves between runs, a change in what you see may come from the network and say nothing about the campaign. An ad verification proxy should therefore be a static one, held for the whole period you pay for, which is how our ISP proxies are sold. ISP against rotating residential proxies compares holding one address with drawing from a pool.

How do you prepare the browser?

Set the browser up the way the audience’s is likely to be, so that what it receives is what the audience receives.

• Keep a separate browser profile for checks that has never signed in to the ad platform, the advertiser’s site or the advertiser’s accounts.
• Match the device type to the placement: desktop inventory from a desktop browser. Placements bought on mobile carriers need a carrier connection, which a static ISP address is not.
• Set the browser’s language to the audience’s, since language is a common targeting setting.
• Before the first run, open What Is My IP through the proxy. It prints the address, its location and its network, which go into every record.

How do you run the check and record it?

Run every check the same way, and record it so that someone who was not there can see what you saw. The IAB/MRC guideline is blunt about evidence: “Conjecture or verbal evidence is not considered acceptable for ad verification.” The steps of a single run are listed under Run and record one check. Each record holds five things.

1. Screenshots: one of the browser window with the ad in place and the address bar in view, and a full-page capture of the page. Keep the original files. If you mark them up, save the annotated copies separately, since the guideline asks that any altered evidence be disclosed.
2. The redirect chain. Tick Preserve log on the Network panel of the browser’s developer tools, so that requests survive page loads, then click the ad. Chrome’s Network panel exports the session as a HAR file, and its default export leaves out cookies and other sensitive data, which suits a file you will send to a partner.
3. The time, in UTC, so that runs made from different time zones line up.
4. The address used and the network it belongs to, copied from the check page you opened before the run.
5. What the campaign said should happen: the placement, the creative and the approved landing page, taken from the insertion order or the trafficking sheet.

Keep the records. The guideline suggests that verification records be kept for at least 60 days from the first report, and evidence of material errors and suspected fraud for 12 months.

How do you spot cloaking and misplacement by a partner?

Compare the record with the plan. Most failures surface as a mismatch between the two, and the table What a mismatch points to lists the common ones with the question each one raises.

Cloaking is the clearest case. Google’s advertising policy defines it as “showing different content on your website to different people or to Google to try to hide things that might break Google Ads’ rules”. A partner who cloaks shows reviewers and the advertiser a compliant landing page and shows the audience something else. Two comparisons point to it: the landing page reached from the market differs from the one the partner submitted, or the same ad resolves to different pages from a hosting address and from an internet provider’s address. Small differences are normal. Google allows a page to vary by language or location as long as the product promoted is the same for everyone, so the test is whether the product changed.

Misplacement shows in the placement record. An ad on a domain other than the one in the delivery report suggests the inventory was misrepresented. A publisher’s ads.txt file declares the companies it authorises to sell its inventory, so you can check whether the seller named in your report is on it. Ads hidden, stacked under another ad or served in a one-pixel frame appear in the MRC’s list of sophisticated invalid traffic. An ad served in an excluded market, or missing from a bought one, is a geo-targeting failure.

When you find one, report it through the channel the campaign contract names and attach the records. The guideline holds verification services to a rule worth copying. Testing a seller without its participation is authorised only where the campaign terms do not prohibit it. Even then, the client must have told the seller in advance, or the verification partner must already be approved to work in that seller’s environment.

How many addresses does a verification programme need?

One per market, plus any you add for parallel work. No count fits every programme, but four questions settle it.

• How many markets? Each country you check needs its own address in that country, so a campaign running in three countries needs three.
• How much runs at once? One person working through the markets in turn needs no more. Two people checking the same market at the same moment can share an address: each one carries up to 100 concurrent sessions, dropping to 10 once it has transferred 50 GB in a calendar month (Terms of Service, section 2.4).
• Do you compare networks? A cloaking test needs a second vantage point of a different kind, such as a hosting address. A second address of the same kind adds nothing to it.
• How often? Checking more often reuses the same address at shorter intervals, and frequency alone adds no addresses. Keep the schedule and the sample no larger than the check needs. Every load of a live placement can count as an impression, and section 5 of our Acceptable Use Policy prohibits generating artificial traffic, clicks or impressions.

The MRC lists known monitoring and testing automation among the invalid traffic that measurement should filter, which is the right outcome for a check. It belongs in your verification record, and the delivery the advertiser pays for should leave it out. Addresses are priced per IP per period, as listed on the pricing page.

When does a proxy check not answer the question?

• Carrier-targeted mobile placements. They need a carrier connection, and we do not sell mobile addresses yet. The mobile proxies page explains how they work.
• City-level targeting. A country-level address cannot confirm it.
• Delivery share, reach and invalid-traffic rates. These need the campaign’s own data and a measurement vendor accredited for them.
• Testing an ad network’s defences. Getting past its review or its bot detection is not verification, and section 5 of our Acceptable Use Policy prohibits it.

For a campaign in the United States, the US ISP proxies page lists each named carrier, and one static residential proxy for ad verification per market is where a programme starts. The catalogue covers 77 countries, priced on the pricing page, and the ad verification page answers the questions a buyer asks before ordering.