About The Investigation. Every Wednesday, ADOTAT publishes one long piece built from primary sources rather than press releases: written on-record answers, contracts, filings, transcripts, and the questions the trades tend not to ask. The format is deliberately narrow.

One subject, named companies, named executives, and every claim put to the people it concerns before publication, with their answer printed as they gave it or their silence noted. Nothing here is sponsored, nobody reviews it in advance, and the reporting runs whether or not the subject is a friend of the publication.

In February 2025, adtech was caught running brand advertising on an image host that the national child-protection clearinghouse had flagged for child sexual abuse material for three years. The industry said it was appalled. Nineteen months later, ADOTAT asked twenty-three companies what they actually did. Fifteen never answered. The only company willing to explain what happens to the money is a buyer, and its answer points directly at the sellers who won't talk.

Before I covered ad tech, I helped catch people who prey on children.

For a few years I was part of the Secret Service-led New York Electronic Crimes Task Force, one of its first members, working under Bob Weaver. We sat in the same office as the Secret Service liaisons to NCMEC, the National Center for Missing & Exploited Children, which is where the reports land. It was only a few years. I still have nightmares.

I'm not going to describe what I saw. You don't need those pictures in your head, and I'd rather you didn't carry them. What I'll tell you is that the violence and destruction done to children stops being an abstraction once you've looked at it for a living. It isn't a "category." It isn't a "sensitive content segment." It's a kid, and somebody got paid for what happened to that kid.

Then came September 11. In 2001 we worked out of the ninth floor of 7 World Trade Center. Whatever that work had already done to me, 9/11 made it worse. I'm not saying this for sympathy. I'm saying it so you understand why I read the February 2025 Adalytics report differently than most people in this business did.

So when this industry got caught, I expected better. I didn't expect perfection, just better. This is an industry that can tell you in milliseconds whether you looked at a pair of sneakers last Tuesday. It can tell whether it's paying the people who run a site the national clearinghouse flagged for child sexual abuse material.

Let's see how seriously they took it.

Every industry has a language it speaks when it's caught. Advertising's is short, and everyone in the business knows it by heart.

Zero tolerance. Abhorrent. We regret. We take this seriously. We are reviewing. It gets recited within hours of a bad headline, by comms directors who have recited it before and will again. It isn't quite a lie. It's closer to a prayer: something said aloud so that everyone listening can believe, for one news cycle, that the thing being condemned is outside the system and not part of how it runs.

In the first week of February 2025, the prayer got a workout.

A research firm called Adalytics published a report showing that brand advertising had run on imgbb.com and ibb.co, a free image host that asked nothing of its users. No registration. Links that could be hidden from search engines. Links that could be set to vanish after a few days. It was the kind of place built for people who don't want to be found. NCMEC, the National Center for Missing and Exploited Children, had notified that site about child sexual abuse material dozens of times in 2021, 2022 and 2023. The ads beside it came from brands you've touched today: Starbucks, PepsiCo, Honda, Unilever, Mastercard, Adidas. One came from the U.S. Department of Homeland Security.

The report also named the pipes. Amazon. Google. Criteo. Quantcast. Microsoft. Outbrain. TripleLift. Zeta Global. Nexxen. AdExchanger's reporting that month added more third-party vendors accused of serving ads into that archive: PubMatic, Beeswax, Sharethrough, Infillion.

Then came the liturgy.

Amazon told The Register, "We regret that this occurred." It said it had swiftly blocked the sites, that it has strict policies, and that it was taking additional steps.

Google told the same outlet it had zero tolerance for content promoting child sexual abuse and exploitation, that it had already acted, that its teams watch constantly, and that the accounts were terminated.

Integral Ad Science said it had zero tolerance for illegal activity and strongly condemned anything connected to child sexual abuse material.

DoubleVerify put its statement on its own website: "We find this content abhorrent." It promised a comprehensive review of image-hosting sites and a mechanism to block anonymous, profile-based image hosts at scale.

Two U.S. senators, Marsha Blackburn and Richard Blumenthal, wrote to the CEOs of Amazon, Google, DoubleVerify and IAS, and to the Media Rating Council and TAG, the two bodies that certify the industry's honesty to itself. The letter to Andy Jassy said ad tech had "created a funding stream that perpetuates criminal operations." The senators gave everyone one week to answer.

Lou Paskalis, the industry consultant, wrote what the statements were careful not to say: that the size didn't matter, that a thousand impressions or five dollars was beside the point, because "this is as wrong as it gets."

Digiday reported at the time that neither certifier had issued a formal response. One of them then did. TAG answered the senators in writing on February 14, 2025, inside their one-week deadline, and its CEO tells me it was the only recipient to publish a response.

Then the week ended, as weeks do. The report became a link people forwarded with a grimace. The senators' letters went into a file. The ad servers never stopped. And the question underneath all that disgust, the one that matters to anyone who has ever followed dirty money, was never asked out loud:

Who got paid?

I want to describe my inbox, because in this story it's a place.

Most mornings it's full of ad tech. Embargoed announcements about the future of addressability. Invitations to dinners in rooms with good lighting. Requests to put a chief revenue officer on The ADOTAT Show. Follow-ups to the requests. "Happy to connect." "Circling back." "Would love to get 15 minutes." These are companies that want to be seen, and I understand that. Visibility is the product. An ad company that can't get attention is a strange kind of company.

On August 23, 2026, I sent twenty-three of those companies a different kind of email.

The same five questions went to sixteen exchanges and SSPs, four DSPs and buy-side platforms, and three verification and data vendors. Every one got the same words in the same order. I told each of them that the answers would publish side by side, one row per company, and that silence would publish as a blank cell.

The questions were plain. I wrote them for anyone with a policy to answer in an afternoon.

Six answered in some form. Two declined. Fifteen said nothing.

Nothing, over three, four and sometimes five sends across five weeks, with every delay announced to every company. Their names should be read slowly, the way you'd read names off a wall:

Index Exchange. Magnite. PubMatic. Nexxen. Teads. GumGum. TrustX. Yieldmo. Infillion. FreeWheel. Pixalate. Choozle. StackAdapt. Equativ and Sharethrough. (Equativ's clock started late because of my own addressing error, which I fixed on September 2. It has had four weeks since.)

Now set that list next to February 2025. Nexxen. Outbrain, now part of Teads. PubMatic. Beeswax, which FreeWheel owns. Sharethrough. Infillion. Named then, blank now.

Three of the companies named in 2025 did answer me: Criteo, TripleLift and Zeta. That's the whole split. The companies named in February either explained themselves in 2026, or stayed silent both times.

I have one exact example of what that silence sounds like.

On August 22, Yieldmo CEO Michael Yavonditte answered an ADOTAT question the day it arrived, on the record, with his name and title, about contextual advertising. He wrote that contextual "is highly effective but it needs to be setup properly in a dsp or buying platform." It was a good answer, generous and quick, from someone who knows his business and likes talking about it.

The next morning, the child sexual abuse material questions went to that same address. A reminder followed three days later, another the day after that, and a final notice in September.

The same inbox, the same man, one day apart. On contextual targeting he answered within hours. On whether his company pays sellers who host abuse material, nothing.

Someone will say they were busy. Fourth-quarter planning, conferences, travel. "Too busy" is an honest answer to a question about attention metrics. It isn't an answer to this one.

There's a column in our comparison grid headed Money owed to blocked seller. It's the fifth question, the one I cared most about, because I learned a long time ago that you can tell what an institution believes from where its money goes, not from what it says.

Twenty-one companies appear in the grid. Seventeen of their cells in that column are empty.

The first of the four that aren't empty belongs to Zeta Global, which answered all five questions on August 28. Its chief communications officer, Candace Dean, wrote:

"Zeta does not issue payment and will seek clawbacks from the applicable SSP."

That's a buyer saying it won't pay for impressions on a flagged publisher, and that it expects the money back from whichever SSP sold them. One side of the market believes the money should flow back up the chain.

So I asked the other side whether it ever did.

Not one SSP or exchange would say.

TripleLift, the most forthcoming seller in the survey by a wide margin, said payouts are assessed "on a case-by-case basis in accordance with the contractual terms." Sovrn, which answered in full on Tuesday, said much the same: "The treatment of accrued amounts depends on the circumstances of the individual case, including the nature of the issue identified, applicable agreement, and any relevant legal requirement." And Criteo said it "does not publicly disclose confidential contractual or payment matters involving individual supply partners."

That's the column: one buyer asking for its money back, two sellers pointing to their contracts, one company calling the question confidential, and seventeen rows of white space. "It depends" is an answer to whether a policy exists. It isn't an answer to whether a dollar moved.

Three numbers would fill the column, and no company in the chain has ever disclosed any of them:

I want to be precise, because precision is the only thing that holds up against a denial. Amazon said in February 2025 that it refunded advertisers, though never how much. So the provable sentence isn't "nobody refunded anyone." It's this: no SSP has ever said it withheld a payout from a seller blocked for child sexual abuse material.

Richard Murphy of the Alliance for Audited Media, whose job is the plain arithmetic of what happened, gave me the sentence that shows this is knowable:

"It is common to have post impression adjustments, and the time from ad serving to publisher payment in the digital media ecosystem is quite long."

Every contract in this business has a waiting period between the ad and the payment. The money sits somewhere for weeks. Someone could reach in and hold it. The only question is whether anyone did, and that's the one question nobody will answer.

Judy Shapiro has spent years on brand safety, which is the industry's name for the promise that your ad won't appear beside something that would shame you. She answered my questions within three hours. Her first line explains the whole thing:

"It is virtually impossible for a client to 'catch' a brand safety violation and all the players knows it, DSP, SSP and agencies."

Then an image I haven't been able to shake:

"Rarely does a brand 'catch' a brand safety violation because seeing it is like seeing a shooting star in a brightly lit city, during the day."

Think about what that means. A marketer is sitting in a glass office with a dashboard glowing green: 100 percent brand safe, 100 percent suitable. Behind the dashboard is a city lit so brightly that nothing unusual can be seen in it, and somewhere in that daylight, something is burning.

Then Shapiro said the part the industry would rather skip:

"Worse, the incentives to keep brand unsafe inventory in the ecosystem are irresistible to the adtech players."

Murphy, who chooses his words like a man who has to defend each one in an audit, came to the same place from the other side:

"I think economics is a driving factor. Quality, transparent, trustworthy inventory costs more than cheap, risky, opaque inventory. We still have budget being allocated to the latter group."

Two very different people gave the same answer. It keeps happening because it pays. The liturgy is what the industry says. The price is what it does.

The rest continues for signed-up readers: