The Field Kit is normally for members only. This one is free for every reader, start to finish, because nobody should have to pay to find out whether their ad budget is paying people who host child sexual abuse material.

In yesterday's investigation, one buyer and three sellers answered the same question about money. Their answers don't fit together.

The buyer, Zeta Global, wrote: "Zeta does not issue payment and will seek clawbacks from the applicable SSP."

The sellers. TripleLift said payouts to a blocked seller are assessed "on a case-by-case basis in accordance with the contractual terms." Sovrn said treatment of accrued amounts "depends on the circumstances of the individual case." Criteo said it "does not publicly disclose confidential contractual or payment matters involving individual supply partners." Fifteen other companies didn't answer at all.

So one side of the market says the money should come back up the chain, and the other side says it depends on a contract you have never seen.

Here's the part that matters to you. You are a party to one of those contracts. Your insertion order, your supply agreement, your DSP terms. If none of them says what happens to the money when a seller is cut off for child sexual abuse material, then "it depends" is the policy, and you agreed to it.

This week's kit fixes that. Six asks, in the order the money moves: the block, the trigger, the list, the plug, the payout, the ledger. Each comes with the dodge ADOTAT actually received in writing, and the follow-up that ends it.

And one recommendation we have never made before in this newsletter: don't buy from StackAdapt until it answers. Not because we have evidence it made money here. We don't. Because it won't tell anyone whether it could have.

Zero tolerance is a press release. A frozen payout is a clause.

Let's start with what this isn't. ADOTAT has no evidence that StackAdapt made money from the flagged image host, or from any publisher flagged for child sexual abuse material. None. This is not an accusation. It's a concern, and it's about transparency.

StackAdapt is a DSP. It sits on your side of the table. When a buyer like Zeta says it claws money back from the SSP, it's a DSP making that call on behalf of the advertisers it buys for. That's exactly why StackAdapt's silence matters more than most.

On August 27, 2026, ADOTAT sent StackAdapt the same five questions every other company received, through the press agency named on its own wire releases. Do you block the whole domain. What triggers it. Which lists. Who pulls the plug. Does the seller still get paid. Reminders followed. So did a final notice. StackAdapt never answered any of them.

Its competitors did. Zeta answered all five. Criteo named its segments and the month it adopted them. Answering was possible. StackAdapt chose not to.

Then we asked the people who fund it. Ontario Teachers' Pension Plan, whose venture arm led StackAdapt's February 2025 round, acknowledged our inquiry and promised an answer to our “serious inquiry” by September 9. It never came. Summit Partners and Intrepid Growth Partners, StackAdapt's other named investors, never answered at all. Ontario Teachers' is a jointly sponsored public pension plan. Teachers' retirement money is behind a company that won't say whether it pays sellers flagged for child sexual abuse material.

We have the same concern, to a lesser degree, about Index Exchange. It's one of the largest exchanges in the market. ADOTAT sent it the five questions on August 23, followed by reminders and a final notice. Index Exchange never replied in any form. Again, we have no evidence Index Exchange monetized the flagged domain, and it wasn't among the companies named in the February 2025 reporting. But an exchange that size sits between thousands of sellers and your budget, and "no comment, five times" is not a brand safety policy.

Both companies are headquartered in Canada, and that deepens the concern rather than easing it. Both sell into the U.S. market, to U.S. brands, with U.S. budgets. One of the three clearinghouses named in our very first question is the Canadian Centre for Child Protection, which runs Project Arachnid in their own country.

And Canada's Bill C-34, introduced in June, puts new duties on companies that host content while companies paid per impression to sell ads beside it appear to sit outside it. When a company sits outside one country's reach and the gap in another country's law, transparency is the only accountability left. Both chose not to offer it. We have more meetings with canadian authorities next week about this and will followup.

So here is our recommendation, and it's mine personally: do not buy from StackAdapt until it answers our five questions on the record. Not in a statement, not on background, not on a call. Five answers, with a name attached. The day it does, its row in our grid gets filled in with the date, and this recommendation comes down.

For Index Exchange, we're not making a do-not-buy call. We're asking you to make the ask yourself, as a customer, and to weigh the answer you get.

If you already buy through either one, send the email at the bottom of this kit. You're the customer. They may answer you.

This kit is for whoever signs the supply agreement or the IO, and for the brand safety or ops lead they forward it to. It assumes three things: a delivery report by domain from your DSP, a named contact at each SSP on your supply path, and the willingness to get the answers in a file instead of on a call.

One thing to do before you send anything. Pull your own delivery report for imgbb.com and ibb.co, the image host named in the February 2025 Adalytics report, going back as far as your DSP retains logs. If your spend shows up, you already have a line item for question six. If it doesn't, you still send the letter, because the next flagged domain won't have a report written about it.

Every answer below is quoted from the companies that responded to ADOTAT's survey. The dodges are real. So are the good answers. Where a company did the right thing, it's in here as the standard you can hold everyone else to.

The printable one-page card is attached below, free like everything else in this issue.

The ask. When a clearinghouse such as NCMEC, the Internet Watch Foundation or the Canadian Centre for Child Protection has notified a publisher about child sexual abuse material, do you block the whole domain, every subdomain and path, or filter page by page?

Why it matters. Page-level filtering means the seller account stays open. The publisher keeps selling, keeps accruing revenue, and the exchange keeps taking a fee on everything that isn't caught. A domain block closes the account. TripleLift described the right standard: "fully excluding the publisher from the TripleLift exchange and blocking it from all monetization channels, rather than limiting the exclusion to individual pages or URLs." Sovrn described the same: blocking at the top level means "every subdomain and full path under that domain is covered." Zeta applies "a network-level domain block."

The hidden version of this problem. You can't block a domain you can't see. Richard Murphy of the Alliance for Audited Media told ADOTAT the existing tools only work if exchanges "require the use of sellers.json, schain, and ads.txt for all transactions" and allow "no 'confidential' statuses." A confidential seller on your path is a domain you've agreed not to know.

Clean answer. Full domain, all subdomains, all channels, on a single credible notice. And a list of any confidential sellers on your deals, or a commitment to drop them.

The dodge: "We can remove a domain if we receive credible reports."

The follow-up: "Who decides what's credible, and has a clearinghouse notice ever reached you directly?"

A policy that waits for a report is a policy that waits for a reporter.

The ask. What starts the block, through which channel, and how many hours from notice to removal?

Why it matters. This is the structural gap yesterday's piece found. NCMEC's notices go to the company hosting the images. They go nowhere else. There is no feed from the clearinghouse to the exchange. NCMEC had been notifying the image host since 2021. TripleLift, the most careful seller in the survey, learned about it on February 7, 2025, the day the trade report came out, and removed the publisher "within 24 hours." That's the fastest documented response in the survey, and it still started three years late, because the warning was never addressed to the exchange.

So the question for your seller isn't only how fast they move. It's how they would ever find out.

Clean answer. A named trigger (a clearinghouse notice, a verification vendor segment, a law enforcement contact), a named team that receives it, and a notice-to-block time measured in hours.

The dodge: "We act immediately once the matter is verified."

The follow-up: "Who verifies, through which channel, and what was your notice-to-block time the last time this happened?"

"Immediately" is a promise. A timestamp is a record.

The ask. Which lists and segments do you use, by product name and adoption date? Are you an IWF member, or does its data reach you through a partner?

Why it matters. Murphy made the point everyone else skipped: "you need to be a member to license the IWF list." No supply-side platform appears on the IWF's public member list. The data companies joined after the report: Peer39 in February 2025, DoubleVerify in April, IAS in July.

Criteo gave the most checkable answer in the survey. It "adopted DoubleVerify's newly introduced 'Highly Illicit: Do Not Monetize' and 'P2P Sharing and Streaming' avoidance segments upon their release in February 2025." A product name and a date. That's what a real answer looks like, and it's the template for yours.

TripleLift was just as honest about the gap: "We don't work directly with IWF, and to our knowledge, IWF data doesn't reach us indirectly through our current partners either." Peer39's CEO, whose company pushes IWF signals to its integrations, described the rest of the market in one line: "I can't speak to what platforms who are not integrated with us do."

Clean answer. Named segments, named vendors, adoption dates, and a straight yes or no on IWF data.

The dodge: "We use trusted third parties and industry sources."

The follow-up: "Name them, with the date you adopted each one."

A list you can't name is a list you can't audit.

The ask. Who can pull a publisher, and does commercial sign-off ever apply?

Why it matters. Judy Shapiro told ADOTAT "the incentives to keep brand unsafe inventory in the ecosystem are irresistible to the adtech players." If the person who pulls the plug reports into the person who owns the revenue, the incentive gets a vote.

Two companies drew the line clearly. TripleLift's Marketplace Quality team "does not report into any commercial leadership," and for high-risk signals "Commercial or other internal sign-off is therefore not a prerequisite to taking immediate action." Zeta's Inventory Quality team makes the call, and the "commercial side is not involved in the process." TripleLift also said medium-risk cases do involve commercial stakeholders. That admission is what makes the rest of the answer believable. Hold other sellers to the same candor.

Clean answer. A named team, a reporting line that doesn't run through revenue, and a written statement that child sexual abuse material is never a medium-risk case.

The dodge: "Decisions follow our policies and processes."

The follow-up: "Does the person who pulls the plug report into revenue? Yes or no."

The ask. When you block a seller for child sexual abuse material, is revenue accrued to that seller withheld or paid out?

Why it matters. This is the column that stayed white. Seventeen of twenty-one cells in yesterday's grid were empty, and the four that weren't split between Zeta's clawback, two contract references and one "confidential." No SSP has ever said it withheld a payout from a seller blocked for child sexual abuse material.

The money can be held. Murphy explained why: "It is common to have post impression adjustments, and the time from ad serving to publisher payment in the digital media ecosystem is quite long." Every seller agreement has a payment window, often thirty to ninety days. The money sits somewhere for weeks. The only question is whether anyone reaches in.

This is where you have leverage no reporter has. ADOTAT can ask. You can make it a condition of payment.

Clean answer. "Accrued revenue for a publisher blocked on these grounds is frozen and not remitted." In writing, pointing to the clause.

The dodge: "Payouts are assessed on a case-by-case basis in accordance with the contractual terms."

The follow-up: "Then show us the term. What does your publisher agreement say happens to that money?"

"It depends on the contract" is only an answer if you're allowed to read the contract.

The ask. For any publisher blocked on these grounds, report our impressions after your first knowledge, our spend, your fee, and the amount paid out to the publisher.

Why it matters. Three numbers would close this story, and no company in the chain has disclosed any of them. Amazon said in February 2025 that it refunded advertisers, and never said how much. TripleLift called its spend "minimal" and declined to quantify it, citing a long-standing policy against account-level financial disclosure. That was the most anyone offered.

Notice what you're asking for here. Not the publisher's account. Yours. Sellers decline to disclose partner finances. That's a reason to protect the publisher's numbers from other buyers. It isn't a reason to hide your own spend from you.

Clean answer. A four-line report for your account: impressions, spend, fees, remittance. Zero is a fine answer, as long as it's written down.

The dodge: "We don't publicly disclose confidential contractual or payment matters involving individual supply partners."

The follow-up: "We're not asking about your partner. We're asking about our money. Report our line."

Send it to each SSP, exchange and DSP on your path, including StackAdapt and Index Exchange if you buy through them, and copy your account rep so nobody later says they never saw it.

Subject: Supply policy on clearinghouse-flagged publishers

Hi,

Before we renew or scale spend with you, we need written answers to the following. A file or an email is fine. A call isn't a substitute.

If an item isn't available, tell us which one and why. We'd rather have "we don't track that" in writing than a summary on a call.

Thanks,

Paste these into the next IO or supply agreement, and have your counsel tune them:

None of this asks a seller to build anything. TripleLift and Zeta already describe the first line. Murphy explained why the second is possible. The third is arithmetic the seller already has. The clauses just attach a price to not doing it.

A company with a real policy answers in a day, the way TripleLift answered ADOTAT a day early, with a date, a team name and a line it wouldn't cross. A company without one sends a statement that uses the words "abhorrent," "zero tolerance" and "industry partners," and asks whether you'd like to hop on a quick call.

And a company like StackAdapt sends nothing at all. Five weeks, five questions, three investors, zero answers. The first one earned the renewal. The last one told you everything you need to know about where to put your budget.