# Is Contextual Advertising Safe? Analyzing Systemic Risks with Ads on YouTube

Asmaa El Fraihi, Ines Abdelaziz, Oana Goga

► To cite this version:

Asmaa El Fraihi, Ines Abdelaziz, Oana Goga. Is Contextual Advertising Safe? Analyzing Systemic Risks with Ads on YouTube. WWW 2026 - ACM International World Wide Web Conference, Apr 2026, Dubai, United Arab Emirates. hal-05494521v2

HAL Id: hal-05494521

https://hal.science/hal-05494521v2

Submitted on 17 Feb 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# Is Contextual Advertising Safe? Analyzing Systemic Risks with Ads on YouTube

Asmaa El Fraihi*

asmaa.el-fraihi@inria.fr

Institut National de Recherche en

Informatique et en Automatique

Institut Polytechnique de Paris

Palaiseau, France

Ines Abdelaziz*

ines.abdelaziz@inria.fr

Institut National de Recherche en

Informatique et en Automatique

Institut Polytechnique de Paris

Palaiseau, France

Oana Goga

oana.goga@inria.fr

Institut National de Recherche en

Informatique et en Automatique

Institut Polytechnique de Paris

Palaiseau, France

## Abstract

Contextual advertising is seeing a resurgence in popularity as a privacy-preserving alternative to behavioral advertising. While often regarded as a coarse-grained approach, advances in AI-driven content analysis have transformed it into a highly granular form of targeting. In this paper, we examine the safety risks of contextual advertising through a two-part empirical study of YouTube. First, we show that advertisers can reach audiences defined by sensitive attributes—such as religion, mental health conditions, and political ideology—by strategically selecting contextual placements, effectively circumventing policies that prohibit such targeting via behavioral signals. Second, to assess how this risk manifests in practice, we develop an automated measurement framework to collect ads delivered on high-risk content environments, focusing on conspiracy videos. We find that contextual advertising is highly prevalent in these environments, disproportionately delivers sensitive ad categories (including alternative health, religion, and political content), and provides limited transparency into why ads are shown. Our results demonstrate that contextual advertising can be as opaque and susceptible to abuse as behavioral targeting, and highlight the need for stronger transparency and regulatory scrutiny of contextual ad systems.

## CCS Concepts

* Information systems → Online advertising; * Security and privacy → Human and societal aspects of security and privacy.

## Keywords

Contextual Advertising; Advertising Transparency; Conspiracy Videos

## 1 Introduction

Behavioral targeting relies on large-scale user tracking to build detailed profiles that determine when, where, and to whom ads are shown. This model has faced sustained criticism for its intrusiveness and lack of transparency [6, 9, 11, 36], contributing to widespread user distrust and the adoption of privacy-enhancing tools such as ad blockers and privacy-first browsers. At the same time, major browsers such as Safari and Firefox have phased out third-party cookies by default [32, 40], directly weakening the infrastructure that enables behavioral tracking. Regulatory frameworks including

the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA) further restrict the collection, sharing, and use of personal data for ad targeting [15, 16].

Within this shifting ecosystem, **contextual advertising**—which matches ads to the content a user is currently viewing rather than their historical behavioral profile—has reemerged as a leading alternative [8, 17]. Because it is regarded as an ethical and privacy-preserving approach, and because it does not rely on third-party cookies, its adoption has accelerated in regulation-heavy environments such as the European Union (EU), where it now accounts for a growing share of digital advertising [17].

Advertisers can manually define contextual targeting parameters by selecting topics, keywords, or specific placements (e.g., particular channels, blogs, or videos) where they want their ads to appear. Increasingly, however, these decisions are also shaped by platform-side optimization systems that apply artificial intelligence tools—such as semantic and sentiment analysis, clustering, and reinforcement learning—to infer relevant contexts [29]. In effect, these systems translate content signals into audience-relevant proxies. As a result, contextual advertising can enable precise audience targeting without relying on individual profile data. For instance, an advertiser could place predatory offers or pseudoscientific “miracle cures” adjacent to videos or blogs about health anxieties or personal hardship, or be algorithmically matched to such material based on semantic similarity—effectively reaching users within vulnerable segments based solely on contextual cues. This growing algorithmic complexity raises important safety and accountability concerns. Yet, contextual targeting has received little empirical scrutiny [33].

In this paper, we examine the implications of contextual advertising for sensitive audience targeting and its use in high-risk content environments. We formalize these concerns as the following research questions:

**RQ1:** Can advertisers reach audiences defined by sensitive attributes (such as religion or political ideology) by using content as a proxy for those traits?

**RQ2:** How prevalent is contextual advertising on sensitive or fringe content, and how does the surrounding content influence the nature of the ads served?

**RQ3:** Does contextual advertising provide a level of transparency sufficient for meaningful auditing and user understanding?

To address these questions, we conduct a two-part study of contextual advertising on YouTube, one of the largest video platforms and a central actor in the digital advertising ecosystem [10].

In the first part of our study (RQ1), we conduct ad experiments using curated YouTube placements as proxies for sensitive traits

<footnote>*Both authors contributed equally to this research.</footnote>

<footnote>This paper has been accepted at The ACM Web Conference 2026. Please cite the version appearing in the conference proceedings.</footnote>
such as religion, mental health condition, personal hardship, and political ideology (§ 3). We find that **advertisers can cheaply and effectively use contextual placements to reach sensitive audiences at scale, despite policies prohibiting such targeting through behavioral advertising**. This exposes a policy loophole with significant potential for abuse, enabling practices such as the exploitation of vulnerable users through predatory or misleading commercial offers, as well as ideological manipulation through the targeted delivery of political or polarizing messages to already aligned audiences.

The second part of our study (RQ2) examines the prevalence of contextual advertising on sensitive content, using fringe and conspiratorial videos on the platform as a case study. To this end, we constructed a curated corpus of conspiracy videos reflecting active misinformation narratives and developed an automated measurement framework to capture ads served on this content, together with the platform-provided explanations of their purported targeting rationale. The framework deploys multiple simulated user personas, systematically exposing them to both conspiracy and control videos (§ 4). We find that **contextual advertising plays a central role in sustaining the monetization of conspiracy content**—30% of ads in our dataset included a contextual targeting rationale—and **disproportionately delivers sensitive ad categories** such as *alternative health* (1.37% vs. 0.38%; *p* < 0.001), *religion* (8.08% vs. 6.01%; *p* < 0.01), and *political content* (6.88% vs. 1.42%; *p* < 0.001) when compared to control videos.

Furthermore, **we identify significant gaps in contextual advertising transparency** on YouTube (§ 5; RQ3). The explanations provided to clarify why an ad was shown, including for political messaging, refer to contextual targeting only in vague terms, making it impossible to discern the specific contextual cues driving ad delivery or to determine whether placements are set by advertisers or by opaque platform-level optimization systems. Additionally, users who opt *out* of behavioral targeting receive even less disclosure and are exposed to contextual ads without any indication that this targeting rationale was applied.

Taken together, our results show that contextual targeting can be just as opaque and susceptible to abuse as behavioral advertising. While it avoids direct profiling, it still allows advertisers—and ad platforms—to shape who sees what, in ways that are difficult to audit or contest. We argue that contextual advertising demands the same degree of empirical scrutiny, regulatory oversight, and transparency expectations that behavioral advertising has attracted.

## 2 Background

Advertisements on YouTube are served through the Google Ads platform. To display their ads, advertisers can choose from a set of targeting options, such as demographics, locations, interest groups (such as affinity and in-market audiences), customer lists, and content-based targeting, i.e., contextual advertising [20].

**Behavioral advertising on YouTube.** Behavioral advertising—also referred to as *personalized, profiling-based, or interest-based advertising*—relies on tracking users’ online activity to build detailed consumer segments. On YouTube, this involves aggregating data from watch history, search queries, and activity across Google’s

network to infer users’ interests, demographics, and intent [41]. Advertisers can then target these segments (e.g., “fitness enthusiasts,” or “in-market for financial services”) through Google Ads.

**Contextual advertising on YouTube.** Contextual—or content-based—targeting on YouTube delivers ads based solely on real-time content signals (i.e., the specific YouTube video or channel the user is currently watching), instead of inferred user attributes. When opting for contextual targeting, advertisers can choose—or delegate the choice to automated ad delivery systems—which contextual signals to use for targeting:

**Content keywords:** Advertisers may supply a list of keywords they deem relevant to their campaign. Google uses these keywords to match ads to content containing those terms [20].

**Content topics:** Ads can be targeted to a broad range of themes. Google automatically analyzes videos to determine the dominant topics and match them to advertiser-selected categories [20].

**Placements:** Advertisers can directly specify any set of YouTube videos or channels where they want their ads to appear. This method, also referred to as *managed placements*, bypasses the need to rely on automated systems to analyze and match platform content to the ads [20].

**Ad transparency on YouTube.** Ad transparency on YouTube is implemented through both user-facing and public-facing tools:

**User-facing tools:** YouTube provides users with two main transparency tools: “Why you’re seeing this ad?” information panel (see Figure 1 in Appendix) and “My Ad Center” [37]. These tools are intended to disclose information about why a specific ad was shown and the advertiser’s identity.

**Public-facing tools:** Google’s *Ads Transparency Center* is a database/platform designed to provide visibility into ads running across Google products. It allows users—and auditors—to search for specific advertisers, view the ads they have served, and access information such as the geographic and temporal reach of ads.

## 3 Mechanisms for Reaching Vulnerable Audiences

Sensitive attributes in personalized advertising refer to categories of personal data that are considered particularly private or potentially exploitative if used for targeting (e.g., religion or political affiliation). To protect users from discrimination and manipulation, both platforms (such as Google [22]) and regulators place strict restrictions on the use of such attributes in behavioral advertising [15, 16]. For instance, the GDPR classifies these as “special categories” of data placing strict limits on their use for advertising, while the DSA prohibits platforms from targeting ads using such data.

In this section, we present an empirical investigation into whether these regulatory and platform-level protections can be circumvented through the strategic use of contextual advertising. We hypothesize

<footnote>Article 4(1) “Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited [...]” [16]</footnote>

<footnote>Article 26(3)“Providers of online platforms shall not present advertisements to recipients of the service based on profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679 using special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679.” [14] Note that this article refers to the GDPR.</footnote>
that advertisers can effectively reach audiences associated with spe-
cial categories by curating placements on YouTube whose content
serves as a reliable *proxy* for sensitive traits, and conduct a series
of ad delivery experiments to validate this.

**3.1 Identifying Proxies for Sensitive Attributes**

We focus on several categories of sensitive attributes: *political ideology, belief systems and worldviews, religious belief, health conditions, sexual or gender identity, and vulnerability-related attributes* (see Table 1). Several of these categories are explicitly referenced under Article 9(1) of the GDPR. Within each category, we selected illustrative attributes that demonstrate how contextual placements can be curated to proxy for sensitive personal characteristics. To curate these placements, we employed two placement curation methods.

(1) **Query-based selection:** We constructed search queries designed to reflect the content-seeking behavior of users exhibiting the specific sensitive attribute. Using the YouTube Data API [24], we retrieved the top 10 relevant videos per query. To ensure alignment, two independent researchers involved in the study manually reviewed and labeled the videos based on the title, description, hashtags, and top comments; only videos with inter-rater agreement were retained (**653 videos**, 85.8%).

(2) **Channel-based selection:** We identify YouTube channels whose primary content is dedicated to, or whose audience is strongly associated with the attribute. This selection was informed by analysis of external sources such as online forums, Reddit communities, and journalistic articles. Placing an ad on a channel makes the ad eligible to appear on any monetized video published by that channel, providing a broader, sustained audience reach. In total, we curated **54 channels** via this method.

Table 1 presents examples of the placement input used to opera-
tionalize the targeting for each sensitive attribute. The complete set
of placement inputs is provided in Appendix B. These placement
curation methods easily scale, allowing continuous discovery of
new content and enabling advertisers to target users engaging with
material linked to sensitive attributes. We employ limited manual
validation, but even without human oversight, the method likely
reaches audiences associated with sensitive traits with reasonable
accuracy—though it may also capture unrelated users. Such pre-
cision aligns with industry norms, as prior work has documented
inaccuracies in behavioral audience segments [5, 39].

**3.2 Ad Delivery Experiments**

We conducted experiments on Google Ads to provide empirical
validation of this form of targeting across 12 sensitive attributes.

3.2.1 *Experiments Design.*

*Campaign setup:* For each trait, we launched a distinct campaign targeting its curated placements.

*Settings and budget:* All campaigns used the skippable in-stream video ad format. The bidding strategy was set to maximize impressions within a small €10 lifetime budget. Only placement-based targeting was enabled; all audience expansion and campaign optimization parameters were explicitly disabled to isolate the effect of the selected placements.

*Ad creative:* The creative used was a neutral video promoting drinking water (see Ethics Statement in Appendix A). This ensures the content itself does not trigger policy issues, thereby influencing the delivery based on content sensitivity.

*Policy compliance check:* Campaigns were submitted through Google’s standard ad review process, and we documented approval outcomes, including any rejections or flags related to the targeted placements.

*Delivery validation:* Each campaign was monitored for 24 hours to confirm successful ad delivery on the intended placements and to record the number of impressions generated.

3.2.2 *Results.*

*Policy compliance check:* All 12 ad experiments, despite targeting content proxies for sensitive attributes, passed Google’s ad review process without restriction [19]. This demonstrates that as long as the ad creative and general campaign settings comply with policy, platform enforcement does not prevent advertisers from exploiting content proxies to reach sensitive audiences.

*Delivery validation:* To further confirm the circumvention mechanism, we focused on validating ad delivery on a subset of six audience traits: left-leaning and right-leaning political views, Muslim and Jewish religious affiliations, financial hardship, and conspiracy-oriented worldviews. Using Google Ads reporting tools (see Appendix G.1), we confirmed that ad delivery occurred exclusively on the intended videos and channels for each attribute. We stopped the campaigns once successful delivery was confirmed. Collectively, the experiments generated 2,834 impressions within a few hours with an average cost per view of €0.02. This demonstrates that the circumvention mechanism is possible and cost-effective—ads can be delivered to audiences defined by sensitive traits reliably without the direct use of user data.

**3.3 Scaling Conspiratorial Worldview Proxies**

We examine whether the placement curation strategies described
in §3.1 can be scaled to produce large sets of thematically con-
sistent contextual placements. Focusing on conspiratorial world-
view-related content, we assess whether these discovery methods
retrieve content that reliably aligns with the intended context when
applied at scale.

To do this, we apply a lightweight automated labeling step us-
ing GPT-4o. The model is used solely to filter results, excluding
videos that debunk or critically examine conspiracy narratives and
retaining those that present or endorse them. Each video is assigned
a relevance score on a 5-point scale, from 1 (“very unlikely”) to
5 (“highly likely”) to contain conspiracy or misinformation con-
tent, based on its title, description, and transcript (full prompt in
Appendix C). The criteria of evaluation are the following:

(1) Promotion of unfounded claims, unsupported theories, or con-
tradictions of widely accepted facts.

(2) Use of language suggesting secrecy, cover-ups, or manipulation
by powerful entities (e.g., governments, secret societies, etc.).

(3) Patterns of fear-mongering, distrust in authoritative sources, or
appeals to emotion over logic.

(4) Recurrent themes commonly associated with conspiracy theories
or misinformation (e.g., anti-vaccine rhetoric, flat earth, etc.).
<table><caption>Table 1: Sensitive attributes proxies with the total number of placements curated, and the audience size estimated by Google.</caption><thead><tr><th>Sensitive category</th><th>Attribute</th><th>Examples of seed queries and channels</th><th>No. placements</th><th>place-ments</th><th>Audience size</th></tr></thead><tbody><tr><td rowspan="2">Political ideology</td><td>Left-leaning</td><td>HasanAbi, The Majority Report, David Pakman.</td><td>10</td><td></td><td>84M</td></tr><tr><td>Right-leaning</td><td>Tucker Carlson, The Daily Wire, Nuance Bro, Charlie Kirk</td><td>12</td><td></td><td>290M</td></tr><tr><td>Belief systems and Worldview</td><td>Conspiratorial world-view</td><td>"Project Blue Beam", "The Dead Internet Theory", "PROOF AI Is Sentient"</td><td>86</td><td></td><td>150k</td></tr><tr><td rowspan="3">Religious belief</td><td>Christian</td><td>BibleProject, Elevation Church, Grace Digital Network</td><td>11</td><td></td><td>22M</td></tr><tr><td>Jewish</td><td>JewishUncensored, Jewish Voice, AishJewish</td><td>8</td><td></td><td>1.7M</td></tr><tr><td>Muslim</td><td>Mufti Menk, One Path Network, Islamic Guidance, Talk Islam</td><td>11</td><td></td><td>1.1M</td></tr><tr><td rowspan="2">Health conditions</td><td>Mental health conditions</td><td>"living with adhd", "living with depression", "how to cope with depression", "lies depression tells you"</td><td>80</td><td></td><td>90k</td></tr><tr><td>Special medical conditions</td><td>"Living with Cerebral Palsy", "how to cope with cerebral palsy", "dealing with diabetes"</td><td>92</td><td></td><td>30k</td></tr><tr><td rowspan="2">Sexual/Gender identity</td><td>LGBT</td><td>"LGBTQ+ Relationship Advice", "Coping with Homophobia", "Sexuality crisis", "Lesbian Relationship Struggles"</td><td>86</td><td></td><td>60k</td></tr><tr><td>Transgender identity</td><td>"how to start HRT", "Top surgery q&amp;a", "Coping with Gender Dysphoria", "Binder safety Tips", "binder tutorial"</td><td>69</td><td></td><td>20k</td></tr><tr><td rowspan="2">Vulnerability-related attributes</td><td>Financial hardship</td><td>"how to live on a small budget", "how to apply for public housing", "low-income tips for budget"</td><td>137</td><td></td><td>190k</td></tr><tr><td>Disabilities</td><td>"How to Apply for Disability Benefits", "Coping with Disability", "How I Stay Positive Despite Chronic Illness"</td><td>89</td><td></td><td>20k</td></tr></tbody></table>

We evaluated this scheme against two reference datasets: (1) 862 videos labeled as conspiracy-related in prior work [18, 30, 31], and (2) a control set of 382 videos unrelated to conspiracy themes, spanning topics such as music, comedy, and mainstream news (§ 4.1.1). The labeling achieved an overall accuracy of 90.1%, correctly identifying 86% of conspiracy-related videos and flagging only two videos from the control set. Manual review confirmed that both flagged control videos contained speculative or misleading narratives, consistent with our labeling criteria. These results indicate that a simple automated filter is sufficient to validate large sets of placements retrieved through contextual discovery.

## 3.4 Discussion

Our findings show that contextual advertising on YouTube can be systematically used to reach audiences defined by sensitive attributes, circumventing restrictions on behavioral targeting.

**Scalability:** Our approach for identifying proxies is highly accessible as placement lists can be retrieved efficiently using the YouTube Data API or simple search queries, and the range of targetable attributes is limited only by the availability of content consumption proxies. More importantly, this method does not rely on sophisticated behavioral profiling or algorithmic inference; advertisers simply reach users while they are actively engaging with content that directly signals their traits.

**Risk:** Contextual advertising has long existed in conventional media, where placement alongside content offers, at best, a coarse association with audience interests. In online platforms, content consumption carries a different weight: users intentionally navigate to and engage with highly specific pieces of content, and do so at scale. In this setting, selecting a placement is no longer merely an alignment with a topic, but an interaction with a stream of self-selected signals that reflect users' beliefs, concerns, or circumstances at the moment of exposure. As a result, contextual placement on platforms such as YouTube can operate as a precise and scalable mechanism for reaching sensitive traits, giving rise

to risks that are qualitatively different from those associated with traditional contextual advertising.

Our experiments used a neutral creative, allowing us to focus on the effects of contextual placement selection in ad delivery without engaging creative-level moderation policies. Within this scope, the mechanism we examine introduces multiple avenues for abuse that raise societal concerns. One is exploitation of vulnerability, where advertisers can, for instance, target users seeking content related to financial hardship or mental and physical health struggles with predatory schemes or unproven products. Another is ideological manipulation, in which contextual placements can be used to isolate audiences already engaged with fringe material, reinforcing echo chambers and amplifying extreme or polarizing messages.

**Legality:** The current EU legal framework does not clearly address forms of contextual advertising that rely on combinations of content proxies to reach audiences associated with sensitive attributes. Because such targeting does not necessarily involve the direct processing of personal data—i.e., profiling as defined by the GDPR—it may, depending on interpretation and implementation, fall outside the narrow prohibitions related to the use of special categories of data. However, even if such practices are formally compliant, they may still conflict with the broader protective aims and principles of EU data protection, including requirements of fairness, transparency, and purpose limitation (e.g., GDPR Article 5(1)(a–b) [16]).

# 4 Contextual Advertising and Conspiracy Content

This section investigates the prevalence of contextual advertising on high-risk YouTube content using conspiracy and misinformation

<footnote>Article 4 (4) "'profiling' means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;" [16]</footnote>

<footnote>Article 5 (1)(a) "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency'); [...]".</footnote>
videos as a test bed. We select fringe content because it raises important safety and integrity concerns while avoiding the direct ethical risks associated with testing other sensitive traits. We specifically assess the extent to which contextual targeting exposes users to potentially harmful or unsafe ad placements (RQ2).

## 4.1 Measurement Framework

To capture ad delivery, we built a custom browser extension that automatically records ads shown during video playback. We deploy this extension with automated personas that simulate different user types, each configured with distinct browsing and search histories reflecting varying interactions with factual and non-factual content. This design allows us to observe how the availability of behavioral data influences the overall prevalence of contextual advertising. We utilized this setup to monitor ad delivery across two video sets: our curated corpus of conspiracy videos and a matched control dataset of general-interest videos. For every recorded ad, we collected ad and advertiser metadata and the ad targeting explanation provided by the platform (§ 2), enabling us to isolate and analyze ads attributed to contextual signals.

### 4.1.1 Conspiracy Videos Corpus.
Existing conspiracy video datasets are outdated [18, 30, 31], cover limited time windows, and attract few active ads. To address this, we constructed a new corpus reflecting current misinformation and fringe narratives circulating on the platform. Following the proxy-identification process (§ 3.1), we formulated keyword queries based on trending narratives from online forums, social media discussions, fact-checking organizations, and news sources (e.g., “Project Blue Beam New Jersey Drones”). We retrieved videos via the YouTube Data API, and we filtered them using our automated labeling method (§ 3.3). Only videos rated 4 or 5 were retained, resulting in a **curated set of 536 conspiracy and misinformation videos.** This corpus is recent (modal publication year 2024), highly engaged (median 167k views), and has a median duration of 15 minutes.

Control videos corpus. For comparative analysis, we constructed a control dataset of general-interest YouTube videos unrelated to conspiracy and misinformation. We began by retrieving the top 500 English-language videos via keyword queries across twelve broad categories (e.g., Music, Gaming, News), creating an initial pool of 6,000 videos. To ensure comparability with the conspiracy dataset, we applied a filtering process to match the control videos across three dimensions: video length, engagement (log-transformed views), and publication date. After filtering and excluding two videos containing potential misinformation, we obtained a **final control dataset of 382 videos.**

### 4.1.2 Persona Design.
To compare ad delivery across varying levels of behavioral signal availability and isolate the role of contextual targeting, we simulated 13 user personas (Table 2). We designed four personas with distinct browsing history training and four with search history training, with each set further stratified by gender and content factuality (factual or non-factual). To establish critical reference points and isolate contextual cues, we included two personas with no behavioral history and two personas where we explicitly disabled ad personalization through Google ad settings. We

<table><caption>**Table 2: Constructed personas.**</caption><thead><tr><td>Reference</td><td>Persona details</td><td>Total Ads</td></tr></thead><tbody><tr><td>P1(F/M)</td><td>Profiles with fact-based browsing history.</td><td>1360</td></tr><tr><td>P2(F/M)</td><td>Profiles with fact-based search history.</td><td>1408</td></tr><tr><td>P3(F/M)</td><td>Profiles with misinformation-related browsing history.</td><td>1397</td></tr><tr><td>P4(F/M)</td><td>Profiles with non-fact-based search history.</td><td>1563</td></tr><tr><td>P5(F/M)</td><td>Profiles with no search or browsing history.</td><td>872</td></tr><tr><td>P6(F/M)</td><td>Profiles with disabled ad personalization.</td><td>1549</td></tr><tr><td>P7</td><td>No Google profile (Guest profile).</td><td>1058</td></tr></tbody></table>

'F/M' indicates two profiles were created: a female persona and a male one.

also included a guest user (non-logged-in) to represent an anonymous viewing scenario. We provide a detailed description of all configurations and persona training in Appendix E.

### 4.1.3 Ad Collection.

**Browser extension.** We developed a custom browser extension that extends prior methodologies [33] to capture and analyze ad delivery. This tool monitors network traffic to pinpoint the request triggering a YouTube video ad. It then programmatically simulates user interaction by clicking the ad's information ("i") panel and parsing the resulting HTML to scrape the ad explanations. The extension is designed to collect comprehensive details, including the **ad's metadata** (title, advertiser information, and Transparency Center link [25]), the specific **ad targeting rationale** that expresses why an ad has been shown to a user (see Appendix F for examples), and the ad's predicted **topics** from Google.

**Automation setup.** To scale the experiment across multiple profiles, we utilized Selenium WebDriver [34] to automate interactions with YouTube within isolated browsing sessions. Each persona was loaded into a separate Selenium instance, authenticated with its associated Google account (excluding the non-logged-in guest user), and equipped with our custom ad collection extension. We divided the data collection into fixed, short viewing batches during specific times of the day (Morning, Afternoon, Evening, and Late Night) to mitigate detection and simulate natural user behavior. Each batch (i.e., watch session) involved 50 videos, equally split between the conspiracy and control content. To further simulate natural viewing, the personas were programmed to watch each video for a randomly selected duration (5–10 minutes), with randomized pause intervals inserted between videos.

We collected a total of **9,207 ads across 13 personas** and 35 viewing batches.

### 4.1.4 Ad Labeling.
To characterize the ads served on conspiracy content, we label each ad along three dimensions:

**Targeting type:** We grouped the raw ad targeting explanation strings into several high-level categories (e.g., Time/Location, Demographic, Interests, etc.). Table 6 in the Appendix presents all resulting categories and their corresponding explanation strings. We then further consolidated these categories into three core analysis groups: **(1) Contextual Targeting:** Explanations that explicitly reference the current content being viewed (e.g., “The video you’re watching”). This has been shown through controlled ad experiments in prior work [33] to be the explanation used when ads
are contextually targeted. **(2) Personalized Targeting:** Explanations that encompass categories relying on user data or estimations derived from user data, including interests, lookalike audiences, behavioral signals, and customer and remarketing lists exclusions. **(3) No Targeting:** Explanations that only generically reference time and/or location, indicating a lack of granular user targeting.

**Political relevance:** Identifying political ads is inherently challenging due to ambiguous definitions and indirect issue-based messaging [35]. We therefore use an SVC-based classifier from prior work [35] to identify likely political ads based on ad transcripts, yielding 718 candidates. To obtain a high-confidence set, one of the authors reviewed these ads, and we retained only cases where the model prediction and human judgment agreed.

**Advertiser and content types:** We adopt a similar labeling taxonomy from Ballard et al. [4] for advertiser and content types. We use GPT-4o to assign these labels (see Appendix D for details). We infer advertiser type from metadata on their YouTube page (name, title, description, keywords). Content type is derived from the ad video's transcript and the YouTube channel's title.

## 4.2 Results

### 4.2.1 Prevalence of Contextual Ads.
Table 3 reports the distribution of ads by persona, targeting type (contextual, personalized, or none), and corpus (conspiracy vs. control). We identify 1,595 contextual ads (30.86%) during conspiracy watch sessions. In comparison, 1,545 ads (38.35%) on control content were contextual.

When examining the distribution across behavioral personas, we found that contextual ads were delivered to all personas except those with disabled ad personalization (P6F and P6M). This outcome is unexpected, as users with disabled ad personalization should receive more contextual ads [38]. We therefore exclude these profiles from analysis for the remainder of this section and investigate this discrepancy further in § 5.

To assess the relative importance of different targeting mechanisms, we compare the proportion of each targeting type received by a given persona across the two corpora (conspiracy vs. control) using two-proportion z-tests. The differences were not statistically significant, except for profiles P4F, P5F, and P5M, which received a higher share of contextual ads on control content.

We further examined variation in contextual advertising across personas within the conspiracy corpus. The differences were also found not statistically significant, with the exception of the fact-based browsing profiles (P1F and P1M), which consistently received the highest average share of contextual ads.

Overall, contextual advertising accounted for a substantial share of ads served on conspiracy content, despite being less prevalent than on control content. The rate of contextual ad delivery was broadly consistent across behavioral profiles, indicating that the personas' past behavioral signals did not significantly alter the overall rate of contextual ad delivery.

### 4.2.2 Sensitive Ad Categories.
Table 4 presents the distribution of ad labels (§ 4.1.4) across conspiracy and control videos, grouped by targeting mechanism (contextual, personalized, or none). We compare the prevalence of each content category across targeting

<table><caption>Table 3: Distribution of targeting type by persona for conspiracy vs. control videos.</caption><thead><tr><th rowspan="2">Persona</th><th colspan="3">Conspiracy</th><th colspan="3">Control</th></tr><tr><th>Contextual</th><th>Personalized</th><th>No Targeting</th><th>Contextual</th><th>Personalized</th><th>No Targeting</th></tr></thead><tbody><tr><td>P1F</td><td>42.17%</td><td>51.15%</td><td>6.68%</td><td>46.11%</td><td>47.31%</td><td>6.59%</td></tr><tr><td>P1M</td><td>43.08%</td><td>48.31%</td><td>8.61%</td><td>47.19%</td><td>46.44%</td><td>6.37%</td></tr><tr><td>P2F</td><td>46.71%</td><td>51.82%</td><td>1.46%</td><td>49.54%</td><td>49.07%</td><td>1.39%</td></tr><tr><td>P2M</td><td>36.27%</td><td>61.72%</td><td>2.00%</td><td>40.33%</td><td>55.37%</td><td>4.29%</td></tr><tr><td>P3F</td><td>36.83%</td><td>60.99%</td><td>2.18%</td><td>47.85%</td><td>47.85%</td><td>4.30%</td></tr><tr><td>P3M</td><td>40.60%</td><td>53.69%</td><td>5.70%</td><td>48.19%</td><td>44.14%</td><td>7.66%</td></tr><tr><td>P4F</td><td>32.55%</td><td><strong>61.60%**</strong></td><td>5.85%</td><td><strong>39.56%*</strong></td><td>56.87%</td><td>3.57%</td></tr><tr><td>P4M</td><td>35.68%</td><td>59.80%</td><td>4.52%</td><td>44.80%</td><td>52.78%</td><td>2.43%</td></tr><tr><td>P5F</td><td>31.28%</td><td><strong>58.97%**</strong></td><td>9.74%</td><td><strong>43.21%*</strong></td><td>50.62%</td><td>6.17%</td></tr><tr><td>P5M</td><td>40.58%</td><td><strong>54.11%**</strong></td><td>5.31%</td><td><strong>53.74%*</strong></td><td>38.32%</td><td>7.93%</td></tr><tr><td>P6F</td><td>0.0%</td><td>0.0%</td><td>100%</td><td>0.0%</td><td>0.0%</td><td>100%</td></tr><tr><td>P6M</td><td>0.0%</td><td>0.0%</td><td>100%</td><td>0.0%</td><td>0.0%</td><td>100%</td></tr><tr><td>P7</td><td>34.53%</td><td>46.15%</td><td><strong>19.32%***</strong></td><td><strong>43.13%*</strong></td><td>48.41%</td><td>8.46%</td></tr></tbody></table>

*p*-values were adjusted using Benjamini-Hochberg FDR

* *p* < 0.05, ** *p* < 0.01, *** *p* < 0.001

types between the two datasets (conspiracy vs. control) using two-proportion z-tests, applying Fisher's exact test for sparse categories.

**Political relevance:** We identified 235 ad instances as political in our dataset, originating from 54 distinct advertisers. We found that political ads appeared disproportionately more on conspiracy-related content compared to control (*p* < 0.001), which shows disproportionate exposure to political ads in conspiracy environments. Moreover, when political ads do appear, they're more often explained as contextually targeted on conspiracy videos than on control ones (6.88% vs. 1.42%, *p* < 0.001).

**Advertiser types:** We highlight two sensitive advertiser categories: *self-improvement* (dubious “get-rich-quick” schemes, physical transformation programs, and alternative health products) and *special interest groups* (government agencies, NGOs, charities, and lobbying organizations). Both categories appeared disproportionately more on conspiracy content compared to control (*p* < 0.001). We find that ads from both of these categories made up a significantly larger share of contextual ads on conspiracy than on control videos (*self-improvement*: 7.46% vs. 2.13%, *p* < 0.001; *special interests*: 10.21% vs. 4.14%; *p* < 0.001). This demonstrates that the over-representation of these sensitive advertisers on high-risk content is not just a volume effect but is also disproportionately concentrated within contextual targeting mechanisms.

**Content types:** We identify five categories of sensitive ads: (1) *alternative health* (e.g., dubious health products and unverified medical services), (2) *government*, (3) *medical* (e.g., medicinal products and healthcare services), (4) *third sector* (e.g., non-profit organizations), and (5) *religion* (e.g., religious services or products). Given the conceptual overlap between government and third sector ads and those from special interest groups (all of which were included in that broader category), we focus our analysis on the remaining three categories. Each appeared disproportionately more frequently on conspiracy than on control videos, consistent with prior findings [4] (*alternative health* and *religion*: *p* < 0.001; *medical*: *p* = 0.10).

These categories were overrepresented in contextually targeted ads on conspiracy content compared to control (*alternative health*: 1.37% vs. 0.38%, *p* < 0.01; *medical*: 8.08% vs. 6.01%, *p* < 0.05; *religion*: *p* < 0.001).
<table><caption>**Table 4: Distribution of targeting types by advertiser and content category.**</caption><thead><tr><th rowspan="2"></th><th colspan="3">Conspiracy</th><th colspan="3">Control</th></tr><tr><th>Contextual</th><th>Personalized</th><th>No Targeting</th><th>Contextual</th><th>Personalized</th><th>No Targeting</th></tr></thead><tbody><tr><td><strong>Political (man-ual)</strong></td><td>97***</td><td>60</td><td>5</td><td>22</td><td>12</td><td>3</td></tr><tr><td><strong>Advertiser Category</strong></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Aggregator sites</td><td>24</td><td>61**</td><td>24</td><td>15</td><td>16</td><td>4</td></tr><tr><td>Information Media</td><td>200</td><td>299</td><td>33</td><td>217</td><td>243</td><td>11</td></tr><tr><td>Merchant</td><td>1064</td><td>1730***</td><td>173</td><td>1194***</td><td>1325</td><td>162</td></tr><tr><td>Miscellaneous</td><td>25</td><td>19</td><td>1</td><td>22</td><td>26*</td><td>3</td></tr><tr><td>Self Improvement</td><td>119***</td><td>150***</td><td>46</td><td>33</td><td>31</td><td>5</td></tr><tr><td>Special Interest Groups</td><td>163***</td><td>89</td><td>13</td><td>64</td><td>53</td><td>1</td></tr><tr><td><strong>Content Category</strong></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Alternative Health</td><td>22**</td><td>18*</td><td>24</td><td>6</td><td>3</td><td>3</td></tr><tr><td>Automotive</td><td>12</td><td>68</td><td>3</td><td>91**</td><td>70*</td><td>0</td></tr><tr><td>Beauty</td><td>11</td><td>19</td><td>2</td><td>19</td><td>27*</td><td>1</td></tr><tr><td>Business and Finance</td><td>99</td><td>102</td><td>37</td><td>155***</td><td>94</td><td>7</td></tr><tr><td>Education</td><td>133***</td><td>136***</td><td>9</td><td>47</td><td>36</td><td>2</td></tr><tr><td>Entertainment</td><td>100*</td><td>148*</td><td>18</td><td>70</td><td>137</td><td>38</td></tr><tr><td>Food and Drink</td><td>54</td><td>77</td><td>4</td><td>105***</td><td>90**</td><td>3</td></tr><tr><td>Games</td><td>32*</td><td>77</td><td>2</td><td>17</td><td>42</td><td>1</td></tr><tr><td>Gold and Precious Metals</td><td>4</td><td>0</td><td>0</td><td>1</td><td>2</td><td>0</td></tr><tr><td>Government</td><td>33*</td><td>6</td><td>6</td><td>10</td><td>11</td><td>0</td></tr><tr><td>Home Goods</td><td>35</td><td>146**</td><td>16</td><td>51</td><td>66</td><td>5</td></tr><tr><td>Industrial</td><td>49*</td><td>11</td><td>2</td><td>28</td><td>17*</td><td>1</td></tr><tr><td>Insurance</td><td>25</td><td>43</td><td>11</td><td>25</td><td>41</td><td>13</td></tr><tr><td>Legal</td><td>30***</td><td>22</td><td>13</td><td>3</td><td>2</td><td>3</td></tr><tr><td>Lifestyle (fitness, fashion)</td><td>31</td><td>209</td><td>17</td><td>70***</td><td>130</td><td>10</td></tr><tr><td>Major Retailer</td><td>36*</td><td>118</td><td>4</td><td>20</td><td>95</td><td>9</td></tr><tr><td>Marketing and Advertising</td><td>51</td><td>108</td><td>26</td><td>33</td><td>82</td><td>30</td></tr><tr><td>Medical</td><td>129*</td><td>84</td><td>16</td><td>93</td><td>58</td><td>2</td></tr><tr><td>Miscellaneous</td><td>220</td><td>304</td><td>27</td><td>230</td><td>244</td><td>9</td></tr><tr><td>Third sector</td><td>92***</td><td>31***</td><td>6</td><td>18</td><td>5</td><td>2</td></tr><tr><td>Real Estate</td><td>13</td><td>35***</td><td>3</td><td>14</td><td>5</td><td>1</td></tr><tr><td>Religion</td><td>34***</td><td>12</td><td>0</td><td>0</td><td>4</td><td>0</td></tr><tr><td>Software</td><td>93</td><td>131</td><td>14</td><td>83</td><td>93</td><td>6</td></tr><tr><td>Sports</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td>Technology</td><td>225</td><td>354</td><td>30</td><td>312***</td><td>261</td><td>30</td></tr><tr><td>Travel and Tourism</td><td>32</td><td>87</td><td>11</td><td>44</td><td>62</td><td>13</td></tr><tr><td><strong>Total</strong></td><td>1595</td><td>2348</td><td>290</td><td>1545</td><td>1694</td><td>186</td></tr></tbody></table>

Values in red indicate cases where contextual targeting is the predominant method within the category *p*-values were adjusted using Benjamini-Hochberg FDR

* *p* < 0.05, ** *p* < 0.01, *** *p* < 0.001

2.13% vs. 0.0%, *p* <0.001). Contextual targeting was also the dominant explanation used for ads with these labels (red values in Table 4).

## 4.3 Discussion

**Prevalence of contextual targeting on fringe content.** While contextual advertising is not the dominant targeting strategy—and is less prevalent on conspiracy than on control content—its substantial presence on high-risk conspiracy content indicates that it remains a meaningful component of monetization in these environments. This introduces safety concerns distinct from the presence of harmful content alone. While misleading or fringe material may shape beliefs or emotions, contextual advertising can translate those states into concrete actions by presenting aligned commercial or political messages at moments of heightened receptivity. This alignment

may arise from platform-side inference, where contextual signals reflect distorted or unsafe themes, or from advertiser-side placement choices that deliberately target such environments—both of which can enable exploitation of fear, anxiety, or ideological commitment.

**Contextual targeting of sensitive ads on fringe content.** Sensitive ad categories appeared disproportionately on conspiracy content and were more often delivered through contextual targeting compared to the control. Political ads were notably overrepresented, indicating that contextual placements can expose users to targeted political messaging in high-risk environments. We also observed higher shares of sensitive advertiser types, particularly self-improvement (e.g., dubious financial or health products) and special interest groups (e.g., government agencies, NGOs, charities, and lobbying organizations). Contextual ads further clustered in categories with safety implications: Alternative Health and Medical ads intersecting with misinformation spaces may amplify pseudoscientific claims, while Religion ads may profile users along sensitive attributes, raising privacy concerns. Overall, these patterns reveal a broader systemic risk of contextual advertising—namely, its capacity to reproduce sensitive and unsafe ad placements without past behavioral data.

## 5 Contextual Advertising and Transparency

We discuss the transparency mechanisms related to contextual advertising on YouTube.

**Transparency in user-facing explanations.** Across all ad explanations collected in our measurement study (§ 4), contextual advertising was identified exclusively through the generic phrase “The video you are watching.” These explanations provide no actionable information about how a specific placement was determined—for example, whether it was driven by keyword or topic selection, explicit advertiser choices, or platform-level optimization. This lack of granularity is systematic and prevents meaningful interpretation of the underlying targeting logic, thereby limiting the ability to audit ad delivery or identify potentially manipulative or exploitative practices.

**Auditing political ad transparency.** Understanding how political ads are served—particularly the role of contextual cues—requires access to transparency mechanisms that reveal ad targeting and placement decisions. Because user-facing explanations provided limited detail, we rely on Google’s public ad repository (Ads Transparency Center for Political Advertising), which discloses information about ad content, delivery periods, and targeting parameters and serves as a reference point for examining political ad delivery in theory.

We cross-referenced political ads from our dataset with entries in Ads Transparency Center for Political Advertising [21] and identified 62 matches. Several advertiser entries were missing or inaccessible, as the Center does not support straightforward matching. In addition, a number of ads we labeled as political were not classified as such by Google. This is possibly due to the inherent complexity of labeling political advertising, as definitions can vary across platforms, jurisdictions, and even annotators [35].

Among the matched entries, 33 instances were identified as contextually targeted in our dataset, yet none of their corresponding repository entries disclosed the specific contextual cues or parameters that informed delivery. Repository information was limited to
demographic (age, gender) and geographic targeting. We identify
this as a gap in transparency that does not meet the requirements
put forward by regulation, and limits independent auditing of
political advertising on the platform.

*Transparency for users with disabled personalization.* Profiles with ad personalization disabled (P6F and P6M) were designed to observe ads served without using personal data, and therefore expected to rely solely on contextual cues. However, as shown in Table 3, these profiles consistently received explanations referencing only *“time and location”*, with no indication that contextual signals were used. This contrasts with the behavior described in Google’s official documentation [38], which states that ads shown to users with disabled personalization could be based on contextual information. Two interpretations are therefore possible: either contextual targeting was not applied in these cases, or it was applied but not disclosed.

To test the completeness of user-facing explanations for profiles
with disabled behavioral targeting, we conducted a supplemen-
tary targeting experiment using two YouTube profiles: one with
personalization enabled and one disabled. Both profiles were used
to search for a query ("Travel to Tokyo"). This is a behavior that
would typically trigger keyword-based targeted ads on the search
results page. The profiles received the same travel ad from the
same advertiser, with identical URL parameters. However, the ad
explanations provided to the users differed: the personalized profile
correctly cited search terms as the targeting mechanism, while the
disabled personalized profile listed only time and location. This
result strongly suggests that contextual cues are being used for
ad delivery even when personalization is disabled, without being
disclosed to the user.

A similar pattern appears in our main dataset. We identified
50 instances of ads that were shown on the same videos to both
personalized and non-personalized profile types. For users with
personalization enabled, these ads were labeled as being contex-
tually targeted, while, when the same ads were delivered to the
non-personalized users, the ad explanations provided no target-
ing rationale besides time and location. This pattern suggests that
contextual signals were likely applied in both contexts but were
selectively disclosed to users.

Taken together, these observations indicate that, in practice,
contextual advertising may exhibit transparency limitations com-
parable to those previously associated with behavioral targeting.

6 Related Work

A substantial body of research has examined the privacy and ethical
implications of **behavioral advertising**. Prior work shows that
platforms can infer sensitive attributes and enable discriminatory
ad targeting even without explicit advertiser intent [1, 2, 9, 36].
Others have also criticized the scale and pervasiveness of its data
collection practices [11, 12, 39]. These risks have contributed in

part to the resurgence of **contextual advertising** as a purportedly
privacy-preserving alternative. However, empirical work on the
privacy and safety implications of contextual advertising remains
limited. Medjkoune et al. [33], for example, show that contextual
systems can be exploited to reach protected groups such as children.

At the same time, prior work on misinformation and fringe
or polarizing content shows that exposure to such material—and
susceptibility to it—are unevenly distributed across populations,
shaped by identity, polarization, and prior beliefs [3, 26–28]. This re-
search shows that individuals systematically self-select into content
environments aligned with their worldviews, producing audience
clustering around specific narratives. In the context of this work,
these findings suggest that content consumption patterns them-
selves can serve as reliable *proxies* for sensitive attributes, raising
concerns that contextual advertising may enable targeted reach
even in the absence of audience profiling.

Prior work has also examined the monetization of fringe and
conspiratorial content on YouTube, focusing primarily on revenue
flows rather than advertising mechanisms [4]. We extend this line of
inquiry by examining how contextual advertising operates within
such content environments, and how contextual signals associated
with fringe narratives shape ad delivery and targeting dynamics.

7 Conclusion

This study examined how contextual advertising on YouTube can
be leveraged to reach vulnerable audiences. Our findings show
that contextual advertising warrants the same level of scrutiny
as behavioral targeting, as it can produce comparable risks when
deployed in sensitive or ideologically charged contexts. We rec-
ommend that platforms disclose advertiser-selected contextual cri-
teria—especially for political ads—in their Transparency Center,
and clarify which content signals (e.g., keywords, topics, metadata)
inform ad delivery. Restricting behavioral targeting alone does not
ensure safety, fairness, or compliance with public-interest goals.

Acknowledgments

We thank the anonymous reviewers for their helpful feedback. This
research is supported by the European Research Council (ERC)
grant no. 101041223, and the French National Research Agency
(ANR) ANR-21-CE23-0031 grant.

References

[1] Muhammad Ali, Piotr Sapiezynski, Miranda Bogen, Aleksandra Korolova, Alan Mislove, and Aaron Rieke. 2019. Discrimination through optimization: How Facebook's Ad delivery can lead to biased outcomes. *Proceedings of the ACM on human-computer interaction* 3, CSCW (2019), 1–30.

[2] Julia Angwin and Terry Parris Jr. 2016. Facebook lets advertisers exclude users by race. *ProPublica blog* 28 (2016).

[3] Eytan Bakshy, Solomon Messing, and Lada A Adamic. 2015. Exposure to ideologically diverse news and opinion on Facebook. *Science* 348, 6239 (2015), 1130–1132.

[4] Cameron Ballard, Ian Goldstein, Pulak Mehta, Genesis Smothers, Kejsi Take, Victoria Zhong, Rachel Greenstadt, Tobias Lauinger, and Damon McCoy. 2022. Conspiracy brokers: Understanding the monetization of youtube conspiracy theories. In *Proceedings of the ACM Web Conference 2022*. Association for Computing Machinery, 2707–2718.

[5] Muhammad Ahmad Bashir, Umar Farooq, Maryam Shahid, Muhammad Fareed Zaffar, and Christo Wilson. 2019. Quantity vs. Quality: Evaluating User Interest Profiles Using Ad Preference Managers. In *NDSS Symposium*.

[6] José González Cabañas, Ángel Cuevas, and Rubén Cuevas. 2018. Unveiling and quantifying facebook exploitation of sensitive personal data for advertising purposes. In *27th USENIX security symposium (USENIX security 18)*. 479–495.

<footnote>DSA Article 39(1): "Providers of very large online platforms or of very large online search engines that present advertisements on their online interfaces shall compile and make publicly available in a specific section of their online interface, through a searchable and reliable tool [...]" [13].</footnote>

<footnote>European Democracy Shield Article 19(1): "When using targeting techniques or ad-delivery techniques in the context of online political advertising involving the processing of personal data, controllers shall [...] adopt, implement and make publicly available an internal policy [...] and keep records on the relevant mechanisms and parameters used."</footnote>
[7] Salim Chouaki, Abhijnan Chakraborty, Oana Goga, and Savvas Zannettou. 2024. What News Do People Get on Social Media? Analyzing Exposure and Consumption of News through Data Donations. In *Proceedings of the ACM Web Conference 2024*. Association for Computing Machinery, 2371–2382.

[8] Corvidae. 2024. *Programmatic Advertising Vs Contextual Advertising | Corvidae*. https://corvidae.ai/blog/programmatic-advertising-vs-contextual-advertising-exploring-the-path-to-advertising-excellence/

[9] Amit Datta, Michael Carl Tschantz, and Anupam Datta. 2015. Automated Experiments on Ad Privacy Settings: A Tale of Opacity, Choice, and Discrimination. 2015, 1 (apr 2015), 92–112. doi:10.1515/popets-2015-0007

[10] Stacey J Dixon. 2025. *Most popular social networks worldwide as of February 2025, by number of monthly active users*. https://www.statista.com/statistics/272014/global-social-networks-ranked-by-number-of-users/

[11] Steven Englehardt and Arvind Narayanan. 2016. Online tracking: A 1-million-site measurement and analysis. In *Proceedings of the 2016 ACM SIGSAC conference on computer and communications security*. 1388–1401.

[12] Steven Englehardt, Dillon Reisman, Christian Eubank, Peter Zimmerman, Jonathan Mayer, Arvind Narayanan, and Edward W Felten. 2015. Cookies that give you away: The surveillance implications of web tracking. In *Proceedings of the 24th International Conference on World Wide Web*. 289–299.

[13] European Parliament and Council of the European Union. 2022. *Article 39, the Digital Services Act (DSA)*. https://www.eu-digital-services-act.com/Digital_Services_Act_Article_39.html

[14] European Parliament and of the Council. 2022. *Article 26, the Digital Services Act (DSA)*. https://www.eu-digital-services-act.com/Digital_Services_Act_Article_26.html

[15] European Parliament and of the Council. 2022. *Regulation - 2022/2065 - EN - DSA - EUR-Lex*. https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng

[16] European Union. 2016. *Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)*. http://data.europa.eu/eli/reg/2016/679/oj

[17] eurostat. 2024. *Internet advertising of businesses - statistics on usage of ads*. https://ec.europa.eu/eurostat/statistics-explained/SEPDF/cache/54450.pdf

[18] Marc Faddoul, Guillaume Chaslot, and Hany Farid. 2020. A longitudinal analysis of YouTube's promotion of conspiracy videos. *arXiv preprint arXiv:2003.03318* (2020).

[19] Google Ads Help. 2025. *About the ad review process - Google Ads Help*. https://support.google.com/google-ads/answer/1722120?hl=en Last Accessed: 2025-07-21.

[20] Google Ads Help. 2025. *Targeting your ads*. https://support.google.com google-ads/answer/1704368?hl=en Last Accessed: 2025-07-11.

[21] Google Ads Transparency Center. 2025. *Political advertising on Google*. https://adstransparency.google.com/political?region=US&format=VIDEO Last Accessed: 2025-07-17.

[22] Google Advertising Policies Help. 2025. *Personalized advertising - Advertising Policies Help*. https://support.google.com/adspolicy/answer/143465?hl=en#777 Last Accessed: 2025-07-11.

[23] Google As Help. 2025. *Political content - Advertising Policies Help*. https://support.google.com/adspolicy/answer/6014595#:~:text=Restricted%20targeting%20for%20election%20ads5 Last Accessed: 2026-01-26.

[24] Google for Developers. 2025. *API Reference | YouTube Data API | Google for Developers*. https://developers.google.com/youtube/v3/docs Last Accessed: 2025-07-17.

[25] Google Transparency Center. 2025. *Google Ads Transparency Center*. https://adstransparency.google.com/ Last Accessed: 2025-07-17.

[26] Nir Grinberg, Kenneth Joseph, Lisa Friedland, Briony Swire-Thompson, and David Lazer. 2019. Fake news on Twitter during the 2016 US presidential election. *Science* 363, 6425 (2019), 374–378.

[27] Andrew Guess, Jonathan Nagler, and Joshua Tucker. 2019. Less than you think: Prevalence and predictors of fake news dissemination on Facebook. *Science advances* 5, 1 (2019), eaua4586.

[28] Andrew M Guess, Brendan Nyhan, and Jason Reifler. 2020. Exposure to untrustworthy websites in the 2016 US election. *Nature human behaviour* 4, 5 (2020), 472–480.

[29] Emil Häglund and Johanna Björklund. 2024. AI-driven contextual advertising: Toward relevant messaging without personal data. *Journal of Current Issues & Research in Advertising* 45, 3 (2024), 301–319.

[30] Mark Ledwich and Anna Zaitsev. 2019. Algorithmic extremism: Examining YouTube's rabbit hole of radicalization. *arXiv preprint arXiv:1912.11211* (2019).

[31] Shao Yi Liaw, Fan Huang, Fabricio Benevenuto, Haewoon Kwak, and Jisun An. 2023. Younicon: Youtube's community of conspiracy videos. In *Proceedings of the International AAAI Conference on Web and Social Media*, Vol. 17. 1102–1111.

[32] MDN. 2025. *Third-party cookies - Privacy on the web | MDN*. https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Third-party.cookies

[33] Tinhinane Medjkoune, Oana Goga, and Juliette Senechal. 2023. Marketing to children through online targeted advertising: Targeting mechanisms and legal

aspects. In *Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security*. 180–194.

[34] Selenium. 2025. *WebDriver*. https://www.selenium.dev/documentation/webdriver/ Last Accessed: 2025-07-22.

[35] Vera Sosnovik and Oana Goga. 2021. Understanding the complexity of detecting political ads. In *Proceedings of the Web Conference 2021*. 2002–2013.

[36] Till Speicher, Muhammad Ali, Giridhari Venkatadri, Filipe Nunes Ribeiro, George Arvanitakis, Fabricio Benevenuto, Krishna P Gummadi, Patrick Loiseau, and Alan Mislove. 2018. Potential for discrimination in online targeted advertising. In *Conference on fairness, accountability and transparency*. PMLR, 5–19.

[37] Google Support. 2025. *Get started with My Ad Center - My Ad Center Help*. https://support.google.com/My-Ad-Center-Help/answer/12155154?hl=en Last Accessed: 2025-08-06.

[38] Support Google. 2025. *How personalized ads work - Android - My Ad Center Help*. https://support.google.com/My-Ad-Center-Help/answer/12155656?hl=en&co=GENIE.Platform%3DAndroid Last Accessed: 2025-07-17.

[39] Giridhari Venkatadri, Piotr Sapiezyński, Elissa M Redmiles, Alan Mislove, Oana Goga, Michelle Mazurek, and Krishna P Gummadi. 2019. Auditing offline data brokers via facebook's advertising platform. In *The World Wide Web Conference*. 1920–1930.

[40] John Wilander. 2020. Full third-party cookie blocking and more. *WebKit. Preuzeto s: https://webkit.org/blog/10218/full-third-party cookie-blocking-and-more* (2020).

[41] YouTube Help. 2026. *Ads on videos you watch - YouTube Help*. https://support.google.com/youtube/answer/3181017?hl=en Last Accessed: 2026-01-22.

## A Ethics Statement

This research was conducted under an approved Institutional Review Board (IRB) protocol. The ad experiments in § 3 used neutral campaign material (a generic video advertisement about drinking water) and complied with Google Ads' terms of service. The measurement study on conspiracy content (§ 4) relied exclusively on automated personas and controlled browsing environments, did not involve human subjects, and did not affect real user experiences.

*Responsible Disclosure*. Our analysis examines the design and operation of contextual advertising systems as deployed. This work does not identify or exploit a specific technical vulnerability, implementation flaw, or security bug that could be remediated through responsible disclosure. Rather, our findings highlight a systemic risk arising from platform-level policy choices and optimization practices that are functioning as intended. As a result, responsible disclosure to the platform was not applicable in this context.

## B Placement Selection in Ad Experiments

We provide the extended list of queries and channels we used for conducting ad experiments (§ 3). See Table 5.

## C Conspiracy Video Labeling

We provide the labeling prompt used to identify conspiracy content. The prompt follows a Chain of Thought (CoT) structure, integrating a Likert scale assessment. We requested the model to output its reasoning, which we use to qualitatively assess labeling consistency.

**Task**

You are an annotator trained to evaluate text for themes, language patterns, and claims associated with conspiracy theories or mis/disinformation. To do this, you are provided with a YouTube video transcript, the video's title, and its description (when it is available).

**Instructions**

1. Identify any claims that lack credible evidence, promote unfounded theories, or contradict widely accepted facts.

2. Look for language that suggests secrecy, cover-ups, or manipulation by powerful entities (e.g., governments, corporations, or secret societies).

3. Check for patterns of fear-mongering, distrust of
<table><caption>Table 5: Extended list of queries and channels for selecting placements to target users in sensitive attribute categories.</caption><thead><tr><th>Attribute category</th><th>Sensitive attribute</th><th>Placements examples ("query" or channels)</th></tr></thead><tbody><tr><td rowspan="2">Political ideology</td><td>Left-leaning</td><td>The Young Turks, The Majority Report, HasanAbi, David Pakman, The Bulwark, Democracy Now, Some More News, Philosophy Tube, Luke Beasley, Second Thought.</td></tr><tr><td>Right-leaning</td><td>Tucker Carlson, The Daily Wire, Fox News, Steven Crowder, PragerU, Actual Justice Warrior, Paul Harrell, Tim Pool, Nuance Bro, Mark Dice, Hodge Twins, Charlie Kirk.</td></tr><tr><td>Belief systems and Worldview</td><td>Conspiracy</td><td>"Project Blue Beam New Jersey drones", "Luigi Mangione psyop", "AI Will Cause the Apocalypse", "Proof AI Will Soon Control the World", "Proof AI Is Controlling the Internet", "PROOF AI Is Sentient", "The Great Reset", "5G radiation make you sick", "the simulation theory", "Social Media Manipulation", "The Dead Internet Theory", "fake youtube views dead internet", "The plot to steal the elections".</td></tr><tr><td rowspan="3">Religious belief</td><td>Christian</td><td>Joel Osteen, T.D. Jakes Ministries, BibleProject, CBN News Channel, Sid Roth's It's Supernatural!, Elevation Church, Living Waters, Off The Kirb Ministries, Grace Digital Network, Paul Begley, Treasure Christ.</td></tr><tr><td>Jewish</td><td>Discovering the Jewish Jesus with Rabbi Schneider, JewishUncensored, J-TV: Jewish Ideas. Global Relevance, Jewish Voice, AishJewish, Hidabroot – Torah &amp; Judaism, The Jewish Chronicle, The Jewish Convert, Jewish Marriage, Discovering the Jewish Jesus Podcast.</td></tr><tr><td>Muslim</td><td>mercifulservant, Mufti Menk, One Path Network, I'm a Muslim, Islamic Guidance, Islam The Ultimate Peace, Talk Islam, Islam Populer, Hi-Tech Islamic Naat, Islamic Teacher Official, Madani Channel.</td></tr><tr><td rowspan="2">Health conditions</td><td>Mental health conditions</td><td>"living with adhd", "living with depression", "solutions for depression", "solutions for adhd", "how to deal with depression and anxiety", "how to cope with depression", "lies depression tells you", "what helps during depression", "depression in workplace".</td></tr><tr><td>Special medical conditions</td><td>"Living with Cerebral Palsy", "how to cope with cerebral palsy", "dealing with diabetes", "diabetes quick solutions", "cooking recipes for diabetes", "dealing with chronic illness", "Parkinson's medication side effects", "Deep brain stimulation for Parkinson's", "Meditation for tremors", "Parkinson's clinical trials".</td></tr><tr><td rowspan="2">Vulnerable populations/Personal Hardships</td><td>Financial hardship</td><td>"how to live on a small budget", "how to apply for public housing", "low-income tips for budget", "tips to budget with small income", "how to pay debt with low-income", "dollar tree shopping tips for low budget", "$1 meals idea", "food stamps tutorial", "food stamps tips", "cooking on a tight budget", "how to apply for SNAP", "how to apply for medicaid", "how to apply for EBT", "how to apply for free internet programs for low-income families", "how to get housing assistance", "meal planning with SNAP".</td></tr><tr><td>Disabilities</td><td>"How to Apply for Disability Benefits", "Wheelchair Dance Class", "Coping with Disability", "Disability Burnout", "How I Stay Positive Despite Chronic Illness", "Best Wheelchairs for Travel", "Adaptive Kitchen Tools for One-Handed Cooking", "Using Voice Assistants as a Visually Impaired Person", "How I Drive with Hand Controls", "Navigating college with a Disability".</td></tr><tr><td rowspan="2">Sexual/gender identity</td><td>LGBT</td><td>"How I Knew I Was Gay", "LGBTQ+ Relationship Advice", "Coping with Homophobia", "Sexuality crisis", "Lesbian Relationship Struggles", "am I a lesbian", "am i gay", "how to know you are queer", "how to deal with homophobia in workplace", "gay relationship advice".</td></tr><tr><td>Transgender identity</td><td>"Starting Hormone Replacement Therapy", "how to start hormone replacement therapy", "Top surgery q&amp;a", "changing your gender legally", "Coping with Gender Dysphoria", "Makeup for trans woman", "Binder safety Tips", "binder tutorial".</td></tr></tbody></table>

authoritative sources or appeals to emotion over logic.

4. Note any recurring themes commonly associated with conspiracy theories or mis/disinformation (e.g., anti-vaccine rhetoric, flat Earth theories, election fraud claims, etc.).

5. Provide a final assessment, using a Likert scale:

1: Very Unlikely

2: Unlikely

3: Neutral

4: Likely

5: Very Likely

That the video supports conspiracy theories or mis/disinformation.

Video Title: {title}

Video Description: {description}

Video Transcript: {transcript}

**Output Format:**

Format the output as a JSON object:

```json
{
  "Final Assessment": The Score you gave for the video using the description "Reasoning": In a couple of sentences, explain your conclusion based on evidence from your assessment
}
```

## D Content Labeling Prompt

We note that this labeling task is inherently challenging and time-consuming for human annotators. Ad transcripts often provide limited or ambiguous information about the advertised product or

entity, and in some cases contain no explicit cues at all. For example, transcripts consisting primarily of slogans or generic calls to action may not clearly identify what is being advertised. We therefore rely on GPT-40 for labeling, as large language models can integrate sparse transcript content with additional metadata (description, channel name, ad title) to infer the advertised product or service, reducing the need for manual lookup and enabling more consistent labeling.

We experimented with multiple prompt strategies to improve the consistency of content-type and advertiser-type labeling, including concise and detailed prompts, Chain-of-Thought (CoT) prompting, and varying the number of label classes. All prompt variants were evaluated against a manually annotated set of 50 ads labeled by a human reviewer. We selected the prompt that had the highest agreement with the human annotations. The selected prompt achieved agreement rates of 86% for content type and 83% for advertiser type.

You are provided with the title of a YouTube channel, its description, keywords added by the advertiser to the channel, and a transcript of a video advertisement they posted.

Here is the input:

* Advertiser Channel Name: {advertiser_channel}

* Transcript: {transcript}

* Description: {description}

* Keywords: {keywords}

Your task is to analyze these inputs to determine:
1. **Business category**: assign a high-level category that describes the business of the advertiser based on the Advertiser Channel Name, Description, and Keywords.

2. **Content category**: assign a high-level category that describes the content/topic of the ad, and what it is promoting.

Choose one value from each of the following lists:

**Business Category:**

- Aggregator sites: Link aggregators, review sites, and other aggregated information advertising for products not owned by them

- Information Media: News sites, blogs, podcasts and other media that provide information not advertising a specific product

- Merchant: Sites that sell products, or provide some sort of services, such as e-commerce sites, retailers, service providers, lawyers, real estate agents, etc.

- Self Improvement: Sites that provide self-improvement products or services, such as courses, coaching, or personal development tools

- Special Interest Groups: Charities, Governmental or Political organizations, non-profits, lobbies

**Content Category:**

- Alternative Health

- Automotive

- Beauty

- Business and Finance

- Education

- Entertainment

- Food and Drink

- Games

- Gold and Precious Metals

- Government

- Home Goods

- Industrial

- Insurance

- Lifestyle (fitness, fashion, etc.)

- Legal

- Marketing and Advertising

- Real Estate

- Religion

- Retail

- Medical

- Miscellaneous

- Political (outside of government)

- Software

- Technology

- Travel and Tourism

Return your output strictly in the following JSON format:

```json
{{
  "business_category": "<single best-matching category
    from Business Category list>",
  "content_category": "<single best-matching category
    from Content Category list>",
  "ad_id": "(ad_id)"
}}
```

# E Persona Design

## E.1 Behavior-based personas

We construct eight personas in total along two behavioral dimensions: **browsing history** and **search history**. For each dimension, we create two behavioral conditions—factual and non-factual—and instantiate one male and one female persona per condition.

**Browsing history training.** We construct four personas (two factual and two non-factual) with distinct browsing patterns. **Non-factual browsing personas** visit a curated list of misinformation

websites identified in prior work [7], which propagate false or misleading narratives in domains such as health and politics. **Fac-tual browsing personas** visit mainstream, evidence-based news sources with established reputations for accuracy [7]. Each persona is programmed to visit 50 URLs in total, distributed across multiple sessions. The browsing behavior is automated to resemble natural interaction patterns, which include randomly set dwell and scroll times, and rest periods.

**Search history training.** We construct four personas based on search activity (again split by factuality and gender). **Non-factual search personas** issue queries based on conspiracy-related phrases (e.g., "AI controlling elections", "vaccine microchip theory"). **Fac-tual search personas** search for evidence-based alternatives (e.g., "how vaccines work", "certified election results"). Each persona performs a fixed sequence of queries over multiple sessions to simulate natural user behavior. The profiles search 36 queries.

## E.2 Non-behavioral personas

To isolate the influence of behavioral signals from contextual cues, we design personas with **no behavioral history**. These profiles allow us to assess whether, in the absence of behavioral data, users are more likely to receive ads based on context cues. We implement two experimental conditions:

**No history profiles.** Two personas (one male and one female) are not exposed to any browsing or search activity prior to ad collection. These profiles serve as *neutral baselines* that reflect the ad experience of users who have not yet engaged in behavior that might inform targeting.

**No personalization profiles.** Two personas (one male and one female) are configured to explicitly opt out of ad personalization through Google ad settings. These users do not generate or retain any browsing, search, or cookie-based data. According to Google [38], ads shown to such users should rely exclusively on broad demographics, location data, and contextual relevance.

## E.3 No profile persona

Finally, we simulate an anonymous user by accessing YouTube in *Guest* mode, without log-in.

# F User-facing Ad Explanations

Figure 1 shows a screenshot of an ad explanation panel ("*Why are you seeing this ad?*"). This panel appears when users click on the information icon ("i") of an ad on YouTube. Table 6 shows example explanation strings and their corresponding targeting category.

# G Google Ads

## G.1 Ad reporting tools

Figure 2 is a screenshot of a Google Ads reporting tool showing the ad impressions we received while running the Political right-leaning proxies experiment. The impressions are shown per placement, in this case, the video channels we included for targeting.
<figure><img src="image_2.png" /><figcaption>Figure 1: Example screenshot of user-facing ad explanations on YouTube.</figcaption></figure>

<table><caption>Table 6: Ad targeting categories with examples of explanation strings from the “Why you’re seeing this ad” notice.</caption><thead><tr><th>Category</th><th>Representative Explanation Strings</th></tr></thead><tbody><tr><td>Time/Location</td><td>"The time of day or your general location (such as your country or city)", "The time of day", "Your general location"</td></tr><tr><td>Demographic</td><td>"Your age", "Your gender", "Household income range", "Parental status"</td></tr><tr><td>Detailed Demographic</td><td>"Education status", "Job industry", "Relationship status", "Employer size range"</td></tr><tr><td>Interests</td><td>"Google's estimation of your interests"</td></tr><tr><td>Contextual</td><td>"The video you're watching"</td></tr><tr><td>Lookalike Audiences</td><td>"Your similarity to groups of people the advertiser is trying to reach"</td></tr><tr><td>Behavioral</td><td>"Websites you've visited", "Your activity while signed in to Google"</td></tr><tr><td>Device Type</td><td>"The type of device (such as phone, tablet, or desktop computer) where you're currently seeing this ad"</td></tr><tr><td>Customer Lists exclusions</td><td>"The advertiser's interest in reaching new customers who haven't bought something from them before"</td></tr><tr><td>Remarketing exclusions</td><td>"The advertiser's interest in reaching people who may not have interacted with them recently"</td></tr></tbody></table>

## G.2 Google Ads Repository for political advertising

In addition to the transparency limitations related to Google's lack of appropriate disclosure of political advertising on YouTube (described in § 5) we observe another discrepancy when examining political advertising disclosures on YouTube. Although Google's policy restricts political ads to demographic, geographic, and contextual targeting [23], we identified 24 matched ads whose user-facing explanations referenced interest-based, behavioral, or lookalike

<figure><img src="image_3.png" /><figcaption>Figure 2: Example screenshot for ad campaign placement monitoring on Google Ads.</figcaption></figure>

audience targeting. None of these cases were flagged as policy violations in the Ads Transparency Center. While a detailed assessment of policy compliance is beyond the scope of this study, this observation highlights additional gaps between declared targeting constraints and observable ad delivery explanations, reinforcing the need for accurate and independently auditable transparency mechanisms.