Spyware Puts Ads on Google.com

Spyware Puts Ads on Google.com

Cingular Wireless and Travelocity ads appeared on Google.com last month, without Google's consent, thanks to spyware.

Google doesn't sell ad space on its famously white search page. Nonetheless, Cingular Wireless and Travelocity ads appeared on Google.com last month, without Google's consent, thanks to spyware.

In January, Cingular, Priceline, and Travelocity agreed to pay fines and reform their advertising practices, in accordance with an agreement made with New York State Attorney General Andrew Cuomo to hold advertisers responsible for the behavior of advertising affiliates.

"Advertisers can no longer insulate themselves from liability by turning a blind eye to how their advertisements are delivered, or by placing ads through intermediaries, such as media buyers," Cuomo said in announcing the settlement.

In a report issued last week, spyware researcher Ben Edelman found that Cingular, Priceline, and Travelocity continue to advertise through spyware despite their agreement.

"[D]espite their duties to the NYAG, both Cingular and Travelocity have failed to sever their ties with spyware vendors," Edelman states. "As shown in the six examples below, Cingular and Travelocity continue to receive spyware-originating traffic, including traffic from some of the Web's most notorious and most widespread spyware, in direct violation of their respective Assurances of Discontinuance."

Edelman claims to have found "only a single example of Priceline ads shown by spyware," an ad placed "through Priceline's affiliate program, operated by Commission Junction." Specifics supporting that claim are not provided on Edelman's site.

Priceline maintains that it does not use or contract with third parties for the use of adware or spyware, a policy that has been in place since April 2006.

Edelman concedes that Priceline has improved its advertising practices. In his report, he said, "Priceline seems to have succeeded in substantially reducing these relationships -- suggesting that Cingular and Travelocity could do better if they put forth appropriate effort."

Travelocity claims that it has been making an effort. "When we found out about the ads, we immediately suspended the campaigns identified in the article because if the report is true, the ads would be in violation of our policies and practices," a company spokesperson said in an e-mailed statement. "We are aggressively investigating these claims to determine if there is a third party inappropriately serving our ads."

Travelocity maintains that it "does not use adware or spyware, and we have terms and conditions that specifically prohibit the ad networks we engage from placing our ads through channels involved with adware, spyware or similar programs. Similar safeguards exist for our affiliate network."

Suggesting that Edelman's motives might not be entirely pure, the Travelocity spokesperson pointed out that Edelman sued Travelocity last year in small claims court in Massachusetts over a reservation dispute, but failed to recover any damages.

In an e-mail, Edelman explained that his report "is not related to, nor motivated by, my separate pricing dispute with Travelocity." That dispute, he said, arose because Travelocity refused to honor the price it offered on its Web site, confirmed via e-mail and over the phone. "I thought (and still think) Travelocity is obliged to honor its confirmed prices in such situations, and I'm disappointed that Travelocity has not done so," he said.

A spokesperson for AT&T, which has been phasing out the Cingular brand name since completing the acquisition of BellSouth late last year, said in an e-mail that "[i]t appears that one of the ad networks we work with was subject to a spyware attack."

"It is our firm policy that the ad networks we work with not use spyware, which as you know can cause pop-ups and spam to appear," the spokesperson said. "We take this policy very seriously and our partners understand how important it is to us. We are working with that network to correct the problem, and are looking at further steps we can take to protect customers and potential customers from spyware."

Edelman concludes that beyond avowed good intentions, advertisers need some mechanism to see their intentions realized. "Advertisers ought not assume that partners and subpartners will follow the rules automatically, particularly when there's so much money to be made from cheating," he said in his report. "Instead, advertisers need systems to monitor and oversee compliance. It's hard to imagine any other context in which a company would spend hundreds of thousands of dollars through dozens, hundreds, or thousands of suppliers without meaningful oversight. Yet such practices seem to remain commonplace in Internet advertising."
As Edelman points out, at least two such services already exist: AffiliateFairPlay.com and ProtectMyMark.com.

Google did not respond to a request for comment.