Google is not failing to catch bad ads because it doesn’t care. Google is failing because catching bad ads is one of the hardest classification problems anyone has ever tried to run at planetary scale, and every honest person who has built a filtering system knows it. The popular story says a trillion-dollar company could fix this tomorrow if it wanted the revenue less. I build bots for a living, I’ve shipped moderation pipelines that fell over in embarrassing ways, and I think that story is mostly wrong.
That’s not a defense of Google. It’s a claim about the shape of the problem, which matters a lot more if you’re the one building the thing.
Adversaries adapt faster than your rules do
Every filter I’ve ever written had the same lifecycle. Version one catches the obvious garbage. Version two catches the slightly cleverer garbage. Version three is a mess of exceptions because the people you’re filtering read your version two behavior and adjusted. The feedback loop on the attacker side is faster than your deploy cycle, always.
Google’s own posture reflects that reality. Ginny Marvin, Google Ads product liaison, put it plainly on LinkedIn when agencies got hit with phishing scams in April: “While we proactively monitor for unusual account activity to stop these incidents, advertisers must remain alert.” Read that as an engineering statement rather than a PR one. It says the automated layer is real, it’s running, and it is not sufficient on its own. That’s the same sentence I’d write about any bot I’ve deployed against a motivated human opponent.
The phishing angle is the part people underrate. Those scams didn’t target Google’s ad review system at all. They targeted the humans who hold the accounts. A perfectly tuned ad classifier does nothing about a compromised advertiser account being used to push whatever the attacker wants. You’ve moved the attack surface from content to identity, and identity is squishier.
The policy stack is a signal about model confidence
Google’s stated rules are strict on paper. The ad policies prohibit selling or promoting counterfeit goods, defined as goods carrying a trademark identical to or substantially indistinguishable from someone else’s mark. Dangerous products get similar treatment. So the rules exist. The gap between rule and enforcement is where all the interesting engineering lives.
Watch what Google actually shipped in response. The Limited Ad Serving policy expanded to cover every Google Ads surface: Search, Shopping, YouTube, Gmail, Play Store, Demand Gen. Accounts land in an “unqualified advertisers” bucket and get throttled rather than removed. If you’ve ever tuned a moderation model, you recognize that design immediately. It’s what you build when your classifier has decent recall but you don’t trust its precision enough to hard-ban. So you rate-limit instead. Suspicion becomes a dial rather than a switch.
Throttling is a reasonable choice. It’s also an admission. You don’t build a graduated trust tier if you’re confident you can just identify the bad actors and cut them off.
What this means if you’re building the bot
The lesson I keep pulling out of this, and applying to my own work, breaks down into a few habits:
- Design for graceful degradation, not perfect detection. Rate limits, holdbacks, and staged trust give you somewhere to put uncertain cases. Binary allow/deny forces you to be right, and you won’t always be.
- Treat account takeover as a separate threat model. Content filters and identity security are different systems. Google’s phishing problem shows what happens when you’re strong on one and the attacker walks through the other.
- Assume your automation will be gamed by people reading its output. Anything you expose about why something was blocked becomes a tuning signal for the other side.
- Keep a human in the loop where the cost of being wrong is high. Marvin’s advice to advertisers is basically that. The machine watches, the human stays alert.
There’s a related trap on the optimization side. AI-generated ad copy and auto-applied recommendations became standard practice by 2026, and following every recommendation without judgment inflates spend without improving profit. Same pattern, different domain: an automated system producing plausible suggestions that a person needs to filter. Automation moves the work, it doesn’t delete it.
Uncomfortable but useful
If you want Google’s ad ecosystem clean, the honest version of that wish involves accepting more false positives, which means more legitimate advertisers throttled or blocked by mistake. That tradeoff has a real cost, and it’s the same one I face every time I set a threshold in a bot that decides what gets through.
So the dodgy ads keep showing up. Not because nobody’s trying, but because the adversary is human, funded, and iterating. That’s the problem class we’re all in now. Build like it.
đź•’ Published: