AdLens, a system developed by researchers affiliated with New York University and Radboud University, classified deceptive software and app ads in Google’s Ads Transparency Center. The study reported three patterns: false security warnings, implausible claims about software capabilities, and designs that obscure what is being promoted or who is advertising it. The counts cover selected ad-library topics and ads shown in at least one European Economic Area (EEA) country, not a U.S. sample. (AdLens paper)
Three patterns the researchers classified
| Ad category | Ad IDs | What the ads do |
| Scareware | 238 | Use false warnings that a device is infected or damaged |
| Deceptive claims | 3,346 | Make implausible claims about software capabilities |
| Misleading design | 258 | Use designs that obscure the product or advertiser |
An ad could fall into more than one category. The authors estimated more than 16 million impressions for scareware ads and 89.9 million for ads with deceptive claims. An impression is an ad exposure, not a count of unique people, infections, or financial losses.
What the study counted
The study’s three dataset totals refer to different things. The researchers collected 188,834 ad creatives from 90,000 ad IDs; one ad ID can have several creative variants. After removing creatives with identical extracted text, 112,761 remained.
The sample covered Google Ads Transparency Center ads in the Software, Mobile App Utilities, and Computer & Consumer Electronics topics, provided they had been shown in at least one EEA country. AdLens ranked candidates and applied category-specific cutoffs rather than classifying every ad in Google’s library. The resulting counts are lower-bound estimates for this sample, not a census of Google advertising or a U.S. prevalence estimate.
How AdLens classified ads
AdLens used optical character recognition (OCR) to extract text, translated non-English ad text, and ranked likely candidates by semantic similarity. Two vision-language models classified candidates; a third model assessed disagreements. Three human annotators reviewed more than 5,000 ads.
On disagreements in a 1,283-ad gold-standard set, the judge scored 0.922 macro-F1. Macro-F1 averages the model’s F1 scores across categories. A separate 253-ad test set produced a reported macro-F1 of 0.997, but it contained only three positive examples of misleading design. The authors’ project repository also records an erratum to Table 2(c). These figures describe the study’s evaluation sets, not the accuracy of Google’s ad-review operation.
What the impression estimates and a reported removal show
For ads older than 90 days, Google provides lower and upper impression bounds for the EEA and Turkey region. The researchers used the midpoint of those bounds to estimate exposure. That method does not turn impressions into a count of people who saw an ad or suffered harm.
The authors also describe a specific report involving 42 ads linked to pdfscraper.com, which the paper associates with the TamperedChef infostealer campaign. They say Google removed the ad they reported while 41 other ads linked to the domain remained active. That is the outcome they observed in this case. (AdLens paper)
How to report a suspicious Google ad
On a Google service, select More or Info on the ad, choose Report ad, select a reason, and submit the form. Google says it reviews reports; filing one does not automatically block the ad. Google’s reporting instructions
