In the 1990s and early 2000s, digital display advertising—banner ads, pop-ups, and so on—was just the digital analogue of print advertising: A brand would buy space directly from a website. But today that is increasingly rare. What has risen in its place is something known as programmatic advertising. With programmatic, ads no longer target specific publications. Instead, they target specific types of users, based on things like age, sex, location—along with the creepier stuff, like what their browsing history reveals about their interests. Advertisers now put their ads into an automated system with instructions to reach a certain audience, wherever they are. They have some power to tell the system to keep their ads away from certain sites and content, but the results are spotty.

Programmatic advertising is the economic fuel of the “free” internet. Its rise has made it dramatically easier for anyone to create their own site and immediately make money from traffic. Unfortunately, the same convenience that allows a food blogger to turn their following into an income also allows anyone to set up a site pushing hate speech or propaganda and get it monetized without any advertiser explicitly choosing to pay them.

“Previously, without ad tech, it was much harder for them to make money,” says Augustine Fou, an ad fraud consultant. Automation changed everything. The key change, Fou explains, was “the ease with which you can copy and paste a few lines of code onto your site and start running ads and making money. Prior to programmatic, you’d have to get an advertiser or a media buying agency to give you money.” Ad-tech tools do allow brands to block certain sites and types of content, but advertisers frequently don’t take advantage of them.

The paradox of programmatic advertising is that while it might be easy to tap into, the actual mechanism is absurdly complex: a series of real-time auctions mediated by layers of automated middlemen. Every time a page or app running programmatic ads is loaded, the publisher starts by sending its available ad space, along with whatever information it has on the user loading the page—essentially the inventory it’s selling—into its ad server. (The most popular ad server by far is run by Google.) The ad server beams out a bid request to advertisers looking to target that type of user. Brands put their ads into an ad-buying platform, along with their target audience and what they’re willing to pay. (Google also owns the biggest buying-side platform, which is particularly popular among smaller businesses.) The platform sends that bid to the ad exchange, where it competes against other bids for the target audience. The winning bid then competes against all the winners from all the other exchanges. Finally, the winner of winners appears on the publisher’s site. Believe it or not, this is a dramatically oversimplified account; the real thing is much more complicated. But, in a nutshell, that’s how a household name like Merck or Dell can end up sponsoring Covid denialism. (Two weeks ago, Google finally announced that it would begin blocking ads from running on stories promoting debunked coronavirus theories.)

Technically, most social media advertising could also be described as programmatic display, in the sense that it’s targeted at users based on behavioral data through an automated auction. The difference is that social media ads appear in the closed system of a given platform, while what I’m calling programmatic advertising follows you all around the web. But the two share important similarities.

“So much of it is about creating a space in which users can be targeted when they are, for lack of a better term, vulnerable,” says the Post’s Zucker-Scharff. They’re vulnerable to the right piece of fake news showing up at the right part of a feed or on a site at the right time. That sort of thing only happens because they can be targeted with this type of data.”

Search

The last big bucket of digital ads is search: Results that advertisers pay to have displayed above or below the actual results from a search engine. This is a much simpler system. You pick your search engine, specify which search terms you want to trigger your ad, and pay based on how many clicks the ad gets. There’s no complicated chain of intermediaries that makes other ad ecosystems so ripe for foul play. And Google, which accounts for some 90 percent of the global search engine market, has pretty robust policies concerning the ads that run on its platform.