In the YouTube app, an ad appeared that looked exactly like an iPhone system alert. "iPhone Storage is Full," it said, in Apple's typography, with Apple's modal styling, and two buttons — "Yes" and "No" — sitting exactly where Apple puts its dialog buttons. The buttons did nothing. They were pixels inside a static image, and tapping anywhere on the banner redirected to an app store page. The alert was a counterfeit: a fake emergency about the state of the viewer's own device, manufactured to convert a moment of panic into an install.
The ad was seen by Chris Greening, a hardware engineer who publishes as atomic14. He tapped it by accident — a lapse of concentration while checking his storage, the exact state of mind the ad is designed to exploit — and then did what the platform asks users to do: he reported it. The response was a form letter. "We found that the ad doesn't go against Google's policies," it said, "which prohibit certain content and practices that we believe to be harmful to users and the overall online ecosystem." He reported it again. The same letter came back. Multiple people reported the same ad. The same letter came back to all of them.
Then Greening did something the review process had not done. He fed the ad to the company's own language model — Gemini, the same class of system the company sells for exactly this kind of content classification — and asked whether it violated policy. The verdict came back in seconds: DISAPPROVED. Not a soft flag. Three specific violations, each named against the company's own written rules: Mimicking System Alerts / UI Elements, because the banner imitates an iOS system alert modal complete with standard typography and mock buttons; Non-Functional / Deceptive UI Components, because the "Yes" and "No" are static visuals designed to capture clicks anywhere on the banner; and Deceptive Fear-Based Tactics, because "if you don't free up space soon, some features may not work properly" fabricates an urgent failure state on the user's device. The classifier quoted the policies it was enforcing and condemned the ad on every count. "Google's own model rejects the ad in seconds," Greening wrote, "yet Google's review process approved it twice."
That sentence is the whole structure, and it is worth pausing on, because it is not a story about detection failing. It is a story about two systems that never meet.
The company operates a classification system and a review system, and they are different machines with different authority. The classification system — Gemini, and the ad-quality models the company demonstrably possesses — evaluates an ad against the written policy and produces a verdict: disapproved, with reasons. The review system is a workflow: an ad enters a queue, a pipeline of checks and escalations runs, an approval or rejection exits the far end, and the ad server obeys the exit stamp. The two systems should be the same system. The verdict of the classifier should be an input to the workflow; the workflow's approval should be an input to the ad server. What the letter proves is that they are not. The classifier's verdict — a full condemnation, three violations, produced in seconds at effectively zero cost — is routed nowhere. It does not reach the ad server. It does not even reach the reviewer, if a reviewer exists. It reaches the reporter, in a letter.
The letter itself is the second tell. "We found that the ad doesn't go against Google's policies" is written in the voice of an adjudication that has happened — a finding, already made, by the institution. But the finding is boilerplate. It is the same sentence whether the reported ad is a counterfeit system alert, a doubled-Bitcoin scam, or a harmless mattress company. A system that produces the same verdict for every input is not evaluating its inputs; it is closing tickets. The reporter is not a participant in the review; the reporter is a variable in a loop that always exits the same way. The people in the Hacker News thread who tried reporting these ads describe the mechanics precisely: the ad keeps playing while you report it, and after the report completes, the ad remains, and you see it again after a few swipes. One commenter put the economic reading in a single line: if they reject more ads, they get less money.
That is not cynicism; it is the incentive structure, stated plainly. The legal framework is the American Section 230, which shields platforms from liability for most user content — and, in practice, for the ads they select and place, a point the thread disputes at length. The liability shield removes the penalty side of the ledger. The revenue side remains: every ad that runs is booked revenue, and scam ads run well — fraudsters pay to reach victims, and the platform's cut is the same regardless of what the victim loses downstream. Meta, the one company that has been forced to put numbers on this, admitted that scam ads are roughly ten percent of its revenue. Reuters' investigation into Meta's fraudulent ads reached the same conclusion from the other direction. A platform is a company that gets paid by the checked to run the check, and the check costs money while the checked pays it. The structural position is exactly the one that produced the Enron audit: Arthur Andersen signed the books of a company that paid Arthur Andersen. Sarbanes-Oxley was written to break that coupling — the auditor's budget must not come from the audited. The ad platforms operate the pre-2002 arrangement, with the auditor and the audited collapsed into one company and the auditor's findings printed on a letter no decision-maker reads.
There is a sharper observation in the thread than the money, though. "AI is only used on users, not customers," one commenter wrote. The classifier that could condemn the ad is not being aimed at the ads; it is being aimed at the people who report them, in the form of automated moderation of complaints — the same technology, pointed the other way. The asymmetry is the structure. Scrutiny that costs revenue is minimized; scrutiny that manages users is deployed at scale. The company has the machine, the policy, and the verdict. What it has not built is the wire from the verdict to the ad server, because every department that would build that wire is paid by the department it would cut.
The report, meanwhile, enters a queue whose metric is not detection but closure. The team that processes complaints is graded on tickets closed, and the cheapest closure is the form letter, so the letter is what the queue produces — a loop whose exit condition is the reporter giving up. The classifier that could break the loop exists, is runnable, and costs the company nothing to run against every ad it serves. The loop survives because nothing inside it is rewarded for routing a reporter's complaint to the classifier, and nothing outside it is punished for routing every complaint to the letter. Detection was never the bottleneck. The bottleneck is the absence of any wire between the part of the company that knows and the part of the company that approves, and the wire is absent because the two parts have never had a reason to meet on the same side of the money.
The ad will keep running until those two systems are the same system. Nothing about the situation requires better detection. The detection is already done, in seconds, for free, by the company's own flagship product, on the record. What is missing is not a classifier. It is the decision to let the classifier's verdict have the same authority over the ad server that the approval stamp has — and that decision has a price, and the price is exactly the revenue the ad is earning while you read this.