“Brand Safe” Is a Promise. Here’s the Machine Behind It.

Every marketer has ticked the box. Almost nobody has opened the hood. Underneath sit three layers of machinery, two separate moments of decision, and one number — the classifier’s error rate — that quietly decides whether your ad lands beside a war report or a recipe.

The checkbox and the machine

You have seen the slide. Somewhere around page nine of the media plan there is a line item for verification, and beside it a small green tick. The tick says “brand safe.” Everyone nods. The meeting moves on to the fun part, which is creative.

Here is the question nobody asks in that meeting: safe according to what?

Because “brand safe” is not a state of the world. It is the output of a process — a chain of crawlers, language models, taxonomies and filter lists, each capable of being wrong in its own particular way. When the tick appears, you are not looking at a guarantee. You are looking at the last edge of a very long assembly line, and you have been shown only the finished box.

The gap between the promise and the machinery is where most brand-safety spending quietly leaks out. So let’s walk the line.

Three layers, and why the middle one is the whole game

Strip away the marketing language and the stack is small enough to hold in your head.

The crawl. Vendors send software across the open web to see what is out there: pages, apps, video, connected TV. Coverage is always partial. News homepages change hourly, user-generated pages change constantly, and a meaningful share of inventory is simply unscored at the moment a bid request arrives asking whether that page is acceptable.

The classifier. Crawled pages get sorted into risk tiers. Keyword rules still do some of the work, semantic models do more of it, and a shared vocabulary — the IAB Tech Lab Content Taxonomy — lets buyers, sellers and vendors at least argue in the same language.

The decision. Those labels become lists, and the lists decide what happens to each impression. There are exactly two moments to make that call, and the difference between them is the most commercially important thing in this article.

Notice what is missing from that description: your brand. The stack does not know what you sell, what you stand for, or which headlines would actually hurt you. It knows categories. Everything else is interpretation layered on top — usually by someone in a meeting who has never seen the classifier’s error rate.

What the crawl layer really promises

Crawling sounds like surveillance. In practice it is closer to a library being reshelved while you read.

Every page must be fetched, parsed and scored before a bid request asks about it. Any gap in coverage forces buyers into a quiet, consequential choice: do I avoid unclassified pages entirely, or let them through? Avoid them and reach collapses, because the long tail of the web is mostly unclassified. Let them through and you have just declared that the fastest-growing part of the inventory base is exempt from your standards. Most setups do a bit of both, usually without anyone documenting the split.

This is the first place where “brand safe” stops meaning what the tick implies. It does not mean verified safe. It means verified or assumed.

Inside the classifier: where safety is actually manufactured

If you remember one thing from this piece, make it this: the classifier is the product. The crawl is plumbing, the decision layer is administration, but the classifier is the thing you are actually buying.

Modern versions look nothing like a keyword list. One vendor describes its contextual engine as full-page semantic analysis over a proprietary knowledge graph, with entity recognition and more than ninety emotional and sentiment signals across more than fifty languages, re-scored daily. The same vendor states that keywords now account for roughly a quarter of one percent of blocked or flagged impressions on buy-side open web traffic. That number is a useful tell: the industry’s own instrumentation says the blunt instrument has been demoted.

Why does this matter commercially? Because a keyword filter cannot tell a tennis shot from a gunshot, and it never will. A semantic model can — most of the time. That “most of the time” is the entire professional argument, and it cuts both ways: fewer absurd blocks, but also fewer guarantees, because a probabilistic system that is right 95% of the time is wrong on one impression in twenty, and you buy impressions in the millions.

The taxonomy you have never read, and why it decides your reach

There is a document most media buyers have never opened, and it has more influence over their inventory access than any vendor contract: the IAB Tech Lab Content Taxonomy.

Version 2.2, released for comment in late 2020 and built with the industry alliance GARM, folded eleven sensitive-topic categories and four risk levels — Floor, High, Medium, Low — into the standard, and treated risk as an attribute that attaches dynamically to a topic rather than replacing it. OpenRTB carries the result through cat and cattax fields on the content object, so a bid request can declare which taxonomy its category codes belong to and what the page is about at site, section and page level.

That sounds like boring plumbing. It is actually the mechanism that lets a brand say “block gambling, allow alcohol, treat crime coverage as acceptable on news domains but not on entertainment sites” and have that instruction travel intact from a spreadsheet in London to an auction in Singapore.

When the taxonomy works, you get precision. When it degrades — stale codes, missing signals, a publisher that never tagged its pages — you get the opposite: a filter that looks configured and behaves randomly. And when the vocabulary itself is contested, as it became after 2024, you get something stranger: everyone still using the same words while meaning different things.

Pre-bid and post-bid: the distinction that actually costs money

Here is where most brand-safety budgets get misallocated.

Pre-bid evaluation happens inside the auction, before money moves. The placement is judged, and if it fails, you never bid. It is preventive, and it is more precise, because you are stopping the impression rather than explaining it afterwards. It is also expensive in a specific, under-discussed way: every false positive is reach you paid overhead to not get.

Post-bid evaluation happens after the ad has served. Tags and scripts fire, the true page is identified, the impression gets flagged. Then comes a reconciliation conversation — credits, make-goods, adjustments. The language gets slippery here, because post-bid is routinely described as “blocking,” and blocking is not quite what happens. By the time the flag lands, a human being has already seen your logo next to the thing you wanted to avoid.

The asymmetry shows up in the money. In the benchmark that has become the reference point for programmatic transparency, only 43.9 cents of every dollar entering a demand-side platform reached a consumer in 2024 — an improvement of nearly eight points on the prior year, and still a majority of spend diverted before it reached anyone. Verification spend is, in that frame, a small premium paid to protect the smaller number that survives. Getting the moment of decision wrong means paying the premium and still buying the waste.

Suitability is not safety, and the difference is your brand

Safety is binary and everyone agrees on it. Adult content, illegal drugs, hate speech, terror propaganda — the floor. Nobody argues about the floor.

Suitability is where the argument lives, because suitability is brand-specific. A luxury hotel chain and a discount airline can look at the same article about pest problems in hotels and reach opposite conclusions. One sees reputational poison. The other sees a very cheap context for a very cheap flight.

This is the distinction that separates a mature setup from a lazy one. Safety is a setting you inherit from the industry. Suitability is a decision you have to make yourself, in writing, with someone accountable for it — because the moment you start specifying what is unsuitable for your brand, you have also started specifying what reach you are willing to give up.

Most organisations never actually write it down. They inherit a template, add a few categories after an incident, and never revisit. Which is how you end up with the situation in the next section.

The over-blocking ledger

For years, publishers complained that brand-safety filters blocked content that was never a risk. In 2026, that complaint got measured.

A verification vendor partnered with Reuters to test how often blunt keyword blocklists demonetised pages its own semantic system had already cleared as suitable. The result: 54% of cleared news URLs would have triggered a typical blocklist. On the lifestyle vertical, only 4.27% of URLs were affected — but those pages carried 13.5% of the section’s impressions, because they were the popular ones. Swapping out seven high-volume keywords for semantic segments cut blocked content by an estimated 58%.

The examples are almost comic. A story about filming a sequel got blocked because the URL contained “shot.” Coverage of the band Arcade Fire got blocked for “fire.” In a separate audit of 1,200 Australian news articles published between July 2025 and June 2026, 57% contained at least one term capable of triggering an exclusion rule, 38% of low-sensitivity stories were wrongly excluded, business and finance coverage was hit hardest by words like “bank,” “crash” and “dispute,” and the single most common trigger was a state name: Victoria. An exclusion list built around a 2015 terror attack was still blocking “Paris” through the 2024 Olympics.

Now the money. A 2019 study by the cybersecurity firm CHEQ and the University of Baltimore put US publisher revenue lost to over-blocking at roughly $2.8 billion in that year alone — about a quarter of digital news ad revenue. The 2026 Australian audit estimated $180 million of annual ad opportunity at risk, equivalent to 23 million lost ad interactions. And the asymmetry gets worse at the margin: some Black-owned publishers have reportedly seen as much as three-quarters of their traffic blocked.

Here is the part that should make a CMO sit up. When publishers replaced legacy filters with semantic models, the recovered inventory was substantial: Newsweek went from 63% to 98% of content classified as brand-safe, Immediate Media unlocked 50% more ad delivery, and News UK grew brand-safe inventory by a fifth. That is not new supply. That is inventory that already existed, that audiences were already reading, that brands were already paying to be excluded from.

Where the risk actually pools

If you want to find your brand-safety problem, do not start with your settings. Start with your media mix.

A benchmark covering 2025 data and built on more than 300 billion daily digital interactions found that mobile web display represented 45.1% of measured impressions — and 54.9% of suitability failures, 71.9% of made-for-advertising impressions, and 71.5% of ad clutter impressions. Its MFA rate ran four times desktop’s. Its suitability failure rate was 5.7% against desktop’s 3.4%.

Read those numbers again and notice the shape of them. One environment, less than half the volume, carrying the overwhelming majority of the failure. That is not random. Mobile web pages compress time-in-view, invite higher ad density, and scroll fast enough that attention is scarce and monetisation is aggressive.

Which means something practical: uniform settings across formats are a category error. The controls that make sense on desktop display are under-powered on mobile web, and the controls that make sense on mobile web will choke your desktop reach if applied everywhere. Most organisations apply one profile to everything and call it consistency.

MFA: the inventory built to beat the scoreboard

Made-for-advertising sites deserve their own section because they expose a flaw in how the industry measures quality.

The 2023 benchmark that put MFA on the map was brutal: 21% of programmatic impressions, 15% of spend, an estimated $13 billion wasted annually, some advertisers sending up to 42% of budget to these domains, and only about 36 cents of every dollar entering a demand-side platform reaching an actual consumer. MFA inventory also tends to look good on the metrics buyers screen for — cheap CPMs, decent viewability, low invalid traffic, clean-looking content categories. It is optimised for the scoreboard, not for the reader.

The response worked, at least at first. The follow-up benchmark covering 2024 found average MFA spend down from 15% to 6.2%, the median from 10% to 1.1%, and the average number of domains per campaign down from 44,000 to 22,634. That is a rare piece of good news in this field: attention, applied to a specific metric, moved the metric.

Then AI arrived and changed the unit economics of garbage. Generation is now nearly free, so the incentive to produce content purely to intercept ad dollars got stronger, not weaker. One vendor measured MFA impressions up 19% year over year, with the sharpest growth in hybrid sites that mix real content and junk — the hardest kind to classify cleanly.

This is the pattern to internalise. Brand safety is not a problem you solve. It is a race you keep running, and the other side keeps getting faster tools.

AI slop, and the collapse of the “quality” signal

The newest front is not harmful content in the traditional sense. It is content that is merely worthless — fluent, cheap, search-optimised, and produced at a scale no editorial operation can match.

The scale is now measurable. One verification vendor detected more than half a billion impressions of low-quality AI-generated content in the first half of 2026 alone. A rival’s threat research identified a coordinated network of more than two hundred AI-generated domains, with the operators leaving their generation prompts visible in the site code. The content spreads across categories you would not expect: travel, technology, sports, and — tellingly — violence and vehicle disasters, because those harvest cheap clicks.

Does the audience care? More than marketers assumed. In a 2026 global study of 22,000 consumers across 22 markets, 42% said a brand using low-quality or uncanny AI creative would damage their opinion of it, while 40% responded positively to polished AI work. Consumers are not rejecting AI. They are rejecting cheapness, and applying that judgment to whoever’s logo is nearby.

Meanwhile 56% of those same consumers said they cannot consistently tell AI-generated content apart. Hold those two findings together. Audiences cannot identify the thing that damages their opinion of you, but they form the opinion anyway. That is a brand-risk profile no keyword list was designed to handle, and it is why classification models are being rebuilt around multimodal signals rather than text.

What GARM’s collapse actually changed

In August 2024, the Global Alliance for Responsible Media shut down, days after a platform filed an antitrust suit against its parent body. GARM was small — two full-time staff — but it had produced the two documents the industry actually used: the Brand Safety Floor and the Adjacency Standards Framework. It also had a number worth citing: ads running against harmful or illegal content fell from 6.1% in 2020 to 1.7% in 2023.

The litigation ended in 2026, first with a dismissal and then with a settlement in which the advertisers’ federation agreed not to restart GARM or anything like it.

So what broke? Less than the headlines suggested, and more than the industry admits. The frameworks survived as documents and as functionality embedded in vendor tools and platform policies. What did not survive was the coordination layer — the forum where buyers and sellers agreed what the categories meant and what counted as a violation. In its place: each platform defining its own thresholds, each vendor scoring against its own model, each advertiser negotiating bilaterally.

The measurable consequence is not worse filtering. It is a slow divergence in what the same words mean depending on who is saying them. One platform can credibly claim to be “99% brand safe” while a vendor’s numbers tell a different story, and both statements can be technically true because neither uses the same denominator. That is not a scandal. It is what happens when a shared vocabulary loses its referee.

Consolidation is quietly reshaping the referee

One 2026 development deserves a paragraph of its own, because it changes who is doing the auditing.

In August 2026, the audience-measurement firm Nielsen agreed to acquire one of the two dominant verification vendors for roughly $2.15 billion, in a deal expected to combine audience data with media-quality verification inside a single company serving clients responsible for more than $300 billion in ad spend.

On paper that is efficiency: one platform for who saw the ad and whether the ad was any good. In practice it creates a structural question the industry has not had to ask before. The acquirer sells audience data to the publishers and platforms that the verification arm is supposed to independently police. When the auditor and the audience-data provider are the same company, independence stops being a methodology question and becomes a governance one.

Nothing breaks on day one. Tags still fire, integrations still work, methodology is still documented. What changes is the incentive structure underneath the scorecard — and that is exactly the kind of change that shows up in your numbers two years later, without anyone able to point to the moment it shifted.

The new surfaces are harder, not easier

Two frontends are opening fast, and both break the assumptions the stack was built on.

Connected TV looks like television and behaves like the open web. In the first quarter of 2026, one vendor detected 140% more CTV fraud schemes and variants than in the same period a year earlier. The same company’s data indicates more than one in three CTV impressions are delivered to screens that are switched off, contributing to an estimated $1 billion in annual waste. Fraud rates on protected campaigns stayed under 1%; on unprotected impressions they ran near 9%. Program-level metadata is thin, and “genre” has historically been a free-text field — a polite way of saying nobody agreed what it contains.

Conversational surfaces are stranger still. Advertising inside AI chat has no static page to classify, because the context changes with every turn of the conversation. Verification vendors are piloting measurement there now — one running suitability reporting against its existing taxonomy, another building attribution and a separate suitability framework with the platform, explicitly because context is dynamic and evaluating it cannot wait for a crawl cycle. Whether that becomes genuine independent verification or a nicely formatted dashboard over the platform’s own judgment is the open question of the next two years.

Both cases share a symptom worth naming: verification capability lags inventory creation. It always has. It is lagging more now.

The playbook, stripped of adjectives

Six things, in the order they pay off.

Write down your suitability standard. Not a template. A document, half a page, naming the categories you will and will not accept, who owns the decision, and when it gets reviewed. If you cannot produce that document on request, you do not have a standard; you have a vendor default.

Audit what is being blocked in your name. Ask directly: which domains, categories and keywords are excluded on my behalf, who set them, and when were they last touched? Most teams discover inherited exclusions from campaigns that ended years ago. This is the highest-return hour in brand safety.

Move from exclusion lists to inclusion lists. Exclusion is a losing game against an infinite, AI-fed supply of new domains. Curation is finite and auditable. The buyers who made this shift cut domain counts by half and lost nothing measurable.

Match controls to risk, not to habit. If mobile web display is where the failure concentrates, that is where the tightest settings belong. Applying one profile to every format is not rigour; it is the appearance of rigour.

Instrument the grader, not just the grade. Track your classifier’s false-positive and false-negative rates on a sample you review by hand. Vendors publish accuracy claims; sampling tells you what those claims mean in your inventory. Nobody does this, and it is the difference between managing risk and reciting it.

Re-price the trade deliberately. Every filter setting is a purchase of safety with reach, and someone in your organisation should be able to say what exchange rate you are getting. Over-blocking is not a cautious default; it is a spend decision made by omission.

Where I would push back

Three caveats, honestly stated.

First, most of the numbers in this field come from companies that sell the fix. Vendor benchmarks are the best data available and they are not neutral. Where a single-vendor figure appears here, treat it as direction rather than gospel, and look for a second source before you build a plan on it.

Second, the peer-reviewed evidence on brand damage from context is thinner than the industry’s confidence implies. INMA’s own review of the literature found little to no peer-reviewed support for the claim that advertising near news harms brands, and some evidence pointing the other way. The studies linking adjacency to lost sales are mostly survey-based, and surveys measure stated attitudes, not behaviour.

Third, precision has a cost that never appears on the invoice. A perfectly curated buy can be perfectly safe and commercially pointless. The goal was never maximum safety. It was the best available ratio of safety to attention — and no vendor can pick that ratio for you, because it depends on what your brand is willing to be seen next to.

Conclusion

Brand safety is not a checkbox, a vendor, or a setting. It is a machine with three stages, and the only stage that determines whether the promise holds is the one least discussed: the classifier, with its error rate, its taxonomy, and its blind spots.

Everything else follows from taking that seriously. If the classifier is good, pre-bid filtering is cheap insurance and post-bid reporting is a reconciliation tool. If the classifier is blunt, pre-bid filtering quietly strangles your reach, post-bid reporting tells you about damage after the fact, and the tick on page nine is a story you told yourself.

The marketers who get this right are not the ones with the strictest settings. They are the ones who can answer three questions without leaving the room: what is being blocked on my behalf, what is my filter getting wrong, and what am I paying for the difference. In an inventory base now flooded with cheap synthetic content, those three answers matter more than any promise a vendor can make.