“While we proactively monitor for unusual account activity to stop these incidents, advertisers must remain alert.” That’s Ginny Marvin, Google Ads product liaison, writing on LinkedIn in April 2026 after agencies running Google Ads were hit with phishing scams.
Read that sentence again as a systems statement rather than a PR statement. The first clause describes an automated detection layer. The second clause quietly admits that layer has a false-negative rate high enough that the humans downstream need to stay on watch. That is not a communications failure. It is an accurate description of how the architecture actually works, and it tells us something useful about the limits of any detection system operating at Google’s scale.
Detection is a classifier, and classifiers have thresholds
I study agent architectures, so my instinct is to ask where the decision boundary sits. Every ad review pipeline — automated, human, or hybrid — is fundamentally a classifier making a call under uncertainty. You set a threshold. Move it toward aggressive enforcement and you block legitimate advertisers, generate appeals, and lose revenue. Move it toward permissiveness and dodgy ads slip through.
There is no threshold setting that eliminates both error types. This is not a Google-specific weakness; it is a property of statistical decision-making. What is specific to Google is the asymmetry in how those two errors are felt. A blocked legitimate advertiser files a complaint through a channel Google owns and can measure. A phishing ad that reaches a user produces harm that lands outside the system, often untraceable back to the decision that allowed it.
When one error type is loud and internally measurable and the other is diffuse and external, the optimization pressure has a direction. Not through malice. Through gradient.
What Limited Ad Serving actually signals
Google’s response has been structural rather than purely threshold-based. The Limited Ad Serving policy now spans every Google Ads surface — Search, Shopping, YouTube, Gmail, Play Store, Demand Gen — and accounts fall into an “unqualified advertisers” classification that restricts how widely their ads can run.
Architecturally, this is more interesting than tuning a content classifier. It shifts the unit of trust from the individual ad to the account. Instead of asking “is this creative acceptable,” the system asks “has this entity earned distribution.” That is a reputation layer, and reputation layers are generally the right answer for adversarial environments, because they raise the cost of iteration for bad actors. A scammer who has to build advertiser standing before achieving reach faces a slower loop than one who can spin up creatives until something passes review.
But reputation systems have a known failure mode: account takeover. Which brings us straight back to the phishing scams that hit agencies. If trust attaches to accounts, then stealing an account becomes the highest-value attack in the system. The defense and the vulnerability are the same design decision viewed from two sides.
The compounding effect of automation elsewhere
There is a second dynamic worth tracking. AI-generated ad copy and auto-applied recommendations are now standard in Google Ads, and advertisers who follow every recommendation without scrutiny inflate spend without improving profit. Google Ads has also been testing strength match labels and expanding AI reporting.
Note what happens when generation is automated on one side and review is automated on the other. Volume rises. Variation rises. The review classifier now faces a larger and more diverse input distribution than the one it was calibrated against. Meanwhile the human advertiser — the party Marvin asks to remain alert — is increasingly abstracted away from the specifics of what is running in their own account. You cannot audit what you did not author and cannot see.
That is the structural problem underneath the headline. Vigilance is being requested from the layer with the least visibility.
Where the policy language runs ahead of the mechanism
Google’s policies are clear enough on paper. Counterfeit goods are prohibited outright — promoting items bearing a trademark identical to or substantially indistinguishable from a real one is not allowed. Strict rules also target dangerous products. The stated intent is not the gap.
The gap is between a rule expressed in natural language and an enforcement mechanism that must apply that rule to millions of submissions without a human reading most of them. “Substantially indistinguishable” is a judgment call. Encoding judgment calls into scalable systems is precisely the hard problem in agent design, and nobody has solved it cleanly.
So dodgy ads persist because the enforcement surface is adversarial, the error costs are asymmetric, trust has been relocated to accounts that can be stolen, and generation is scaling faster than review. Each of those is a design tradeoff, not an oversight. The honest version of Marvin’s statement is that Google has built the best classifier it can and is asking users to cover the residual.
That is a reasonable request. It is also an admission that the machine is not finished, and probably cannot be.
🕒 Published: