(Note: I work for Mozilla. None of this is secret. None of this is Mozilla policy. Not speaking for Mozilla here.)

A big objection to tracking protection is the idea that the tracker will always get through. Some people suggest that as browsers give users more ability to control how their personal information gets leaked across sites, things won’t get better for users, because third-party tracking will just keep up. On this view, today’s easy-to-block third-party cookies will be replaced by techniques such as passive fingerprinting where it’s hard to tell if the browser is succeeding at protecting the user or not, and users will be stuck in the same place they are now, or worse.

I doubt this is the case because we’re playing a more complex game than just trackers vs. users. The game has at least five sides, and some of the fastest-moving players with the best understanding of the game are the ad fraud hackers. Right now ad fraud is losing in some areas where they had been winning, and the resulting shift in ad fraud is likely to shift the risks and rewards of tracking techniques.

Data center ad fraud

Fraudbots, running in data centers, visit legit sites (with third-party ads and trackers) to pick up a realistic set of third-party cookies to make them look like high-value users. Then the bots visit dedicated fraudulent “cash out” sites (whose operators have the same third-party ads and trackers) to generate valuable ad impressions for those sites.

If you wonder why so many sites made a big deal out of “pivot to video” but can’t remember watching a video ad, this is why. Fraudbots are patient enough to get profiled as, say, a car buyer, and watch those big-money ads. And the money is good enough to motivate fraud hackers to make good bots, usually based on real browser code. When a fraudbot network gets caught and blocked from high-value ads, it gets recycled for lower and lower value forms of advertising. By the time you see traffic for sale on fraud boards, those bots are probably only getting past just enough third-party anti-fraud services to be worth running.

This version of ad fraud has minimal impact on real users. Real users don’t go to fraud sites, and fraudbots do their thing in data centers and don’t touch users’ systems. The companies that pay for it are legit publishers, who not only have to serve pages to fraudbots—remember, a bot needs to visit enough legit sites to look like a real user—but also end up competing with ad fraud for ad revenue. Ad fraud has only really been a problem for legit publishers. The adtech business is fine with it, since they make more money from fraud than the fraud hackers do, and the advertisers are fine with it because fraud is priced in, so they pay the fraud-adjusted price even for real impressions.

What’s new for ad fraud

So what’s changing? More fraudbots in data centers are getting caught, just because the adtech firms have mostly been shamed into filtering out the embarassingly obvious traffic from IP addresses that everyone can tell probably don’t have a human user on them. So where is fraud going now? More fraud is likely to move to a place where a bot can look more realistic but probably not stay up as long—your computer or mobile device. Expect ad fraud concealed within web pages, as a payload for malware, and of course in lots and lots of cheesy native mobile apps. Ad fraud makes way more money than cryptocurrency mining, using less CPU and battery.

So the bad news is that you’re going to have to reformat your uncle’s computer a lot this year, because more client-side fraud is coming. Data center IPs don’t get by the ad networks as well as they once did, so ad fraud is getting personal. The good news, is, hey, you know all that big, scary passive fingerprinting that’s supposed to become the harder-to-beat replacement for the third-party cookie? Client-side fraud has to beat it in order to get paid, so they’ll beat it. As a bonus, client-side bots are way better at attribution fraud (where a fraudulent ad gets credit for a real sale) than data center bots.

Users don’t have to get protected from every possible tracking technique in order to shift the web advertising game from a hacking contest to a reputation contest. It often helps simply to shift the advertiser’s ROI from negative-externality advertising below the ROI of positive-externality advertising.

Advertisers have two possible responses to ad fraud: either try to out-hack it, or join the “flight to quality” and cut back on trying to follow big-money users to low-reputation sites in the first place. Hard-to-detect client-side bots, by making creepy fingerprinting techniques less trustworthy, tend to increase the uncertainty of the hacking option and make flight to quality relatively more attractive.