Inside the 'arms race' between YouTube and ad blockers

YouTube recently took dramatic action against anyone visiting its site with an ad blocker running — after a few pieces of content, it'll simply stop serving you videos. If you want to get past the wall, that ad blocker will (probably) need to be turned off; and if you want an ad-free experience, better cough up a couple bucks for a Premium subscription.

Although this is an aggressive move that seemingly left ad blocking companies scrambling to respond, it didn’t come out the blue — YouTube had been testing something similar for months. And even before this most recent clampdown, the Google-owned video service has been engaged in an ongoing conflict — a game of cat-and-mouse, an arms race, pick your metaphor — with ad-blocking software: YouTube rolls out new ways to serve ads to viewers with ad blockers, then ad blockers develop new strategies to circumvent those ad-serving measures.

As noted in a blog post by the ad- and tracker-blocking company Ghostery, YouTube employs a wide variety of techniques to circumvent ad blockers, such as embedding an ad in the video itself (so the ad blocker can’t distinguish between the two), or serving ads from the same domain as the video, fooling filters that have been set up to block ads served from third-party domains.

It’s not that YouTube is alone in these efforts; many digital publishers make similar attempts to stymie ad blockers. To some extent, YouTube’s moves just get more attention because the service is so popular. As AdGuard CTO Andrey Meshkov put it in an email, “Even when they run a test on a share of users… the number of affected people is very high.”

At the same time, according to Ghostery’s director of product and engineering Krzysztof Modras, it’s also true that “as one of the world’s largest publishers, YouTube constantly invests in circumventing ad blocking.” And that those investments have been effective. Many of the most common ad blocking strategies, including DNS filtering (filtering for third-party domains), network filtering (which Modras described as “more selective” and better at blocking first-party requests) and cosmetic filtering (which can blocks ads without leaving ad-shaped holes in the website content) no longer work on the site.

Now, Modras said, YouTube seems to be “adapting [its] methods more frequently than ever before. To counteract its changes to ad delivery and ad blocker detection, block lists have to be updated at minimum on a daily basis, and sometimes even more often. While all players in the space are innovating, some ad blockers are simply unable to keep up with these changes.”

Keeping pace with YouTube will likely become even more challenging next year, when Google’s Chrome browser adopts the Manifest V3 standard, which significantly limits what extensions are allowed to do. Modras said that under Manifest V3, whenever an ad blocker wants to update its blocklist — again, something they may need to do multiple times a day — it will have to release a full update and undergo a review “which can take anywhere between [a] few hours to even a few weeks.”

“Through Manifest V3, Google will close the door for innovation in the ad blocking landscape and introduce another layer of gatekeeping that will slow down how ad blockers can react to new ads and online tracking methods,” he said.

For many users, the battle between YouTube and ad blockers has largely been invisible, or at least ignorable, until now. The new wall dramatically changes this dynamic, forcing users to adapt their behavior if they want to access YouTube videos at all. Still, the ad blocking companies suggest it’s more of a policy change than a technical breakthrough — a sign of a new willingness on YouTube’s part to risk alienating its users.

“It's not that YouTube's move is something new, many publishers went [down] this road already,” Meshkov said. “The difference is [the] scale of YouTube.” That scale affects both the number of users impacted, as well as the number of resources required to maintain these defenses on the publisher's side. “Going this road is very, very expensive, it requires constant maintenance," he added, "you basically need a team dedicated to this. There's just a handful of companies that can afford it."

As ever, ad blockers are figuring out how to adapt, even if it’s requiring more effort from their users, too. For example, Modras noted that “throughout much of October, Ghostery experienced three to five times the typical number of both uninstalls and installs per day, as well as a 30 percent increase in downloads on Microsoft Edge, where our ad blocker was still working on YouTube for a period of time.” All of this activity suggests that users are quickly cycling through different products and strategies to get around YouTube’s anti-ad block efforts, then discarding them when they stop working.

Meanwhile, uBlock Origin still seems to work on YouTube. But a detailed Reddit post outlining how to avoid tripping the platform's ad-block detection measures notes that because “YouTube changes their detection scripts regularly,” users may still encounter the site’s pop-up warnings and anti-adblock wall in “brief periods of time" between script changes (on the platform's end) or filter updates (on uBlock's side.) uBlock Origin may also stop working on Chrome next year thanks to the aforementioned Manifest V3. And if you’re hoping to use it on a non-Chrome browser, Google has allegedly begun deprecating YouTube's load times on alternate browsers, seemingly as part of the anti-ad block effort. While 404 Media and Android Authority, which both reported on this issue, were not able to replicate these artificially slowed load times, users were seemingly able to avoid them through the use of a “user-agent switcher,” which disguises one browser (say, Firefox) as another (in this case, Chrome).

Why do some ad blockers still work? The answer seems to boil down to a new approach: Scriptlet injection, which uses scripts to alter website behavior in a more fine-grained way. For example, Meshkov said an ad blocker could write a scriptlet to remove a cookie with a given name, or to stop the execution of JavaScript on a web page when it tries to access a page property with a given name.

On YouTube, Modras said, scriptlets can alter the data being loaded before it’s used by the page script. For example, a scriptlet might look for specific data identifiers and remove them, making this approach “subtle enough” to block ads that have been mixed in with website functionality, without affecting the functionality.

Scriptlet injection also plays a role in an increasingly crucial part of the ad blocker’s job: escaping detection. AdGuard’s Meshkov said this is something that teams like his are already working on, since they try escape detection as a general rule — both by avoiding activity that would alert a website to their presence, and by using scriptlets to prevent common fingerprinting functions that websites use to detect ad blockers.

Scriptlet injection seems to be the most promising approach right now — in fact, Modras described it as currently “the only reliable way of ad blocking on YouTube.”

Meshkov said that assessment is accurate if you limit yourself to browser extensions (which is how most popular ad blockers are distributed). But he pointed to network-level ad blockers and alternative YouTube clients, such as NewPipe, as other approaches that can work. A recent AdGuard blog post outlined additional other steps that users can try, such as checking for filter updates, making sure multiple ad blockers aren't installed and using a desktop ad-blocking app, which should be harder to detect than an extension. (AdGuard itself offers both network-level blocking and desktop apps.)

At least one popular ad blocker, AdBlock Plus, won’t be trying to get around YouTube’s wall at all. Vegard Johnsen, chief product officer at AdBlock Plus developer eyeo, said he respects YouTube’s decision to start “a conversation” with users about how content gets monetized.

Referencing the now independently run Acceptable Ads program (which eyeo created and participates in), Johnsen said, “the vast majority of our users have really embraced the fact that there will be ads [...] we’ve made it clear we don’t believe in circumvention.”

Similarly, a YouTube spokesperson reiterated that the platform’s ads support “a diverse ecosystem of creators globally” and that “the use of ad blockers violate YouTube’s Terms of Service.”

As the battle between YouTube and ad blockers continues, Modras suggested that his side has at least one major advantage: They’re open source and can draw on knowledge from the broader community.

“Scriptlet injection is already getting more powerful, and it’s becoming harder for anti-ad blockers to detect,” he said. “In some ways, the current situation has spurred an arms race. YouTube has inadvertently improved ad blockers, as the new knowledge and techniques gained from innovating within the YouTube platform are also applicable to other ad and tracking systems.”

But even if most users grow frustrated with the new countermeasures and decide to whitelist YouTube in their ad block product of choice, Modras suggested that ad blockers can still affect the platform's bottom line: “If users disable ad blocking on only YouTube and maintain their protection on other websites as they browse, the platform will quickly learn that they are still unable to effectively target ads to these users,” since it won’t have data about user activity on those other sites.

Regardless of what YouTube does next, Meshkov suggested that other publishers are unlikely to build a similar wall, because few if any services enjoy the same chokehold on an entire media ecosystem — not only owning the most popular video sharing service, but also the most popular web browser on which to view it. "YouTube is in a unique position as it is de facto a monopoly," he said. "That's not true for most of the other publishers.”

Even against those odds, ad block diehards aren't dissuaded in their mission. As Meshkov put it bluntly: “YouTube’s policy is just a good motivation to do it better.”

Correction, December 1 2023, 10:09am ET: A quote in the penultimate paragraph was incorrectly attributed to Krzysztof Modras rather than Andrey Meshkov. This has been amended.