Ad Verification with Proxies: Proving a Campaign Ran

Geo-targeted creative only renders for the right audience. How residential exits, city targeting and timestamped captures show what really served.

Digital advertising has an accountability gap built into its plumbing. A media buyer pays for impressions delivered to a specific audience (a country, a city, a daypart, a type of site) and then receives a report, produced by the selling side, asserting that this happened. The creative, the placement, the landing page and the surrounding content were all rendered on devices the buyer will never see. Ad verification is the practice of closing that gap by independently observing the campaign the way its audience does, and the reason it needs proxies at all is that the observation only counts if the observer is indistinguishable from the audience.

That last clause carries the whole discipline. An ad server is a decision engine: every impression is an auction and a targeting evaluation that takes the viewer's location, device and traffic quality into account before choosing what to serve. Check your own geo-targeted campaign from the wrong vantage point and the server does not show you a degraded version of the truth. It shows you a different decision entirely.

Why you cannot verify your own campaign from your desk

Open a target site from the office to "check the ads" and three separate mechanisms conspire to show you something other than what your audience sees.

First, geo-targeting works as designed. A campaign bought for the Italian market is served to viewers whose IP geolocates to Italy. From a London office you are not in the audience, so the slot fills with something else: a different campaign, a house ad, or programmatic remnant. Nothing is wrong, and yet the check has told you nothing.

Second, your own history poisons the sample. Ad platforms frequency-cap per user; a verifier who reloads a page eight times stops being served the campaign because the platform believes this "user" has seen it enough. Your cookies, your logged-in accounts and your retargeting profile all steer the auction away from a clean read.

Third, and least obvious: traffic-quality filtering. The ecosystem spends heavily on excluding non-human and datacenter traffic from paid impressions, because advertisers do not want to pay for bots. An observer arriving from a hosting-range IP is precisely what those filters exist to catch. The ad server may serve nothing, serve unpaid filler, or flag the session. A verification probe from a datacenter address is therefore not just unrepresentative; it is actively classified as the thing the industry filters out. This is why serious verification runs through residential exits: the observation has to arrive with the network reputation of an ordinary household, or the decision engine being observed will not make the decision you are trying to audit.

Reconstructing the audience, one variable at a time

Verification is impersonation of a legitimate viewer, variable by variable, and each targeting dimension the campaign bought is a dimension the probe must match.

Location is the big one. Country-level targeting needs a country-pinned exit; city or DMA-level buys need city-level pinning, which is exactly what country and city targeting in the gateway username provides. If the buy says Milan, verify from Milan. An exit in Rome can legitimately fall outside the campaign's geofence, and recording that as "creative did not serve" is a false alarm that erodes trust in the whole verification program. Check the city is served before you promise a client city-level evidence: the per-market pages list what is targetable today, Italy and the United Kingdom among them, and a campaign geofenced to a city with no exits online is a gap to disclose up front, not to discover mid-flight.

Device and environment come next. A mobile-only campaign will not render in a desktop browser, and in-app inventory will not render in any browser. Match the user agent and viewport to the bought environment, and run a real browser (headless automation via Puppeteer or Playwright with the proxy attached), because ad slots are assembled by JavaScript and do not exist in the raw HTML a plain HTTP client fetches.

Session freshness is the discipline that keeps samples independent. Every check should begin as a new person: empty cookie jar, fresh exit IP. Within a single check, though, the identity must hold still: the page load, the ad request chain and the landing-page click must all traverse one exit, or the mid-flight IP change itself becomes a fraud signal. That is a per-request rotation versus held-session distinction, and sticky versus rotating sessions covers how to get each on demand.

What you are looking for: the taxonomy of things going wrong

A verification probe is hunting for specific, nameable failures, and the data model follows from the taxonomy.

Non-delivery. The simplest: the campaign was bought for a context and never appears there across a statistically sensible number of clean samples. One empty slot means nothing; auctions are probabilistic. Persistent absence across dayparts and exits is a delivery problem worth escalating with evidence attached.

Wrong-geo delivery. The mirror image: creative bought for one market rendering in another, where the buyer may not even have rights to advertise or stock to sell. Only observation from the wrong market can catch it, which is a reason verification sampling should include exits outside the target geography: probes that should see nothing, confirming they see nothing.

Domain spoofing. In programmatic supply chains, a fraudulent seller declares premium inventory in the bid request while actually rendering the ad somewhere cheap or unsavoury. The buyer's report says a reputable news site; the impression happened elsewhere. Catching it means observing the rendering context directly: which page, which frame, which declared domain, and comparing against the supply-chain declarations the seller made.

Ad stacking and invisible delivery. Multiple creatives layered in one slot with only the top one visible, or slots rendered outside the viewport, in one-pixel frames, or under other elements. Every stacked impression is billed; one at most was seen. A verifier controlling a real browser can measure what a reporting pixel cannot: rendered size, position, occlusion and viewability of the creative it was served.

Landing-page and redirect integrity. The click side of verification. Follow the clickthrough and record the full redirect chain: does it land where the insertion order says, does it hop through unexpected intermediaries, does it vary by geography or device in ways nobody signed off? Malicious redirects and cloaked affiliate hops are geo- and device-conditional almost by definition, which is why they survive casual checking from the buyer's office and fall over in front of an in-market probe.

Brand-safety adjacency. Not fraud, but contract: the ad may have served exactly as bought, next to content the brand explicitly excluded. Verification here means capturing the surrounding page, not just the slot. The headline above the creative is part of the impression as far as the brand is concerned. Adjacency is also geo-dependent in ways buyers underestimate, because the content many sites serve differs by market too.

Evidence is the product

A verification finding that cannot be shown to a vendor is an anecdote. The deliverable of this whole exercise is a record that supports a make-good conversation, so build the capture pipeline as carefully as the probing:

Treat all of this as operational record-keeping for a commercial conversation. Whether any of it has standing in a formal dispute is a question for contracts and counsel, not for a technical guide. Platform terms of service govern automated access to ad-serving systems, which is the reader's own compliance homework, jurisdiction by jurisdiction.

Sampling design: enough eyes, spread correctly

Verification is statistics, not surveillance. You cannot observe every impression, so design the sample: per market in the buy, some checks per daypart across the flight, split across the device mix, from fresh identities each time. Weight toward the placements carrying the most spend and toward the first days of a flight, when a misconfigured campaign costs least to catch. Spread probes across the day rather than batching them at a fixed hour. A burst of simultaneous fresh viewers from one city is its own detectable pattern, and the probe being classified as suspicious traffic un-blinds the whole measurement.

Keep per-slot request volume low by design. Unlike a scraping workload, verification needs few requests per target: its cost driver is the breadth of geographies and dayparts, not depth on one page. That breadth is exactly what a gateway with per-request country selection is for, and the use-cases overview sketches how the same access layer serves neighboring workloads. This guide's siblings cover two of them: price monitoring shares the in-market vantage discipline, and rank tracking shares the clean-session one. Note, though, the difference in what each is defending against: price monitoring fights personalisation, rank tracking fights its own footprint, and ad verification fights an adversary who profits from the observer seeing something different from the audience.

Calibrate the verifier before you trust it

A verification system accuses vendors, so it had better be right about itself first. The lowest-cost calibration is a self-serve test placement you control: run a tiny campaign of your own, targeted at one city, and confirm your probes from that city see it while probes from elsewhere do not. That single exercise validates the geo-pinning, the browser fingerprint, the capture pipeline and the parser in one pass. It also gives you a known-good baseline to re-run whenever the tooling changes, so a browser update or an exit-pool shift shows up as a calibration failure instead of a phantom finding against a vendor.

Calibration also tells you your false-negative rate. If your own always-on placement is detected in eighteen of twenty clean probes, then an audited campaign detected in zero of twenty is a real absence, not auction noise, and now you can say so with a number attached. Without that baseline, every non-delivery claim degenerates into the vendor asserting the auction is probabilistic and nobody being able to say how improbable the observed silence actually is.

Getting a first probe running

A minimal viable verifier is one scripted browser, one residential exit in the campaign's market, one page load, one screenshot with metadata. Prove that loop, then scale along the sampling plan rather than toward request volume. Costs stay modest because each check is a handful of page loads; what you are paying for is the credibility of the vantage point. Pricing for residential access is on the pricing page, and the free tier is sufficient to script and debug the capture loop before pointing it at a live flight.

The one-sentence summary of the whole field: an ad server decides what to serve based on who seems to be asking, so the only trustworthy audit is one conducted by a probe the server cannot tell from a customer: in the right city, on the right device, with no history, and with the camera running.