Gemini Detects Fake iOS Ads That Google Ads Approved Twice

⏱️ Lectura: 11 min

Misleading Google Ads keep passing human review, even though Google’s own AI model, Gemini, identifies them as fraud within seconds. The case was documented by developer Chris Greening on his blog atomic14 on September 13, 2026, after reporting the same ad twice without any change.

📑 En este artículo

1. TL;DR
2. What Happened
3. Context and History
4. Misleading Google Ads: Gemini’s Technical Analysis
5. How to Test It With Your Own Ad
6. Impact and Analysis
7. What’s Next
8. Frequently Asked Questions
   1. What policies did the ad violate according to Gemini?
   2. Why doesn’t Google use Gemini to automatically review all ads?
   3. How do I report a misleading ad on Google Ads?
   4. Can I use Gemini to review my own ads before publishing them?
   5. Does this type of ad only affect iOS?
   6. What’s the difference between an ad rejected by rules and one rejected by an LLM?
9. References

The disputed ad precisely reproduces iOS’s “iPhone Storage is Full” pop-up: same typography, same container, and fake “Yes” and “No” buttons that actually just redirect to an app store. Several users reported the same ad and received the identical automated response from Google: the ad doesn’t violate any policy.

TL;DR

• Google Ads approved an ad twice that mimics iOS’s native “iPhone Storage is Full” alert.
• Developer Chris Greening reported the ad twice and received the same response: it doesn’t violate policies.
• Gemini, Google’s model, classified the same ad as DISAPPROVED within seconds when asked to review it.
• Gemini detected three violations: mimicking system alerts, non-functional buttons, and false fear tactics.
• The ad circulated in the YouTube app with fake “Yes”/”No” buttons that only redirect to an app store.
• Google Ads combines automated rules and large-scale human review, without a mandatory filter using a multimodal LLM.
• Any developer can replicate Greening’s test with the Gemini API and an image of the ad.
• The case reopens the question of why Google doesn’t use its own AI models to stop misleading advertising.

What Happened

Greening noticed the ad inside the YouTube app when, as he tells it, he almost tapped it by accident while checking his iPhone’s free storage. The ad reproduced a fake storage-full alert with “Yes” and “No” buttons that don’t control anything: any tap within the banner triggers the same redirect to an app store.

He did what he was supposed to do: he reported the ad to Google. The response came in a standard template: “we found that the ad does not violate Google’s policies, which prohibit certain content and practices we consider harmful to users and the online ecosystem in general.” He reported it a second time. He received the same response. And he wasn’t the only one: other users reported the same ad and got the identical result.

Faced with that dead end, Greening tried something different: he showed the ad to Gemini and asked it to evaluate it against Google’s advertising policies. The model responded with a blunt verdict, DISAPPROVED, detailing three specific violations and recommending suspending the advertiser’s account in case of repeat offenses.

Context and History

This isn’t the first time the quality of Google Ads moderation has been called into question. The platform processes ads from a range of advertisers, from small shops to organized fraud networks, and combines rule-based automated filters with sample-based human review. That model works reasonably well for obvious violations (explicit content, blatant trademark infringement), but leaves gaps for misleading ads specifically designed to look legitimate to a rushed reviewer.

Greening himself cites Hanlon’s razor as a first explanation: “never attribute to malice what is adequately explained by stupidity.” In other words, the problem could be simple operational overload rather than a deliberate incentive to let through ads that generate clicks (and therefore revenue). But he also notes the less charitable reading: an ad with a high click-through rate is, for Google’s advertising business, a profitable ad, and that creates a perverse incentive not to look too closely.

Misleading Google Ads: Gemini’s Technical Analysis

Gemini’s full response, as reproduced by Greening, classified the ad under two categories of Google Ads’ Misrepresentation policy: “Misleading Ad Design” and “Unreliable / Deceptive Claims.” Within those categories, the model detailed three specific violations:

• Imitation of system alerts: the banner reproduces, through typography, containers, and buttons, the look of a native iOS modal, something Google’s ad policies explicitly prohibit.
• Non-functional interface components: the “Yes” and “No” buttons don’t execute any real action, they just capture any click within the banner to redirect to an app store.
• Fear tactics with unverified data: the text “If you don’t free up space soon, some features may not work properly” fabricates a sense of urgency about the user’s hardware with no real basis.

What stands out isn’t just the verdict but the speed: Gemini generated that structured analysis in the time it takes to run a chat query, against a human review process that approved the same ad twice in different weeks. To understand where a model like this fits (or doesn’t fit) into the actual review pipeline, it helps to compare the three methods currently coexisting in ad moderation:

Method	When it’s used	Advantage	Limitation
Automated rule-based filters	First pass on every new ad	Scales to millions of ads with no marginal cost	Only detects already-catalogued patterns (words, domains, image hashes)
Sample-based human review	Ambiguous cases or user reports	Understands context and intent that a rule can’t capture	Doesn’t scale as fast as the volume of ads or reports
Multimodal LLM classification (Gemini)	Today: manual tests like Greening’s, outside the official flow	Understands visual and textual intent, cites the violated policy, responds in seconds	Requires someone to invoke it; Google doesn’t apply it automatically to every report

flowchart TD
A["New or reported ad"] --> B["Automated rule-based filters"]
B --> C{"Known fraud pattern?"}
C -- "Yes" --> D["Automatic rejection"]
C -- "No" --> E["Human review queue"]
E --> F{"Reviewer approves?"}
F -- "Yes" --> G["Ad goes live"]
F -- "No" --> D
G -. "Gap: no multimodal LLM gate" .-> H["Gemini could reclassify here"]

The diagram sums up the central point of the case: between the human review queue and the ad going live, there is currently no mandatory reclassification step with a model like Gemini. That step only happened because a user ran it manually, outside Google’s official flow.

How to Test It With Your Own Ad

Reproducing Greening’s experiment doesn’t require special access: an account on Google AI Studio is enough to generate an API key. The key works the same on Windows, macOS, and Linux since the interaction happens via HTTP or a cross-platform SDK.

First, install the official Python SDK (same command on all three platforms, run in a terminal or PowerShell):

pip install google-generativeai

On Windows it works from PowerShell or cmd.exe with that same command; on macOS and Linux, from bash or zsh. With the library installed, this script sends an image of the ad along with the relevant policies and requests a structured classification:

import google.generativeai as genai

genai.configure(api_key="YOUR_GEMINI_API_KEY")
modelo = genai.GenerativeModel("gemini-2.0-flash")

imagen_anuncio = genai.upload_file("suspicious_ad.png")

prompt = """
Evaluate this ad image against Google Ads' Misrepresentation
policies (Misleading Ad Design and Unreliable/Deceptive
Claims). Respond with: verdict (APPROVED or DISAPPROVED), a
list of violated policies, and specific evidence found in
the image.
"""

respuesta = modelo.generate_content([prompt, imagen_anuncio])
print(respuesta.text)

The expected result is a structured block of text with the verdict and the evidence, similar to what Greening got: a list of specific violations instead of a simple “yes” or “no.” That format is exactly what was missing from the automated response he received from Google’s human review team.

💡 Tip: if you manage an advertiser account, run this check before uploading any creative. It can save you from an eventual account suspension if the design gets too close to imitating an operating system alert.

Impact and Analysis

The case matters beyond a single ad because it exposes a concrete operational gap: Google builds and sells some of the most capable multimodal classification models on the market, but doesn’t systematically apply them to its own ad review process. Review still relies on rules and human sampling, the same scheme that existed before these models existed.

To check whether your own Google Ads account has ads flagged by policy, the Google Ads API exposes the ad_group_ad.policy_summary.approval_status field via GAQL. A minimal query to audit the status of your creatives:

SELECT
  ad_group_ad.ad.id,
  ad_group_ad.policy_summary.approval_status,
  ad_group_ad.policy_summary.review_status
FROM ad_group_ad
WHERE ad_group_ad.status != 'REMOVED'

That same field is what Google could reinforce with an additional verdict from a multimodal model before marking an ad as APPROVED, and today it doesn’t do so as a mandatory step.

⚠️ Heads up: an ad passing the automated filter and human review doesn’t mean it complies with the policies. Reporting it once doesn’t guarantee a second review different from the first, as this case shows.

The simplest reading is the Hanlon’s razor one that Greening himself cites: operational overload, not malice. But there’s also a real economic incentive that can’t be ignored: an ad with a high click-through rate generates revenue, and that reduces the internal urgency to stop it as long as it doesn’t trigger a public reputation crisis.

What’s Next

Nothing in the case documented by Greening indicates that Google has announced a process change based on this specific report. What is reproducible today, with the code from the previous section, is that any developer or media agency can build their own preclassification filter with Gemini before one of their own ads goes live, without depending on Google integrating that step into its official pipeline.

In the meantime, public pressure (cases like this one, documented and shared, including the literal text of the reporting system’s response) remains the fastest way to force a second human look at a specific ad, even though it doesn’t solve the underlying volume problem.

Try it yourself: install google-generativeai with the command above and run the classification prompt on any suspicious ad you’ve seen this week.

📖 Summary on Telegram: View summary

Frequently Asked Questions

What policies did the ad violate according to Gemini?

Two categories of Google Ads’ Misrepresentation policy: Misleading Ad Design, for imitating a system alert, and Unreliable/Deceptive Claims, for the false urgency message about storage.

Why doesn’t Google use Gemini to automatically review all ads?

Google hasn’t publicly explained that decision in this specific case. The process documented by Greening shows that review still relies on automated rules and human sampling, without a mandatory reclassification step using a multimodal model.

How do I report a misleading ad on Google Ads?

From the app or site where the ad appears, using the “Report this ad” option, which opens a form where you can describe the policy allegedly violated.

Can I use Gemini to review my own ads before publishing them?

Yes. The script in the “How to Test It With Your Own Ad” section sends an image and a prompt with the relevant policies, and returns a structured verdict before the ad reaches Google’s review queue.

Does this type of ad only affect iOS?

The documented case specifically imitates an iOS alert, but the same technique, mimicking a native operating system dialog, has also been reported with Android variants in the past, and falls under the same Misrepresentation policy.

What’s the difference between an ad rejected by rules and one rejected by an LLM?

A rule-based filter rejects already-catalogued patterns: a word, a domain, a known image hash. A multimodal LLM like Gemini evaluates intent and visual context, so it can detect an interface imitation never seen before, as happened in this case.

References

• Why is Google still serving dodgy ads?: Chris Greening’s original report on atomic14, with screenshots of the ad and Gemini’s full response.
• Google Ads Policy Center: official documentation of the Misrepresentation policies cited in the case.
• Gemini API documentation: official reference for the SDK used in this article’s code examples.
• Google Ads API documentation: official reference for GAQL and the policy_summary field used in the verification section.

📱 Like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Imagen destacada: Foto de Markus Winkler en Unsplash