Cryptographic publisher IDs reach Japan as fake news clones multiply

Thursday produced an unusual cluster of stories with a single common demand running underneath them: show the evidence. A Japanese standards body wired digital signatures into the content management systems of the country's two largest newspapers so that a page can prove who published it. A Brazilian regulator switched off a video feature because the operator could no longer demonstrate that it was able to see what happened inside it. New York City opened an inquiry into prediction markets after an analysis found that most of their sponsored influencer videos showed trades that never took place. Nielsen's chief executive spent part of the day arguing that a measurement company can still referee a market it is buying into. And a German out-of-home group published half-year accounts showing that the fastest-growing line in its business is the one where every impression is tied to a physical screen in a known location.

None of these events were coordinated. Read together on the same morning, they describe a market where the assertion is cheap and the proof is expensive, and where the cost of that asymmetry is starting to appear in filings, court documents and quarterly numbers.

A signature that answers who, not what

The lead development came out of Tokyo. Japan's two largest newspapers by circulation have integrated a digital signature standard called Originator Profile into their content management systems, and the advertising group that originated the technology is now applying the same credential to its own media buys. Nieman Lab documented the state of the rollout on August 12, 2026, three weeks after the standard's developer tooling reached the Chrome and Firefox extension stores.

The scope of the claim is narrower than most provenance work, and deliberately so. Originator Profile does not attempt to establish whether an article is accurate. It establishes whether the site serving the article is operated by the organization it says it is.

That distinction has an architecture behind it. The standard applies a digital signature to information corresponding to both the content and the sender, making tampering detectable. Originator details sit in one data model; content-level details sit in a second model named Content Attestation, which confirms that the originator holds a valid profile and that the served content has not been altered. Both are built on Verifiable Credentials following the issuer, holder and verifier split, a design the developer documentation credits with protecting privacy and cutting server load, since a verifier does not need to call the issuer on every page load.

What separates the scheme from a domain check is the certification step. A third-party organization confirms the identity of the publisher before anything is signed, and the resulting profile carries the publisher's corporate mission, editorial policy, journalistic responsibility and information transmission policy alongside the identity claim, together with industry association membership and any certifications held.

Membership of the Originator Profile Collaborative Innovation Partnership includes The Yomiuri Shimbun, The Asahi Shimbun, NHK and LY Corporation, which runs Japan's most popular news aggregator and the LINE messaging app used by more than 80% of the country. Tottori Prefecture has deployed the standard across prefectural government websites. Dentsu, where the idea began in 2021, is rolling it out for its ad buys.

Makoto Yoshiike, deputy secretary general of the partnership and senior deputy chief officer in the president's office at The Yomiuri Shimbun, drew the boundary around what the standard does not do. "We aren't trying to dictate whether the information is accurate or not," he said, framing the exercise entirely as one of provenance.

An advertising problem that became a journalism problem

The origin story runs through the ad market rather than the newsroom. Dentsu had been struggling with malicious digital ads and with scammers profiting from them before commercial image generators shipped, and set out to authenticate advertiser information as an ad moves through the programmatic chain. The company partnered with Keio University professor Jun Murai, a founding figure of the Japanese internet, to develop the specification. News publishers were recruited afterwards.

OP-CIP was founded on December 15, 2022 and announced on January 17, 2023 as a non-profit mutual benefit corporation, established with the media and advertising industries under the supervision of Keio University's Cyber Civilization Research Center. The eleven founding members included News Corp, The Japan Times, Nippon Television Network Corporation and the ad tech businesses fluct and Momentum. Murai argued at the founding that the attention economy "has distorted the integrity of the market," positioning the technology as a corrective to that distortion rather than as a media quality label.

Scope widened after a 7.5 magnitude earthquake struck the Noto Peninsula on January 1, 2024, killing more than 700 people. Generated images of the wreckage circulated, fraudulent donation sites collected money, and false reports of people trapped under rubble diverted rescue crews. The Japanese national government began funding the organization and local governments started joining. Tatsuya Kurosaka, project associate professor at Keio and secretary general of OP-CIP, described a recurring pattern in which "there is no end to fraudulent information being disseminated" during disasters, with impersonation of local governments and public utilities among the most common forms.

Signed on is not switched on

The gap between membership and deployment is the honest part of the story, and the organization does not conceal it. Dozens of members of the Japanese Newspaper Publishers and Editors Association have signed on, along with major television networks. Only a handful have fully integrated the technology into operations. Yoshiike put the target at 50 major organizations operating with the standard in place by early 2027.

Two structural gaps remain, both named by OP-CIP itself. The first is social distribution: the signature lives inside the HTML of a page, so it does not travel with a link shared on a social platform, and a reader sees it only after navigating to the article's own page. The second is the browser. Verification currently requires an extension, and the ambition is to remove that dependency through a badge in the browser address bar, which would require adoption by the World Wide Web Consortium. A W3C working group now exists to explore the possibility, which leaves the outcome with the vendors that ship browsers.

OP Inspector, the developer extension announced on July 24, 2026, retrieves, verifies and visualizes profile information attached to websites and content. It identifies errors caused by key revocation or misconfiguration, shows signature verification and tampering detection status, and exports verification data as JSON. That export is the detail with the clearest downstream implication for advertising: it turns the extension into something an ad operations or brand safety team could script against rather than a consumer trust badge. The Chrome listing carries version 0.6.1, an update date of July 3, 2026, and 67 users. OP-CIP has been explicit that a consumer-facing build is a separate, future release.

Where it sits against the existing stack

For media buyers, the useful comparison is with what the programmatic market already runs on. Ads.txt, sellers.json and the SupplyChain object establish who is authorized to sell an impression and which intermediaries touched the bid. IAB Tech Lab's auction definitions place those checks at the request-validation stage, before enrichment and bidding. They say nothing about whether the entity behind a domain is who it claims to be, or whether the page rendering around the ad has been altered. Originator Profile targets that lower layer.

It also sits apart from the media provenance work of the last three years. SynthID embeds imperceptible marks in generated images, audio, video and text, and the C2PA standard attaches signed metadata to media files. Neither authenticates the operator of a website.

Regulation has been moving on a parallel track. Article 50 of the EU AI Act became binding on August 2, 2026, requiring machine-readable marking of synthetic output from providers and visible labelling of deepfakes and certain published text from deployers, with penalties reaching 3% of worldwide annual turnover. Platform enforcement has scaled alongside it, with Meta reporting the removal of 134 million scam ads during 2025.

Detection has not kept pace with the volume. Integral Ad Science blocked roughly 800 domains tied to hidden browser windows generating about a million dollars a month in fabricated traffic on August 7, and a separate malvertising campaign assembled its payload inside each victim's browser to evade network inspection across twelve countries including Japan. The economics that make the standard attractive are visible in the same market: French general news publishers referred Google to the competition authority on August 11 over AI summaries, citing referral declines of up to 38%, and smaller publishers have lost roughly 60% of search traffic over two years. A signed page is only worth something if something downstream reads the signature.

Fake trades, real sponsorships

The same evidentiary problem surfaced in New York on the same day, with the roles reversed. Where Japanese publishers are trying to prove that a real page is real, an American investigation is asking whether sponsored content ever depicted anything real at all.

The New York City Council opened an inquiry into four prediction markets, Polymarket, Kalshi, Coinbase and Gemini Titan, over allegedly deceptive marketing and the targeting of minors. Council Speaker Julie Menin sent letters to all four companies requesting detailed information about their marketing operations, with 14 days to respond. Menin wrote that reports allege Polymarket worked with social media influencers to reach young adults with "false, deceptive and unconscionable advertising."

The number that gives the inquiry its shape came from a Wall Street Journal analysis of more than 1,100 videos made by creators sponsored by Polymarket. Seventy percent featured fake websites and simulated trades. The purpose was to create the impression that many influencers were winning their bets. The bets were not real.

That is a precise description of a verification failure at the creative layer rather than the supply layer. Every ads.txt file, every sellers.json entry and every signed profile in the chain could have been valid while those videos ran. Nothing in the programmatic transparency stack inspects whether the trading interface shown in a sponsored video corresponds to an account that exists. The disclosure regime does not either: influencer marketing rules concern whether a relationship is declared, not whether the demonstration is authentic.

The Council cannot press criminal charges, but it can issue subpoenas, and the documents produced under one enforcement action have a long record of becoming evidence in others. The letters follow a suit filed the previous month by New York Attorney General Letitia James against Kalshi over the alleged operation of an illegal gambling app.

Disclosure machinery moved in the opposite direction elsewhere in the day's news. Snap introduced an in-feed advertising format for pharmaceutical brands that allows up to three disclaimer calls to action alongside a primary call to action across Snap Ads, Story Ads and Commercials, with Sponsored Snaps to follow by the end of 2026. Smaller text links sit below the primary creative, letting a viewer reach information about medications and health services without leaving the feed. Prescription advertising is one of the few categories where the regulator specifies what has to be visible and where, and the format exists because that specification exists. Prediction markets, sold through creator videos, have no equivalent.

Who verifies the verifier

The independence question arrived on August 13 in its most direct form yet. Nielsen chief executive Karthik Rao defended the company's planned $2.15 billion purchase of DoubleVerify against the argument that a verification business cannot stay independent once it belongs to a measurement company with a position in the same market it is meant to police.

Rao did not dispute that the question was fair, and said he had anticipated it. He characterised the referee role as one that attracts abuse by design, describing a company routinely "punched in the face for obvious reasons" for reporting the score, and framed the acquisition as an offensive move rather than a defensive one. The deal was announced the previous week and is set to close in the first quarter of 2027, ending DoubleVerify's roughly five-year run as a public company.

The structural point is worth separating from the corporate one. Ad verification exists because buyers do not trust the sell side's own account of what it delivered. If the verifier is owned by the incumbent currency provider, the number of independent parties in the chain falls by one, and the market's remaining check on measurement becomes a matter of governance commitments rather than corporate separation. That is precisely the substitution the Japanese standards work is trying to avoid at the identity layer, where certification is deliberately handed to a third-party organization rather than performed by the publisher or the platform.

Consolidation pressure on the verification and measurement layer is not confined to one transaction. Digiday's Future of Marketing Briefing on August 14 counted four sizeable delistings inside a year: Integral Ad Science went private last December in a roughly $2 billion deal with Novacap, Nielsen agreed terms for DoubleVerify on August 6, LiveRamp is headed for a Publicis-owned exit by year end, and Criteo, coming off a 14% revenue decline, is in active talks with Vista Equity Partners. Mark Boidman, head of media and entertainment at Solomon Partners, framed the discount investors are applying as a forward-looking one, arguing that they are pricing "what nobody can yet prove they'll still be in five" years rather than last quarter's results.

The measurement consequence follows mechanically. Fewer listed intermediaries means fewer quarterly filings, and those filings have been one of the few reliable sources of independently disclosed numbers about how the middle of the market performs. A companion Digiday analysis published August 13 set out the same picture in figures, with platform owners absorbing the digital growth while independent names plateau.

The screen that cannot be cloned

Against that backdrop, the day's clearest set of audited figures came from an inventory type with no impersonation problem at all. Ströer published second-quarter and half-year 2026 results in Cologne on August 13, showing group revenue of EUR 1,037.4 million for the six months to June 30 and a widening gap between digital screens and everything else the company operates.

Second-quarter revenue reached EUR 541.8 million, up 7 percent reported and 4.2 percent organically against EUR 504.7 million a year earlier. The organic swing is the striking part: the same quarter of 2025 recorded organic contraction of 2.3 percent, making the year-on-year movement 6.5 percentage points. Within the OoH Media segment, digital out-of-home revenue climbed 24.3 percent in the quarter to EUR 115.6 million and 18.5 percent across the half to EUR 206.7 million. Classic out-of-home, the poster and large-format business, generated EUR 138.2 million in the quarter, down 1.3 percent.

Programmatic buying is where the divergence widens furthest. Ströer's investor presentation puts programmatic DOOH revenue growth at 45.0 percent in the second quarter and 29.3 percent across the half, on reported net revenues. Automated trading is therefore compounding at roughly twice the rate of the digital screen business that contains it, in a quarter when the German advertising market grew 1.9 percent on Nielsen gross rate-card terms. Television fell 1.1 percent in the quarter, print fell 4.5 percent, and desktop and mobile grew 15.3 percent. German out-of-home as a whole gained 8.8 percent.

Growth that far above the surrounding market is reallocation, not category expansion. The same signal appears at the other large European operator. JCDecaux reported half-year programmatic revenue of EUR 102.8 million, up 30.9 percent organically, lifting the automated share of digital sales to 12.3 percent from 10.1 percent. Germany is the outlier inside that average: JCDecaux told analysts in July that the market trades 42.7 percent of its digital revenue programmatically, the highest share among its markets, disclosed alongside a 15-year Hamburg street furniture contract covering about 2,200 bus shelters that goes to a parliamentary vote in September.

Ströer credits part of the quarter to World Cup campaigns and to a large-format screen it calls The Whale. The tournament ran from June 11 to July 19, 2026, so only the group-stage weeks fell inside the reporting period, and United States television advertising around the competition reached more than 25 billion impressions on iSpot measurement.

The rest of the accounts complicate the story. Adjusted group EBITDA rose 3 percent to EUR 273.0 million while revenue grew about 6 percent, narrowing the adjusted margin to 26.3 percent from 27.2 percent. Reported figures fell: EBITDA to EUR 254.4 million, EBIT to EUR 90.7 million, consolidated profit to EUR 38.5 million from EUR 45.1 million, with exceptional items tripling to EUR 18.7 million. The DaaS and E-Commerce segment, which houses Statista and AsamBeauty, saw adjusted EBITDA fall 43.6 percent to EUR 11.4 million. Net debt rose to EUR 995.8 million from EUR 870.7 million at the end of 2025, taking leverage to 2.60 from 2.31, which the company attributes to the EUR 102.0 million dividend and a EUR 23.5 million buyback. Chief executive Udo Müller framed digital out-of-home as the growth engine offsetting weaker non-core lines, citing a 19 percent figure that rounds the 18.5 percent half-year rate stated elsewhere in the same release. Full-year guidance was confirmed.

Set against the provenance theme, the out-of-home numbers are a reminder of what buyers are paying a premium for. A screen in a Hamburg bus shelter cannot be spoofed by a cloned domain, cannot be rendered inside a hidden browser window, and does not require a cryptographic credential to prove it exists. The trade-off is that its measurement is comparatively coarse. What the market appears to be doing, on this evidence, is paying more for inventory whose existence is not in question, in a domestic market growing barely at all in aggregate.

Brazil removes the feature, not the encryption

The most consequential regulatory action of the window took the evidentiary question to its logical end. Brazil's data protection authority ordered Discord on August 12, 2026 to switch off Go Live and every functionally equivalent video feature for users in the country within three business days, after concluding that end-to-end encryption deployed in March left the company unable to observe what happens inside closed servers.

The instrument is Nota Tecnica no 1/2026/CGF/SFI/ANPD, filed under process no 00261.004804/2026-54, signed electronically at 10:06 and 10:11 on August 12 and published at 11:34 the same morning. The order does not remove the service from Brazil. Text messaging, voice channels and everything else continue running. What stops is one functionality and its technical relatives.

The drafting is unusually tight against substitution. The suspension reaches sharing, transmission, retransmission, embedding, mirroring, synchronised reproduction and screen sharing, whether performed by native resources or by bots, WebHooks, APIs, applications, integrations, commands and automations. A separate paragraph requires technically effective anti-circumvention measures, naming resource renaming, intermediary domains, invite codes and redirects as the evasion patterns to be blocked. Reinstatement is conditional on demonstrating implementation and effectiveness of proportionate technical, security and governance measures, and requires express prior authorisation.

Two financial exposures sit behind it. Failure to prove compliance within the deadline sends the file to the agency's board for possible daily fines. Separately, confirmed irregularities in the administrative process can trigger sanctions of up to R$50 million per infraction under article 35 of the ECA Digital.

The regulator did not treat encryption itself as the violation, and that is the finding with the widest reach. Its reasoning is that architecture is a supplier choice, and that where a security decision makes a given control unworkable, the provider carries the burden of implementing substitute controls of equivalent or superior effectiveness. Audio and video in direct messages, group messages, voice channels and Go Live have been covered by end-to-end encryption since March 2, 2026. The statute was signed on September 17, 2025 and its implementing regulation published on March 18, 2026, so the note observes that the less protective design for live transmissions arrived immediately after promulgation and on the eve of entry into force, without a documented prior risk assessment.

The detection evidence is where the file becomes specific. The company described proactive action using behavioural signals, relations between accounts, network patterns, metadata, reports and enforcement history. The note records that no concrete evidence of implementation or effectiveness accompanied that description. In the case referenced as Operacao Livia, reported to the agency by the company itself, the automated system assigned an erroneously low risk score to an event the note characterises as extremely serious. The score and threshold are redacted, but the gap between them is described as showing that the system was not close to flagging the environment as a priority. The argument that lowering the threshold would generate more false positives did not persuade the regulator, which held that calibration cannot be set by operational efficiency alone.

Reporting by users received sharper treatment. Its effectiveness depends on at least one participant recognising the violation, not being involved in it, being able to react, knowing the mechanism exists and trusting that the platform will act in time. In invitation-only servers, the note observes that participants are pre-selected for the offence, so protection would depend on violators reporting themselves. SaferNet Brasil data cited in the file records 406 complaints involving the service between January and July 2026 against 264 a year earlier, a 54% increase and a record for the period in a series running since 2017.

For anyone selling attention around live video in Brazil, the operative precedent is feature-level suspension: the unit of regulatory risk moves from the account to the format, with reinstatement gated on evidence rather than on elapsed time. The wider tension is not new. The European Union lost its legal basis for voluntary scanning of child abuse material on April 3, 2026, and Signal threatened to withdraw from Germany over a proposal to scan messages before encryption. Brazil has taken a third route, leaving the encryption intact and removing the product. Enforcement against the same company has been accumulating elsewhere: Texas filed suit in Collin County District Court on May 22, 2026, with Nevada and Indiana filing separately the same month.

Brazilian rules also reach advertising directly. Article 22 of the statute prohibits profiling techniques for directing commercial advertising to children and adolescents, a provision the agency folded into its 2026 and 2027 enforcement priorities alongside 30 planned inspection actions, and a draft age verification guide went to public comment in May 2026.

Controls that produce records

Two smaller items from the same window fit the pattern, both concerning the ability to specify and then check what a system did.

Walmart began letting advertisers exclude specific search terms, adding negative keyword exclusion to its retail search product. The feature is unglamorous and long requested. Its significance is that it converts an implicit outcome into an explicit instruction: without exclusions, a retail media system decides where a brand appears and the advertiser learns about it afterwards, from a report generated by the same system. The parallel with Google's Performance Max is exact, since keyword exclusions arrived there in 2023 after buyers objected to the product bidding on queries where the sale was already secured. Category constraints follow the same logic, since a kosher or vegan protein brand has reasons to stay out of certain queries that no performance model will infer on its own.

Live sports supplied the other example, and a rare piece of clean attention measurement. Adweek reported that hydration breaks introduced during the World Cup held audiences far better than conventional commercial pods: one advertiser saw viewership fall by roughly 20% during halftime, while only 1% of viewers changed channel during the three-minute hydration breaks. Adam Schwartz, senior vice president and director of national broadcast and sports media at Horizon Media, expects rights bidders to price that in, noting that "there's certainly revenue that can be generated there if they monetize that correctly." The breaks were presented as a player safety measure. The measurement suggests they will outlive the heat.

The connective tissue across all of it is that assertions are becoming cheaper to manufacture at exactly the moment when the systems that used to check them are consolidating. A cryptographic profile is one answer, valid only if browsers read it. A regulator ordering a feature offline is another, valid only inside one jurisdiction. Quarterly accounts from a screen operator are a third, valid because the inventory is physical and the numbers are audited. What is common to the three is that none of them relies on the party making the claim to also confirm it.

Also noted

• August 14, 2026: Google search ranking volatility spiked across August 12 and 13, following unconfirmed movement around August 5 and August 1 to 3, with the last confirmed update being the June 2026 spam update. Search Engine Roundtable
• August 13, 2026: Moloco launched an agency partner programme as it pushes beyond mobile programmatic into connected television and other channels. Digiday
• August 13, 2026: Marketers are buying tools that score brand visibility inside large language model responses, but linking those scores to commercial outcomes remains unresolved. Digiday
• August 13, 2026: Tubi renewed its agreement with Nielsen's Gracenote, gaining metadata across roughly 55 million titles and testing Gracenote IDs inside programmatic bid streams. MediaPost
• August 12, 2026: A 6,542-word letter from Meta chief executive Mark Zuckerberg on artificial intelligence used the phrase balance of power 23 times and did not mention advertising once. PPC Land