  Online advertising relies on a complex and opaque supply chain that involves
multiple stakeholders, including advertisers, publishers, and ad-networks, each
with distinct and sometimes conflicting incentives. Recent research has
demonstrated the existence of ad-tech supply chain vulnerabilities such as dark
pooling, where low-quality publishers bundle their ad inventory with
higher-quality ones to mislead advertisers. We investigate the effectiveness of
vulnerability notification campaigns aimed at mitigating dark pooling. Prior
research on vulnerability notifications has primarily focused on
single-stakeholder scenarios, and it is unclear whether vulnerability
notifications can be effective in the multi-stakeholder ad-tech supply chain.
We implement an automated vulnerability notification pipeline to systematically
evaluate the responsiveness of various stakeholders, including publishers,
ad-networks, and advertisers to vulnerability notifications by academics and
activists. Our nine-month long multi-stakeholder notification study shows that
notifications are an effective method for reducing dark pooling vulnerabilities
in the online advertising ecosystem, especially when targeted towards
ad-networks. Further, the sender reputation does not impact responses to
notifications from activists and academics in a statistically different way. In
addition to being the first notification study targeting the online advertising
ecosystem, we are also the first to study multi-stakeholder context in
vulnerability notifications.
