EUIPO Finds Legit Brands Still Funding Pirate Sites Through Ad Tech
The EUIPO Observatory has published its 2025 annual monitoring report on online advertising on IPR-infringing websites and apps, and the numbers are difficult to dismiss. Across 5,671 monitored websites, 37% were classified as illegal and 63% as high-risk; estimated worldwide ad revenue for those websites reached EUR 382 million in 2025. The report also identified 61,628 unique advertisers on monitored websites, including 4,778 Major Brands.
What makes this development more than another anti-piracy headline is that the ad money is still coming from the mainstream market. Legitimate advertising budgets continue to reach infringing traffic through fragmented programmatic buying chains. For brands, agencies and ad tech platforms, this is no longer a side issue for legal teams. It is becoming a governance question about who screens supply, who documents exceptions, and who takes responsibility when lawful brands end up funding unlawful or high-risk inventory.
The report shifts attention from pirated content to the financing layer
Digital copyright enforcement often concentrates on the visible front end: domain blocking, takedowns, delisting and link removal. The EUIPO report moves one step deeper. Pirate services do not persist simply because infringing content is available; they persist because money still reaches them. Of the 5,671 monitored websites, 2,109 were classified as illegal and 3,562 as high-risk. Yet high-risk websites accounted for the larger share of estimated worldwide ad revenue, at EUR 269.2 million, compared with EUR 112.8 million for illegal websites.
That distinction matters. It suggests that the bigger commercial risk does not sit only with sites already named in court orders or administrative actions. A large part of the monetisation problem sits in the grey zone: websites that are easier to buy through, harder to escalate internally, and less likely to trigger immediate manual intervention. For advertisers, the practical problem is often not deliberate support for piracy. It is poor visibility over where the budget actually lands once automated buying takes over.
Why legitimate brands still appear on pirate inventory
The report should not be read as claiming that brands intentionally support infringement. The more plausible explanation is structural. Advertising budgets pass through DSPs, exchanges, agencies, resold inventory and optimisation systems before they reach a page impression. Programmatic buying is very effective at maximising reach, engagement and conversion opportunities, but those signals do not answer the legal question of whether the underlying content is lawfully distributed. If IP-specific screening is weak or badly timed, legitimate ads can still land on infringing or high-risk domains.
EUIPO points to the same governance gap. The number of Major Brand advertisers identified on monitored websites increased by 12%, from 4,259 to 4,778. The report also notes that the outreach programmes that had educated brands about placements on IPR-infringing websites ended in 2023, and that Infringing Website Lists that previously had an impact within countries appear less effective against large-scale digital advertising. In other words, awareness on its own is not solving the leakage.
The 2018 MoU still matters, but it is no longer enough on its own
The European Commission’s Memorandum of Understanding on online advertising and IPR was built around a sensible idea: if commercial-scale infringement depends on ad revenue, cutting off the money can be more scalable than chasing every infringing page one by one. That logic still holds. The difficulty is that the ad ecosystem of 2026 is more automated, more layered and less transparent than the one the MoU was originally designed to influence.
The report itself flags a new layer of risk. As ad buying moves toward more autonomous and AI-assisted execution, systems may optimise for contextual fit, engagement or sentiment while failing to verify lawful distribution rights. At the same time, infringing operators are adapting. Some use apparently clean websites to build domain reputation and search visibility before switching to piracy or showing infringing content only in short windows. That means voluntary cooperation remains useful, but it now needs harder operational discipline behind it: pre-bid IP checks, synchronised negative domain lists, tighter supply-path controls, manual escalation for sensitive campaigns and documented override decisions.
What brands, agencies and rights holders should do next
For brands, the immediate lesson is that traditional brand-safety settings are no longer enough. Large campaigns, sensitive sectors and high-volume markets increasingly require a distinct IP-risk control layer. That means maintaining exclusion lists, restricting suspicious resold inventory, reviewing supply paths and setting clear rules for when human approval is mandatory. Agencies and ad tech platforms cannot hide behind supply-chain complexity forever. If they design or operate the buying logic, they will be asked to explain why lawful advertising appeared on unlawful or high-risk domains.
Rights holders also have a clearer playbook than before. Instead of spreading enforcement resources evenly across every mirror site and every complaint channel, they can gain more leverage by supplying structured evidence, risk-tiered site intelligence and demonetisation leads to the advertising side of the market. Once the revenue line tightens, many infringing services lose their ability to scale. That is the sharpest takeaway from the EUIPO report: piracy is still a copyright issue, but in practical commercial terms it is now just as much an advertising supply-chain issue. Anyone treating it as a niche compliance problem is already behind.
