Adwall — Pop-Up Ads and Browser Blockers | adwall.net
Script-opened windows, secondary payloads that use cross-site scripting, and the advertising revenue that keeps the format worth shipping.
A blocker that is switched on still allows windows opened directly by a user click, because suppressing those would break downloads, sign-in flows, and print dialogs. A page can therefore wrap its pop-up in a click handler and slip past the check without changing the blocking setting at all.
Some script-opened pop-ups carry a secondary payload that uses cross-site scripting (XSS). The window itself is the visible part; the payload runs in the background and is not shown in the address bar, which is why allowing a window should follow an address check rather than happen by reflex.
On narrow screens, swipe or scroll the plate sideways.
The money behind the format explains its persistence. Google and Facebook were estimated to be responsible for 70% of overall US digital advertising revenue in 2016, and US mobile advertising spending grew about 90% each year from 2010 to 2013.
In 2016 internet advertising revenues in the United States surpassed those of cable and broadcast television, so the incentives to keep experimenting with window formats did not disappear when blockers became standard in 2002 and 2004.
Blockers also miss windows on allow-listed sites. An entry added in a hurry to let one download through stays until it is removed by hand, and every later pop-up from that site opens without a prompt.
Further reading