If you click through, you're more likely going to be interested in the two that this page links to. The Bloomberg report is more recent (last week) while Citizen Lab's own reporting on the topic is dated from April. You'll need to read either (both?) to get a full sense of what this particular linked piece is actually referencing.
Yet another reason why every browser should include an ad blocker by default as part of its malware and tracking protection.
From a legal standpoint, the issue of liability really needs to be clarified once and for all. A website should be fully responsible for everything it embeds. If an ad spreads malware or tracks visitors, it should be treated as if the site operator had done so themselves. If the risk is too great for most site operators, then we’ll just have to go back to old fashioned forms of advertising. For example, simply a banner that the website operator hosts themselves and receives a fixed amount for.
Indeed, centralized inference by a few providers gives you massive more information regarding what people are doing and what's the intent behind, making these ad-bases surveillance systems of what sites you visit look like from the stone age.
Browser based ads are also a vector, but the information sold by app providers and app SDK providers can deliver much more information.
%surveillance factory%