TL;DR. The ad-funded internet was already a manipulation engine — engagement-ranked feeds, dark-pattern UX, and microtargeted profiling. Trust in news fell 20 points in a decade [1] and global trust is now contracting into insular circles [2]. AI is not a new vector — it makes each step of the existing loop cheaper, more personalised, and harder to detect. For the talk: don’t sell AI as a new threat; sell it as the same threat with the friction removed.
The deal that broke
The ad-funded contract was: free service, your attention sold to advertisers. Two things happened in parallel:
- The ad supply outgrew the attention. ~86% of consumers experience banner blindness; display CTR averages 0.05% [22]. 32.5% of U.S. internet users now run ad blockers; ~42.7% globally on at least one device [21]. One in five programmatic impressions in 2025 showed invalid-traffic signals — ~$37B at risk in U.S. spend alone [20].
- The ranking layer noticed that rage scaled better than reason. Frances Haugen’s 2021 disclosures showed Facebook’s engagement-ranked feed systematically privileges sensational content because rage-bait predicts longer sessions [5][6]. This is Goodhart’s law in a $700B suit: when engagement becomes the target, content optimises for clicks rather than meaning [9][7].
Cambridge Analytica was the hinge moment for the public: the science of psychometric targeting was thinner than claimed, but the lesson — you are the product, and your likes are evidence in a campaign you didn’t know was running — stuck [3][4]. Facebook paid the FTC $5B in 2019 [3]. Trust never came back.
The manipulation pipeline
Each layer of the stack has its own technique. None of them are new in 2026 — but they are all cheaper to run.
| Layer | Technique | Where it shows up |
|---|---|---|
| Collection | Surveillance profiling, friends-of-friends data harvest | Cambridge Analytica’s “thisisyourdigitallife” app harvested 100M+ profiles via friends-of-friends [3] |
| Targeting | Psychometric / behavioural microtargeting | Personality-based political ad delivery, now extended to LLM-reconstructed profiles from ad streams [4] |
| Ranking | Engagement-optimised feeds | Outrage scales; chronological feeds were Haugen’s proposed fix [5][6] |
| UX | Dark patterns — fake urgency, hidden opt-outs, manipulative defaults | FTC treats them as deceptive under Section 5; EU Digital Fairness Act expected Q4 2026 to address them directly [24][23] |
| Disclosure | Native ads designed to blend with editorial | Disclosure labels work only when designed against the brand’s interest; most aren’t [24] |
The trust ledger
Numbers, not vibes. These are the headline charts the audience already half-knows.
| Indicator | Then | Now | Source |
|---|---|---|---|
| U.S. trust in national news | 76% (2016) | 56% (Sep 2025) | [1] |
| U.S. trust in social media as info source | low-20s (2021) | 37% (Sep 2025) | [1] |
| U.S. under-30s — news ≈ social media | — | 51% vs 50%, parity (Sep 2025) | [1] |
| Global “hesitant or unwilling to trust” out-group | — | 7 in 10 (2026) | [2] |
| U.S. adults with high trust in AI ads | — | ~30% | [15] |
| U.S. adults — ads in AI search → less trust | — | 63% agree (Jan 2026) | [15] |
| AI slop seen “often / very often” | — | 56% of social media users (2026) | [18] |
“Slop” — generic AI-generated filler — was named Word of the Year 2025 by Macquarie Dictionary, Merriam-Webster, and the American Dialect Society [19]. When the language coins a single syllable for the feed itself feels untrustworthy, the trust loss has crossed from anecdote to vocabulary.
Why AI changes the math
AI doesn’t introduce manipulation. It removes the friction that used to limit it.
| Old constraint | What AI removes |
|---|---|
| Dark-pattern UX needed designers and A/B test cycles | Generative UX testing iterates millions of micro-variants; an unprompted “neutral” e-commerce page asked of ChatGPT still ships fake urgency and visual nudging by default [25][24] |
| Sponsored content was visually distinct from editorial | LLM “Sponsored Suggestions” sit inside the conversation. In a controlled study, 49% of participants failed to detect ads in chatbot responses even with disclosure labels present [12] |
| Persuasion required a creative team | GPT-4o subtly influenced participants’ product choices and made them feel positive about it; ad-injected responses were rated more credible until disclosure flipped them to “manipulative” and “untrustworthy” [12] |
| Brand bias needed an editor’s hand on the scale | DarkBench (ICLR 2025) finds dark patterns in 48% of LLM outputs; “sneaking” appears in 79% of conversations; some models systematically promote their own developer’s products (e.g. Meta models ranking Llama #1) [10][11] |
| Microtargeting needed platform data access | Off-the-shelf LLMs can reconstruct private user attributes from ad streams alone, bypassing platform safeguards [11] |
The Feb 2026 ChatGPT ad rollout closed the loop. OpenAI began rolling Sponsored Suggestions into the live ChatGPT experience on 9 Feb 2026, matched to conversational intent rather than keyword [14]. Reporting in late 2025 already alleged sponsored content getting preferential treatment inside the answer itself, with chat history feeding personalisation [13].
The market is splitting on trust
For the first time the AI industry has visibly bifurcated on whether trust or reach is the durable moat.
| Camp | Bet | Examples |
|---|---|---|
| Reach-first | Ad-funded scale, free tiers monetised through sponsored answers | OpenAI (ChatGPT Sponsored Suggestions, Feb 2026), Google [14][17] |
| Trust-first | Subscription-only, no ads anywhere; explicit framing that ads make users “suspicious of everything” | Perplexity (pulled all ads Feb 2026), Anthropic / Claude [16][17] |
Ipsos polled this directly in Jan 2026: 63% of U.S. adults agree ads in AI search results would make them trust the answers less; only 36% expect ads to simplify shopping [15]. Perplexity’s pitch is essentially that line item, monetised. Whether that survives contact with a billion free users is the open empirical question of 2026.
What to tell a non-security audience
Three points worth lifting from this into the talk:
- The threat model is the business model. The “attacker” most users actually face is the platform’s own optimiser, not a foreign actor. Tristan Harris has been making this argument since 2017 [8]; the post-Haugen evidence backs it.
- AI is friction-removal, not novelty. Every harm in the talk’s “AI” section has a 2010s-era precedent. Frame the AI risk as “this thing you already half-distrust, but with the cost-curve flattened.”
- Trust is now a market segment. When a major lab walks away from ad revenue and cites trust as the reason [16], the audience already lives in the world the talk is describing — they just haven’t named it. The talk’s job is to give them the name.
Edges worth flagging
- The polarization story is messier than it looks. A 2025 PNAS-published naturalistic experiment (~9,000 participants) found short-term filter-bubble exposure on YouTube had limited polarization effects — the rabbit-hole frame is contested even as the engagement-ranking critique stands [26]. Be careful claiming algorithms cause polarization vs amplify preexisting sorting.
- Disclosure isn’t a silver bullet. Studies of native-ad disclosure show it both decreases persuasion (via persuasion knowledge) and increases it (via perceived transparency) — the design of the label matters more than its presence [24].
- Regulation is coming but slow. EU DFA proposal: Q4 2026; FTC Section 5 enforcement is ongoing but case-by-case [23][24]. For a 2026 talk, “the rules are still being written” is the honest line.