Weight & build
Creative is not secure
What Google's rule says
Google's rule reads: all creatives served outside of China must be 100% SSL-compliant across all calls contained within the creative, including assets, fourth parties, and other trackers. Authorized Buyers reports the same condition as non-secure HTTP calls being detected.
What actually causes it
- One legacy tracking pixel left on http:// in an otherwise secure tag.
- A protocol-relative URL that resolves to HTTP in an environment that is not itself served over HTTPS.
- An HTTPS URL that redirects through an HTTP hop before landing — the destination is secure, the journey is not.
- A hardcoded asset path pointing at an origin that never got a certificate.
How to fix it
Read every host the creative touches, including redirect hops, not just the URLs written in the tag. A single insecure hop in the middle of an otherwise secure chain is enough, and it is invisible if you only inspect the tag source.
The part that is not obvious
Two details make this one different from a generic security requirement. The first is that the policy is explicitly written as an exemption — creatives served outside of China must be compliant — so the geography of the inventory is part of the rule rather than a footnote to it. The second is the word all: the requirement covers assets, fourth parties and other trackers, so compliance is a property of the entire call chain and a browser will report the failure as a mixed-content warning rather than an error, which is why it survives QA.
Related reasons
Reason name verified against Troubleshoot creatives rejected by Display & Video 360 or Google Ad Manager on 30 July 2026. The causes and fix above are practitioner guidance, not Google policy text.