Why did Google suspend my account for malicious or unwanted software?

Direct answerRead the label. Malicious software means Google thinks you intentionally distributed malware. That suspension can happen on detection, with no warning, and Google says you will not be allowed to advertise again unless an appeal shows a mistake. Unwanted software means the download is deceptive, bundled, hard to remove, or missing a clear description of what install does. That one comes with a warning at least 7 days before suspension.

Which label you actually have

Malicious software

Google’s malicious software policy, under abusing the ad network, defines malware as software that aims to harm or get unapproved access to a computer, device, or network. Intentional distribution is not allowed. Named examples include viruses, ransomware, worms, trojan horses, rootkits, keyloggers, dialers, spyware, rogue security software, forced redirects to an infected site without a click, and HTML5 ads that steal credentials from a publisher’s page.

Google calls a violation egregious. Accounts are suspended upon detection and without prior warning, and the page says you will not be allowed to advertise with Google Ads again. Appeals are for cases where you believe the finding is an error. Google says accounts are only reinstated in compelling circumstances, such as a mistake. Some advertisers must pass advertiser verification to appeal, and three failed identity checks can remove the appeal path. The suspension workflow itself is in why Google Ads accounts get suspended.

Unwanted software

Google’s unwanted software policy describes software that is deceptive, tricks people into installing or piggybacks on another install, hides principal functions, changes the system in unexpected ways, is hard to remove, collects or transmits private information without the user’s knowledge, or is bundled without disclosure.

Disapproval examples include no product type in the ad or on the page, a function description that does not match the software, system or browser changes without consent, a difficult uninstall, missing terms of service or an end-user license, a silent bundle, and transmitting private information without the user’s knowledge.

Policy: the ad should contain a product type and one accurate line about what the software does. The destination should repeat that and explain the full result of installing, including browser or settings changes. Disclosures must be conspicuous, prominent, in reasonably large type, and plain enough for someone who is not technical. A large disclosure does not make a silent bundle allowed. The characteristics above are still violations. This policy warns at least 7 days before suspension.

A picture of a download icon that is not a working control is misleading ad design. Software sold so someone can read another adult’s texts is dishonest behavior, not a missing EULA.

A hacked page is the third label

In May 2023 Google split the old malware policy into malicious software, compromised sites, and unwanted software. The policy update describes a compromised site as one whose code was changed to benefit someone else without the owner’s knowledge, often in a way that harms visitors. Ads may not use that destination. The update said this label gets a warning at least 7 days before suspension, unlike malicious software. Open the live Compromised sites article from the abusing-the-ad-network hub before you rely on that timing. Clean the site. Do not file the appeal as if you meant to distribute the payload.

Setup workflow

1. Read the policy name in the notification. Malicious software, unwanted software, compromised site, and circumventing systems are different labels.
2. If the label is malicious software, stop spending and appeal from the suspension notice. Google says reinstatement is for compelling cases such as a mistake. Do not open a replacement account.
3. If the label is unwanted software, put the product type and one true function line in the ad. On the page, explain install effects, including settings changes, in large plain text, and add terms or an EULA.
4. Remove silent bundles, hidden uninstall steps, and private-data collection the user was not told about.
5. If the landing page was hacked, treat that as a compromised destination. Clean the site, then appeal. Do not describe a virus you shipped on purpose as a hack.

Frequently asked questions

Sources

• Google Ads: Malicious software
• Google Ads: Unwanted software
• Google Ads: Abusing the ad network
• Google Ads: Update to Abusing the ad network policy (February 2023)

Enforcement details change. This reading is as of September 23, 2026. It is not a promise that an appeal will be granted.