Ever since the 2016 election, Google has promised to police political advertising on its platforms more closely. Today, if you want approval to run an election ad on a Google property, you have to first verify your identity. (Google uses the term “election ad,” not “political ad.”) Once you’re verified and your ad is approved, you can only target by location, age, and gender. Microtargeting, based on granular stuff like demographics, interests, voter file data, and so on, is unavailable.

But what, exactly, counts as an election ad? Recently, Patrick Berlinquette tried to find out. A search marketer from Long Island, Berlinquette has a penchant for experimenting with Google ads. (Last year he wrote in The New York Times about the power of targeted mental health support for people searching for suicide-related terms.) In July, he ran a series of ads pegged to election-specific search terms, targeting people who might be using Google to figure out whom to vote for.

“I wanted to test how easy it was to run political ads,” he said. “It was that simple. I didn’t know much about the political space. From what I understood, it was a high hurdle, you had to get a certificate. I expected to get disapproved right away, and I was going to move on.”

Google’s policy says that election ads “include ads that feature” a candidate, officeholder, party, or ballot measure. When Berlinquette used candidates’ names, like Trump or Biden, in the text of the ad itself, he indeed got disapproved. This left a question in his mind: What if you targeted an ad at people who search for a specific candidate, but avoid mentioning that candidate’s name in the actual ad?

In one example, Berlinquette put in the search keywords “should+vote+Biden” for an ad that read, “You Shouldn’t | He’ll destroy this country.” Other ads used the phrase “Say No To Joe.” He ran similar, anti-Trump ads keyed to search terms like “why+vote+Trump.” In those cases, Google approved the ads and let them run until Berlinquette disabled them. (Berlinquette set a very low budget and targeted his ads narrowly to make sure few people would see them. The ads ran for about a week, racking up a few hundred impressions and a few dozen clicks.) Because these weren’t flagged as election ads, the full suite of microtargeting options remained available. All he had to do, it seemed, was avoid using a candidate’s full or last name. Moreover, he was able to use any URL he wanted. (Google search results, including ads, have to include a landing page.) Most of the time, he used well-known news sites, adding a layer of credibility. Users who clicked the ad would be taken to an article on that site about the candidate. Berlinquette seemed to have uncovered a serious weakness in Google’s election ads policy.

Google agreed—partially. After I shared Berlinquette’s experiment with the company, members of the policy and enforcement teams reviewed the ads and concluded that they should have been disapproved. The reason: An ad that doesn’t mention Trump by name can still count as a Trump election ad, or an anti-Trump election ad, if it links to an article about him. According to a Google spokesperson, Berlinquette had identified an enforcement gap. In response, Google says it plans to increase the amount of human review that goes into evaluating landing pages for ads that potentially fall under the election policy.

Berlinquette was delighted to hear that news. He has long considered the ability to run ads with any URL to be one of Google’s biggest vulnerabilities. “The advertiser can basically bring you wherever you want, with no check, when the entity you’re sending the traffic to did not write the ad,” he said. “To the end user that’s using Google, they have no idea. Hopefully not only with political ads, but across the board, Google will take that more seriously.” (In April, Google announced that it plans to implement a political-ad-style verification requirement for all would-be advertisers, though the company says this “will take a few years to complete.”)