I was going to challenge you to find me a company selling malware on CBS or NBC, but then I remembered Google runs TV ads, so fair point. /s
And importantly, broadcast television doesn't get Section 230 protections, and does just fine. A great example of why tech companies don't need immunity. Broadcast TV ads are sold on a smaller scale, such that humans are involved in the process and bad actors are caught early.
> Citation needed.
The general problem here is that Google is the only one with meaningful data, and obviously they're very motivated not to reveal how big a market illegal activity is on their platform. Note that even in legitimate verticals, scams push the bidding higher for advertising on their platforms. So not only does Google make money directly off scammers, they also make more money off legitimate advertisers because the bidding was higher. Google both claims that there's no data proving their business is illegitimate, while keeping all the data secret. So we have to rely on the evidence we can see.
A great example is what The Verge uncovered in 2017 with rehab scams: https://www.theverge.com/2017/9/7/16257412/rehabs-near-me-go... where they found some insane CPCs: "If you’re in Arizona, and you click on the top ad, you’ll cost that advertiser around $221", and Google was actively soliciting business in this extremely valuable market: "The search giant actively courts treatment centers, both online and off. In May, a Google “digital ambassador” was a featured speaker at the Treatment Center Executive & Marketing Retreat". They had multiple people directly focused on cultivating business in this particular market. Scammers were both harming consumers directly, and also pushing the CPCs up to insane levels for real drug rehab centers, hurting consumers indirectly as well.
You can also see an interesting way Google helps bad actors stay hidden here: "The 800 number was ephemeral. ...Google offers advertisers unique “tracking” phone numbers that forward to a company’s phones, so they can understand which ads are bringing in the most clients. The phone numbers only stay up as long as the ad does." So you can't even meaningfully trace out a phone number on a scam ad back to the company that pays for it. Everything is laundered through Google accounts.
After this piece, of course, Google finally acted and more or less shut down their entire drug rehab vertical for a while, and retooled it. I'm sure it's drastically less profitable now. But the problem is, they got to keep the millions and millions of dollars profit they got from engaging in a business practice that was directly harmful to people.
My long time example, which Google still refuses to address, is searches for "mapquest". MapQuest is a top search term for seniors, who don't realize that other directions sites exist. To it's credit, MapQuest is still pretty decent. Problem is, Google sells ads for "Maps Quest" that look like the real site, but redirect you to sites that require you install browser-hijacking add-ons in order to proceed (add-ons hosted in the Chrome Web Store, I might add). No matter how many times I've attempted to report them, these sites are allowed to continue doing this. A Googler actually had them removed once, and Google re-enabled the same sites' ads within a couple of hours.
Another fun part of this, is that if MapQuest wants to be presented above those malicious ads, MapQuest has to outbid them... for it's own trademarked brand name! Ad squatting is another way Google rakes in massive revenues via essentially blackmail: Pay us or we'll let scammers place higher than you for your own name.
I wouldn't hazard a statistic, because it'd be a guess, but I imagine if Google were forced to disclose advertisers and spends, you'd find a substantial portion of Google's profits were ill-gotten gains.