Yeah but if the adserver is a black box that's managed by the ad network I would have thought the website could pass the liability on to them (and state this in their ToS somewhere)