Why your Google Ads network settings won't stay fixed

A real pattern: $455 on two networks nobody chose

One B2B search campaign — the DB Access Control campaign — leaked onto two networks in a single 30-day window. It spent $337.42 on the Display Network (42,622 impressions, zero conversions) and $117.23 on search partners (a 15% click-through rate, zero conversions). That's $454.65 on surfaces a lead-gen search campaign was never meant to touch, and both were live because Google turns them on.

The obvious response is to uncheck both boxes. It works — for that campaign, that day. It does not stay fixed.

Why the fix slips

Network settings are chosen per campaign, at creation, and the defaults favor reach. Google's documentation says search partners "are included by default," opted out only "through your campaign settings," and Display Expansion is enabled by the same logic. The opt-out being per campaign is the catch: there's no account-level switch that forces every new campaign, however it's created, to start on Google Search only. (Google Ads Editor can remember your preferred defaults, but only for campaigns you build there.)

So the leak isn't a one-time mistake to clean up. The next campaign a teammate spins up in the web UI starts with Display and search partners on, exactly like the last one. A clean network audit decays the moment someone creates a campaign.

This is drift, not a bug

The pattern is familiar to anyone who runs infrastructure: live state quietly diverges from intended state, and the gap reopens every time someone makes a change outside the agreed path. The console will show a campaign's settings if you go looking, but nothing tells you "a new campaign is serving on Display" unless you happen to open it. Each setting is correct in isolation and wrong in aggregate.

That reframes the fix. The question isn't "are the boxes unchecked?" It's "how do I know they're still unchecked next month, across every campaign, including the ones I didn't create?"

What actually keeps it fixed

1. Write down the intended baseline. Decide which networks each campaign should serve — for most lead-gen Search campaigns, Google Search only — so there's something to check against. A setting with no declared intent can't drift; it's just whatever the UI last left it.
2. Re-check on a cadence, not once. Network settings are set-and-forget by design, which is exactly why they need a standing review. Monthly catches a new campaign before it spends much.
3. Treat every new campaign as guilty until reviewed. A campaign you didn't create is the highest-risk case: it inherited Google's defaults, not yours.
4. Watch the metric, not your memory. Segment performance by network so Display and search-partners spend report separately. A re-leak shows up in the numbers whether or not anyone remembered to open the settings.

How a declarative account does it

The DB Access Control account runs on Adjar, where the baseline is config and the check is a command. Every campaign declares the networks it serves on, and the default is Google Search only — the inverse of the UI:

[[campaigns]]
name = "DB Access Control | SEARCH | 2026-Q2"

[campaigns.network]
google_search = true
search_partners = false  # off — the search-partners leak
display = false  # off — the Display leak

The check pulls every enabled and paused campaign in the account, not just the declared ones, and compares. A campaign created in the UI has no match in the config, so it surfaces in the very next plan — as a line to either adopt (which enforces search-only) or archive. Run that plan on a schedule and a new leak can't outlive a day: the audit humans forget becomes the one the account runs on its own.

That's the difference between fixing a leak and closing it. Anything not declared search-only is corrected to it, or removed, on the next run.