# Website Categorization policy pack `policy_v1` — group reference Companion to §11 of the Website Categorization bulk feed data dictionary () and to the real-time API's `?pack=policy_v1` parameter. Pack `policy_v1`, mapping version **2026.09.2**, taxonomy `iab_v3.1`, 47 groups. ## What a policy pack is — and is not A policy pack is a **fixed, versioned lookup** from the 704 IAB Content Taxonomy v3.1 categories onto a small set of filtering-ready **policy groups** — the vocabulary (`adult`, `gambling`, `piracy`, `drugs`, `weapons`, `hate`, `dating`, `social_networking`, `shopping`, …) that DNS-filtering, secure-web-gateway and endpoint policies already use. Group names follow the convergence across the public category lists of Cloudflare, Cisco, DNSFilter, BrightCloud, Fortinet, Palo Alto, Zscaler, Netskope and Microsoft. It exists because IAB scatters what a blocking policy treats as one thing: gambling alone lives under `Attractions`, `Shopping`, `Sports` and `Video Gaming`, and an integration that blocks the `Sensitive Topics` subtree blocks none of it. Read these three points before you build a block-list on it: - **It is a pure function of the stored label.** `policy_group` (feed) and `policy.group` (API, `include=policy`) are computed from `tier1..tier4` and nothing else. The deepest rule matching the tier path wins; a label that stopped at a tier-1 takes that tier-1's default group. `policy_basis` / `policy.basis` records the axis it came from — `primary` today; `site_purpose` once that axis is labeled, when it takes precedence. - **It cannot correct a wrong stored label.** A domain whose IAB category is wrong projects to the wrong group — an adult site stored as `Entertainment > Movies` reads `entertainment`. Per-group precision and recall have **not been measured**; no accuracy figure attaches to any group. Evaluate on your own domains before you block on it. - **It expresses only what IAB v3.1 has nodes for.** There is no malware, phishing, botnet, hacking, peer-to-peer or proxy/anonymizer group, and no nudity, cannabis, self-harm or "safe for kids" group, because the taxonomy has no such categories. Threat intelligence is a separate WhoisXML product and is deliberately not conflated with web categorization. Parked and dead domains are not a group either — they are the feed's `domain_status` lane, which carries them with no category at all. Group **ids** (the left column below) are the contract: lowercase, stable across pack versions, matched with a plain equality test. Names and descriptions are documentation. `sensitive` marks the groups buyers typically block-list; it has no runtime effect. ### Versioning The mapping is versioned independently of the feed schema and the API. A change to any rule bumps the pack `version`, is recorded in the changelog below, and — on the feed — changes published `policy_group` values with **no column change**. Pin the version (feed: `manifest.json` → `policy_pack.version`, or the per-row `policy_pack_version` `policy_v1@2026.09.2`; API: `policy.pack_version`) if your policy depends on exact group membership. A pack version change ships via full snapshot only — the policy columns are derived, not tracked. `version` is **CalVer `YYYY.MM.N`**: a four-digit year, a zero-padded month and a release counter within that month starting at 1 — `2026.09.1`, `2026.09.2`, and `2026.09.10` for a tenth September release. Compare the three fields **as integers**, never the strings: `"2026.09.10" < "2026.09.9"` lexicographically, while `2026.09.10` is the newer mapping. Each version has exactly one spelling (`2026.09.01` is not a version, and neither is `2026.9.1`). Every changelog entry below is also carried inside the pack in machine-readable form, with the fields our CI validates it against: | Field | Meaning | | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | `version`, `date` | the version this entry describes and the day it was cut | | `previous_version` | the version it succeeds, `null` on the first entry — the entries chain, so a missing version is a build failure, not a silent skip | | `moved` | every taxonomy path whose group changed, as `{path, from, to}` — the complete diff, not a summary | | `added_groups`, `retired_groups` | group ids that appear or disappear at this version | | `notes` | the human explanation | The fully resolved 704-node mapping of every published version is frozen alongside the pack (`policy_packs/data/history/policy_v1@.json`, IAB path → IAB id → group), and each entry's `moved` list is checked against those snapshots in CI — so the changelog cannot drift from the mapping it describes. A snapshot records the commit whose pack file carried that version's **rules**, which is not necessarily the commit whose file ships today: editing documentation (a group description, a comment) leaves the mapping, and therefore the snapshot, untouched. Ask your account contact if you want a version's full node-to-group table. A group **id** never changes meaning inside a pack. A group that has to be renamed or retired is retired by a new pack id (`policy_v2`), never by re-using an id in place, so `moved`, `added_groups` and `retired_groups` fully describe what changed for a policy written against ids. ## Groups The **Nodes** column counts the IAB v3.1 categories (of 704) that project to the group; the **Rule paths** column lists the IAB paths the pack names explicitly (each rule also covers the path's descendants unless a deeper rule overrides it). | Group id | Name | Sensitive | Nodes | Definition | Rule paths | | ------------------------- | ------------------------------- | :-------: | ----: | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `adult` | Adult | yes | 2 | Pornography and explicit sexual content (IAB `Sensitive Topics > Adult & Explicit Sexual Content`), plus adult-only video games. Vendors call this Adult / Pornography. Sex education and sexual health are `health`; lingerie retail is `fashion_beauty`; dating is `dating`. IAB v3.1 has no separate non-sexual-nudity node. | `Sensitive Topics > Adult & Explicit Sexual Content`
`Video Gaming > Video Game Genres > Adult Video Games` | | `gambling` | Gambling | yes | 3 | Real-money gambling: casinos and betting (`Attractions > Casinos & Gambling`), lotteries and scratchcards (`Shopping`), and poker and professional gambling (`Sports`). Casino-themed video games with no real-money play are the separate `gambling_games` group (Option C, 2026.09.2). Lotteries sit inside Gambling for most vendors; fantasy sports and horse racing stay in `sports` (Cisco, Palo Alto convention). Illegal-gambling markers detected by our gambling rule filter land on `Sensitive Topics > Spam or Harmful Content`, i.e. in `harmful_content` — block `gambling`, `gambling_games` and `harmful_content` to block everything gambling-shaped. | `Attractions > Casinos & Gambling`
`Shopping > Lotteries and Scratchcards`
`Sports > Poker and Professional Gambling` | | `gambling_games` | Gambling Games (simulated) | yes | 1 | Casino- and gambling-themed video games with no real-money play — social casino, virtual slots, poker-simulation games (`Video Gaming > Video Game Genres > Casino and Gambling Video Games`). Separate from `gambling`, where market and regulators draw the line at real money (see the design doc's market evidence). Blocking buyers who want everything casino-shaped, including real-money casinos the classifier may have stored under this genre, block `gambling` AND `gambling_games`. | `Video Gaming > Video Game Genres > Casino and Gambling Video Games` | | `piracy` | Piracy & Copyright Infringement | yes | 1 | Sites distributing or facilitating unauthorised copies of copyrighted material — torrents, warez, cracks, illegal streaming (`Sensitive Topics > Online Piracy`). IAB v3.1 has no separate peer-to-peer node; legitimate freeware/shareware portals are `software_downloads`. | `Sensitive Topics > Online Piracy` | | `drugs` | Drugs | yes | 1 | IAB v3.1's single sensitive-substances node, `Sensitive Topics > Illegal Drugs, Tobacco, eCigarettes, Vaping, Alcohol`: illegal and abused drugs, and tobacco, vaping or alcohol content when the site is about the substance as sensitive content. The taxonomy does not separate the four (nor cannabis/CBD, which most vendors split out), so this group cannot either. Neutral beverage and cigar content is `alcohol` / `tobacco`; pharmaceuticals, addiction treatment and smoking cessation are `health`. | `Sensitive Topics > Illegal Drugs, Tobacco, eCigarettes, Vaping, Alcohol` | | `alcohol` | Alcohol | yes | 1 | Consumer alcohol content — beverage brands, breweries, wineries, wine and spirits retail, cocktail content (`Food & Drink > Alcoholic Beverages`). Bars and restaurants are `food_drink`; the sensitive framing of the same substance is `drugs`. | `Food & Drink > Alcoholic Beverages` | | `tobacco` | Tobacco | yes | 1 | Cigar and tobacco hobby and retail content (`Hobbies & Interests > Cigars`) — IAB v3.1's only tobacco-specific node. Vaping and e-cigarettes as sensitive content are `drugs`; smoking cessation is `health`. | `Hobbies & Interests > Cigars` | | `weapons` | Weapons | yes | 1 | Firearms, ammunition and weapon sales, reviews or advocacy (`Sensitive Topics > Arms & Ammunition`). Hunting and shooting sports are `hunting_fishing`; the defence industry is `business`. | `Sensitive Topics > Arms & Ammunition` | | `hate` | Hate & Discrimination | yes | 1 | Hate speech, discrimination and acts of aggression against groups by race, ethnicity, religion, nationality, gender, sexual orientation, disability or age (`Sensitive Topics > Hate Speech and Acts of Aggression`). | `Sensitive Topics > Hate Speech and Acts of Aggression` | | `violence` | Violence & Gore | yes | 1 | Graphic violence, death, injury and military conflict presented as sensitive content (`Sensitive Topics > Death, Injury, or Military Conflict`). Crime and disaster as news topics are `news`; criminal activity is `illegal_activities`. | `Sensitive Topics > Death, Injury, or Military Conflict` | | `illegal_activities` | Illegal Activities | yes | 1 | Crime and harmful acts against individuals, society and human rights — instruction in or promotion of criminal activity, exploitation, abuse (`Sensitive Topics > Crime & Harmful Acts to Individuals, Society & Human Right Violations`). Vendors call this Illegal / Criminal Activities. | `Sensitive Topics > Crime & Harmful Acts to Individuals, Society & Human Right Violations` | | `terrorism` | Terrorism & Extremism | yes | 1 | Terrorist and violent-extremist content, recruitment and propaganda (`Sensitive Topics > Terrorism`). | `Sensitive Topics > Terrorism` | | `harmful_content` | Spam & Harmful Content | yes | 1 | Spam, scams, deceptive or otherwise harmful content (`Sensitive Topics > Spam or Harmful Content`). Also where our gambling rule filter routes illegal/unlicensed gambling markers (satta/matka, Indonesian judi/slot SEO spam). A CONTENT label, not a threat verdict: IAB v3.1 has no malware, phishing, botnet or anonymizer category; threat intelligence is a separate WhoisXML product. | `Sensitive Topics > Spam or Harmful Content` | | `profanity` | Profanity & Tasteless | yes | 1 | Obscene, vulgar, crude or profane content that is not sexual or violent (`Sensitive Topics > Obscenity and Profanity`). | `Sensitive Topics > Obscenity and Profanity` | | `social_issues` | Debated Social Issues | yes | 1 | Contested social and moral issues — abortion, gun control, immigration, sexuality and gender debates and similar (`Sensitive Topics > Debated Sensitive Social Issues`). Vendors name Abortion / Social Issues here. Mainstream political coverage is `politics`. | `Sensitive Topics > Debated Sensitive Social Issues` | | `sensitive_other` | Sensitive (unspecified) | yes | 1 | A label that stopped at the `Sensitive Topics` tier-1 without naming which sensitive theme applies. Treat as sensitive; the specific group is unknown. | `Sensitive Topics` | | `hunting_fishing` | Hunting & Fishing | | 2 | Sport hunting, shooting sports, gun clubs and fishing (`Sports > Hunting and Shooting`, `Sports > Fishing Sports`). Separate from `weapons`, as in Cisco, BrightCloud, Fortinet and Palo Alto; block both to cover everything firearm-related. | `Sports > Hunting and Shooting`
`Sports > Fishing Sports` | | `dating` | Dating | | 1 | Online dating, personals and matchmaking (`Family and Relationships > Dating`). | `Family and Relationships > Dating` | | `social_networking` | Social Networking | | 1 | Social networks and online communities (`Technology & Computing > Computing > Internet > Social Networking`). | `Technology & Computing > Computing > Internet > Social Networking` | | `search_engines` | Search Engines & Portals | | 1 | Web search engines and portals (`Technology & Computing > Computing > Internet > Search`). | `Technology & Computing > Computing > Internet > Search` | | `communication` | Email, Messaging & Conferencing | | 3 | Communication services and topics — web email (`… > Internet > Email`), web conferencing and online meetings (`… > Computer Software and Applications > Web Conferencing`) and the `Communication` tier-1 (messaging, telephony, postal services). | `Communication`
`Technology & Computing > Computing > Computer Software and Applications > Web Conferencing`
`Technology & Computing > Computing > Internet > Email` | | `software_downloads` | Software Downloads | | 1 | Freeware and shareware download portals (`Technology & Computing > Computing > Computer Software and Applications > Shareware and Freeware`). Pirated software is `piracy`; software as a topic is `technology`. | `Technology & Computing > Computing > Computer Software and Applications > Shareware and Freeware` | | `artificial_intelligence` | Artificial Intelligence | | 1 | AI and generative-AI tools, services and topics (`Technology & Computing > Artificial Intelligence`) — the node an enterprise "Generative AI" policy keys on. Robotics, AR and VR stay in `technology`. | `Technology & Computing > Artificial Intelligence` | | `technology` | Technology & Computing | | 40 | Hardware, software, programming, networking, security, cloud, web hosting and consumer electronics — the `Technology & Computing` tree except the nodes split into `social_networking`, `search_engines`, `communication`, `software_downloads` and `artificial_intelligence`. IAB v3.1 has no hacking, proxy/anonymizer, VPN or peer-to-peer node; `Information and Network Security` is defensive security content. Includes `Web Hosting`, where hosting-provider placeholder pages have historically been over-labelled (feed changelog 2026-08-24). | `Technology & Computing` | | `games` | Games | | 26 | Video games on any platform, esports and non-gambling game genres (`Video Gaming` except the casino and adult genres), plus tabletop, card and role-playing games (`Hobbies & Interests > Games and Puzzles`). No real-money play. | `Hobbies & Interests > Games and Puzzles`
`Video Gaming` | | `entertainment` | Entertainment | | 82 | Movies, music, television and radio (`Entertainment`, `Genres`), celebrity and pop culture (`Pop Culture`), events and conventions (`Events`), and nightclubs (`Attractions > Nightclubs`). IAB v3.1 has no streaming-service node: a streaming platform is labelled by its content. | `Attractions > Nightclubs`
`Entertainment`
`Events`
`Genres`
`Pop Culture` | | `arts_literature` | Arts & Literature | | 14 | Fine and performing arts (`Fine Art`) and books, comics and poetry (`Books and Literature`). Arts-and-crafts hobbies are `lifestyle`. | `Books and Literature`
`Fine Art` | | `news` | News & Media | | 3 | Current-affairs topic roots: `Crime`, `Disasters` and `War and Conflicts`. IAB v3.1 has no "news publisher" or military node — a general news site is labelled by its dominant topic, most often `politics`. **Warning: this group does not contain newspapers, news portals or news publishers**, so allowing or blocking `news` does not allow or block news sites, and no group does. The id stays `news` because a group id never changes meaning inside a pack; a rename is a new pack id (`policy_v2`). | `Crime`
`Disasters`
`War and Conflicts` | | `politics` | Politics & Advocacy | | 4 | Politicians, parties, elections, civic affairs, policy and advocacy (`Politics`). | `Politics` | | `government_legal` | Government & Legal | | 1 | Legal topics and services (`Law`). IAB v3.1 has no government-services or military node; civic affairs sit under `Politics` (→ `politics`). | `Law` | | `business` | Business | | 61 | Companies, industries, B2B services, marketing and advertising, logistics and management (`Business and Finance` except `Economy`). IAB v3.1 has no ad-server/tracker node; the advertising nodes here are about the advertising business. | `Business and Finance` | | `finance` | Finance | | 41 | Personal finance, banking, insurance, investing, loans and taxes (`Personal Finance`), and the economy, markets and currencies (`Business and Finance > Economy`). | `Business and Finance > Economy`
`Personal Finance` | | `careers` | Jobs & Careers | | 9 | Job search, career advice, vocational training and remote work (`Careers`). | `Careers` | | `education` | Education | | 18 | Schools, universities, online learning, homework and language learning (`Education`). IAB v3.1 has no cheating/plagiarism node. | `Education` | | `science` | Science | | 10 | Natural sciences, space, geography, environment and weather (`Science`). | `Science` | | `health` | Health & Medicine | | 54 | Medical conditions, treatments, pharmaceuticals, sexual and reproductive health, mental health, addiction treatment, fitness, nutrition and wellness (`Medical Health`, `Healthy Living`). Sex education lives here (vendor convention), not in `adult`. IAB v3.1 has no self-harm node. | `Healthy Living`
`Medical Health` | | `lifestyle` | Society & Lifestyle | | 66 | Family and parenting (`Family and Relationships` except `Dating`), hobbies, crafts and collecting (`Hobbies & Interests` except `Cigars`, `Games and Puzzles` and `Paranormal Phenomena`), pets (`Pets`), celebrations (`Personal Celebrations & Life Events`) and holidays (`Holidays`). | `Family and Relationships`
`Hobbies & Interests`
`Holidays`
`Personal Celebrations & Life Events`
`Pets` | | `food_drink` | Food & Dining | | 13 | Cooking, recipes, diets, restaurants and non-alcoholic beverages (`Food & Drink` except `Alcoholic Beverages`; `Attractions > Bars & Restaurants`). | `Attractions > Bars & Restaurants`
`Food & Drink` | | `travel` | Travel & Attractions | | 35 | Travel, hotels, transport and destinations (`Travel`), and visitor attractions — theme parks, museums, parks, zoos, landmarks (`Attractions` except casinos, bars, malls and nightclubs). | `Attractions`
`Travel` | | `shopping` | Shopping | | 11 | Retail, marketplaces, coupons, gifts and groceries (`Shopping` except `Lotteries and Scratchcards`; `Attractions > Malls & Shopping Centers`). | `Attractions > Malls & Shopping Centers`
`Shopping` | | `real_estate` | Real Estate | | 12 | Property listings, buying, selling and renting (`Real Estate`). | `Real Estate` | | `automotive` | Vehicles | | 41 | Cars, motorcycles, parts, repair, buying and selling (`Automotive`). | `Automotive` | | `sports` | Sports | | 66 | All sports, teams, leagues and equipment (`Sports` except `Poker and Professional Gambling`, `Hunting and Shooting` and `Fishing Sports`), including fantasy sports and horse racing. | `Sports` | | `fashion_beauty` | Fashion & Beauty | | 44 | Clothing, accessories, intimates, beauty and personal care (`Style & Fashion`). | `Style & Fashion` | | `home_garden` | Home & Garden | | 12 | Home improvement, décor, gardening, appliances and smart home (`Home & Garden`). | `Home & Garden` | | `religion` | Religion | | 10 | Religions, spirituality, atheism and agnosticism (`Religion & Spirituality` except `Astrology`). | `Religion & Spirituality` | | `cults_occult` | Cults, Occult & Astrology | | 2 | Astrology and horoscopes (`Religion & Spirituality > Astrology`) and paranormal phenomena (`Hobbies & Interests > Paranormal Phenomena`) — the closest IAB v3.1 comes to vendors' Cult & Occult / Alternative Beliefs category. IAB has no cult or satanism node. | `Hobbies & Interests > Paranormal Phenomena`
`Religion & Spirituality > Astrology` | ## Open mapping decisions These are recorded so a change is a visible version bump, never a silent drift: 1. **Gambling scope — decided 2026-09-03 (Option C, mapping 2026.09.2).** The three real-money nodes (`Attractions > Casinos & Gambling`, `Shopping > Lotteries and Scratchcards`, `Sports > Poker and Professional Gambling`) project to `gambling`; `Video Gaming > Video Game Genres > Casino and Gambling Video Games` (simulated gambling, no real-money play) projects to the separate `gambling_games` group, where twelve vendors' published definitions and every regulator, rating body and app store checked draw the line at real money. Block **both** groups to block everything casino-shaped — including real-money casinos the classifier may have stored under the video-game genre, which is a label error the pack cannot correct. Fantasy sports and horse racing stay in `sports`, matching Cisco's and Palo Alto's convention. 2. **Substances.** IAB's single node `Illegal Drugs, Tobacco, eCigarettes, Vaping, Alcohol` cannot be split, so `drugs` covers all four substances when framed as sensitive content; neutral beverage content is `alcohol`, cigar content is `tobacco`. 3. **News.** IAB v3.1 has no news-publisher node. `news` holds the current-affairs topic roots (`Crime`, `Disasters`, `War and Conflicts`); a general news site is labelled by its dominant topic, most often `politics`. The group id is therefore misleading — it reads like "news sites" and is not — but it stays: ids never change meaning inside a pack, so renaming it is a `policy_v2` decision, not a `policy_v1` mapping change. ## Changelog - **2026.09.2** (2026-09-03) — Option C: simulated gambling leaves `gambling`. `previous_version: 2026.09.1`. The complete diff is one path: - `moved`: `Video Gaming > Video Game Genres > Casino and Gambling Video Games` (IAB id `ZJG29S`) — from `gambling` to `gambling_games`. - `added_groups`: `gambling_games`. `retired_groups`: none. No other path changed group: the three real-money nodes stay in `gambling`. - **What it moves, in rows.** On the 2026-09-02 snapshot that node carried **2,483 rows in partition p00**, **≈40K rows feed-wide**. Every one of them reads `policy_group=gambling_games` instead of `gambling` from the first full snapshot exported under 2026.09.2 onward. A policy that blocked `gambling` and wants the pre-2026.09.2 behaviour blocks `gambling` **and** `gambling_games`. - The API (`include=policy`, `?pack=policy_v1`) reflects it once the image deploys; the feed with the first full snapshot after that (a pack change never rides a delta). - **2026.09.1** (2026-09-01) — Initial release; `previous_version: null`, nothing moved. Gambling = all four gambling-themed nodes (casinos, lotteries, poker, casino-and-gambling video games) — the initial scope, narrowed in 2026.09.2 above.