They often are sandboxed within an iframe element: (https://www.iab.com/guidelines/safeframe/)