Quoting Bagas Sanjaya <bagasdotme@gmail.com>:
Suppose that an upstream has released a program which its license
conforms to DFSG (named ZZZ), but when I test it, ads placed by the
upstream appear (such as pop up ads). Since ads can affect user
experience of ZZZ, but at the same time the upstream get paid by ad
networks which he place the ads into ZZZ, would it acceptable to
package ZZZ for Debian?
Side question, because you mention "ad networks":
Does showing the ad involve a potential privacy violation?
I.e. does showing the ad involve any network traffic,
leaking the users IP address?
If so, I strongly suggest to patch ZZZ accordingly.
Otherwise, I would leave it to the package maintainer,
whether they like to disable the ad or not,
but that's more a question for debian-legal@lists.debian.org.