How This Briefing Works
This report opens with key findings, then maps the gaps between what Adbeat discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Adbeat was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Requires claims extraction via CDT”
Live website analysis pending
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Adbeat
- →Require Adbeat to execute post-consent only with documented legal basis
- →Implement 30-day data retention limits for ad interaction data
- →Add competitive intelligence disclosure to privacy policy
- →Audit data sharing agreements to identify ad strategy data buyers
If You're Evaluating Adbeat
- →Assess first-party ad effectiveness measurement vs. third-party competitive intelligence
- →Review DPA for ad tracking data controller/processor responsibilities
- →Calculate competitive leakage cost: (Adbeat fee + ad strategy value to competitors)
Negotiation Leverage
- →Session recording without consent violates GDPR Article 6 - require post-consent execution or contract termination
- →Tag manager deployment without consent governance creates liability gaps - demand technical controls preventing pre-consent execution
- →Ad strategy data resale subsidizes competitor campaigns - require complete buyer list with pricing transparency and opt-out rights
- →Persistent cross-site tracking violates ePrivacy Directive - demand 30-day retention maximum with automated deletion
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Captures ad interaction patterns and engagement behaviors for competitive benchmarking. Creates GDPR personal data processing obligations without documented legal basis.
Full session replay
Impact: Records visitor sessions across publisher networks to reconstruct ad effectiveness. Every recording creates GDPR data subject access request liability requiring video reconstruction.
Ignoring CMP signals
Impact: Executes ad tracking and session recording before consent collection. Documented in pre-consent timeline analysis. Violates ePrivacy Directive cookie consent requirements.
Long-lived identifiers
Impact: Maintains cross-site advertising profiles via persistent identifiers. Extends GDPR data retention and deletion obligations across multiple domains.
Container/loader (neutral)
Impact: Deploys via GTM enabling dynamic updates without change control. Creates consent governance gaps and prevents technical enforcement of privacy controls.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
77 detection signatures across scripts, domains, cookies, and network endpoints