How This Briefing Works
This report opens with key findings, then maps the gaps between what Adgoji discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Adgoji was observed loading and executing before user consent was obtained on 41% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Requires claims extraction via CDT”
Live website analysis pending
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Adgoji
- →Require Adgoji to execute post-consent only with explicit identity resolution disclosure
- →Implement immediate data deletion for identity-matched sessions upon visitor request
- →Add identity resolution disclosure to privacy policy with clear opt-out mechanism
- →Audit data sharing agreements to identify identity graph buyers
If You're Evaluating Adgoji
- →Review DPA for identity resolution data controller/processor responsibilities
- →Assess first-party attribution vs. third-party identity matching risk
- →Calculate competitive leakage cost: (Adgoji fee + identified visitor list value to competitors)
Negotiation Leverage
- →Identity resolution without consent violates GDPR Article 6 - require explicit opt-in or contract termination
- →Session recording creates data breach liability - demand encryption at rest and in transit with annual security audits
- →Identity graphs sold to third parties subsidize competitor prospecting - require complete buyer list with pricing transparency
- →Linking anonymous to personal data triggers retroactive GDPR obligations - demand legal opinion on joint controller liability
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Full session replay
Impact: Records visitor sessions to track ad-to-conversion attribution paths. Every recording creates GDPR data subject access request liability and breach notification obligations if storage compromised.
Ignoring CMP signals
Impact: Executes session recording and identity matching before consent collection. Documented in pre-consent timeline analysis. Creates strict liability under ePrivacy Directive.
PII deanonymization
Impact: Links anonymous ad interactions to email addresses and CRM records. Converts pseudonymous tracking data to personal data, triggering retroactive GDPR compliance obligations for all historical sessions.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
39 detection signatures across scripts, domains, cookies, and network endpoints