All Vendors
advertising

AdRoll

85.4% pre-consent tracking rate — one of the highest observed — while marketing a "privacy-forward future." Privacy policy explicitly admits: "we have sold personal information in the form of business emails." Own website loads 64 third-party vendors with 34 firing pre-consent, including BrightData (web scraping) and data brokers.

121 IOCs41 detections85% pre-consent39 sites
90
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what AdRoll discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Key Findings

41 detections across 39 sites85% pre-consent activity3 critical disclosure gaps
CRITICAL

claims_gap

85.4% pre-consent tracking rate. 34 vendors fire before consent on own website. Privacy policy admits to SELLING personal information.

GDPR Article 7CCPA Section 1798.100ePrivacy Directive
CRITICAL

disclosure_gap

64 third-party vendors detected on adroll.com including BrightData, Clearbit, ZoomInfo, Demandbase, Clarity, Contentsquare, Criteo, and 50+ others

GDPR Article 13GDPR Article 28CCPA Section 1798.140
CRITICAL

compliance_gap

Explicit admission of selling personal information in privacy policy. SOC2 Privacy principle cannot coexist with a data sales business model.

SOC2 Trust Services Criteria - PrivacyAICPA TSP Section 100
CRITICAL

Pre-Consent Activity

AdRoll was observed loading and executing before user consent was obtained on 85% of sites where it was detected.

GDPRePrivacy
HIGH

consent_gap

Own website (adroll.com) has no visible CMP while loading 64 vendors, 34 pre-consent. BrightData and session recording fire before any consent mechanism.

GDPR Article 7ePrivacy Directive Article 5(3)
Disclosure Gaps

Claims vs. Observed Behavior

4 gaps
3 CRIT1 HIGH
Classified:BTI-X01BTI-X02BTI-X04BTI-X05BTI-X08BTI-X09BTI-X10

claims_gap

GDPR Article 7 · CCPA Section 1798.100 · ePrivacy DirectiveCRITICAL
They Claim

“Homepage: 'Keep ROI flowing without compromising consumer trust. Our technology keeps ads relevant — and performant — in a privacy-forward future.'”

Observed Behavior

85.4% pre-consent tracking rate. 34 vendors fire before consent on own website. Privacy policy admits to SELLING personal information.

Runtime pre_consent rate + Privacy policy Section: In the preceding twelve months we have sold...

disclosure_gap

GDPR Article 13 · GDPR Article 28 · CCPA Section 1798.140CRITICAL
They Claim

“Privacy policy discloses 4 Audience Partners: Bombora, Experian, Eyeota, LiveRamp”

Observed Behavior

64 third-party vendors detected on adroll.com including BrightData, Clearbit, ZoomInfo, Demandbase, Clarity, Contentsquare, Criteo, and 50+ others

Runtime vendor detection vs disclosed partner list

compliance_gap

SOC2 Trust Services Criteria - Privacy · AICPA TSP Section 100CRITICAL
They Claim

“Trust Center: SOC2 Type 2 Audit (Security and Privacy) with no exceptions”

Observed Behavior

Explicit admission of selling personal information in privacy policy. SOC2 Privacy principle cannot coexist with a data sales business model.

Trust center SOC2 claim + Privacy policy data sales admission

Customer Impact

What This Means For You

If AdRoll retargeting is deployed on your site, their pixel fires before consent on 85.4% of observed implementations — one of the highest pre-consent rates in our detection network. Under GDPR Art 7, this creates near-certain consent violations on EU traffic. AdRoll explicitly admits to selling business emails, meaning your visitors' data may enter a commercial data marketplace. Their audience data flows to Experian (credit bureau), Bombora (intent data), Eyeota, and LiveRamp — your customer signals become competitor intelligence through these partnerships. AdRoll's own website loads 64 third-party vendors with 34 firing pre-consent including BrightData (web scraping), demonstrating that privacy-forward positioning is marketing language, not operational reality. Any conversions attributed to AdRoll from EU or California traffic are legally tainted by pre-consent tracking.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

If You Use AdRoll

  • →IMMEDIATE: Audit your AdRoll implementation — 85.4% pre-consent rate means your pixel almost certainly fires before consent on EU traffic
  • →Request in writing the full list of data recipients beyond the 4 disclosed Audience Partners (Bombora, Experian, Eyeota, LiveRamp)
  • →Request written confirmation that your customer data is NOT being sold — their privacy policy admits to selling business emails
  • →Review your DPA to ensure contract explicitly prohibits sale of data derived from your visitors
  • →Discount any EU/CA conversions attributed to AdRoll where pre-consent tracking makes consent chain legally questionable

If You're Evaluating AdRoll

  • →Ask why AdRoll's own website fires 34 vendors pre-consent while marketing a 'privacy-forward future'
  • →Request complete data flow documentation showing where your customer data goes beyond retargeting
  • →Require contractual prohibition on data sale — their default terms allow selling personal information
  • →Factor in joint regulatory liability: 85.4% pre-consent rate with admitted data sale creates one of the highest compliance risk profiles we observe
  • →Consider retargeting alternatives that do not sell personal data and maintain sub-10% pre-consent rates

Negotiation Leverage

  • →Pre-consent SLA: 85.4% pre-consent rate makes GDPR compliance nearly impossible with current implementation. Require contractual guarantee of 0% pre-consent activity with liquidated damages, and mandate server-side integration to replace client-side pixel.
  • →Data sale prohibition: AdRoll admits to selling personal information in the form of business emails. Require contractual prohibition on selling, sharing, or enriching any data derived from your visitors with third parties.
  • →Data partner restriction: AdRoll shares data with Experian, Bombora, Eyeota, and LiveRamp. Require contractual right to approve or reject each data partner that receives your visitor data, with 30-day advance notice before additions.
  • →BrightData relationship: BrightData (web scraping service) loads on adroll.com. Require written explanation of this relationship and contractual guarantee that BrightData is not involved in any data processing related to your account.
  • →Attribution audit rights: Given 85.4% pre-consent rate, Criteo-attributed conversions from EU/CA traffic may be legally invalid. Require access to raw conversion data with consent timestamps for independent attribution verification.
Runtime Detections

Runtime Detections

8 BTI-C CODES

BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.

BTI-C01Defeat Device

Evasion infrastructure, auditor bypass

BTI-C06Behavioral Biometrics

Keystroke/mouse tracking

BTI-C07Session Recording

Full session replay

BTI-C08Cross-Domain Sync

Identity stitching

BTI-C09Consent Bypass

Ignoring CMP signals

BTI-C10Fingerprinting

Device identification

BTI-C14Identity Resolution

PII deanonymization

BTI-C15Tag Manager

Container/loader (neutral)

IOC Manifest

IOC Manifest

89 INDICATORS

Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

TRACK
*www.adroll.com/js/site.js*
Tracking script
TRACK
*www.adroll.com/js/site/*.js*
Tracking script
TRACK
*s.adroll.com/j/VMYZUWPHFRH37EAOEU2EQS/roundtrip.js*
Tracking script
TRACK
*d.adroll.com/consent/check/VMYZUWPHFRH37EAOEU2EQS*
Tracking script
TRACK
*s.adroll.com/j/sendrolling.js*
Tracking script
TRACK
*ipv4.d.adroll.com/user_attrs*
Tracking script
TRACK
*s.adroll.com/j/clarity.js*
Tracking script
TRACK
www.adroll.com/js/site.js
Auto-extracted from scan
TRACK
s.adroll.com/j/VMYZUWPHFRH37EAOEU2EQS/roundtrip.js
Auto-extracted from scan
TRACK
www.adroll.com/js/site/2779.js
Auto-extracted from scan
TRACK
www.adroll.com/js/site/7926.js
Auto-extracted from scan
TRACK
www.adroll.com/js/site/7072.js
Auto-extracted from scan
TRACK
d.adroll.com/consent/check/VMYZUWPHFRH37EAOEU2EQS
Auto-extracted from scan
TRACK
ipv4.d.adroll.com/user_attrs
Auto-extracted from scan
TRACK
s.adroll.com/j/sendrolling.js
Auto-extracted from scan
TRACK
s.adroll.com/j/clarity.js
Auto-extracted from scan
Ecosystem

Ecosystem & Supply Chain

AdRoll/NextRoll operates as a major node in the surveillance adtech ecosystem, connecting advertisers to a vast network of data brokers and identity resolution services. Their disclosed partners—Bombora (B2B intent data), Experian (credit bureau/data broker), Eyeota (audience data), and LiveRamp (identity graph)—represent the core data enrichment supply chain. Runtime detection on adroll.com reveals deeper connections: Clearbit and ZoomInfo (visitor de-anonymization), Demandbase (ABM/identity), BrightData (web scraping infrastructure), and Criteo (competitor retargeting). Session recording via Clarity and Contentsquare captures detailed user behavior. The presence of BrightData—a company known for ethically controversial data collection—on AdRoll's own website suggests data sourcing practices that extend beyond standard advertising partnerships. AdRoll's explicit admission of selling business emails positions them as both a service provider AND a data broker, creating conflict of interest between serving customers and monetizing customer data.
Loaded By (5)
AdbeatAdiantGoogletagmanagerEmailableSegment
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

121 detection signatures across scripts, domains, cookies, and network endpoints

Vendor Details