How This Briefing Works
This dossier opens with key findings, then maps the gap between what Google AdSense discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 366 sites
vendor fires before consent
Briefing
Google AdSense is the dominant publisher-side ad network, part of Alphabet Inc.'s advertising ecosystem that includes DoubleClick, Google Ads, and Google Marketing Platform. BLACKOUT runtime analysis shows a 5.7% pre-consent tracking rate across 264 detections on 255 sites—significantly better than industry peers like AdRoll (85.4%) but technically non-zero. Unlike competitors, Google explicitly states "We never sell your personal information to anyone" and provides robust user controls through My Ad Center. The 5.7% pre-consent rate primarily reflects third-party implementation issues rather than Google's defaults, as Google provides consent integration tools (Funding Choices, CMP APIs). On Google-owned properties (adsense.google.com), detected tracking is predominantly first-party Google services. For publishers using AdSense, the risk profile is implementation-dependent—proper consent integration eliminates most compliance exposure.
What This Means For You
If Google AdSense is deployed on your site, your compliance exposure is largely implementation-dependent. Google provides robust consent integration tools including Funding Choices and Consent Mode v2 — when properly configured, these can achieve near-zero pre-consent rates. Unlike competitors, Google explicitly does not sell personal information, keeping data within Alphabet's ecosystem. Under GDPR Art 7, you remain responsible for ensuring AdSense loads after consent on your property. The 5.7% pre-consent rate observed in the wild primarily reflects publisher implementation gaps, not Google's defaults. Your primary risk is proper CMP integration, not vendor behavior.
Risk Channel Breakdown
AdSense attribution is generally reliable within Google's ecosystem, though cross-platform attribution accuracy depends on consent implementation. Google's walled garden approach means data stays within their measurement system.
Unlike competitors, Google explicitly does not sell personal information. Data remains within Alphabet's ecosystem rather than flowing to external data brokers. This is a meaningful differentiator.
As a Google property, AdSense inherits Alphabet's security infrastructure. Attack surface is well-documented and extensively audited. Third-party vendors on adsense.google.com (Scrapemagic, Bytemine) warrant investigation.
5.7% pre-consent rate is implementation-dependent. Google provides consent tools (Funding Choices, CMP integration) that, when properly implemented, can achieve full compliance. Risk is on the publisher, not Google.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Long-lived identifiers
PII deanonymization
Container/loader (neutral)
Claims-vs-Reality (BTI-X)
False certification claims
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Google AdSense's public claims against observed runtime behavior and identified 2 contradictions.
"Google-owned properties should only load Google services"
adsense.google.com loads non-Google third parties including Scrapemagic, Bytemine, Lavender, Scoreplex, Upcell
1 more gap — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →