All Vendors
dsp

Benchmedia

Benchmedia operates as a programmatic advertising platform with significant consent and behavioral tracking violations. The platform demonstrates consent bypass behavior while maintaining persistent cross-site tracking capabilities.

109 IOCs11 detections9% pre-consent11 sites
70
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what Benchmedia discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Key Findings

11 detections across 11 sites9% pre-consent activity
MEDIUM

Pre-Consent Activity

Benchmedia was observed loading and executing before user consent was obtained on 9% of sites where it was detected.

GDPRePrivacy
Disclosure Gaps

Claims vs. Observed Behavior

2 gaps

disclosure

HIGH
They Claim

“Pending privacy policy review”

Observed Behavior

Behavioral biometrics and session recording observed without disclosure verification

Customer Impact

What This Means For You

Customers face regulatory exposure from consent violations, with potential fines up to 4% of global revenue under GDPR or $7,500 per violation under CCPA. Behavioral biometrics collection without disclosure creates additional liability under state privacy laws. Session recording functionality may capture sensitive form data, creating data breach notification obligations.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

If You Use Benchmedia

  • →Implement server-side consent verification before Benchmedia initialization
  • →Deploy consent management platform (CMP) with explicit opt-in for behavioral tracking
  • →Configure tag manager rules to block Benchmedia until consent granted
  • →Enable privacy-preserving ad targeting modes if available
  • →Conduct quarterly audits of tracking behavior vs. privacy policy disclosures

If You're Evaluating Benchmedia

  • →Request Data Processing Agreement (DPA) with behavioral tracking scope definitions
  • →Require vendor attestation on consent mechanism compliance
  • →Verify IAB Transparency & Consent Framework (TCF) v2.2 implementation
  • →Demand contractual liability protection for regulatory fines
  • →Consider alternative DSP platforms with consent-first architecture

Negotiation Leverage

  • →Benchmedia behavioral biometrics collection (BTI-C06) operates without consent verification—require contractual commitment to honor consent signals
  • →Session recording functionality (BTI-C07) must be disabled by default with explicit opt-in requirement
  • →Consent bypass behavior (BTI-C09) creates direct regulatory exposure—demand indemnification for GDPR/CCPA fines arising from vendor non-compliance
  • →Request technical documentation on data retention periods and deletion procedures for behavioral profiles
  • →Negotiate right to audit vendor compliance with consent directives on quarterly basis
Runtime Detections

Runtime Detections

4 BTI-C CODES

BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.

BTI-C06Behavioral Biometrics

Keystroke/mouse tracking

Impact: Captures mouse movements, scroll depth, and interaction patterns to build unique user fingerprints, enabling cross-site tracking even when cookies are cleared.

BTI-C07Session Recording

Full session replay

Impact: Records user interactions during ad engagement, capturing behavioral data that can reconstruct user journeys and preferences without explicit consent.

BTI-C08Cross-Domain Sync

Identity stitching

BTI-C09Consent Bypass

Ignoring CMP signals

Impact: Initializes tracking mechanisms before consent is collected, creating automatic GDPR/CCPA violations and exposing customers to regulatory action.

IOC Manifest

IOC Manifest

101 INDICATORS

Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

TRACK
*benchmedia.com/wp-includes/js/jquery/jquery-migrate.js*
Tracking script
TRACK
*benchmedia.com/wp-includes/js/jquery/jquery.js*
Tracking script
TRACK
*benchmedia.com/wp-content/plugins/the-events-calendar/common/build/js/user-agent.js*
Tracking script
TRACK
*benchmedia.com/wp-content/plugins/impeka-wpb-extension/assets/js/ext-extras.js*
Tracking script
TRACK
*benchmedia.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.js*
Tracking script
TRACK
*benchmedia.com/wp-content/plugins/impeka-wpb-extension/assets/js/ext-elements.js*
Tracking script
TRACK
*benchmedia.com/wp-content/plugins/js_composer/assets/js/dist/js_composer_front.js*
Tracking script
TRACK
*benchmedia.com/wp-content/themes/impeka/js/main.js*
Tracking script
TRACK
*benchmedia.com/wp-content/themes/impeka/js/extras.js*
Tracking script
TRACK
*benchmedia.com/wp-content/plugins/activecampaign-subscription-forms/site_tracking.js*
Tracking script
TRACK
*benchmedia.com/cdn-cgi/challenge-platform/scripts/jsd/main.js*
Tracking script
TRACK
*benchmedia.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/*/main.js*
Tracking script
TRACK
benchmedia.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js
Auto-extracted from scan
TRACK
benchmedia.com/wp-includes/js/jquery/jquery.min.js
Auto-extracted from scan
TRACK
benchmedia.com/wp-includes/js/jquery/jquery-migrate.min.js
Auto-extracted from scan
TRACK
benchmedia.com/wp-content/plugins/the-events-calendar/common/build/js/user-agent.js
Auto-extracted from scan
TRACK
benchmedia.com/wp-content/plugins/activecampaign-subscription-forms/site_tracking.js
Auto-extracted from scan
TRACK
benchmedia.com/wp-content/themes/impeka/js/extras.min.js
Auto-extracted from scan
TRACK
benchmedia.com/wp-content/themes/impeka/js/main.min.js
Auto-extracted from scan
TRACK
benchmedia.com/wp-content/plugins/impeka-wpb-extension/assets/js/ext-extras.min.js
Auto-extracted from scan
TRACK
benchmedia.com/wp-content/plugins/impeka-wpb-extension/assets/js/ext-elements.min.js
Auto-extracted from scan
TRACK
benchmedia.com/wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js
Auto-extracted from scan
TRACK
benchmedia.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Auto-extracted from scan
TRACK
benchmedia.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/7f3d2ee44814/main.js
Auto-extracted from scan
Ecosystem

Ecosystem & Supply Chain

Benchmedia operates within the programmatic advertising ecosystem, typically deployed through tag managers or header bidding wrappers. The platform integrates with ad exchanges, supply-side platforms (SSPs), and demand-side platforms (DSPs) to facilitate real-time bidding. Data flows bidirectionally with ad tech partners for user matching and campaign optimization.
Loads (1)
Activecampaign
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

109 detection signatures across scripts, domains, cookies, and network endpoints

Vendor Details