How This Briefing Works
This dossier opens with key findings, then maps the gap between what Bidvertiser discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 1 sites
vendor fires before consent
1 CRIT · 2 HIGH
Briefing
BidVertiser is an Israeli advertising network operated by Bpath LTD since 2008, specializing in direct navigation, pop-unders, push notifications, and native ads. The vendor openly admits to using browser fingerprinting for "unique user delivery" while claiming GDPR compliance. Runtime analysis reveals a 35.5% pre-consent tracking rate and numerous undisclosed third-party vendors including identity resolution services (Contactout, Firmable) on their own website. The privacy policy dates from 2018 and explicitly states they do not honor Do Not Track signals.
What This Means For You
YOUR publisher inventory served through BidVertiser includes browser fingerprinting that YOUR users cannot opt out of through standard cookie controls. YOUR visitors are fingerprinted for "unique user delivery" — a tracking method that persists across cookie deletion and private browsing. YOUR regulatory exposure is heightened because fingerprinting requires explicit consent under ePrivacy Directive Article 5(3), yet BidVertiser's undisclosed identity resolution vendors Contactout and Firmable further compromise YOUR consent framework. YOUR privacy policy cannot accurately disclose data flows when BidVertiser's own subprocessor list names only Cloudflare.
Risk Channel Breakdown
As an ad network, BidVertiser corrupts measurement by injecting fingerprinting-based tracking that persists across sessions regardless of cookie deletion. Their admission of accurate fingerprinting for unique user delivery means attribution data is polluted by persistent identification that users cannot control.
BidVertiser operates as a demand aggregator connecting advertisers to publishers. Traffic patterns and conversion data flowing through their network expose competitive intelligence. Identity resolution vendors (Contactout, Firmable) detected on their own site suggest B2B data leakage pathways.
Pop-under and injection-based ad formats create attack surface through code injection. Their stated malware scanning and fraud detection cannot fully mitigate risks from the injection pops format they offer. The 2018-dated privacy policy suggests security posture may be equally outdated.
Explicit DNT non-compliance combined with 35.5% pre-consent tracking creates direct regulatory exposure under GDPR. The gap between claimed GDPR compliance and observed behavior (pre-consent fingerprinting, undisclosed vendors) represents material misrepresentation risk for customers relying on their compliance claims.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Device identification
Claims-vs-Reality (BTI-X)
Not in privacy policy
Hidden data recipients
False certification claims
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Bidvertiser's public claims against observed runtime behavior and identified 4 contradictions.
"GDPR compliance claimed in privacy policy"
Homepage explicitly states: Unique user delivery guaranteed by our accurate fingerprinting
3 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 3, observed 3
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →