QA mode · Tier:PUBLIC(override via ?tier=paid | premium)
← All Vendors
advertising

DoubleClick

Google's ad serving backbone fires across 243 monitored sites with a 52% pre-consent rate, triggering 7 distinct BTI behavioral codes including cross-domain identity stitching and consent bypass.

10 IOCs observed503 detections55% pre-consent336 sites
85
Vendor Risk Score
Tier: HOSTILE
Observation Coverage

BLACKOUT observes runtime behavior in the browser. This dossier reflects browser-side execution, which is one of five vendor data-egress classes. Server-to-server transfers, backend integrations, and offline data flows are outside this observation boundary.

BLACKOUT observes runtime behavior and cites the regulations that address that behavior pattern. Legal determinations are the customer's counsel's call.

How This Briefing Works

This dossier opens with key findings, then maps the gap between what DoubleClick discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.

Key Findings

At a Glance

Detections
503

across 336 sites

Pre-Consent Rate
55%

vendor fires before consent

Disclosure Gaps
1

1 HIGH

Summary

Briefing

DoubleClick, now operating as Google Ad Manager, is Google's primary ad serving and tracking infrastructure. BLACKOUT detected it on 243 sites across 362 total detections, making it the second most prevalent advertising vendor in our monitoring corpus. With 7 BTI-C codes triggered — including defeat device behavior (C01), cross-domain sync (C08), and identity resolution (C14) — DoubleClick operates a full-spectrum tracking pipeline that stitches user identity across Google's entire ad network. The 52% pre-consent firing rate means more than half of observed deployments activate before any consent mechanism engages.

Customer Impact

What This Means For You

If DoubleClick is running on your site, your visitors' behavioral data flows into Google's advertising ecosystem where it becomes available to any advertiser — including your direct competitors. The 52% pre-consent firing rate means your site likely violates ePrivacy requirements regardless of your CMP configuration. With 7 BTI-C codes triggered, you face compounding regulatory exposure: GDPR fines for unlawful cross-domain data sharing, ePrivacy penalties for pre-consent tracking, and potential CCPA violations for undisclosed sale of personal information. Your privacy policy almost certainly does not disclose the full scope of identity stitching and cross-domain synchronization occurring through DoubleClick.

Collapse Engine

Risk Channel Breakdown

Oracle
Truth Collapse
40

Signal corruption score of 40 reflects DoubleClick's role in distorting attribution data. As an intermediary in Google's ad network, it injects measurement signals that blend first-party analytics with third-party ad tracking, making it difficult to distinguish organic engagement from paid amplification.

Broker
Control Collapse
100

CAC subsidization score of 100 — maximum severity. DoubleClick's cross-domain sync (C08) and identity resolution (C14) feed user behavioral data back into Google's advertising ecosystem. Every site running DoubleClick contributes visitor intelligence to Google's demand-side platform, where competitors can purchase targeting segments built from your audience data.

Reaper
Safety Collapse
0

Expands attack surface

Counselor
Legitimacy Collapse
100

Legal tail risk score of 100 — maximum severity. The 52% pre-consent firing rate directly violates ePrivacy Directive requirements for prior consent. Cross-domain identity stitching without explicit user authorization creates GDPR Article 6 exposure. DoubleClick's defeat device behavior (C01) suggests awareness of consent requirements paired with systematic circumvention.

BTI Codes

Threat Indicators

Runtime-observed (BTI-C)

BTI-C01
Defeat Device

Evasion infrastructure, auditor bypass

BTI-C06
Behavioral Biometrics

Keystroke/mouse tracking

BTI-C08
Cross-Domain Sync

Identity stitching

BTI-C09
Consent Bypass

Ignoring CMP signals

BTI-C10
Fingerprinting

Device identification

BTI-C13
Persistence Mechanisms

Long-lived identifiers

BTI-C14
Identity Resolution

PII deanonymization

7
BTI Consequences Identified

Per-code narrative explanations of what each detected behavior means for your organization

Available in VIDB Subscription

Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →

Disclosure Gaps

Claims vs. Reality

1
Gaps Observed
1 HIGH

BLACKOUT analyzed DoubleClick's public claims against observed runtime behavior and identified 1 contradiction.

Available in VIDB Subscription

Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →

Recommended Actions

What To Do

Recommended Actions
8

4 for current users · 4 for evaluators

Negotiation Leverage
5

contractual leverage points

Available in VIDB Subscription

Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →

Ecosystem

Supply Chain & Pairings

Commonly Paired With
10

googleanalytics4, googletagmanager, linkedinads

Available in VIDB Subscription

Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →

Profile: doubleclickFirst Seen: 2025-12-28Last Updated: 2026-05-21