How This Briefing Works
This dossier opens with key findings, then maps the gap between what Infolinks discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 2 sites
vendor fires before consent
Briefing
Infolinks converts webpage text into advertising inventory through JavaScript-based keyword detection and link injection. Their technology survives standard ad blocking by dynamically modifying page content after load, creating persistent tracking infrastructure that operates outside user consent frameworks.
What This Means For You
Marketing teams report distorted engagement metrics as in-text ad clicks register as content engagement. Product teams face UX degradation complaints. Legal teams inherit GDPR exposure from consent bypass and defeat device deployment. Revenue impact: every Infolinks impression subsidizes competitor acquisition while corrupting your attribution model.
Risk Channel Breakdown
In-text ad injection corrupts user behavior signals by introducing synthetic engagement patterns. Clicks intended for content become ad clicks, poisoning conversion attribution and A/B test validity at 25/100 corruption rate.
Every Infolinks click feeds competing advertisers while degrading your site experience. CAC subsidization reaches 90/100 as users engage with competitor offers embedded in your content.
Expands attack surface
Defeat device deployment (C01) combined with consent bypass (C09) creates maximum legal exposure at 100/100. GDPR Article 25 violations likely given behavioral biometrics and session recording without explicit consent.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Device identification
Container/loader (neutral)
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Infolinks's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
3 for current users · 3 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →