How This Briefing Works
This dossier opens with key findings, then maps the gap between what Match2one discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 1 sites
vendor fires before consent
1 HIGH
Briefing
Match2One is a programmatic advertising platform detected on 39 sites with 40 detections in our observation corpus. While programmatic platforms inherently require some client-side presence, Match2One's 29-script IOC profile is an order of magnitude beyond what standard ad tech requires. BLACKOUT analysis confirms defeat device behavior (C01), session recording (C07), consent bypass (C09), device fingerprinting (C10), persistence mechanisms (C13), and identity resolution (C14). The combination of a 48% pre-consent rate with maximum legal tail risk and CAC subsidization scores places Match2One among the highest-risk advertising vendors in our database.
What This Means For You
If you deploy Match2One, 29 separate scripts execute on your visitors' browsers — each one a potential data collection vector that your CMP must correctly manage. With a 48% pre-consent rate, nearly half your visitors experience unauthorized data collection before they can make a consent choice. The identity resolution capability means your anonymous visitors can be deanonymized and their profiles sold through programmatic channels to anyone willing to bid, including your direct competitors. You bear data controller responsibility for this entire processing chain, despite having no visibility into where the data ultimately flows.
Risk Channel Breakdown
Signal corruption score of 25 reflects Match2One's identity resolution and fingerprinting capabilities contaminating advertising attribution. Cross-device identity stitching can inflate reach and frequency metrics, distorting campaign performance data and corrupting marketing measurement models that rely on accurate audience deduplication.
Maximum CAC subsidization score (100). Match2One's 29-script infrastructure captures extensive behavioral and identity data from your site visitors. As a programmatic platform, this data directly feeds real-time bidding ecosystems where your competitors purchase targeting segments built from your visitor intelligence.
Expands attack surface
Maximum legal tail risk (100). A 48% pre-consent firing rate across 39 sites demonstrates systemic consent bypass. Combined with fingerprinting (C10) and identity resolution (C14), each pre-consent page load creates multiple regulatory violations under GDPR, ePrivacy Directive, and CCPA. The 29-script footprint makes comprehensive consent management exceptionally difficult to implement correctly.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Long-lived identifiers
PII deanonymization
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Match2one's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →