Who's Tracking You? Use This New Service to Find Out
DecryptAds is a free, newly launched service that scrapes and correlates adtech disclosure files (ads.txt, app-ads.txt, buyers.json/sellers.json) to reveal the full advertising ecosystem behind any website or app The tool approaches adtech from a security and privacy perspective, enabling detection of malicious ads, adversarial-nation ad networks, and AI-generated "slop" sites Cross-referencing multiple declaration files is essential, as supply-chain integrity issues manifest as broken cross-ref
Analysis
TL;DR
- DecryptAds is a free, newly launched service that scrapes and correlates adtech disclosure files (ads.txt, app-ads.txt, buyers.json/sellers.json) to reveal the full advertising ecosystem behind any website or app
- The tool approaches adtech from a security and privacy perspective, enabling detection of malicious ads, adversarial-nation ad networks, and AI-generated "slop" sites
- Cross-referencing multiple declaration files is essential, as supply-chain integrity issues manifest as broken cross-references, cloned declarations, and unauthorized reseller paths that single files cannot reveal
- A case study of espn.com uncovered 143 ad partners and 19 registered data brokers, with nearly half collecting geolocation data and some harvesting device fingerprints and sensitive personal information
- The service flags "geo-risk" ad partners, revealing that entities like Between Digital—linked to Russian banking infrastructure—serve ads on major U.S. military news sites and operate as both publisher and reseller, creating conflicts of interest
Why It Matters
DecryptAds addresses a critical transparency gap in the adtech industry by making semi-public but fragmented disclosure files accessible and actionable for security and privacy professionals. As ad supply chains grow increasingly complex and opaque, tools that can correlate data across multiple declaration files are essential for detecting malicious actors, supply-chain fraud, and foreign-backed data harvesting operations.
Technical Details
- DecryptAds continuously scrapes publicly available adtech disclosure files: ads.txt (website ad partners), app-ads.txt (mobile and smart TV ad partners), and buyers.json/sellers.json (entities buying, selling, or reselling ad inventory)
- The platform cross-references these files to identify supply-chain integrity issues such as broken cross-references, cloned declaration sets across unrelated domains, seller removals visible only across exchanges, and bid-log supply paths absent from authorized seller lists
- The service aggregates state-level data broker registration data from California, Oregon, Texas, and Vermont to identify entities collecting consumer data
- DecryptAds includes a "Geo Risk" classification system that flags adtech partners based in adversarial nations (China, Russia) or countries with strong financial/political ties to them (Cyprus, UAE)
- The tool visualizes complex ad supply chains, as demonstrated by its detailed profile of espn.com showing 143 ad partners and 19 data brokers with their respective data collection practices
Industry Insight
- Adtech supply-chain transparency is becoming a security imperative; organizations should adopt tools like DecryptAds to audit their own ad partners and detect compromised or adversarial entities in their inventory
- The Between Digital case illustrates the risk of dual-role resellers who operate on both sides of the bidding equation, creating conflicts of interest that can siphon ad spend—industry watchdogs and auditors should scrutinize such arrangements
- Growing state-level data broker registration laws are gradually exposing the scale of consumer data harvesting, but comprehensive visibility will require broader regulatory mandates and continued third-party monitoring tools
Disclaimer: The above content is generated by AI and is for reference only.