AdPushup

Overview

AdPushup is a revenue optimization platform for digital publishers that mediates between a publisher's ad inventory and multiple programmatic demand sources. Operating as a managed service, AdPushup places scripts on publisher pages that take control of ad slot layout, run real-time bidding auctions across connected exchanges, and optimize placement configurations based on viewability and revenue data. The platform is distinct from basic ad networks: it functions as a header bidding wrapper and layout A/B testing engine simultaneously, meaning a single AdPushup integration can coordinate dozens of demand-side platforms in a single page load.

What This Script Does

Header bidding wrapper: AdPushup loads a JavaScript wrapper — typically delivered from cdn.adpushup.com — that executes Prebid.js-based header bidding auctions before the page's ad server makes its final ad call. The script contacts multiple SSPs and ad exchanges in parallel, collects bid responses within a configured timeout window, and passes the highest bids to the publisher's primary ad server (usually Google Ad Manager).

Ad layout and A/B testing: Beyond bidding, AdPushup scripts test different ad slot configurations (size, position, lazy-load thresholds) and dynamically inject winning layout variants. This involves DOM manipulation and reading viewport dimensions and scroll position.

Data collection: The scripts collect impression-level data including ad unit ID, page URL, viewport size, bid prices, winning SSP, and user agent. Viewability metrics (time-in-view, percentage visible) are measured using IntersectionObserver APIs and reported to AdPushup's analytics backend.

Cookies and identifiers: AdPushup sets cookies to track ad frequency and session context. Additionally, each connected SSP and DSP within the header bidding auction sets its own third-party cookies or reads existing ones for audience targeting. Depending on configuration, this can involve identifiers from Google, Magnite, OpenX, PubMatic, Index Exchange, and others — each with their own cookie domains and expiry windows.

Domains contacted: cdn.adpushup.com, plus bid request endpoints for each integrated exchange (e.g., prebid.adnxs.com, hbopenbid.pubmatic.com, bidder.criteo.com).

Consent & Compliance

GDPR and ePrivacy Directive: AdPushup coordinates programmatic advertising that relies on reading and writing cookies to build audience profiles for targeted ads. This requires explicit, freely given consent under the ePrivacy Directive before any cookies are set or read. Under GDPR, processing personal data for behavioral advertising requires consent under Article 6(1)(a) — legitimate interests is not a valid basis for cross-site behavioral profiling per EDPB guidance. Publishers using AdPushup are responsible for ensuring their CMP captures valid TCF consent signals before the header bidding wrapper fires. AdPushup supports IAB TCF 2.x; publishers must configure the integration to respect consent status. IAB TCF purposes involved: Purpose 1 (store/access device), Purpose 2 (basic ads), Purpose 3 (personalized ads), Purpose 4 (ad measurement), Purpose 7 (ad performance), Purpose 9 (market research).

CCPA/CPRA: The sharing of user identifiers and behavioral data with dozens of demand-side platforms during a single bidding auction constitutes "sharing" of personal information under CPRA for cross-context behavioral advertising purposes. Publishers must provide a "Do Not Sell or Share My Personal Information" opt-out mechanism and must pass a US Privacy string or GPP signal to AdPushup and all connected bidders.

EU-US Data Privacy Framework: Many DSPs connected through AdPushup are US-based and transfer EU personal data to the United States. Publishers should verify that connected demand partners are certified under the EU-US DPF or rely on SCCs.

Consent category: Marketing.

Should You Block This Without Consent?

Yes.

AdPushup and the downstream bidding ecosystem it activates set tracking cookies and transmit user identifiers to advertising platforms before the auction even completes. Firing this script without consent violates ePrivacy requirements in the EU and triggers CPRA sharing obligations in California. Block the AdPushup loader entirely until the user has granted marketing/advertising consent, then load it dynamically post-consent.