Does AdPushup require consent before its header bidding scripts fire?

Yes. AdPushup coordinates programmatic advertising auctions across dozens of demand-side platforms, setting tracking cookies and transmitting user identifiers to advertising exchanges before any auction completes. GDPR and ePrivacy require explicit opt-in consent before the AdPushup loader is permitted to run.

What happens when AdPushup loads on a publisher page?

AdPushup executes a Prebid.js-based header bidding auction contacting multiple SSPs in parallel, tests ad slot configurations via DOM manipulation, sets frequency and session cookies, collects viewability metrics, and sends bid request data to numerous third-party demand partners including Google, Magnite, and Criteo.

How does ConsentStack manage AdPushup on a publisher site?

ConsentStack blocks the AdPushup loader entirely under the marketing category until the visitor grants advertising consent. This prevents downstream exchanges from reading or setting cookies before the auction fires. Once consent is recorded, ConsentStack dynamically loads AdPushup so header bidding can begin for that session.

What tracker domains does AdPushup use?

ConsentStack has catalogued tracker domains for AdPushup including adpushup.com. These are the network destinations AdPushup's scripts contact, which a consent platform blocks until a visitor agrees.

AdPushup - Ad Optimization & Header Bidding Consent

Back to Vendor Library

Overview

AdPushup is a revenue optimization platform for digital publishers that mediates between a publisher's ad inventory and multiple programmatic demand sources. Operating as a managed service, AdPushup places scripts on publisher pages that take control of ad slot layout, run real-time bidding auctions across connected exchanges, and optimize placement configurations based on viewability and revenue data. The platform is distinct from basic ad networks: it functions as a header bidding wrapper and layout A/B testing engine simultaneously, meaning a single AdPushup integration can coordinate dozens of demand-side platforms in a single page load.

What This Script Does

Header bidding wrapper: AdPushup loads a JavaScript wrapper — typically delivered from cdn.adpushup.com — that executes Prebid.js-based header bidding auctions before the page's ad server makes its final ad call. The script contacts multiple SSPs and ad exchanges in parallel, collects bid responses within a configured timeout window, and passes the highest bids to the publisher's primary ad server (usually Google Ad Manager).

Ad layout and A/B testing: Beyond bidding, AdPushup scripts test different ad slot configurations (size, position, lazy-load thresholds) and dynamically inject winning layout variants. This involves DOM manipulation and reading viewport dimensions and scroll position.

Data collection: The scripts collect impression-level data including ad unit ID, page URL, viewport size, bid prices, winning SSP, and user agent. Viewability metrics (time-in-view, percentage visible) are measured using IntersectionObserver APIs and reported to AdPushup's analytics backend.

Cookies and identifiers: AdPushup sets cookies to track ad frequency and session context. Additionally, each connected SSP and DSP within the header bidding auction sets its own third-party cookies or reads existing ones for audience targeting. Depending on configuration, this can involve identifiers from Google, Magnite, OpenX, PubMatic, Index Exchange, and others — each with their own cookie domains and expiry windows.

Domains contacted: cdn.adpushup.com, plus bid request endpoints for each integrated exchange (e.g., prebid.adnxs.com, hbopenbid.pubmatic.com, bidder.criteo.com).

Consent & Compliance

GDPR and ePrivacy Directive: AdPushup coordinates programmatic advertising that relies on reading and writing cookies to build audience profiles for targeted ads. This requires explicit, freely given consent under the ePrivacy Directive before any cookies are set or read. Under GDPR, processing personal data for behavioral advertising requires consent under Article 6(1)(a) — legitimate interests is not a valid basis for cross-site behavioral profiling per EDPB guidance. Publishers using AdPushup are responsible for ensuring their CMP captures valid TCF consent signals before the header bidding wrapper fires. AdPushup supports IAB TCF 2.x; publishers must configure the integration to respect consent status. IAB TCF purposes involved: Purpose 1 (store/access device), Purpose 2 (basic ads), Purpose 3 (personalized ads), Purpose 4 (ad measurement), Purpose 7 (ad performance), Purpose 9 (market research).

CCPA/CPRA: The sharing of user identifiers and behavioral data with dozens of demand-side platforms during a single bidding auction constitutes "sharing" of personal information under CPRA for cross-context behavioral advertising purposes. Publishers must provide a "Do Not Sell or Share My Personal Information" opt-out mechanism and must pass a US Privacy string or GPP signal to AdPushup and all connected bidders.

EU-US Data Privacy Framework: Many DSPs connected through AdPushup are US-based and transfer EU personal data to the United States. Publishers should verify that connected demand partners are certified under the EU-US DPF or rely on SCCs.

Consent category: Marketing.

Should You Block This Without Consent?

Yes.

AdPushup and the downstream bidding ecosystem it activates set tracking cookies and transmit user identifiers to advertising platforms before the auction even completes. Firing this script without consent violates ePrivacy requirements in the EU and triggers CPRA sharing obligations in California. Block the AdPushup loader entirely until the user has granted marketing/advertising consent, then load it dynamically post-consent.

Is AdPushup GDPR compliant?

AdPushup typically loads marketing trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So AdPushup can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads AdPushup, not on AdPushup itself.

Visit website