CHEQ

Overview

CHEQ is a go-to-market security and ad fraud prevention platform. Its scripts are deployed on advertiser and publisher websites to analyze incoming traffic in real time, distinguishing human visitors from bots, scrapers, and invalid click sources. CHEQ is commonly found on landing pages, paid-search destinations, and lead generation forms where fraudulent traffic causes direct financial harm to advertisers.

What This Script Does

The CHEQ script (typically cheq.js or loaded from a *.cheqzone.com domain) executes behavioral and environmental analysis in the browser immediately on page load. It collects a wide range of signals to build a risk assessment for each visitor session.

Signals analyzed include: browser fingerprint characteristics (user agent, canvas rendering, WebGL renderer, installed fonts, screen dimensions), mouse movement patterns and interaction velocity, network characteristics (IP address, ASN, whether the connection appears to be a proxy or datacenter), page referrer, and timing of user interactions relative to page load. These signals are submitted to CHEQ's real-time classification API, which returns a risk verdict used to allow, flag, or block the visitor.

CHEQ may set a session cookie or a short-lived identifier to avoid re-analyzing the same browser within a session. Device fingerprinting is a core component of CHEQ's detection methodology and does not rely on cookie consent to function — fingerprints are computed from browser environment properties without writing to persistent storage.

The CHEQ script operates primarily as a fraud-signal collector; it does not display content or modify the page for legitimate visitors.

Consent & Compliance

CHEQ's consent posture is nuanced. The fraud-prevention function has a legitimate business rationale, but the technical implementation involves extensive device fingerprinting, which regulators — particularly the CNIL and the ICO — have determined requires consent when used for any purpose beyond strictly necessary security functions.

Under ePrivacy Article 5(3), any reading of or writing to a user's terminal equipment requires consent unless strictly necessary. CHEQ argues its processing falls under the security necessity exemption, but this position is contested when the same fingerprint data is used to enrich advertiser analytics dashboards or retargeting suppression lists, rather than solely blocking individual bot sessions.

Under GDPR, the legal basis for real-time fraud detection is typically legitimate interest (Article 6(1)(f)), provided the processing is genuinely limited to security purposes and a balancing test is documented. If CHEQ data feeds marketing or attribution reporting, the legitimate-interest basis becomes harder to defend.

Under CCPA/CPRA, device fingerprinting data constitutes personal information. Security-purpose processing may be exempt from opt-out rights, but only if the data is not used for advertising or commercial profiling.

The consent category is mixed (essential/analytics). Pure bot-blocking is essential; analytics enrichment requires consent.

Should You Block This Without Consent?

Conditional. If CHEQ is deployed strictly for real-time bot blocking and invalid-click prevention with no data feeding marketing or analytics pipelines, it can be treated as essential and loaded without prior consent. If CHEQ data contributes to analytics dashboards, retargeting lists, or ad-performance attribution, it must be gated behind analytics or marketing consent. Review your CHEQ data processing agreement to determine which use cases are active.