Outbrain is a native advertising network founded in Delaware in 2006 whose widgets place sponsored content recommendations on publisher sites. On February 3, 2025 Outbrain Inc. completed its acquisition of Luxembourg-based TEADS from Altice, and effective June 6, 2025 renamed itself Teads Holding Co. (NASDAQ: TEAD), with Altice Teads S.A. holding roughly 46.6% of common stock; legacy Outbrain ads and Teads ads are now governed by separate privacy policies. The legacy Outbrain policy states that a UUID cookie is set on first visit to a partner site, that content consumed across partner sites is catalogued to infer interest categories and audience segments, and that profile elements are shared with DSPs, SSPs and ad exchanges — sharing it acknowledges may be considered "sales" or "sharing" under some US state laws. Ghostery's WhoTracks.me observed its tracker on 944 of the top 10,000 sites. Stated mitigations include no cross-device tracking, 90-day profile retention, an opt-out portal, and Global Privacy Control support. Its record includes a 2013 Syrian Electronic Army compromise and a 2020 Taboola merger abandoned during a UK CMA phase 2 investigation.
TRACK RECORD
1 ENFORCEMENT ACTION
[2020-09-23]
The UK Competition and Markets Authority investigated Taboola's proposed acquisition of Outbrain, found competition concerns at phase 1, and referred the deal for a phase 2 investigation on 9 July 2020; Taboola announced on 14 September 2020 that it was abandoning the purchase, and the CMA cancelled its merger reference. This was a competition matter, not a privacy enforcement action.
Outbrain's user privacy policy states that on a user's first visit to a partner site it drops a cookie to generate a UUID (or receives the device advertiser ID in apps), catalogues the content the user consumes across partner sites, and processes IP address, user-agent data and inferred interest categories and audience segments. The policy also states profile data is retained no more than 90 days from the last interaction.
The Teads user privacy policy — which governs ads served by Teads technology after the 2025 Outbrain-Teads merger — states that profile data is deleted on a rolling basis, with the last data point removed after 4 months and trusted-partner data, including audience segments, deleted after 30 days.
Since the merger, two parallel privacy policies apply: the legacy Outbrain user privacy policy governs ads served by legacy Outbrain technology, while ads powered by Teads technology are governed by the separate Teads user privacy policy — a user can only tell which applies by where the AdChoices logo on a given ad links. The split regime is disclosed on the policy hub itself.
Outbrain publicly announced the closing of its acquisition of Teads on February 3, 2025, following receipt of all necessary regulatory approvals, with the combined company operating under the Teads name and Altice, as selling shareholder, nominating two of ten board members.
Per its FY2025 Form 10-K, Outbrain Inc. (formed in Delaware in 2006) completed its acquisition of Luxembourg-based TEADS on February 3, 2025 for $625 million cash plus 43.75 million shares, after which Altice Teads S.A. owned approximately 46.6% of the company's common stock; the company renamed itself Teads Holding Co. effective June 6, 2025 and began trading as TEAD on Nasdaq on June 10, 2025.
Outbrain's cookie policy states it uses third-party advertising partners to synchronise advertising IDs to improve its interest profiles, and its cookie table lists 99 such partners for cookie syncing, including Google, The Trade Desk, Criteo and Temu.
Outbrain's privacy policy states it may share user-profile elements such as the UUID with DSPs, SSPs and ad exchanges for real-time bidding, and acknowledges that under certain US state privacy laws some of this sharing for targeted advertising may be considered "sales" or "sharing"; it offers an Interest Profile opt-out and honors the Global Privacy Control browser signal per device/browser.
The Teads user privacy policy states that while Teads does not share its user profiles with certain trusted third parties, it does share data points such as bid request data and permits those third parties to collect data directly through their own tracking technology delivered via Teads' systems.
In August 2013 the Syrian Electronic Army compromised Outbrain's systems via a phishing attack, and readers who clicked Outbrain-recommended stories on sites including the Washington Post, Time and CNN were redirected to the group's homepage until Outbrain took its network offline.
The UK Competition and Markets Authority investigated Taboola's proposed acquisition of Outbrain, found competition concerns at phase 1, and referred the deal for a phase 2 investigation on 9 July 2020; Taboola announced on 14 September 2020 that it was abandoning the purchase, and the CMA cancelled its merger reference. This was a competition matter, not a privacy enforcement action.
In its FY2025 10-K risk factors, Teads (formerly Outbrain) discloses rising GDPR-related pressure on its business, including an increasing number of individual data subject requests and, in one instance, an action filed in the Belgian courts seeking to prohibit its processing of data; the filing does not disclose the action's outcome. No completed privacy-specific regulatory fine against Outbrain was identified in this research.
Outbrain's cookie policy documents its identifier cookies: obuid holds the Outbrain UUID and tracks pages visited and clicks for personalized advertising (90-day expiry), auid holds the mobile advertising ID (90 days), and the Zemanta zuid cookie used by Outbrain's DSP persists for 1 year.
Ghostery's WhoTracks.me tracker census (data through June 2026) classifies Outbrain as an Advertising tracker using cookies, observed on 944 of the top 10,000 websites and tracking 0.77% of measured web traffic, with heaviest presence on news and portal sites.
Outbrain's privacy policy states it uses cookies, pixels and similar technologies to collect personal data, but also states that it does not conduct cross-device tracking, meaning it cannot link a user's phone activity to the same user's desktop activity.