ClickGuard

What ClickGuard is

ClickGuard is a click fraud protection service for pay per click advertising, mainly Google Ads and Microsoft Ads. It is sold as software as a service by a company that publishes a postal address in Wilmington, Delaware, United States. Advertisers connect their ad accounts, install a JavaScript tracking code on their website, and ClickGuard then scores every click, flags bots, competitors and repeat clickers, and pushes IP exclusions back into the ad platform automatically.

Many people find the tool by searching for ClickGuard analytics: the dashboard shows click quality, invalid traffic rates, live monitoring of paid and organic visits and conversion data. That reporting is only possible because the tracking code observes each visitor on the advertiser's own site, which is what makes ClickGuard relevant for privacy compliance.

Data and cookies it collects

According to ClickGuard's GDPR information, the service processes the IP address, operating system, browser, IP based geolocation, time on site, on site interactions and an anonymised or hashed browser fingerprint. The tracking code is designed to recognise the unique device behind a click and follow it across repeated clicks, and it also tracks organic traffic, not only ad clicks. ClickGuard also adds a tracking template and a final URL suffix to the advertiser's Google Ads account so that click parameters reach its servers.

ClickGuard does not publish a list of cookie names or durations for its tracking code. Its privacy policy mentions cookies, scripts and HTML5 local storage in general terms, so site owners should scan their own pages after installation to see which identifiers are actually written. The conversion script is loaded from pulse.clickguard.com and the dashboard runs on app.clickguard.com.

GDPR and ePrivacy implications

Device fingerprinting and storing identifiers both count as accessing information on the user's terminal equipment under Art. 5(3) of the ePrivacy Directive 2002/58/EC, transposed in France by the rules the CNIL enforces, in Germany by TDDDG § 25 and in Spain by LSSI CE art. 22.2. The data is personal data under the GDPR because an IP address combined with a fingerprint singles out a device. ClickGuard describes itself as a processor and its customers as controllers, so the advertiser carries the responsibility for transparency, legal basis and a signed processing agreement, which ClickGuard offers as a public DPA accepted with its terms of service.

Consent requirements

ClickGuard relies on legitimate interest for fraud detection, but that only covers the processing on its servers. The access to the device is governed by ePrivacy rules, which exempt only what is strictly necessary for a service explicitly requested by the visitor. Protecting an advertiser's budget is not something the visitor asked for, so in practice the tracking code should be blocked until the visitor accepts the relevant category in the cookie banner. Expect some loss of coverage: ClickGuard itself notes that consent settings can prevent it from logging clicks.

Data transfers outside the EEA

ClickGuard states that it may transfer and process data outside the EU, particularly in the United States. It relies on Standard Contractual Clauses under Decision (EU) 2021/914 and supplementary measures such as encryption, and its public pages do not mention a certification under the EU US Data Privacy Framework. After the Schrems II ruling, the advertiser should keep a transfer impact assessment on file and check the DPA for the list of sub processors and hosting locations.

Practical compliance steps

Load the ClickGuard tracking code through your consent management platform or Google Tag Manager with a consent trigger, in the marketing or advertising category, and never directly in the page template. Describe ClickGuard in your privacy notice and cookie policy, including the fingerprinting, the automatic IP blocking and the US transfer. Accept the DPA, document the retention period, and run a DPIA if you track organic traffic at scale. Finally, verify with a browser scan that no request to clickguard.com domains leaves the page before consent.