Keitaro’s updated terms let it share user data with authorities

Keitaro’s updated Terms of Use take effect October 13, published September 29, and they expand exactly what the ad tracker collects from every installation while formally reserving the right to hand that data to authorities. According to the company’s own terms, telemetry now explicitly covers the IP addresses of a user’s server infrastructure, the domain names configured within their instance, technical metadata about the installation itself, and the names assigned to campaigns, offers, and flows. That data can be cross-referenced against telemetry from other Keitaro installations specifically to detect policy violations and sanctions circumvention, meaning a pattern that looks fine on one instance can still get flagged by matching it against what the company sees elsewhere on its own platform.

Keitaro draws a clear line around what telemetry doesn’t touch: creative assets, traffic data, targeting parameters, and anything classified as end-user data processed by the program stay out of scope under the current terms. Blocking, filtering, or spoofing the telemetry stream itself is now a material breach of the agreement, though the company built in some slack for ordinary technical failures, giving users seven to fourteen calendar days to restore transmission before treating an outage as a violation. Retention sits at two years for routine telemetry, extending to three years when the data relates to a suspected policy violation, fraud investigation, or sanctions matter, and longer still if a law requires it.

The verification process is where the terms get genuinely strict. If Keitaro has reasonable grounds to suspect a campaign violates EU restrictive measures, it can demand source-of-funds documentation and proof of beneficial ownership, triggering KYC or KYB checks on the account holder. Users get at least seven calendar days to respond, with one possible seven-day extension, but if verification isn’t wrapped up within fourteen days of the original request, Keitaro can terminate the contract outright, and fees already paid aren’t refunded when that happens. None of this is unusual in isolation, financial platforms run similar checks constantly, but a traffic tracker building sanctions-screening infrastructure into its core terms signals how much EU enforcement pressure has reached tools that sit upstream of the gambling and finance operators affiliates actually promote. The final clause makes the direction of that pressure explicit: Keitaro reserves the right to disclose user data to government bodies, courts, and law enforcement in response to lawful requests, a standard legal-compliance provision that nonetheless marks a shift from a tool historically associated with cloaking and traffic obfuscation toward one now built to cooperate with the authorities its own users have often been trying to avoid.