Outstanding. It's like a ridiculous Law & Order episode where the defendant goes "I wasn't even in town that night."

"So what's your face doing on all of these security cameras at the scene of the crime?"

"... uh..."

so just to be clear, because I find this hard to believe, they are straight up, 100% lying? Or is this taking some hash generating code out of context or something?

It's hard to judge without digging into this spaghetti mess of files. But having the word retarget in your code seems like straight up lying to me.

Tracking is more ambiguous a word and I couldn't find where they define the userid. But however it is generated, it reads like it's unique. And in order to retarget users, you'd have to track which products they've viewed in the first place, that would imply storing browsing history (they deny storing user info as well) and uniquely identifying users across websites.

Given the coding style, I don't think the person(s) who wrote this code is/are doing anything clever other than what it seems.

Not to be too snarky, but I don't think I'd trust somebody who wrote that function to have code where one could "not find any evidence to substantiate security concerns."

Perhaps this is some sort of style thing specific to javascript, but wouldn't:

    function isRetargetingEnabled(){
        return (similarproducts.b.enableRetargetingUnit &&
                !isRetargetingBlackList());
    }

be the better way to write it? Sure say what you want about micro-optimizations, but the function appears to be used in a boolean context, so shouldn't it just return the if condition? Things like this are why I have trouble trusting security claims.

EDIT: Fixed double-negative

I like your style better, but your function doesn't return 0 || 1 (yours returns true || false).

I also wouldn't read too much into it. It's unlikely that the same person wrote all the code involved, and many smart people I know write these kinds of functions, no matter how much I complain about it.

LOL