How This Briefing Works
This dossier opens with key findings, then maps the gap between what 5×5 Data discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 2 sites
vendor fires before consent
3 CRIT · 2 HIGH
Briefing
5×5 Data is a Texas-registered data broker operating an identity resolution "cooperative" where members pool and share person-level PII including names, emails, phone numbers, locations, employment history, and even ethnicity data. Runtime observation on their own website shows a 67% pre-consent tracking rate with their CookieYes consent banner itself firing before consent is granted. Their trust center claims they are "working to meet" GDPR requirements—which is not compliance—while simultaneously selling sensitive personal information including ethnicity data, a special category under GDPR. For any company whose data has been contributed to this cooperative, your visitors' PII is being sold to an unknown number of "Members" with zero transparency about who those Members are.
What This Means For You
If 5x5 Data's pixel is deployed on your site, your visitors' personally identifiable information enters a cooperative where unknown "Members" receive access to pooled identity data including names, emails, phone numbers, locations, employment history, and ethnicity. Under GDPR Art 9, ethnicity is a special category requiring explicit consent — 5x5's 67% pre-consent rate makes valid consent impossible. You cannot audit who receives your data because 5x5 does not disclose their Member list. Under CCPA §1798.140, your organization may bear shared liability for data sold through a vendor you deployed. Their SOC 2 Type I certification is point-in-time only, not the ongoing Type II verification required for enterprise due diligence.
Risk Channel Breakdown
Your attribution data becomes part of a shared pool where competitors can access visitor intelligence you paid to acquire, corrupting your measurement by creating invisible competitive leakage.
Your visitor identification data flows into a cooperative where unknown Members receive access to your leads. 5×5 explicitly admits to selling and sharing PI—your demand signals are being redistributed to competitors.
Embedding 5×5 tracking creates shadow data flows to 40+ undisclosed third parties observed on their own site including IDVisitors, Intentsify, and RB2B. Your security perimeter now extends to every cooperative Member.
5×5 claims to be working toward GDPR compliance while selling ethnicity data—a GDPR special category requiring explicit consent. Their 67% pre-consent rate and CMP that fires before consent creates direct regulatory exposure for anyone using their pixel.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Claims-vs-Reality (BTI-X)
Not in privacy policy
Hidden data recipients
Behavior contradicts marketing
False certification claims
Collection exceeds disclosed scope
Security claims vs evidence
CMP vendor list vs runtime
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed 5×5 Data's public claims against observed runtime behavior and identified 6 contradictions.
"Trust center displays GDPR badge, states 5×5 is working to meet EU data protection requirements"
Explicitly sells ethnicity data (GDPR special category) and has 67% pre-consent tracking rate
5 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →