All Vendors
data_enrichment
5×5 Data

5×5 Data

Operates a data broker cooperative that pools and sells person-level PII including ethnicity data — a GDPR special category requiring explicit consent. 67% pre-consent tracking rate with their CookieYes consent banner itself firing before consent is obtained. Trust center says "working to meet" GDPR requirements, which is not compliance.

65 IOCs3 detections67% pre-consent2 sites
90
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what 5×5 Data discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Key Findings

3 detections across 2 sites67% pre-consent activity3 critical disclosure gaps
CRITICAL

compliance_claim_mismatch

Explicitly sells ethnicity data (GDPR special category) and has 67% pre-consent tracking rate

GDPR Article 9 (Special Categories)GDPR Article 7 (Consent)ePrivacy Directive Article 5(3)
CRITICAL

consent_gap

CookieYes CMP fires pre-consent (pre_consent=true in scan data). 67% overall pre-consent rate.

ePrivacy Directive Article 5(3)GDPR Article 7
CRITICAL

subprocessor_gap

40+ third-party vendors observed including IDVisitors, Intentsify, HockeyStack, RB2B. Zero vendors disclosed by name.

GDPR Article 28GDPR Article 13(1)(e)CCPA Section 1798.140(v)
CRITICAL

Pre-Consent Activity

5×5 Data was observed loading and executing before user consent was obtained on 67% of sites where it was detected.

GDPRePrivacy
HIGH

disclosure_gap

Cooperative model means unknown number of Members receive shared PI

GDPR Article 28(2)Standard Contractual Clauses requirements
Disclosure Gaps

Claims vs. Observed Behavior

6 gaps
3 CRIT2 HIGH1 MED
Classified:BTI-X01BTI-X02BTI-X04BTI-X05BTI-X08BTI-X09BTI-X10

compliance_claim_mismatch

GDPR Article 9 (Special Categories) · GDPR Article 7 (Consent) · ePrivacy Directive Article 5(3)CRITICAL
They Claim

Trust center displays GDPR badge, states 5×5 is working to meet EU data protection requirements

Observed Behavior

Explicitly sells ethnicity data (GDPR special category) and has 67% pre-consent tracking rate

Consumer Privacy Notice admits We have sold or shared your ethnicity data. Trust center text says working to meet not compliant.

subprocessor_gap

GDPR Article 28 · GDPR Article 13(1)(e) · CCPA Section 1798.140(v)CRITICAL
They Claim

Privacy policy mentions service providers and Members generically

Observed Behavior

40+ third-party vendors observed including IDVisitors, Intentsify, HockeyStack, RB2B. Zero vendors disclosed by name.

Scan data shows 40+ distinct vendor slugs on 5x5data.com hostname

disclosure_gap

GDPR Article 28(2) · Standard Contractual Clauses requirementsHIGH
They Claim

No subprocessor list published anywhere

Observed Behavior

Cooperative model means unknown number of Members receive shared PI

Full site review found no subprocessor list. Privacy policy only mentions AWS and Snowflake as delivery partners.

claims_gap

SOC 2 Trust Service CriteriaHIGH
They Claim

SOC 2 Type I certified

Observed Behavior

Type I is point-in-time, not ongoing verification. No Type II certification.

Trust center explicitly states SOC 2 Type I, not Type II

disclosure_gap

GDPR Article 13(2)(a) · CCPA disclosure requirementsMEDIUM
They Claim

No retention period specified

Observed Behavior

Privacy policy says data retained until no longer necessary with no specific timeframe

Consumer Privacy Notice Section 5.C states until no longer necessary

Customer Impact

What This Means For You

If 5x5 Data's pixel is deployed on your site, your visitors' personally identifiable information enters a cooperative where unknown "Members" receive access to pooled identity data including names, emails, phone numbers, locations, employment history, and ethnicity. Under GDPR Art 9, ethnicity is a special category requiring explicit consent — 5x5's 67% pre-consent rate makes valid consent impossible. You cannot audit who receives your data because 5x5 does not disclose their Member list. Under CCPA §1798.140, your organization may bear shared liability for data sold through a vendor you deployed. Their SOC 2 Type I certification is point-in-time only, not the ongoing Type II verification required for enterprise due diligence.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

If You Use 5×5 Data

  • URGENT: Audit your consent implementation — 5x5's own CookieYes banner fires before consent, their pixel likely does the same on your property
  • Request complete Member list in writing — your visitors' PII is being shared with unknown cooperative participants
  • Review what data categories have been contributed from your site — 5x5 sells ethnicity data, a GDPR Article 9 special category
  • Document risk acceptance if continuing use — the cooperative model makes it impossible to audit downstream data flows
  • Consider immediate removal given GDPR special category exposure and inability to verify who receives your data

If You're Evaluating 5×5 Data

  • Request Member list disclosure as a pre-contract condition — 5x5 will likely refuse, which tells you everything about transparency
  • Demand GDPR compliance documentation — 'working to meet' requirements is not compliance and creates shared liability for you
  • Ask about ethnicity data: confirm whether your visitors' racial or ethnic data would enter the cooperative pool
  • Note they hold SOC 2 Type I only (point-in-time), not Type II (ongoing verification) — insufficient for enterprise procurement
  • Evaluate alternatives that do not operate cooperative data pooling models where your data subsidizes competitors' intelligence

Negotiation Leverage

  • Member list disclosure: 5x5 Data operates a cooperative model where unknown Members receive pooled PII. Require complete Member list disclosure as a contract precondition — you have a right to know who receives your visitors' data.
  • Ethnicity data prohibition: 5x5 explicitly admits selling ethnicity data, a GDPR Article 9 special category. Require written contractual prohibition on collecting, storing, or sharing any special category data from your visitors.
  • Pre-consent SLA: CookieYes consent banner fires before consent on their own site, producing a 67% pre-consent rate. Require contractual guarantee of 0% pre-consent data collection with independent audit verification quarterly.
  • GDPR compliance timeline: Trust center states they are 'working to meet' GDPR requirements. Require documented GDPR compliance certification with specific deadline and right to terminate without penalty if unmet.
  • Data deletion and portability: Require contractual right to demand immediate deletion of all visitor data from the cooperative pool, with written confirmation from 5x5 that data has been purged from all Member access.
Runtime Detections

Runtime Detections

7 BTI-C CODES

BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.

Advisory

BTI-2025-0024

BTI-C01Defeat Device

Evasion infrastructure, auditor bypass

BTI-C06Behavioral Biometrics

Keystroke/mouse tracking

BTI-C07Session Recording

Full session replay

BTI-C08Cross-Domain Sync

Identity stitching

BTI-C09Consent Bypass

Ignoring CMP signals

BTI-C10Fingerprinting

Device identification

BTI-C14Identity Resolution

PII deanonymization

IOC Manifest

IOC Manifest

64 INDICATORS

Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

EXFIL
*5x5data.com/wp-content/themes/nylon/assets/build/vertical-scroll-media.js*
Data collection endpoint
EXFIL
*5x5data.com/wp-content/themes/nylon/assets/build/nylon.js*
Data collection endpoint
EXFIL
*5x5data.com/wp-content/themes/nylon/assets/build/manifest.js*
Data collection endpoint
EXFIL
*5x5data.com/wp-content/themes/nylon/assets/build/vendor.js*
Data collection endpoint
EXFIL
*5x5data.com/wp-content/themes/nylon/assets/build/main.js*
Data collection endpoint
EXFIL
*5x5data.com/cdn-cgi/challenge-platform/scripts/jsd/main.js*
Data collection endpoint
EXFIL
*5x5data.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/*/main.js*
Data collection endpoint
EXFIL
5x5data.com
Data collection endpoint
EXFIL
5x5data.com/wp-content/themes/nylon/assets/build/manifest.js
Auto-extracted from scan
EXFIL
5x5data.com/wp-content/themes/nylon/assets/build/vendor.js
Auto-extracted from scan
EXFIL
5x5data.com/wp-content/themes/nylon/assets/build/nylon.js
Auto-extracted from scan
EXFIL
5x5data.com/wp-content/themes/nylon/assets/build/main.js
Auto-extracted from scan
EXFIL
5x5data.com/wp-content/themes/nylon/assets/build/vertical-scroll-media.js
Auto-extracted from scan
EXFIL
5x5data.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Auto-extracted from scan
EXFIL
5x5data.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/7f3d2ee44814/main.js
Auto-extracted from scan
Ecosystem

Ecosystem & Supply Chain

5×5 Data operates as a data broker cooperative, positioning itself as a hub where members contribute PI and receive access to pooled identity data. On their own website, they load HockeyStack, IDVisitors, Intentsify, RB2B, Fullenrich, Google Ads, MetaPixel, HubSpot, ZoomInfo-adjacent vendors, and 30+ others—creating a dense surveillance network. Their cooperative model means data flows to an unknown number of Members who pay fees for access. Key partnerships include RocketReach (announced data quality partnership) and infrastructure via AWS and Snowflake. The cooperative structure makes 5×5 a multiplier in the surveillance economy: every site using their pixel contributes data that gets redistributed to all Members, creating exponential data sharing with zero transparency about recipients.
Loads (1)
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

65 detection signatures across scripts, domains, cookies, and network endpoints

Vendor Details