How This Briefing Works
This report opens with key findings, then maps the gaps between what Albacross discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Albacross was observed loading and executing before user consent was obtained on 86% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Requires claims extraction via CDT”
Live website analysis pending
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Albacross
- →Require Albacross to execute post-consent only with explicit identity resolution disclosure
- →Implement immediate data deletion for identified visitors upon request
- →Add IP tracking and identity resolution disclosure to privacy policy with opt-out mechanism
- →Audit data sharing agreements to identify visitor list buyers
If You're Evaluating Albacross
- →Review DPA for identity resolution data controller/processor responsibilities
- →Assess first-party visitor identification vs. third-party IP matching risk
- →Calculate competitive leakage cost: (Albacross fee + identified visitor list value to competitors)
Negotiation Leverage
- →Identity resolution without consent violates GDPR Article 6 - require explicit opt-in or contract termination
- →Tag manager deployment creates liability gaps - demand technical controls preventing pre-consent execution
- →Identified visitor lists sold to competitors subsidize prospecting - require complete buyer list with pricing transparency and opt-out rights
- →IP tracking converts anonymous traffic to personal data - demand legal opinion on controller/processor responsibilities
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Ignoring CMP signals
Impact: Executes IP tracking and identity resolution before consent collection. Violates ePrivacy Directive and GDPR consent requirements.
PII deanonymization
Impact: Links IP addresses to company accounts and individual contacts via reverse lookup databases. Converts anonymous traffic to identified prospects, triggering full GDPR personal data obligations.
Container/loader (neutral)
Impact: Deploys via tag management system enabling dynamic updates without change control. Creates consent governance gaps and prevents technical enforcement of privacy controls.
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
23 detection signatures across scripts, domains, cookies, and network endpoints