How This Briefing Works
This report opens with key findings, then maps the gaps between what Appcues discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Consent Bypass
22 vendors loading pre-consent (50% rate)
Pre-Consent Activity
Appcues was observed loading and executing before user consent was obtained on 50% of sites where it was detected.
Undisclosed Processing
Identity resolution and advertising vendors not disclosed
Subprocessor Gap
Marketing and identity vendors not in subprocessor list
Undisclosed Party
Not in privacy policy
Claims vs. Observed Behavior
Consent Bypass
“GDPR/CCPA compliance with CookieYes CMP”
22 vendors loading pre-consent (50% rate)
Runtime scan of appcues.com shows Clearbit, Criteo, MetaPixel, etc. loading before consent
Undisclosed Processing
“Privacy policy describes data processing scope”
Identity resolution and advertising vendors not disclosed
Clearbit, Leadfeeder, Dealfront, Criteo, MetaPixel, DoubleClick observed but not in policy
Subprocessor Gap
“Subprocessor list at trust.appcues.com”
Marketing and identity vendors not in subprocessor list
22 vendors detected vs limited subprocessor disclosure
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Appcues
- →Audit your Appcues implementation for pre-consent script loading — if their own site has 50% pre-consent rate, verify your deployment is not inheriting the same behavior
- →Review what user behavior data Appcues captures and map downstream flows to third parties
- →Update your privacy policy and subprocessor list to account for Appcues' actual vendor dependencies
- →Implement server-side consent gating for Appcues scripts rather than relying on client-side CMP
If You're Evaluating Appcues
- →Request Appcues' SOC2 Type II report and verify third-party vendor management controls
- →Compare with Pendo and WalkMe on pre-consent behavior and vendor disclosure practices
- →Test Appcues in a staging environment and audit all network requests before deployment
- →Require contractual guarantees on consent timing and third-party data sharing restrictions
Negotiation Leverage
- →Pre-consent vendor count: 22 vendors fire before consent on appcues.com including Clearbit, Leadfeeder, and Dealfront — use this to negotiate consent timing guarantees for your implementation
- →SOC2 compliance gap: Appcues claims SOC2 Type II yet loads identity resolution vendors pre-consent — request their latest SOC2 report and compare against runtime behavior
- →Identity resolution exposure: Clearbit, Leadfeeder, and Dealfront on appcues.com mean visitor identification happens before consent — negotiate contractual restrictions on identity resolution in your deployment
- →CookieYes CMP bypass: Despite deploying CookieYes, 50% of vendors fire pre-consent — leverage this to require server-side consent enforcement rather than client-side CMP
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Ignoring CMP signals
Device identification
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
23 detection signatures across scripts, domains, cookies, and network endpoints