How This Briefing Works
This report opens with key findings, then maps the gaps between what AWeber discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Analysis pending. Findings will appear here once intelligence collection is complete.
Claims vs. Observed Behavior
pending
“Awaiting scanner verification”
Runtime behavior not yet observed
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
Recommended Actions for AWeber
- →• Audit all pages where the AWeber Email Web Analytics snippet is installed and verify it fires only after valid consent • Review AWeber's third-party ad network data sharing and determine if your subscribers' behavioral data is being used for advertising purposes • Implement server-side email tracking where possible to reduce client-side tracking surface • Evaluate whether Page Hit Automations are tagging subscribers based on pre-consent page visits • Review all Zapier/integration workflows to map where subscriber data flows beyond AWeber
Negotiation Leverage
- →Key leverage: AWeber's ad network partnership creates data sharing that most customers are unaware of — request explicit disclosure of which ad partners receive behavioral data from your account. Ask for a DPA amendment that restricts use of your subscriber data for third-party advertising. During renewal, request contractual confirmation that Email Web Analytics data is not used to train AWeber's own models or shared with ad partners. Key questions: (1) Which specific ad networks receive data collected via the tracking snippet? (2) Can ad network data sharing be disabled at the account level? (3) What is the retention period for cross-site behavioral data? Protections to negotiate: data processing restriction clauses, right to audit sub-processor list, contractual prohibition on using customer subscriber data for AWeber's own advertising partnerships.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Email Web Analytics explicitly tracks subscriber movement across multiple websites when the snippet is installed on more than one property, correlating email identity with cross-site browsing behavior.
Identity stitching
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
24 detection signatures across scripts, domains, cookies, and network endpoints