How This Briefing Works
This report opens with key findings, then maps the gaps between what Basis discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Basis was observed loading and executing before user consent was obtained on 95% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Requires claims extraction via CDT”
Live website analysis pending
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Basis
- →Immediate contract termination - no compliant configuration possible with this threat profile
- →Engage legal counsel for joint controller liability assessment under GDPR Article 26
- →Submit GDPR data deletion request for all session recordings, behavioral profiles, and identity-resolved data
- →Conduct Data Protection Impact Assessment for any future DSP deployment
- →Audit RTB data sharing agreements to identify downstream competitive intelligence buyers
- →Calculate total cost: (Basis fees + competitive intelligence leakage + GDPR liability exposure)
If You're Evaluating Basis
- →Replace with consent-first marketing automation (HubSpot with privacy controls, Marketo with strict data governance)
- →Assess first-party intent signals vs. third-party behavioral surveillance
- →Review all historical campaign data for GDPR Article 17 deletion obligations
- →Evaluate contextual advertising vs. behavioral targeting to eliminate tracking infrastructure
- →Consider litigation risk from GDPR Article 82 private right of action for data subjects
Negotiation Leverage
- →Session recording and behavioral biometrics without consent violate GDPR Article 6 and Article 9 - contract is legally unenforceable under EU law
- →Identity resolution triggers retroactive GDPR obligations for all historical data - demand legal opinion on joint controller liability and potential regulator notification obligations
- →Tag manager deployment without consent governance makes site operator joint controller under GDPR Article 26 - require DPA amendment or contract termination
- →RTB data sharing reveals complete campaign strategy to competitors - demand full audit of ad exchange data distribution with buyer identification and pricing transparency
- →Persistent tracking extends GDPR liability window across customer lifecycle - no compliant retention policy possible without fundamental architecture changes
- →Behavioral biometrics constitute special category data under GDPR Article 9 - require Data Protection Impact Assessment showing legitimate interest override or explicit consent (neither likely achievable)
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Captures keystroke dynamics, mouse patterns, scroll behaviors, and engagement micro-signals for audience profiling and intent scoring. Creates GDPR Article 9 special category data processing violations requiring explicit consent and Data Protection Impact Assessment.
Full session replay
Impact: Records complete visitor sessions across marketing funnel for conversion attribution and journey optimization. Every recording creates GDPR data breach notification obligations if storage compromised and data subject access request liability requiring video reconstruction.
Ignoring CMP signals
Impact: Executes full surveillance stack before consent collection including session recording, behavioral tracking, and identity resolution. Documented in pre-consent timeline analysis. Violates GDPR Article 6 and ePrivacy Directive creating strict liability.
Long-lived identifiers
Impact: Maintains cross-session audience profiles via deterministic and probabilistic matching. Persistent identifiers extend GDPR data retention and deletion obligations across entire customer lifecycle spanning months or years.
PII deanonymization
Impact: Links anonymous sessions to email addresses, CRM records, and third-party identity graphs. Converts pseudonymous tracking to personal data, triggering full GDPR obligations retroactively for all historical sessions tied to resolved identity.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
86 detection signatures across scripts, domains, cookies, and network endpoints