How This Briefing Works
This report opens with key findings, then maps the gaps between what Brandfetch discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Brandfetch was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
consent
“Pending claims extraction via CDT”
Consent bypass and persistent tracking during asset delivery detected
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Brandfetch
- →Self-host brand logos and assets to eliminate third-party tracking during content delivery
- →Configure asset loading to use privacy-preserving proxies if Brandfetch required
- →Implement Content Security Policy (CSP) headers to monitor Brandfetch tracking behavior
- →Disable Brandfetch auto-update features that create recurring tracking touchpoints
If You're Evaluating Brandfetch
- →Request DPA confirming brand asset request data is not retained or analyzed for Brandfetch analytics products
- →Verify data retention period for asset request logs
- →Assess alternative brand asset CDNs with privacy-preserving delivery
- →Demand contractual prohibition on using customer brand request patterns for Brandfetch's own market intelligence
Negotiation Leverage
- →Brandfetch consent bypass (BTI-C09) during asset loading creates tracking where users expect passive content delivery—require technical elimination of tracking from CDN requests
- →Persistent identifiers (BTI-C13) enable long-term brand usage profiling—demand contractual prohibition on retention of request logs beyond technical necessity (24-48 hours)
- →Clarify whether brand request patterns are analyzed for Brandfetch market intelligence products—negotiate opt-out if disclosed
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Ignoring CMP signals
Impact: Initializes tracking during brand asset loading before consent mechanisms engage, creating automatic legal violations for content delivery processes.
Long-lived identifiers
Impact: Maintains long-lived identifiers across asset requests to track brand usage patterns and site contexts over time.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
10 detection signatures across scripts, domains, cookies, and network endpoints