How This Briefing Works
This report opens with key findings, then maps the gaps between what Brightdata discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Brightdata was observed loading and executing before user consent was obtained on 18% of sites where it was detected.
Claims vs. Observed Behavior
consent
“Pending claims extraction via CDT”
Session recording, behavioral biometrics, consent bypass, and persistence detected—creating maximum tracking profile
disclosure
“Pending privacy policy review”
Session recording and behavioral tracking observed—explicit disclosure required to avoid wiretapping liability
purpose
“Pending use case verification”
Detection pattern suggests visitor tracking, not web scraping—requires immediate audit
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Brightdata
- →IMMEDIATE: Audit all Bright Data deployments to verify legitimate web scraping vs. visitor tracking use cases
- →Disable ALL session recording and behavioral tracking features if platform is being used for competitive intelligence
- →Implement strict consent-gating if Bright Data is being used for visitor identification (not recommended)
- →Configure data retention to absolute minimum (24-48 hours) for any retained interaction data
- →Deploy comprehensive privacy policy disclosures for any Bright Data tracking (session recording requires explicit disclosure)
- →Conduct legal review of state wiretapping laws if session recording is deployed
- →Consider complete removal if platform is being used for undisclosed visitor surveillance
If You're Evaluating Brightdata
- →Request DPA with explicit scope limitations on data collection, retention, and cross-customer enrichment
- →Verify Bright Data will not use customer site interaction data for its own data marketplace products
- →Demand contractual indemnification for regulatory fines and wiretapping liability arising from session recording
- →Assess alternative web scraping services that do NOT include visitor tracking capabilities
- →Require technical audit of Bright Data deployment to verify no persistent identifiers or session recording active
- →Negotiate right to immediate data deletion for all captured sessions upon request
Negotiation Leverage
- →Bright Data session recording (BTI-C07) creates wiretapping liability—require immediate technical verification that recording features are disabled or demand contractual indemnification for state law violations
- →Behavioral biometrics (BTI-C06) combined with persistence (BTI-C13) enables extensive cross-site profiling—if visitor tracking is use case, require explicit consent implementation or discontinue deployment
- →Consent bypass (BTI-C09) with session recording active creates maximum regulatory exposure—demand technical implementation of consent verification before ANY tracking activation
- →Clarify whether customer interaction data is retained in Bright Data's data products or marketplace—demand contractual prohibition and deletion of historical data
- →Request documentation on data retention periods, geographic storage locations, and subprocessor access (proxy network raises concerns about data jurisdiction)
- →Negotiate maximum 48-hour retention for any interaction data with automated deletion and cryptographic verification
- →If Bright Data is being used for web scraping (not visitor tracking), demand technical controls preventing accidental activation of tracking features
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Captures mouse movements, scroll patterns, keystroke dynamics, and interaction timing to build unique visitor fingerprints for cross-site identification.
Full session replay
Impact: Records complete user sessions including form interactions, navigation patterns, and on-page behavior—creating potential capture of sensitive data without consent.
Ignoring CMP signals
Impact: Initializes comprehensive tracking infrastructure before any consent collection, creating automatic legal violations across all jurisdictions.
Long-lived identifiers
Impact: Maintains long-lived identifiers across sessions and devices to enable continuous visitor tracking and profile enrichment over extended periods.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
129 detection signatures across scripts, domains, cookies, and network endpoints