How This Briefing Works
This dossier opens with key findings, then maps the gap between what Buyercaddy discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 1 sites
vendor fires before consent
1 HIGH
Briefing
BuyerCaddy is an e-commerce shopping and advertising platform detected across 27 deployments on 24 sites. BLACKOUT identified 6 behavioral threat codes including defeat device infrastructure (C01), behavioral biometrics (C06), session recording (C07), consent bypass (C09), fingerprinting (C10), and identity resolution (C14). The 50-script IOC footprint is the highest in the entire VRS 90 tier, yet the platform drops zero cookies — suggesting a deliberate shift to script-based tracking that avoids cookie-consent obligations. With maximum scores for CAC subsidization and legal tail risk, BuyerCaddy represents substantial hidden exposure beneath a shopping experience wrapper.
What This Means For You
If BuyerCaddy is deployed on your site, your shoppers are being profiled through 50 distinct scripts that capture behavioral biometrics and session recordings under the guise of a shopping experience. The zero-cookie architecture means your consent management platform likely does not gate BuyerCaddy's tracking — their data collection may operate entirely outside your consent framework. Identity resolution means your customers' shopping behavior is being deanonymized and that identity-linked purchase intent data may flow across BuyerCaddy's 24-site network. Your DPA almost certainly does not account for this scope of data processing.
Risk Channel Breakdown
Signal corruption score of 25 reflects BuyerCaddy's behavioral biometrics and session recording distorting the line between shopping assistance and user surveillance. Purchase intent signals become contaminated with identity-linked behavioral profiles that extend well beyond transaction facilitation.
Maximum CAC subsidization score (100) indicates BuyerCaddy's identity resolution capability (C14) across 24 observed sites creates a cross-site intelligence channel. Shopping behavior and purchase intent data resolved to identities on your site may inform competitive targeting across BuyerCaddy's network.
Expands attack surface
Maximum legal tail risk (100) driven by consent bypass (C09), fingerprinting (C10), and a 50-script footprint that operates without cookies. The zero-cookie approach may circumvent cookie consent mechanisms while still performing equivalent tracking through scripts — a strategy that creates novel regulatory exposure under ePrivacy Directive Article 5(3).
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Device identification
PII deanonymization
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Buyercaddy's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →