How This Briefing Works
This report opens with key findings, then maps the gaps between what CrazyEgg discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
CrazyEgg was observed loading and executing before user consent was obtained on 59% of sites where it was detected.
Vendor Disclosure
20+ vendors detected including Airtable, HubSpot, Intentdata, Semcasting, Rockerbox, Dreamdata, Peer39
Pre-Consent Loading
58.8% of CrazyEgg detections are pre-consent on client sites
Undisclosed Party
Not in privacy policy
Undisclosed Sharing
Hidden data recipients
Claims vs. Observed Behavior
Vendor Disclosure
“Cookie policy lists Google Analytics, Facebook, DoubleClick, Drip, CloudFlare”
20+ vendors detected including Airtable, HubSpot, Intentdata, Semcasting, Rockerbox, Dreamdata, Peer39
Runtime scan vs cookie policy comparison
Pre-Consent Loading
“GDPR compliance claimed in privacy policy”
58.8% of CrazyEgg detections are pre-consent on client sites
intel_detections query: AVG(pre_consent)=0.588
Missing Subprocessor List
“Privacy policy mentions third-party data processors”
No public subprocessor list available despite identity resolution vendors observed
404 on /subprocessors, /dpa endpoints
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use CrazyEgg
- →Audit consent timing — verify Crazy Egg loads AFTER consent granted given their 58.8% pre-consent rate
- →Review your privacy policy — ensure Crazy Egg and its 20+ observed third parties are disclosed
- →Request subprocessor list and compare against intent data vendors detected on their site
- →Implement server-side consent gating to prevent Crazy Egg from loading before consent
If You're Evaluating CrazyEgg
- →Test Crazy Egg implementation in staging and audit all network requests
- →Compare with Hotjar and FullStory on pre-consent behavior and vendor disclosure transparency
- →Require contractual guarantees that session recording data will not flow to intent data brokers
- →Verify Crazy Egg GDPR compliance claims against 58.8% pre-consent rate evidence
Negotiation Leverage
- →Intent data broker presence: Intentdata, Semcasting, and Rockerbox on crazyegg.com — use this to negotiate restrictions on behavioral data sharing with intent data vendors
- →58.8% pre-consent rate: More than half of tracking fires before consent — leverage for consent architecture guarantees and contractual termination rights
- →12+ undisclosed vendors: Cookie policy lists 5 vendors while 20+ detected — require complete vendor disclosure as a contract condition
- →Session recording sensitivity: Heatmap and session data captures granular user behavior — negotiate enhanced data protection, retention limits, and restrictions on data enrichment
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
10 detection signatures across scripts, domains, cookies, and network endpoints