How This Briefing Works
This dossier opens with key findings, then maps the gap between what Crisp discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 8 sites
vendor fires before consent
1 CRIT · 2 HIGH
Briefing
Crisp is a French customer support platform (chat widget, shared inbox, CRM) founded in 2015 and bootstrapped from Nantes, France. Despite claiming strict GDPR implementation, BLACKOUT runtime scans reveal 30 undisclosed third-party vendors operating on crisp.chat, with 6 loading before user consent including major ad platforms (Google, Meta, LinkedIn, Twitter). The company publishes no subprocessor list despite GDPR Article 28 requirements. Their own website demonstrates a 53.8% pre-consent tracking rate, directly contradicting their compliance claims.
What This Means For You
If Crisp's chat widget is deployed on your site, you inherit a vendor that claims strict GDPR compliance while running 30 undisclosed third-party vendors on their own site at a 53.8% pre-consent rate. Under GDPR Art 28, Crisp is required to provide a subprocessor list — they do not publish one. Six vendors fire before consent on crisp.chat including DoubleClick, MetaPixel, LinkedIn, and PostHog, suggesting their JavaScript may not respect your CMP signals. The presence of B2B deanonymization vendors (RB2B, HockeyStack, Usergems, Hunter, Pitchbook) on their site means visitors evaluating Crisp are being identified for sales targeting — a practice that may extend to sites embedding their chat widget. You cannot verify Crisp's compliance claims without a published subprocessor list.
Risk Channel Breakdown
Crisp deploys PostHog and GoogleAnalytics4 on their own site, feeding behavioral data to external analytics. Sites using Crisp inherit this measurement pollution - their customer interaction data flows through Crisp servers which may be instrumented with these same trackers, corrupting attribution accuracy.
The presence of B2B deanonymization vendors (RB2B, HockeyStack, Usergems, Hunter, Pitchbook) on crisp.chat suggests Crisp engages in visitor identification practices. Customer chat sessions may leak company/visitor identity to competing sales intelligence platforms.
Crisp chat widget loads on customer sites, creating a third-party JavaScript dependency. The 30 additional vendors detected on crisp.chat suggest aggressive tracking infrastructure that could be mirrored in their embeddable widget, expanding attack surface for sites deploying Crisp.
Critical consent divergence: Crisp claims GDPR compliance but operates 6 pre-consent trackers including ad pixels. Sites embedding Crisp may inherit liability for Crisps own consent violations. No published subprocessor list despite GDPR Article 28 mandating this disclosure.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
Claims-vs-Reality (BTI-X)
Not in privacy policy
Hidden data recipients
False certification claims
Data to undisclosed regions
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Crisp's public claims against observed runtime behavior and identified 4 contradictions.
"Crisp strictly implements the GDPR regulation"
53.8% pre-consent tracking rate with 6 ad/tracking vendors loading before consent
3 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
googletagmanager, metapixel, vector…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →