How This Briefing Works
This dossier opens with key findings, then maps the gap between what Crunchbase discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 1 sites
vendor fires before consent
1 HIGH
Briefing
Crunchbase is a business data enrichment platform detected across 14 deployments on 13 sites. BLACKOUT identified 8 behavioral threat codes — the maximum count in this analysis group — including defeat device infrastructure (C01), behavioral biometrics (C06), session recording (C07), cross-domain sync (C08), consent bypass (C09), fingerprinting (C10), identity resolution (C14), and tag management (C15). The defining characteristic is a 100% pre-consent firing rate: Crunchbase initiates its full behavioral collection stack on every page load before any consent interaction occurs. With 4 cookies, cross-domain sync, and identity resolution, Crunchbase is performing data enrichment operations that go far beyond what sites typically expect from a business data widget.
What This Means For You
If Crunchbase is deployed on your site, every visitor is being subjected to behavioral biometrics, session recording, and identity resolution on every single page load — before they ever see a consent prompt. Your high-value business visitors are being deanonymized and their identity data feeds into Crunchbase's enrichment platform, effectively making your site a free data collection point for Crunchbase's commercial products. The 100% pre-consent rate means there is no CMP configuration that currently prevents this — Crunchbase fires regardless of consent state. You face unavoidable per-pageview regulatory violations in every jurisdiction with consent requirements.
Risk Channel Breakdown
Signal corruption score of 40 reflects Crunchbase's cross-domain sync and identity resolution distorting the boundary between business data enrichment and visitor surveillance. When your site embeds Crunchbase, you expect company data lookups — not behavioral biometrics and session recording feeding a cross-domain identity graph.
Maximum CAC subsidization score (100) indicates Crunchbase's identity resolution (C14) and cross-domain sync (C08) across 13 observed sites creates a channel where your visitor intelligence flows into Crunchbase's enrichment platform. Business visitors identified on your site become data points in Crunchbase's product — your traffic enriches their database.
Expands attack surface
Maximum legal tail risk (100) driven by the 100% pre-consent firing rate — the highest possible. Every single deployment fires before consent, meaning there is zero consent coverage for Crunchbase's behavioral collection. Combined with cross-domain sync, this creates per-pageview violations under GDPR, ePrivacy, and CCPA with no mitigation path short of blocking Crunchbase entirely.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Crunchbase's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 0, observed 1
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →