How This Briefing Works
This report opens with key findings, then maps the gaps between what Crunchbase discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Crunchbase was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Pending Analysis
8 BTI behavioral codes detected with 100% pre-consent firing rate. Full claims extraction required for gap analysis.
Claims vs. Observed Behavior
Pending Analysis
“Claims analysis pending”
8 BTI behavioral codes detected with 100% pre-consent firing rate. Full claims extraction required for gap analysis.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Crunchbase
- →Verify immediately whether Crunchbase is firing before your CMP — 100% pre-consent rate means your consent implementation is not gating their collection
- →Audit your DPA with Crunchbase for coverage of behavioral biometrics, session recording, and cross-domain sync — capabilities that likely exceed your agreement scope
- →Request from Crunchbase a complete accounting of how visitor data from your site is used in their enrichment products
- →Assess joint controller liability exposure under GDPR Art. 26 given cross-domain identity sync
If You're Evaluating Crunchbase
- →Require Crunchbase to implement consent-gating as a precondition before any deployment on your properties
- →Demand contractual prohibition on using visitor data collected from your site in Crunchbase's commercial enrichment products
- →Evaluate server-side Crunchbase data integration as an alternative that eliminates client-side behavioral collection entirely
- →Consider whether business data display value justifies the regulatory and intelligence leakage exposure
Negotiation Leverage
- →100% pre-consent firing rate is the most aggressive in this analysis group — document as evidence of systematic consent violation and demand immediate technical remediation
- →8 BTI behavioral codes is the highest count in this group — use to justify comprehensive DPA renegotiation with enhanced audit rights
- →Cross-domain sync + identity resolution means your visitor data enriches Crunchbase's commercial products — demand either data use restrictions or revenue sharing for the intelligence you provide
- →Crunchbase's brand recognition creates leverage — they cannot afford public disclosure of 100% pre-consent behavioral surveillance on embedded widgets
- →Server-side API alternative exists — use as negotiation baseline: either fix client-side consent compliance or you migrate to server-side integration
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Evasion infrastructure on a platform with 100% pre-consent firing means Crunchbase may present differently during audits than in production — particularly concerning given the gap between expected functionality (business data) and actual behavior (full behavioral surveillance).
Keystroke/mouse tracking
Impact: Keystroke and mouse tracking from a business data enrichment platform is fundamentally outside user expectations. Visitors interacting with Crunchbase company data do not expect their behavioral patterns to be captured and profiled.
Full session replay
Impact: Full session replay from a data enrichment widget means Crunchbase captures complete user sessions — including interactions with other parts of your site beyond Crunchbase content. This data feeds into their enrichment platform.
Identity stitching
Impact: Identity stitching across domains means business professionals visiting your site are correlated with their activity across Crunchbase's 13-site deployment network. This effectively turns your site into a data collection point for Crunchbase's business intelligence products.
Ignoring CMP signals
Impact: 100% pre-consent rate means there is no consent coverage whatsoever. Every page load on every observed deployment fires Crunchbase's full collection stack before consent — creating unavoidable per-pageview regulatory violations.
Device identification
Impact: Device fingerprinting enables persistent identification of business visitors across sessions and devices, feeding Crunchbase's enrichment capabilities while circumventing privacy controls your visitors rely on.
PII deanonymization
Impact: PII deanonymization means your site visitors — particularly high-value business professionals — are being identified and that identity data flows into Crunchbase's enrichment platform. You are effectively providing free visitor intelligence to Crunchbase.
Container/loader (neutral)
Impact: Tag management infrastructure serves as the delivery mechanism for Crunchbase's behavioral collection and cross-domain sync capabilities, often loading additional resources beyond the core business data widget.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
88 detection signatures across scripts, domains, cookies, and network endpoints