How This Briefing Works
This report opens with key findings, then maps the gaps between what Datadog RUM discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Consent Architecture
96% of detected trackers load before consent on datadoghq.com
Pre-Consent Activity
Datadog RUM was observed loading and executing before user consent was obtained on 96% of sites where it was detected.
Subprocessor Disclosure
42+ third-party vendors detected on corporate website
Data Sharing Transparency
Advertising networks (Criteo, Meta, Google, Reddit) receive pre-consent data
Undisclosed Party
Not in privacy policy
Claims vs. Observed Behavior
Consent Architecture
“GDPR compliant per Trust Center”
96% of detected trackers load before consent on datadoghq.com
Runtime scan shows 42 pre-consent third-party trackers including advertising networks and visitor ID platforms
Subprocessor Disclosure
“12 subprocessors listed (infrastructure/support only)”
42+ third-party vendors detected on corporate website
Subprocessor list at datadoghq.com/legal/subprocessors/ omits all advertising, analytics, and visitor identification vendors
Data Sharing Transparency
“Privacy policy references data sharing for business purposes”
Advertising networks (Criteo, Meta, Google, Reddit) receive pre-consent data
Runtime detection of advertising pixels loading before consent interaction
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Datadog RUM
- →Audit your tag architecture — ensure Datadog RUM SDK loads only after valid consent, given their 96% pre-consent rate on their own site
- →Review data retention settings in your Datadog console — defaults may exceed your organization's data retention policy
- →Verify session replay is disabled or consent-gated if enabled — session data captures detailed user interactions
- →Check data residency configuration — Datadog processes data in the US by default, which may conflict with EU requirements
- →Assess whether RUM data could be correlated with identity resolution if you use other Datadog products
If You're Evaluating Datadog RUM
- →Request clarification on why 42+ trackers load pre-consent on datadoghq.com despite GDPR compliance claims
- →Ask for the complete list of marketing technology partners processing website visitor data beyond the 12 infrastructure providers
- →Verify data processing locations match your regulatory requirements before deployment
- →Assess whether a vendor whose own website contradicts stated compliance posture meets your vendor management criteria
- →Compare Datadog RUM consent architecture against alternatives like New Relic or Sentry for compliance guarantees
Negotiation Leverage
- →Subprocessor transparency: 42+ trackers detected versus 12 disclosed infrastructure providers. Require complete enumeration of all marketing technology partners processing visitor data on datadoghq.com and any data sharing relationships that could affect your RUM data.
- →Pre-consent SLA: 96% pre-consent rate on their own site. Require contractual guarantee that Datadog RUM SDK loads only after consent on your property with zero pre-consent data capture.
- →Data residency verification: Datadog processes data in the US by default. Require documented data residency options and verify session replay data stays within your specified region.
- →Session replay isolation: Verify session replay is disabled by default and consent-gated when enabled. Require contractual specification of what data types RUM captures and how they are isolated from Datadog's other products.
- →Identity correlation prohibition: With multiple visitor ID platforms on their site, require contractual guarantee that RUM data from your application is not correlated with identity resolution data from their corporate marketing stack.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
97 detection signatures across scripts, domains, cookies, and network endpoints