How This Briefing Works
This report opens with key findings, then maps the gaps between what Eloqua discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Eloqua was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Unknown - requires claims extraction via CDT”
Runtime evidence shows C09 pattern
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Eloqua
- →Audit Eloqua tracking: what fires before consent?
- →Confirm lead scoring disabled until consent
- →Review Oracle DPA for GDPR Article 28 compliance
If You're Evaluating Eloqua
- →Test page load timeline: does Eloqua script load pre-consent?
- →Ask: can you configure consent-first operation?
- →Verify privacy policy discloses behavioral profiling and lead scoring
Negotiation Leverage
- →C09 consent bypass observed in 40% of deployments. What configuration ensures consent-first tracking?
- →Pre-consent behavioral profiling creates GDPR Article 6 violation. How do you prevent this?
- →You process as controller; Oracle is processor. DPA compliance is our responsibility.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Ignoring CMP signals
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
22 detection signatures across scripts, domains, cookies, and network endpoints