How This Briefing Works
This report opens with key findings, then maps the gaps between what Flowla discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Flowla was observed loading and executing before user consent was obtained on 2% of sites where it was detected.
Claims vs. Observed Behavior
consent
“Unknown - requires claims extraction via CDT”
Deploys behavioral biometrics + pre-consent tracking on shared content spaces
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Flowla
- →Disable all behavioral tracking features in Flowla admin panel
- →Configure analytics-free mode if available (document sharing only)
- →Audit current data retention: request deletion of all historical behavioral data
If You're Evaluating Flowla
- →Require vendor to demonstrate consent-first architecture before contract
- →Demand removal of behavioral biometrics capability or 100% liability assumption
- →Evaluate alternatives: Docsend (analytics-free mode), Notion (no tracking), Google Drive (basic sharing)
Negotiation Leverage
- →Flowla combines two high-risk behaviors: consent bypass + behavioral biometrics, creating compounded liability
- →Vendor must eliminate biometric capture AND implement consent-first loading, or assume full regulatory penalty liability
- →Document sharing works without behavioral surveillance - request feature removal or migrate to privacy-safe alternative
- →Current architecture violates GDPR Article 9 (special category data) with no clear legal basis for processing
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Scroll depth, mouse movements, and timing patterns create behavioral fingerprints usable for identification. GDPR Article 9 classifies biometric data as special category, requiring explicit consent and heightened protection.
Ignoring CMP signals
Impact: Tracking initialization before consent creates strict liability under GDPR Article 7 and ePrivacy Directive. Combined with biometric capture, elevates to special category data violation with increased penalty exposure.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
No indicators in this category
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
6 detection signatures across scripts, domains, cookies, and network endpoints