How This Briefing Works
This report opens with key findings, then maps the gaps between what Getsales discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Getsales was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
consent
“Unknown - requires claims extraction via CDT”
Deploys session replay + behavioral biometrics + pre-consent tracking
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Getsales
- →Disable Getsales session recording immediately - no sales tool justifies recording user behavior without consent
- →Request deletion of all historical session replay data
- →Audit recorded sessions: assess whether sensitive data (emails, searches, form inputs) was captured
If You're Evaluating Getsales
- →Reject any vendor combining session replay with pre-consent deployment
- →Demand contractual liability assumption: vendor pays 100% of penalties for session recording violations
- →Migrate to privacy-safe sales intelligence: intent data from consented sources, firmographic enrichment (no behavioral tracking), or account-based advertising (no session replay)
Negotiation Leverage
- →Getsales combines session replay with consent bypass, creating severe privacy violation liability plus GDPR special category data exposure
- →Session recording may capture sensitive personal data (form inputs, search queries) without consent - heightens regulatory priority and reputational risk
- →Vendor must eliminate session replay AND behavioral biometrics AND implement consent-first architecture, or assume 100% regulatory penalty liability
- →Sales intelligence works without recording user behavior - pre-consent session replay is vendor choice that transfers liability to customer
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Mouse movements, scroll depth, and interaction timing create behavioral fingerprints usable for identification. GDPR Article 9 classifies biometric data as special category requiring explicit consent and heightened protection.
Full session replay
Impact: Records full user sessions including form interactions, navigation patterns, and page sequences. May capture sensitive personal data (email addresses typed in forms, search queries revealing intent). Session replay without consent creates privacy violation with reputational and regulatory risk.
Ignoring CMP signals
Impact: Session recording and behavioral capture initialize before consent opportunity, creating per-visitor GDPR Article 7 violation. Combined with potential sensitive data capture, elevates to Article 9 special category violation with increased penalty exposure.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
33 detection signatures across scripts, domains, cookies, and network endpoints