How This Briefing Works
This report opens with key findings, then maps the gaps between what Infolinks discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Infolinks was observed loading and executing before user consent was obtained on 4% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Infolinks
- →Audit historical engagement metrics for synthetic spikes correlating with Infolinks deployment
- →Extract session recordings showing ad injection timing vs consent banner display
- →Document user complaints about unexpected link behavior
If You're Evaluating Infolinks
- →Map keyword targeting overlap with your owned content strategy
- →Quantify CAC increase from traffic leakage to competitor ads
- →Calculate GDPR fine exposure from consent bypass violations
Negotiation Leverage
- →Infolinks contractually disclaims GDPR compliance responsibility—liability transfers to publisher
- →No SLA on ad quality or competitor exclusion—you cannot prevent direct competitor ads in your content
- →Defeat device deployment violates user expectations and ad blocker respect policies
- →90/100 CAC subsidization score represents measurable revenue leakage to competitors
- →Six BTI codes represent technical violations, not policy preferences—evidence pack includes timestamped captures
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: DOM manipulation bypasses ad blockers, creating adversarial relationship with privacy-conscious users
Keystroke/mouse tracking
Impact: Mouse movement and scroll patterns captured to optimize ad placement targeting
Full session replay
Impact: Full interaction capture including text selection events for keyword targeting refinement
Ignoring CMP signals
Impact: Ad injection initiates before consent banner interaction, processing personal data pre-authorization
Device identification
Impact: Device and browser characteristics collected for cross-session ad frequency capping
Container/loader (neutral)
Impact: Dynamic script loading enables persistent tracking infrastructure updates
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
53 detection signatures across scripts, domains, cookies, and network endpoints