How This Briefing Works
This report opens with key findings, then maps the gaps between what Invibes discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Invibes was observed loading and executing before user consent was obtained on 67% of sites where it was detected.
Claims vs. Observed Behavior
consent
“Unknown - requires claims extraction via CDT”
Deploys behavioral biometrics + pre-consent ad tracking
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Invibes
- →Disable Invibes behavioral tracking immediately
- →Request deletion of all historical behavioral biometric data
- →If continuing: configure consent-first mode or disable biometric capture features
If You're Evaluating Invibes
- →Require vendor to demonstrate consent-first architecture before contract renewal
- →Demand removal of behavioral biometrics or 100% liability assumption
- →Migrate to privacy-safe advertising: contextual targeting (no behavioral tracking), consent-first native ads, or direct publisher relationships
Negotiation Leverage
- →Invibes combines behavioral biometrics with consent bypass for advertising - creates GDPR Article 9 special category violation
- →Vendor must eliminate biometric capture AND implement consent-first loading, or assume full regulatory penalty liability
- →Native advertising works without behavioral surveillance - contextual targeting delivers ads without tracking user behavior
- →Current architecture processes special category data (biometrics) without explicit consent required by GDPR Article 9
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Scroll depth, viewability timing, and interaction patterns create behavioral fingerprints for ad targeting. GDPR Article 9 classifies biometric data as special category requiring explicit consent - pre-consent capture creates heightened penalty exposure.
Ignoring CMP signals
Impact: Behavioral tracking for advertising loads before consent opportunity, creating per-visitor GDPR Article 7 violation. Combined with biometric capture, elevates to Article 9 special category data violation with increased regulatory priority.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
No indicators in this category
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
11 detection signatures across scripts, domains, cookies, and network endpoints