How This Briefing Works
This report opens with key findings, then maps the gaps between what Ketch discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Ketch was observed loading and executing before user consent was obtained on 48% of sites where it was detected.
Claims vs. Observed Behavior
hypocrisy
“Unknown - requires claims extraction”
C06+C07+C08+C09 detected in CMP runtime - privacy tool surveils users
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Ketch
- →IMMEDIATE: Audit Ketch for undisclosed data collection - CMP should not surveil users
- →Verify cross-domain tracking scope - map all properties where Ketch synchronizes identity
- →Document behavioral capture and session recording within consent flows
- →Assess if Ketch exempts itself from consent requirements it enforces on other vendors
If You're Evaluating Ketch
- →Evaluate consent platforms WITHOUT surveillance capabilities - CMP should be neutral infrastructure
- →Consider first-party consent implementation to eliminate third-party CMP risk
- →Investigate OneTrust, Cookiebot, or custom consent solutions without behavioral capture
- →Prepare migration plan - staying with surveillance CMP creates unacceptable liability
Negotiation Leverage
- →Ketch embeds C06/C07/C08/C09 in consent platform - vendor must explain surveillance in privacy tool
- →Demand complete disclosure of behavioral biometrics, session recording, cross-domain tracking
- →Require opt-out of ALL surveillance features - CMP should offer consent neutrally
- →Negotiate liability terms - if CMP violates consent, vendor liability is absolute
- →Consider contract termination - surveillance CMP creates unfixable trust violation
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
IOC Manifest
Indicators of compromise across 6 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
26 detection signatures across scripts, domains, cookies, and network endpoints