How This Briefing Works
This report opens with key findings, then maps the gaps between what Klaviyo discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Klaviyo was observed loading and executing before user consent was obtained on 40% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Klaviyo
- →Audit DPA for data broker syndication authorization—Klaviyo reserves broad rights
- →Extract consent bypass evidence showing tracking before banner interaction
- →Map Klaviyo customer segments to competitor lookalike audience appearance
If You're Evaluating Klaviyo
- →Quantify attribution inflation from email campaign over-claiming
- →Calculate data monetization revenue (your customers, their profit)
- →Document GDPR Article 9 violations from special category data processing
Negotiation Leverage
- →Klaviyo DPA permits customer data syndication to analytics vendors and brokers—loss of control documented
- →100/100 CAC subsidization represents direct competitor funding through marketing automation spend
- →Consent bypass (C09) operates tracking pre-authorization—GDPR Article 6 violations timestamped
- →Cross-domain identity stitching creates comprehensive surveillance network across all channels
- →Email tracking pixels constitute defeat devices under Apple Mail Protection policies
- →100/100 legal exposure represents maximum regulatory risk—evidence pack includes consent violations
- →Customer segments appear in competitor campaigns within 14 days of Klaviyo deployment
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Email tracking pixels and web beacons bypass browser privacy protections
Full session replay
Impact: Web session capture feeds predictive analytics while creating PII exposure
Identity stitching
Impact: Identity stitching across email, web, SMS, and third-party domains enables comprehensive profiling
Ignoring CMP signals
Impact: Tracking initiates before consent banner interaction—processing without lawful basis
Device identification
Impact: Device fingerprinting persists identity across cookie deletion and privacy modes
Container/loader (neutral)
Impact: Dynamic tracking code deployment enables persistent measurement infrastructure
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
66 detection signatures across scripts, domains, cookies, and network endpoints