How This Briefing Works
This dossier opens with key findings, then maps the gap between what LeadRocket discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 6 sites
vendor fires before consent
1 CRIT · 2 HIGH
Briefing
LeadRocket is a MISATTRIBUTED vendor entry - the cdn.lgrckt-in.com domain actually belongs to LogRocket, a session replay and product analytics platform founded in 2016 in Boston. LogRocket captures DOM mutations, console logs, network requests, and user interactions for debugging and UX analysis. Despite SOC2 Type II and GDPR compliance claims, runtime detection shows 71.4% pre-consent loading across monitored sites. The vendor gates SOC2 reports behind sales contact, preventing independent verification. This entry should be merged with the existing LogRocket vendor record.
What This Means For You
If LogRocket (detected as LeadRocket via cdn.lgrckt-in.com) is deployed on your site, 71.4% of sessions may be recorded before users consent. Session replay captures complete user journeys including form inputs, clicks, and page content. Under GDPR Art 7 and ePrivacy Directive Art 5(3), recording user sessions without prior consent creates direct regulatory liability for you as the site operator. LogRocket explicitly does not honor Do Not Track signals, meaning privacy-conscious users have no browser-level opt-out mechanism. Their SOC2 report is gated behind sales contact, preventing independent verification of their compliance claims.
Risk Channel Breakdown
Session replay captures complete user journeys, DOM state, and interactions. This data flows to LogRocket servers where it is processed for analytics. If attribution models rely on clean first-party data, LogRocket session data creates parallel measurement that may diverge from official analytics.
LogRocket captures behavioral signals, error patterns, and feature usage data. While primarily used for debugging, this intelligence about user friction points and feature adoption could inform competitive product decisions if data were accessed by unauthorized parties.
Session replay technology captures sensitive user interactions including form inputs (though passwords claimed excluded). The extensive network of CDN domains (11+ domains) creates a broad attack surface. Pre-consent loading (71.4%) means recording begins before users can object.
Claims SOC2 Type II and GDPR compliance while demonstrating 71.4% pre-consent tracking rate. Privacy policy explicitly states they do NOT honor Do Not Track signals. SOC2 report is gated behind sales contact, preventing independent compliance verification. Creates consent liability for customers deploying LogRocket.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Device identification
PII deanonymization
Claims-vs-Reality (BTI-X)
False certification claims
Gated or missing due diligence docs
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed LeadRocket's public claims against observed runtime behavior and identified 4 contradictions.
"LeadRocket is a separate B2B lead generation vendor"
cdn.lgrckt-in.com is a LogRocket CDN domain - LeadRocket does not exist as a separate entity
3 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 2, observed 2
tolt, cookieyes, googletagmanager…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →