How This Briefing Works
This report opens with key findings, then maps the gaps between what LeadRocket discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Vendor Attribution
cdn.lgrckt-in.com is a LogRocket CDN domain - LeadRocket does not exist as a separate entity
Pre-Consent Activity
LeadRocket was observed loading and executing before user consent was obtained on 71% of sites where it was detected.
Consent Compliance
71.4% of detections show pre-consent loading - session recording begins before user consent obtained
Data Subject Rights
Explicitly does not honor Do Not Track browser signals
Compliance Claim Mismatch
False certification claims
Claims vs. Observed Behavior
Vendor Attribution
“LeadRocket is a separate B2B lead generation vendor”
cdn.lgrckt-in.com is a LogRocket CDN domain - LeadRocket does not exist as a separate entity
LogRocket CSP documentation lists cdn.lgrckt-in.com as official LogRocket CDN
Consent Compliance
“GDPR compliant, SOC2 Type II certified”
71.4% of detections show pre-consent loading - session recording begins before user consent obtained
Runtime scan data from intel_detections table shows 5 of 7 detections with pre_consent=true
Data Subject Rights
“Privacy-respecting analytics”
Explicitly does not honor Do Not Track browser signals
Privacy policy: Although our Site currently does not respond to do not track browser headers...
Transparency
“SOC2 Type II certified”
SOC2 report requires contacting sales - not publicly verifiable
Security documentation states: Please reach out to sales@logrocket.com for more information and our accreditation report
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use LeadRocket
- →URGENT: Verify consent implementation — 71.4% pre-consent rate indicates session recording likely begins before users consent on your site
- →Review LogRocket SDK initialization timing to ensure it fires AFTER consent is obtained, not on page load by default
- →Request their SOC2 Type II report from sales@logrocket.com and verify scope covers client-side session recording, not just internal operations
- →Update your privacy policy to explicitly disclose session recording functionality and what data types are captured
- →Implement LogRocket's GDPR/CCPA portal to honor deletion requests for recorded sessions containing user PII
If You're Evaluating LeadRocket
- →Note: LeadRocket detections (cdn.lgrckt-in.com) are actually LogRocket — same vendor, different CDN domain
- →Request SOC2 report before procurement decision — gating it behind sales contact is a transparency red flag
- →Verify your consent architecture can delay LogRocket SDK loading until after affirmative consent is obtained
- →Assess whether session replay data capture (DOM mutations, form inputs, network requests) aligns with your privacy posture
- →Evaluate alternatives with stronger consent-by-default behavior (FullStory, Hotjar) that do not require manual consent gating
Negotiation Leverage
- →Pre-consent session recording: 71.4% of LogRocket detections show pre-consent loading. Require contractual guarantee that session recording initializes only after affirmative consent, with automated consent gate in their SDK.
- →DNT/GPC compliance: LogRocket explicitly states they do not honor Do Not Track signals. Require contractual commitment to honor GPC signals under CCPA and to implement DNT support within 90 days of contract signing.
- →SOC2 transparency: LogRocket gates their SOC2 report behind sales contact. Require direct access to current SOC2 Type II report as a contract condition, with right to share with your auditors without restriction.
- →Session data scope: Session replay captures form inputs, DOM mutations, and network requests. Require contractual specification of exactly what data types are captured, with explicit exclusion of sensitive form fields and PII.
- →Consent-first SDK initialization: Require documented SDK configuration that prevents any data capture before consent banner interaction, with technical architecture review before deployment.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Device identification
PII deanonymization
IOC Manifest
Indicators of compromise across 2 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
2 detection signatures across scripts, domains, cookies, and network endpoints