How This Briefing Works
This report opens with key findings, then maps the gaps between what Lgads discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Lgads was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
ad_surveillance
“Unknown - requires claims extraction”
C06+C07+C09 detected - advertising surveillance beyond standard ad serving
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Lgads
- →Audit Lgads behavioral and recording scope - verify surveillance extent
- →Document session recording on ad placements and landing pages
- →Enforce consent gate before Lgads initialization to address C09 bypass
- →Verify if behavioral/recording capabilities can be disabled while maintaining core ad serving
- →Assess regulatory classification - does recording constitute special category data?
If You're Evaluating Lgads
- →Request Lgads technical documentation of surveillance capabilities
- →Evaluate advertising platforms without behavioral biometrics or session recording
- →Consider contextual advertising eliminating behavioral tracking
- →Investigate if Lgads offers privacy-preserving deployment mode
Negotiation Leverage
- →Lgads deploys C06+C07+C09 - vendor must explain surveillance in advertising platform
- →Demand complete disclosure of behavioral monitoring and session recording purposes
- →Require consent-first operation - no pre-consent ad surveillance
- →Negotiate opt-out of behavioral/recording features if not essential to ad delivery
- →Establish liability terms for surveillance capabilities and consent violations
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
71 detection signatures across scripts, domains, cookies, and network endpoints