How This Briefing Works
This report opens with key findings, then maps the gaps between what Limadata discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Limadata was observed loading and executing before user consent was obtained on 67% of sites where it was detected.
Claims vs. Observed Behavior
consent_timing
“Unknown - requires claims extraction”
C09 consent bypass observed in data enrichment deployment
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Limadata
- →Implement consent gate before Limadata initialization
- →Verify enrichment functionality with delayed post-consent loading
- →Document consent timestamp vs data processing start for audit trail
If You're Evaluating Limadata
- →Request Limadata consent integration documentation
- →Evaluate data enrichment platforms with consent-first architecture
- →Consider server-side enrichment eliminating browser consent requirements
- →Investigate first-party data enrichment alternatives
Negotiation Leverage
- →Limadata executes pre-consent - vendor must provide consent-aware initialization
- →Require technical documentation of consent management integration
- →Negotiate consent bridge implementation as contract requirement
- →Establish liability terms for pre-consent data processing violations
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Device identification
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
86 detection signatures across scripts, domains, cookies, and network endpoints