How This Briefing Works
This report opens with key findings, then maps the gaps between what LuckyOrange discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
LuckyOrange was observed loading and executing before user consent was obtained on 50% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use LuckyOrange
- →Audit session replay consent language—"analytics" consent insufficient for surveillance
- →Extract identity resolution evidence showing cross-session tracking
- →Map CRO insights to competitor landing page optimization timing
If You're Evaluating LuckyOrange
- →Quantify A/B test intelligence leakage through anonymized data syndication
- →Calculate CRO intelligence monetization (your tests, their consulting revenue)
- →Document GDPR Article 6 violations—session replay requires explicit surveillance consent
Negotiation Leverage
- →LuckyOrange session replays capture form inputs and cart contents—PII exposure documented
- →100/100 CAC subsidization through CRO intelligence syndication to consulting networks
- →Consent bypass (C09) initiates recording pre-authorization—GDPR Article 6 violations timestamped
- →Identity resolution (C14) creates persistent profiles from anonymous sessions without user awareness
- →Heatmap data reveals UX weaknesses competitors exploit in their designs
- →95/100 legal exposure—session recording requires explicit surveillance consent under GDPR
- →Evidence pack includes pre-consent session captures and cross-session identity proof
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Mouse movement and scroll patterns captured to generate heatmaps revealing user intent
Identity stitching
Impact: Identity persistence across sessions enables long-term conversion funnel analysis
Ignoring CMP signals
Impact: Session recording initiates on page load before consent resolution
PII deanonymization
Impact: Anonymous session stitching creates persistent identity across visits and devices
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
52 detection signatures across scripts, domains, cookies, and network endpoints