How This Briefing Works
This report opens with key findings, then maps the gaps between what Mixpanel discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
data_sharing
Runs 25+ third-party ad/tracking cookies on own site including AdRoll, AppNexus, DoubleClick, Facebook, LinkedIn, ZoomInfo. Engages in interest-based advertising via cross-contextual behavioral advertising. Reserves right to share de-identified data with third parties for any purpose.
consent
Pre-consent cookies deploy before consent management on 43% of sites. Fingerprinting embedded in GDPR compliance script. De-identified data retained indefinitely and shared at Mixpanel sole discretion. The processor role does not prevent Mixpanel from creating derivative data products from aggregated customer behavioral patterns.
security
November 2025 smishing breach compromised employee credentials and exposed behavioral data across 8,000 corporate customers. OpenAI terminated Mixpanel usage. SoundCloud breach affected 28 million accounts. Session replay data inadvertently captured PII. Certification did not prevent a social engineering attack that exposed potentially billions of user records.
Pre-Consent Activity
Mixpanel was observed loading and executing before user consent was obtained on 43% of sites where it was detected.
data_collection
Post-breach analysis confirmed session replays can inadvertently capture passwords, credit card numbers, and PII. Privacy controls are opt-in by the customer and masking is not guaranteed. The feature captures complete interaction sequences by default.
Claims vs. Observed Behavior
data_sharing
“Not an ad-tech, data brokerage, or data enrichment provider”
Runs 25+ third-party ad/tracking cookies on own site including AdRoll, AppNexus, DoubleClick, Facebook, LinkedIn, ZoomInfo. Engages in interest-based advertising via cross-contextual behavioral advertising. Reserves right to share de-identified data with third parties for any purpose.
consent
“Acts as data processor only for customer data”
Pre-consent cookies deploy before consent management on 43% of sites. Fingerprinting embedded in GDPR compliance script. De-identified data retained indefinitely and shared at Mixpanel sole discretion. The processor role does not prevent Mixpanel from creating derivative data products from aggregated customer behavioral patterns.
security
“SOC 2 Type II certified with robust security measures”
November 2025 smishing breach compromised employee credentials and exposed behavioral data across 8,000 corporate customers. OpenAI terminated Mixpanel usage. SoundCloud breach affected 28 million accounts. Session replay data inadvertently captured PII. Certification did not prevent a social engineering attack that exposed potentially billions of user records.
data_collection
“Session Replay includes privacy controls for sensitive data masking”
Post-breach analysis confirmed session replays can inadvertently capture passwords, credit card numbers, and PII. Privacy controls are opt-in by the customer and masking is not guaranteed. The feature captures complete interaction sequences by default.
consent
“Honors Global Privacy Control (GPC) signals”
GPC honored on mixpanel.com for interest-based advertising opt-out. However, pre-consent cookies still deploy before GPC can be evaluated. The GPC implementation covers advertising opt-out but not the broader behavioral data collection that begins before consent.
retention
“Event retention period is 2 years (new projects) or 5 years (legacy)”
De-identified data retained indefinitely with explicit right to share with any third party for any purpose. No disclosed verification mechanism for customers to confirm deletion. Origin tracking cookies set with 360-day expiry. The retention policy has a carve-out that effectively allows indefinite data use through de-identification.
fingerprinting
“GDPR compliance script ensures privacy compliance”
Scanner detected navigator fingerprinting inside gdpr-external.min.js — the GDPR compliance script itself performs browser fingerprinting. This means the privacy compliance mechanism is simultaneously a tracking mechanism.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Mixpanel
- →Audit your Mixpanel implementation for pre-consent cookie deployment — check if mp__origin cookies fire before your CMP loads and update your privacy policy to disclose pre-consent analytics tracking
- →Review your GDPR DPIA to account for Session Replay data capture, fingerprinting in gdpr-external.min.js, and the November 2025 breach notification obligations under Article 33/34
- →Request a written statement from Mixpanel confirming whether your organization data was accessed during the November 2025 breach and what specific data types were exposed
- →Verify your DPA covers de-identified data restrictions — the standard terms allow Mixpanel to share de-identified data derived from your users with any third party for any purpose
If You're Evaluating Mixpanel
- →Demand contractual language prohibiting Mixpanel from creating de-identified derivatives of your user data that can be shared with third parties — the current privacy policy explicitly reserves this right
- →Require Mixpanel to provide evidence that session replay masking actually prevents PII capture in your specific implementation — post-breach analysis confirmed masking failures
- →Negotiate breach notification SLAs: the November 2025 breach was disclosed hours before Thanksgiving weekend, limiting customer response capacity
- →Evaluate self-hosted alternatives (PostHog, Plausible, Matomo) that eliminate third-party data exposure and centralized breach risk entirely
Negotiation Leverage
- →The November 2025 breach is your strongest leverage point. Mixpanel was compromised via a basic smishing attack — not a sophisticated zero-day. OpenAI terminated the relationship. Demand: What specific remediation has Mixpanel implemented beyond standard incident response? Request third-party penetration test results post-breach.
- →De-identified data sharing is a revenue mechanism disguised as a privacy provision. Mixpanel reserves the right to use de-identified data for any purpose and disclose to third parties. Demand: Contractual prohibition on creating any derivative data products from our user behavioral data, de-identified or otherwise.
- →Pre-consent tracking (43% of sites) creates joint and several liability under GDPR. If your DPA claims Mixpanel only processes under your instructions, but their SDK deploys cookies before your consent mechanism loads, the DPA terms are contradicted by runtime behavior. Demand: Technical implementation of consent-first SDK initialization as a contractual requirement.
- →Session Replay PII leakage is a documented risk that Mixpanel acknowledges. The breach exposed that masking controls are imperfect. Demand: Indemnification clause specifically covering regulatory penalties arising from inadvertent PII capture in session replay data.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Tracking beacons to api-js.mixpanel.com collect IP addresses by default (ip=1 parameter), device fingerprints, browser metadata, and behavioral events. Pre-consent cookies establish persistent origin tracking before users can express privacy preferences.
Keystroke/mouse tracking
Full session replay
Impact: mixpanel-recorder.min.js captures complete user interaction sessions. Privacy controls exist but are opt-in by the customer. The November 2025 breach demonstrated that session replay data can contain inadvertently captured PII including credentials and financial data.
Identity stitching
Ignoring CMP signals
Impact: 43% pre-consent rate across monitored sites. Pre-consent cookies mp__origin and mp__origin_referrer deploy with 360-day expiry before consent management loads. Mixpanel does not implement consent-first on its own website — the vendor bypasses consent on its own properties.
Device identification
Impact: Navigator fingerprinting detected in gdpr-external.min.js — fingerprinting code is embedded within the GDPR compliance script itself. This creates a paradox where the privacy compliance layer is the fingerprinting mechanism.
PII deanonymization
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
33 detection signatures across scripts, domains, cookies, and network endpoints