How This Briefing Works
This report opens with key findings, then maps the gaps between what Mixrank discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Mixrank was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
disclosure
“Pending claims extraction”
High Broker (50) and Counselor (70) scores indicate significant competitive data exposure and consent violations. Privacy policy likely omits disclosure of competitive intelligence database inclusion.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Mixrank
- →Implement consent gate before MixRank scripts activate
- →Audit Data Processing Agreement for competitive intelligence database inclusion terms
- →GDPR Article 9 compliance review for behavioral biometric processing
- →Privacy policy disclosure review for session recording and data enrichment practices
If You're Evaluating Mixrank
- →Defer all MixRank scripts until post-consent confirmation
- →Demand contractual prohibition on competitor access to your visitor data
- →Assess first-party visitor intelligence alternatives without cross-customer data pooling
- →Require vendor attestation on biometric data processing lawfulness
Negotiation Leverage
- →MixRank contract permits inclusion of your visitor data in competitive intelligence database - demand opt-out and data isolation
- →Session recordings and behavioral profiles may be retained indefinitely for platform improvement - negotiate strict retention limits
- →Confirm whether competitors using MixRank can access insights derived from your visitor traffic
- →Request evidence of GDPR Article 9 lawful basis documentation for biometric processing
- →Demand technical controls preventing cross-customer visitor profile correlation
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
74 detection signatures across scripts, domains, cookies, and network endpoints