How This Briefing Works
This report opens with key findings, then maps the gaps between what Modash discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Modash was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
disclosure
“Pending claims extraction”
Broker score (25) and Counselor score (55) indicate data sharing and consent violations. Privacy policy likely lacks specific disclosure of enrichment data sources and sharing practices.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Modash
- →Implement consent gate before Modash scripts load
- →Audit Data Processing Agreement for enrichment data sharing and retention terms
- →Review privacy policy for adequate disclosure of visitor profiling practices
- →Assess persistent identifier lifespan and renewal mechanisms
If You're Evaluating Modash
- →Defer Modash scripts until post-consent confirmation
- →Require vendor documentation on data source transparency and lawful collection basis
- →Assess first-party enrichment alternatives using consented customer data only
- →Implement visitor anonymization for non-consenting users
Negotiation Leverage
- →Modash contract likely permits enrichment data resale or platform-wide sharing - demand customer data isolation
- →Persistent identifiers may have indefinite lifespan - negotiate retention limits aligned to marketing campaign cycles
- →Confirm Modash honors consent withdrawal and purges visitor records from enrichment databases
- →Request disclosure of all third-party data sources used for visitor enrichment and their collection methods
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Ignoring CMP signals
Long-lived identifiers
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
109 detection signatures across scripts, domains, cookies, and network endpoints