How This Briefing Works
This dossier opens with key findings, then maps the gap between what Mouseflow discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 4 sites
vendor fires before consent
3 CRIT · 2 HIGH
Briefing
Mouseflow is a session replay and heatmap analytics platform headquartered in Copenhagen, Denmark, owned by Offspring Capital. Marketed as a privacy-first UX analytics tool, BLACKOUT runtime analysis reveals 36 third-party vendors active on mouseflow.com with 16 firing before consent (44%). The vendor's own site deploys identity resolution (C14), fingerprinting (C10), behavioral biometrics (C06), and session replay (C07), contradicting homepage claims of "we do not track personal information." Detected on 3 sites across BLACKOUT's network with a 75% pre-consent rate.
What This Means For You
If Mouseflow is deployed on your site, you inherit the vendor's runtime behavior profile: session replay capturing every visitor interaction, behavioral biometrics tracking mouse movements and scroll patterns, and identity resolution linking visitors across sessions. Under GDPR Art 5(3) and the ePrivacy Directive, you as the site operator bear liability for all data processing on your property, including Mouseflow's client-side JavaScript execution. Mouseflow's ISO 27001 and SOC 1 Type II certifications explicitly cover data center operations - they do not extend to the client-side script running in your visitors' browsers. The 75% pre-consent detection rate across BLACKOUT's network means three out of four deployments may fire before consent is obtained. CIPA class actions for similar session recording without consent have settled in the $5-50M range.
Risk Channel Breakdown
Mouseflow captures full session replays including mouse movements, clicks, scrolls, and form interactions. This granular behavioral data creates attribution noise when deployed alongside other analytics tools. Session replay data that crosses session boundaries via persistent identifiers makes it impossible to distinguish organic behavior from re-engaged visitors, distorting conversion path analysis.
Scanner detected cross-domain sync (C08) and cookie sync chains on mouseflow.com. Data flows to 36 third-party vendors including Meta Pixel, LinkedIn, DoubleClick, and Leadfeeder/Dealfront. Visitor behavioral data captured through session replay is syndicated to advertising networks, meaning your visitors' browsing patterns become targeting parameters for competitors purchasing the same ad inventory.
Client-side JavaScript execution captures DOM state, mouse coordinates, keyboard timing, and scroll depth. The CDN-hosted script (cdn.mouseflow.com) has full page access and executes in the visitor's browser context. Session replay combined with behavioral biometrics (C06) creates a comprehensive behavioral fingerprint that persists across sessions, expanding the attack surface for any site deploying Mouseflow.
Claims GDPR compliance and ISO 27001 certification while scanner detected consent bypass (C09) with 44% of vendors firing pre-consent on their own site. 16 of 36 detected vendors load before any consent mechanism fires. The subprocessor list discloses 7 entities while 36 are actively processing data. Under GDPR Art 28, the gap between disclosed and actual data processors creates direct compliance exposure for any site operator deploying Mouseflow.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Long-lived identifiers
PII deanonymization
Claims-vs-Reality (BTI-X)
Not in privacy policy
Hidden data recipients
Behavior contradicts marketing
False certification claims
Collection exceeds disclosed scope
Gated or missing due diligence docs
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Mouseflow's public claims against observed runtime behavior and identified 6 contradictions.
"Subprocessor list discloses 7 entities (Mouseflow ApS, Mouseflow Inc, Google Cloud, Leaseweb x2, DoiT, Oddeye)"
Scanner detected 36 third-party vendors on mouseflow.com including HubSpot, Meta Pixel, DoubleClick, Google Ads, GA4, LinkedIn, Leadfeeder/Dealfront, G2, Wistia, Serpstat, Match2one, Basis, and others
5 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 7, observed 8
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →