How This Briefing Works
This report opens with key findings, then maps the gaps between what Ocean discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Ocean was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
disclosure
“Pending claims extraction”
High Broker (50) and Counselor (70) scores indicate significant competitive data exposure and consent violations. Privacy policy likely omits disclosure of behavioral biometrics and cross-customer benchmarking.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Ocean
- →Immediate consent gate implementation before any Ocean scripts load
- →GDPR Article 9 compliance audit for behavioral biometric lawful basis
- →Session recording disclosure in privacy policy with explicit opt-in
- →Data Processing Agreement review for revenue signal sharing with third parties
- →Audit whether Ocean revenue data is accessible to competitors
If You're Evaluating Ocean
- →Defer all Ocean scripts until post-consent confirmation with granular biometric consent
- →Require vendor attestation on GDPR Article 9 lawful basis documentation
- →Assess first-party revenue intelligence alternatives without cross-customer data pooling
- →Demand contractual prohibition on competitor access to your visitor behavioral data
Negotiation Leverage
- →Ocean contract likely permits platform-wide revenue signal benchmarking using your visitor data - demand opt-out
- →Session recordings may be retained for extended periods for signal quality improvement - negotiate 30-day maximum retention
- →Confirm whether competitors using Ocean can access revenue intelligence derived from your prospect traffic
- →Request evidence of GDPR Article 9 compliance documentation for behavioral biometric processing
- →Demand technical controls preventing cross-customer visitor profile correlation and competitive intelligence leakage
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
189 detection signatures across scripts, domains, cookies, and network endpoints