How This Briefing Works
This report opens with key findings, then maps the gaps between what OneTrust discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
OneTrust was observed loading and executing before user consent was obtained on 54% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use OneTrust
- →Conduct independent privacy audit: verify OneTrust consent enforcement actually prevents tracking for users who reject cookies, measuring any consent bypass (C09) behaviors
- →Review OneTrust DPA: confirm whether user consent choices, privacy preferences, and banner interaction data is contractually prohibited from inclusion in benchmarking or privacy intelligence products
- →Query OneTrust: provide complete list of data cooperative participants, privacy intelligence services, and compliance benchmarking products that consume user consent behavioral data
- →Model surveillance scope: compare OneTrust tracking footprint against vendors being managed to quantify whether CMP operates more invasive surveillance than controlled vendors
If You're Evaluating OneTrust
- →Demand contractual prohibition on OneTrust retaining, analyzing, or monetizing any user consent choices, privacy preferences, or banner interaction behaviors
- →Require monthly transparency certification that OneTrust platform tracking respects its own consent mechanisms with zero data collection for users who reject cookies
- →Negotiate privacy intelligence opt-out: user consent behavioral data must never be included in OneTrust benchmarking, analytics, or competitive intelligence products regardless of aggregation
- →Replace with minimal consent infrastructure (custom implementation, privacy-preserving CMP alternatives) that eliminates third-party privacy behavioral intelligence exposure entirely
Negotiation Leverage
- →OneTrust operates comprehensive surveillance (C01,C06,C07,C08,C09,C10,C13,C15) requiring GDPR DPIA and triggering same privacy protections as vendors it manages. Privacy policies disclose consent management not behavioral surveillance. Legal exposure: Our counsel requires independent technical audit demonstrating OneTrust platform tracking fully respects user consent rejections, with zero data collection for opted-out users including OneTrust own analytics.
- →The fundamental regulatory irony: OneTrust consent bypass (C09) and persistent tracking (C13) violate the privacy principles the platform purports to enforce. Users who reject cookies still get tracked by the CMP itself. Quantify hypocrisy: Provide technical documentation proving OneTrust platform tracking ceases completely for users who reject all cookies, or admit consent management is privacy theater.
- →User consent choice monetization through privacy intelligence products creates profound trust violation. Privacy preferences become market research sold to industry participants. Demand transparency: What percentage of OneTrust revenue derives from privacy behavioral data vs. SaaS subscriptions, and which competing organizations purchase consent pattern intelligence derived from our users?
- →If OneTrust refuses to eliminate platform surveillance and privacy intelligence monetization, demand immediate replacement. A consent management platform that violates its own privacy principles creates liability exceeding any compliance optics value. The regulatory exposure from CMP privacy theater may exceed risk from having no consent management at all.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Modifies user consent choices and privacy preferences before downstream enforcement, systematically biasing toward data collection permissiveness rather than user intent
Keystroke/mouse tracking
Impact: Captures user interaction patterns with consent banners and preference centers to optimize conversion rates for data collection acceptance
Full session replay
Impact: Records user interactions with privacy controls including consent banner engagement, preference selections, and opt-out attempts for UX optimization intelligence
Identity stitching
Impact: Synchronizes user consent preferences and privacy choices across multiple organizational domains, creating unified tracking that persists across properties
Ignoring CMP signals
Impact: Operates tracking infrastructure that captures user behavioral data regardless of consent choices, including users who explicitly reject cookies and tracking
Device identification
Impact: Creates persistent user fingerprints to track privacy choices and behavioral patterns across sessions, enabling consent choice continuity and privacy preference analysis
Long-lived identifiers
Impact: Maintains long-lived tracking identifiers that survive user privacy choices and browser controls, enabling longitudinal privacy behavior surveillance
Container/loader (neutral)
Impact: Functions as comprehensive tag orchestration platform controlling third-party vendor initialization, creating single point of surveillance infrastructure across organizational digital ecosystem
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
36 detection signatures across scripts, domains, cookies, and network endpoints
HAR Forensics
| Destination | Data Type |
|---|---|