How This Briefing Works
This report opens with key findings, then maps the gaps between what Ordermygear discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Ordermygear was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
Pending Analysis
“Claims extraction pending”
Claims extraction pending — CDT analysis required.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Ordermygear
- →Verify behavioral tracking configuration remains minimal and doesn't escalate
- →Confirm session data stays customer-isolated and isn't aggregated vendor-side
If You're Evaluating Ordermygear
- →Maintaining current low-risk configuration vs. migrating to privacy-preserving alternatives
Negotiation Leverage
- →Behavioral tracking capabilities detected but low-risk implementation — maintain current configuration and prohibit vendor-side analytics in contract renewals
- →Request annual attestation that behavioral data remains customer-isolated and isn't used for benchmarking or competitive intelligence
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Behavioral fingerprinting capability detected but not actively creating revenue risk in current implementation.
Full session replay
Impact: Session capture capability detected but not actively creating CAC subsidization or consent liability in current configuration.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
82 detection signatures across scripts, domains, cookies, and network endpoints