How This Briefing Works
This report opens with key findings, then maps the gaps between what Osano discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Osano was observed loading and executing before user consent was obtained on 60% of sites where it was detected.
Pending Analysis
8 BTI behavioral codes detected across 10 detections on 8 sites. Full claims extraction required for gap analysis.
Claims vs. Observed Behavior
Pending Analysis
“Claims analysis pending”
8 BTI behavioral codes detected across 10 detections on 8 sites. Full claims extraction required for gap analysis.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Osano
- →Audit Osano's actual runtime behavior against its documented consent flow using independent HAR capture
- →Verify whether Osano's pre-consent firing is a configuration issue or inherent platform behavior
- →Review your DPIA to confirm Osano is properly classified — it may qualify as a data controller, not just a processor
- →Test consent state propagation: confirm downstream vendors actually respect Osano's consent signals
If You're Evaluating Osano
- →Request Osano's own compliance audit results and compare against BLACKOUT runtime findings
- →Evaluate alternative CMPs that do not exhibit consent bypass behavior in runtime analysis
- →Assess whether Osano's identity resolution capabilities are disclosed in their DPA
- →Consider the liability implications of a CMP that itself requires consent governance
Negotiation Leverage
- →Your consent management platform triggers consent bypass (C09) at a 60% pre-consent rate — this is the single most damaging finding possible for a CMP vendor
- →8 BTI behavioral codes detected including identity resolution (C14) and cross-domain sync (C08) — capabilities undisclosed in standard CMP contracts
- →If Osano's consent bypass invalidates downstream consent chains, your organization bears the regulatory exposure for every vendor in the stack
- →Request full disclosure of all data collection, identity resolution, and cross-domain capabilities — compare against their processor agreement
- →Demand runtime audit results showing Osano's own pre-consent behavior on reference implementations
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Osano deploys evasion infrastructure that may behave differently during audits or compliance checks, undermining the reliability of your consent verification processes.
Keystroke/mouse tracking
Impact: A consent management platform collecting behavioral biometric data (keystroke/mouse patterns) raises immediate questions about purpose limitation under GDPR Article 5(1)(b).
Full session replay
Impact: Session replay capability on a CMP means Osano can observe exactly how users interact with consent dialogs — data that should never leave the consent layer.
Identity stitching
Impact: Identity stitching across domains by your CMP means Osano can build cross-site profiles of your visitors through the very tool meant to protect their privacy.
Ignoring CMP signals
Impact: The most critical finding: your consent management platform fires 60% of the time before consent is obtained. This invalidates the entire consent chain for every downstream vendor Osano is supposed to govern.
Device identification
Impact: Device fingerprinting by a CMP creates a persistent identifier that survives cookie deletion — directly contradicting the user's expressed privacy preferences.
Long-lived identifiers
PII deanonymization
Impact: PII deanonymization by a consent platform means Osano can identify individual visitors, creating a data controller relationship most organizations have not accounted for in their privacy impact assessments.
Container/loader (neutral)
Impact: Osano operates as a container/loader, which is expected for a CMP. However, combined with its other behavioral codes, this container has far more capability than a neutral consent layer should possess.
IOC Manifest
Indicators of compromise across 6 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
206 detection signatures across scripts, domains, cookies, and network endpoints