How This Briefing Works
This dossier opens with key findings, then maps the gap between what Osano discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 13 sites
vendor fires before consent
1 HIGH
Briefing
Osano markets itself as a consent management platform designed to help organizations comply with privacy regulations like GDPR and CCPA. BLACKOUT runtime analysis across 8 sites reveals a deeply contradictory reality: the CMP itself triggers consent bypass (C09), identity resolution (C14), cross-domain sync (C08), and session recording (C07). With a 60% pre-consent firing rate and 8 distinct BTI behavioral codes detected, Osano's own technology exhibits the exact behaviors it claims to govern. This is not a minor gap — it is a fundamental credibility collapse for any organization relying on Osano as their compliance foundation.
What This Means For You
If Osano is deployed on your site, your entire consent architecture may be compromised. The 60% pre-consent firing rate means that for the majority of your visitors, tracking begins before they have a chance to express preferences. Every vendor downstream of Osano inherits this tainted consent signal — if your CMP itself violates consent, no vendor it manages can claim valid consent either. Your Data Protection Impact Assessment likely does not account for your CMP operating as a data controller with identity resolution capabilities. Under GDPR, this gap could expose you to enforcement action not just for Osano's behavior, but for every vendor in your consent-managed stack.
Risk Channel Breakdown
Osano's signal corruption score of 40 reflects its role as a consent layer that distorts the measurement of actual consent state. When your CMP itself fires tracking behaviors pre-consent, your consent data becomes unreliable — you cannot trust your own compliance dashboard.
With a CAC subsidization score of 100, Osano's cross-domain sync (C08) and identity resolution (C14) capabilities mean visitor identity data flows through Osano's infrastructure. A consent platform with identity stitching capabilities creates a unique data aggregation risk.
Expands attack surface
Legal tail risk scores 100. A CMP that triggers consent bypass (C09) at a 60% pre-consent rate creates an extraordinary liability position: your compliance tool is itself the compliance violation. Regulators will view this as systemic failure, not a configuration error.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Long-lived identifiers
PII deanonymization
Container/loader (neutral)
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Osano's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 0, observed 1
googletagmanager, hubspot, googleanalytics4…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →