How This Briefing Works
This report opens with key findings, then maps the gaps between what Poptin discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Poptin was observed loading and executing before user consent was obtained on 50% of sites where it was detected.
Claims vs. Observed Behavior
consent_timing
“Pending claims extraction”
Runtime shows immediate form injection without consent checks
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Poptin
- →Verify popup load timing against consent framework activation
- →Implement server-side consent checks before form rendering
- →Document email capture timing in privacy disclosures
If You're Evaluating Poptin
- →Request technical documentation of consent integration methodology
- →Require demonstration of consent-aware form rendering
- →Evaluate alternatives with native consent framework integration
Negotiation Leverage
- →C09 detected: Demand DPA amendment requiring consent verification before ANY form rendering
- →Request written confirmation that modals remain inactive until explicit consent recorded
- →Require audit rights covering modal injection timing and pre-consent data handling
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Ignoring CMP signals
IOC Manifest
Indicators of compromise across 6 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
24 detection signatures across scripts, domains, cookies, and network endpoints