How This Briefing Works
This dossier opens with key findings, then maps the gap between what PostHog discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 18 sites
vendor fires before consent
Briefing
PostHog operates as an open-source product analytics platform combining event tracking, session recording, feature flags, and A/B testing. The platform captures detailed user behavior, interaction patterns, and product usage to inform development decisions. Deployment reveals aggressive session recording, device fingerprinting, and consent bypass patterns that operate despite self-hosted deployment options and privacy-focused positioning.
What This Means For You
Product and engineering teams face three core risks: (1) Product analytics distort feature value assessment by misattributing usage patterns, making development prioritization decisions unreliable. (2) Detailed usage behavior reveals product strategy and development priorities to PostHog infrastructure—even self-hosted deployments send telemetry that exposes roadmap intelligence. (3) Legal exposure from session recording and consent bypass creates GDPR/CCPA liability that privacy teams cannot mitigate while maintaining analytics functionality.
Risk Channel Breakdown
PostHog tracks product usage events and behavioral patterns that feed into feature performance metrics and conversion analytics (25% signal corruption). These signals can distort product decisions by misattributing feature value or over-crediting UI changes in A/B tests.
The platform captures complete product usage behavior including feature adoption, user flows, and interaction patterns (100% CAC subsidization). This intelligence reveals product strategy, development priorities, and user experience decisions to vendor infrastructure—even in self-hosted deployments that phone home telemetry.
Expands attack surface
Session recording with consent bypass creates complete GDPR/CCPA exposure (100% legal tail risk). The vendor processes detailed behavioral data and session replays without transparent consent controls, leaving organizations liable for privacy violations despite open-source licensing.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Device identification
Long-lived identifiers
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed PostHog's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
googletagmanager, googleanalytics4, metapixel…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →