How This Briefing Works
This report opens with key findings, then maps the gaps between what ProspectDesk discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
ProspectDesk was observed loading and executing before user consent was obtained on 67% of sites where it was detected.
Pending Analysis
5 BTI behavioral codes detected across 3 deployments. Full claims extraction required for gap analysis.
Claims vs. Observed Behavior
Pending Analysis
“Claims analysis pending”
5 BTI behavioral codes detected across 3 deployments. Full claims extraction required for gap analysis.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use ProspectDesk
- →Immediately verify whether ProspectDesk fires before your CMP consent gate — the 67% pre-consent rate suggests it likely does on your deployment
- →Conduct a DPIA (Data Protection Impact Assessment) for ProspectDesk — de-anonymization at scale triggers mandatory DPIA requirements under GDPR Article 35
- →Map all 5 domains and identify which third-party identity graph partners process your visitor data
- →Review your privacy policy for adequate disclosure of covert visitor identification
If You're Evaluating ProspectDesk
- →Require ProspectDesk to provide complete documentation of their identity resolution methodology and all sub-processors
- →Demand proof of consent-gated deployment configuration before any procurement commitment
- →Assess whether the sales intelligence value justifies the regulatory exposure of operating a deanon tool
- →Compare ProspectDesk against alternatives that provide company-level identification without individual PII resolution
Negotiation Leverage
- →67% pre-consent firing rate on a de-anonymization tool creates immediate GDPR exposure — demand contractual guarantee of consent-gated loading with penalties for violation
- →5 domains for visitor identification means your data flows to undisclosed identity graph partners — require complete sub-processor disclosure and restrict onward transfers
- →De-anonymization is a high-priority enforcement category for EU regulators — negotiate full indemnification for regulatory penalties arising from ProspectDesk's default deployment behavior
- →Identity resolution + persistence + fingerprinting = permanent visitor surveillance record — negotiate strict data retention limits and deletion obligations
- →5 BTI behavioral codes on 3 deployments shows consistent pattern — use as evidence to negotiate enhanced audit rights and compliance reporting requirements
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Evasion infrastructure may cause ProspectDesk to behave differently during compliance audits than in production, masking the true scope of visitor identification during privacy assessments.
Ignoring CMP signals
Impact: 67% pre-consent rate on a de-anonymization tool means visitors are being identified before they consent. Under GDPR, processing personal data for identification purposes requires explicit consent or legitimate interest with a balancing test that de-anonymization is unlikely to survive.
Device identification
Impact: Device fingerprinting as part of a deanon stack creates persistent identification that visitors cannot prevent or undo. Combined with identity resolution, fingerprinting ensures that even privacy-conscious visitors using cookie blockers are still identified.
Long-lived identifiers
Impact: Long-lived identifiers ensure ProspectDesk maintains visitor profiles across sessions. For a de-anonymization platform, persistence means once a visitor is identified, that identification follows them indefinitely — creating a permanent surveillance record tied to your domain.
PII deanonymization
Impact: PII deanonymization is ProspectDesk's core product. Every anonymous visitor to your site is a target for resolution to a named individual. Under GDPR, this constitutes processing of personal data that requires a lawful basis — a basis that is extremely difficult to establish for covert visitor identification.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
25 detection signatures across scripts, domains, cookies, and network endpoints