How This Briefing Works
This report opens with key findings, then maps the gaps between what Rakutenadvertising discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Rakutenadvertising was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Pending Analysis
7 BTI behavioral codes detected across 1 detection on 1 site. Full claims extraction required for gap analysis.
Claims vs. Observed Behavior
Pending Analysis
“Claims analysis pending”
7 BTI behavioral codes detected across 1 detection on 1 site. Full claims extraction required for gap analysis.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Rakutenadvertising
- →Verify whether your CMP can effectively govern Rakuten Advertising's cookieless tracking methods — standard cookie blocking is insufficient
- →Audit the 8 scripts Rakuten deploys for undisclosed capabilities beyond affiliate attribution
- →Review your privacy notice to confirm advertising network identity resolution is disclosed as a processing activity
- →Test pre-consent behavior in EU/UK markets specifically — 100% pre-consent on advertising tracking is high-priority regulatory risk
If You're Evaluating Rakutenadvertising
- →Request Rakuten Advertising's full data flow documentation showing what data enters Rakuten Group's broader ecosystem
- →Assess whether affiliate attribution can be achieved via server-side integration without on-site JavaScript deployment
- →Evaluate whether your affiliate revenue justifies the regulatory exposure of 7 BTI codes firing 100% pre-consent
- →Review Rakuten Group's cross-subsidiary data sharing policies to understand where your visitor data may flow across their conglomerate
Negotiation Leverage
- →100% pre-consent firing rate on advertising tracking — direct ePrivacy Directive violation in EU/UK markets with no defensible position
- →Zero cookies with active fingerprinting (C10) indicates deliberate evasion of cookie-based consent governance — demand disclosure of all cookieless identification methods
- →Rakuten Group operates a 1.6 billion member ecosystem across e-commerce, fintech, and telecom — demand clarity on cross-subsidiary data sharing for visitor data captured from your properties
- →7 BTI codes including session recording and identity resolution go far beyond standard affiliate tracking — request contractual limitations to conversion attribution only
- →Request evidence that Rakuten Advertising's cookieless tracking methods are compatible with your CMP and consent architecture
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Rakuten Advertising deploys evasion infrastructure that may alter behavior during compliance audits, making it difficult to verify the full scope of tracking during standard privacy assessments.
Keystroke/mouse tracking
Impact: An advertising network collecting behavioral biometric data from your visitors creates enrichment signals that enhance ad targeting profiles — your visitors' interaction patterns improve Rakuten's advertising product.
Full session replay
Impact: Session replay on an advertising network means Rakuten can observe how visitors interact with your site beyond simple conversion tracking. This behavioral data feeds their broader advertising intelligence.
Ignoring CMP signals
Impact: 100% pre-consent firing rate means every visitor encounters Rakuten's full tracking stack before consent. In EU/UK markets, this is a direct ePrivacy Directive violation for non-essential advertising tracking.
Device identification
Impact: Zero cookies but active fingerprinting indicates deliberate cookieless tracking. This technique evades cookie consent mechanisms entirely, making traditional CMP-based governance ineffective.
PII deanonymization
Impact: PII deanonymization by an advertising network means your anonymous visitors are identified and added to Rakuten's advertising profiles. This data feeds a global ad network operated by a conglomerate with 1.6 billion members across its ecosystem.
Container/loader (neutral)
Impact: Rakuten Advertising operates as a container/loader, deploying 8 scripts that may introduce additional tracking capabilities beyond the initial affiliate tag.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
66 detection signatures across scripts, domains, cookies, and network endpoints