How This Briefing Works
This report opens with key findings, then maps the gaps between what RB2B discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Defeat Device
60+ bot detection patterns disable tracking during compliance audits
Cookie Theft
Steals cookies without authorization via grabCookies() function
Anonymous Claim Contradiction
API returns personal emails, LinkedIn profiles, phone numbers, job titles per visitor
Pre-Consent Activity
RB2B was observed loading and executing before user consent was obtained on 5% of sites where it was detected.
Subprocessor Gap
62 third-party vendors detected on rb2b.com
Claims vs. Observed Behavior
Defeat Device
“SOC2 Type II, GDPR, CCPA Compliant”
60+ bot detection patterns disable tracking during compliance audits
Deobfuscated reb2b.js contains user-agent filtering for Playwright, Puppeteer, Selenium, ChromeDriver, Postman, and 55+ other audit tools
Anonymous Claim Contradiction
“Data is aggregated, anonymized or de-identified”
API returns personal emails, LinkedIn profiles, phone numbers, job titles per visitor
Postman collection at rb2b-api shows full PII response including 5+ business emails per person
Subprocessor Gap
“8 data partners disclosed in privacy policy”
62 third-party vendors detected on rb2b.com
Runtime scan of rb2b.com detected 62 vendors; 54 undisclosed (87% gap)
Pre-Consent Tracking
“GDPR and CCPA compliant”
5.1% pre-consent tracking rate across 156 detections
intel_detections query shows pre_consent=true for 8 of 156 RB2B loads
API Contradiction
“Support documentation states We do not currently offer an API”
Public API page at rb2b.com/apis and complete Postman collection
Three contradictory sources: support docs, website API page, Postman collection
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use RB2B
- →Audit your privacy policy for 54+ undisclosed sub-processors inherited from RB2B
- →Review consent mechanisms — 5.1% pre-consent rate creates direct GDPR liability
- →Verify HubSpot/Facebook integrations are aware of RB2B cookie theft
- →Request SOC2 report directly — trust portal access is not public verification
- →Consider that compliance audits see different behavior than production due to defeat devices
If You're Evaluating RB2B
- →Run compliance audit with non-standard user agent to observe actual behavior
- →Review deobfuscated script for bot detection targeting your audit tools
- →Verify all 8 disclosed data partners vs your requirements
- →Understand white-label network exposure (Knock2.ai, Clay)
- →Assess GDPR Article 3(2) exposure if any EU/UK visitors
Negotiation Leverage
- →The subprocessor gap: they disclose 8 data partners but their own site loads 62 third-party vendors. Request a complete, current subprocessor list and contractually require 30-day advance notice of changes — they cannot comply because they do not control their own supply chain.
- →The defeat device: their code detects and disables tracking for 60+ compliance audit tools including Playwright, Puppeteer, and Selenium. Ask them to explain why their SOC 2 certification should be considered valid when their code is specifically designed to behave differently during audits. Request their SOC 2 report directly — it is behind a gated trust portal, not publicly verifiable.
- →The consent contradiction: they claim GDPR and CCPA compliance but have a documented 5.1% pre-consent tracking rate across 128 sites. Request evidence of their lawful basis for processing under GDPR Article 6, specifically for the pre-consent data collection window. These are not theoretical risks — each point is backed by observed runtime behavior across multiple sites and scan dates.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 6 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
49 detection signatures across scripts, domains, cookies, and network endpoints