How This Briefing Works
This report opens with key findings, then maps the gaps between what Rokt discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Rokt was observed loading and executing before user consent was obtained on 50% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Rokt
- →Immediately verify PCI-DSS scope - session recording of payment flow triggers compliance expansion
- →Audit consent timing - recording must not start until after explicit opt-in
- →Request data segregation guarantees - your conversion data should not train competitor offers
- →Implement client-side filtering to block capture of PII/payment fields
If You're Evaluating Rokt
- →First-party A/B testing tools (Optimizely, VWO) with data isolation
- →Checkout optimization without session recording (heatmaps, funnel analysis)
- →On-premise recommendation engines with no cross-merchant data sharing
Negotiation Leverage
- →Session recording at checkout creates PCI-DSS liability - DPA must address compliance responsibility
- →Cross-merchant model means your data trains competitors - require data segregation or discount pricing
- →Behavioral biometrics require GDPR Article 9 consent - verify consent mechanism supports lawful basis
- →CAC subsidization score of 90 is top quartile - demand pricing reflects competitive intelligence value
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Impact: Mouse movement and typing patterns constitute biometric data under GDPR Article 9. Requires explicit consent and heightened security controls.
Full session replay
Impact: Checkout session capture may record credit card entry, creating PCI-DSS scope expansion and requiring encryption/tokenization controls.
Ignoring CMP signals
Impact: Tracking initiates before consent mechanism, creating strict liability under GDPR Article 82 (right to compensation).
Device identification
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
No indicators in this category
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
7 detection signatures across scripts, domains, cookies, and network endpoints