How This Briefing Works
This report opens with key findings, then maps the gaps between what Amazon Seller Services discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Amazon Seller Services was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Amazon Seller Services
- →Legal review of GDPR applicability - Amazon marketplace presence does not exempt third-party vendor from consent requirements
- →Audit data sharing scope - verify your listing performance data is not training competitor recommendations
- →Request explicit consent mechanism independent of Amazon - or accept strict liability for all tracking
- →Verify session recording exclusions - PII and payment data must be filtered before capture
If You're Evaluating Amazon Seller Services
- →First-party Amazon analytics with no cross-seller data sharing
- →Amazon native analytics tools with explicit consent controls
- →Self-hosted marketplace analytics with complete data sovereignty
Negotiation Leverage
- →Perfect legal tail risk (100) indicates zero consent compliance - DPA must include unlimited indemnification
- →Cross-seller analytics means your optimization insights train competitors - demand data segregation guarantees
- →Operating within Amazon does not exempt vendor from GDPR - verify independent consent mechanism exists
- →Persistence mechanisms enable long-term profiling - confirm retention limits align with ePrivacy Directive
- →Platform value derives from shared seller intelligence - pricing should reflect your data contribution
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Impact: Recording Amazon customer sessions may capture PII and purchase history without disclosure, triggering GDPR Article 15 access request complications.
Ignoring CMP signals
Impact: Assumes Amazon marketplace consent covers third-party analytics. GDPR requires independent consent for each processing purpose - creates strict liability under Article 6.
Device identification
Container/loader (neutral)
Impact: Long-lived tracking enables cross-session profiling without renewal of consent, violating ePrivacy Directive cookie lifetime restrictions.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
No indicators in this category
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
27 detection signatures across scripts, domains, cookies, and network endpoints