How This Briefing Works
This report opens with key findings, then maps the gaps between what Sequel Video discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Sequel Video was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Sequel Video
- →Audit tag firing sequence - verify NO tags fire before consent collection
- →Implement consent-first architecture - all tags must be blocked until explicit opt-in
- →Request tag configuration data segregation - your implementation should not train competitor recommendations
- →Replace tag manager with server-side GTM or consent-aware alternative
If You're Evaluating Sequel Video
- →Google Tag Manager Server-Side with consent mode enforcement
- →Segment.io with consent management integration
- →First-party event collection without third-party tag managers
Negotiation Leverage
- →Perfect legal tail risk (100) reflects pre-consent tag firing - DPA must include unlimited indemnification for ALL downstream vendor violations
- →Tag manager creates multiplied liability across entire vendor stack - confirm consent enforcement guarantees
- →Session recording captures PII and form data - verify filtering mechanisms exist
- →Cross-customer tag analytics means your implementation trains competitors - demand data segregation
- →Platform enables compliance violations by design - pricing should reflect regulatory risk transfer
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Impact: Mouse tracking and interaction patterns constitute biometric data under Article 9, requiring explicit consent unavailable in tag manager context.
Full session replay
Impact: Tag manager session recording captures all page interactions including form fills and PII entry, creating GDPR Article 32 security violations.
Ignoring CMP signals
Impact: Tag manager fires third-party vendors before consent banner interaction. Every pre-consent tag creates independent GDPR Article 6 violation with €20M/4% revenue penalty exposure.
Device identification
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
77 detection signatures across scripts, domains, cookies, and network endpoints