How This Briefing Works
This report opens with key findings, then maps the gaps between what Shopify discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Shopify was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Shopify
- →Legal review of data controller liability - Shopify platform tracking makes merchant liable for GDPR violations
- →Implement third-party consent management that blocks Shopify analytics until opt-in
- →Request platform-level consent controls or accept strict liability for all visitor tracking
- →Audit session recording scope - verify PII and payment data exclusions exist
If You're Evaluating Shopify
- →Self-hosted e-commerce with complete consent control (WooCommerce, Magento)
- →Shopify Plus with custom checkout and analytics opt-out
- →Headless commerce with first-party analytics stack
Negotiation Leverage
- →Perfect legal tail risk (100) means platform creates GDPR violations by design - DPA must clarify data controller liability
- →Cross-merchant analytics means your optimization insights train competitors - demand data segregation guarantees
- →Platform consent assumption violates GDPR - merchant needs independent control over analytics initiation
- →Session recording at checkout may capture payment data - verify PCI-DSS scope implications
- →4M merchant network means your performance data has significant training value - pricing should reflect data contribution
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Impact: Shopify behavior tracking includes mouse dynamics and interaction patterns (biometric data under Article 9), requiring explicit consent unavailable in platform context.
Full session replay
Impact: Platform session recording may capture checkout PII and payment interactions, creating PCI-DSS scope expansion and GDPR Article 32 violations.
Ignoring CMP signals
Impact: Shopify analytics initiate at page load before merchant consent banner. Every visitor creates GDPR Article 6 violation with merchant as liable data controller.
Device identification
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
323 detection signatures across scripts, domains, cookies, and network endpoints