How This Briefing Works
This report opens with key findings, then maps the gaps between what Sojern discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Sojern was observed loading and executing before user consent was obtained on 12% of sites where it was detected.
Claims vs. Observed Behavior
disclosure
“Pending claims extraction”
Runtime detection shows C07 (session recording), C09 (consent bypass), C14 (identity resolution), C15 (tag manager)
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Sojern
- →Audit Sojern tag manager for unauthorized third-party additions
- →Implement session recording suppression for payment/PII entry flows
- →Review identity resolution opt-out mechanisms and data deletion procedures
If You're Evaluating Sojern
- →Document session recording scope and retention policies
- →Request written confirmation that travel intent data is not sold to direct competitors
- →Obtain technical specification for disabling identity resolution per-visitor
Negotiation Leverage
- →Session recording: Full replay captures sensitive booking flows — require PII/payment redaction and explicit session recording consent.
- →Identity resolution: Cross-property profiling links travel intent — negotiate competitor exclusions and demand data deletion rights.
- →Tag manager control: Dynamic partner additions bypass customer oversight — require approval workflow for all third-party additions.
- →Data sales: Travel intent signals sold to competitive properties — demand transparency on buyer identity and exclusion rights.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Full session replay
Ignoring CMP signals
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
43 detection signatures across scripts, domains, cookies, and network endpoints