How This Briefing Works
This dossier opens with key findings, then maps the gap between what Termly discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 7 sites
vendor fires before consent
Briefing
Termly deploys consent banners while simultaneously bypassing consent mechanisms to capture visitor behavior. BTI codes (C01 defeat device, C06 biometrics, C07 session replay, C08 cross-domain sync, C09 consent bypass, C10 fingerprinting) indicate comprehensive surveillance disguised as compliance infrastructure. CMP category creates unique liability: the tool meant to protect privacy actively violates it.
What This Means For You
Compliance infrastructure creates liability. Termly captures visitor consent choices while bypassing consent mechanisms, creating indefensible GDPR violations. Legal holds 100% exposure risk from CMP that defeats its own purpose. Consent preference data accessible to competitors using same platform.
Risk Channel Breakdown
Signal corruption (40) from CMP-influenced visitor behavior distorts attribution. Termly captures consent choices and pre-consent interactions, poisoning analytics with compliance-theater data.
CAC subsidization (100) represents total value transfer. Visitor consent preferences, rejection patterns, and behavioral data captured by the CMP become competitor intelligence. You pay for compliance theater; competitors harvest privacy preference data.
Expands attack surface
Legal tail risk (100) from GDPR/CCPA violations. Pre-consent activation by a consent management platform creates indefensible regulatory exposure. Behavioral biometrics, session replay, cross-domain tracking, and fingerprinting by a CMP defeat the purpose of consent infrastructure.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Termly's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 3 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
googletagmanager, googleanalytics4, clarity…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →