How This Briefing Works
This report opens with key findings, then maps the gaps between what Tolt discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Tolt was observed loading and executing before user consent was obtained on 56% of sites where it was detected.
Claims vs. Observed Behavior
disclosure
“Pending claims extraction”
Runtime detection shows C09 (consent bypass)
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Tolt
- →Audit Tolt container loading sequence relative to consent collection
- →Implement consent-gated tag firing rules for all managed tags
- →Review tag approval workflow to prevent unauthorized tag additions
If You're Evaluating Tolt
- →Document pre-consent tag execution scope and affected vendors
- →Request technical controls to defer container initialization until consent obtained
- →Obtain tag firing audit logs to verify consent compliance
Negotiation Leverage
- →Pre-consent execution: Tag container loads before consent collection — require technical mechanism to defer ALL tag firing until authorization.
- →Tag governance: Container enables third-party additions without oversight — demand approval workflow and quarterly tag audits.
- →Consent integration: Native consent management integration required to ensure all tags respect user choices.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Ignoring CMP signals
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
40 detection signatures across scripts, domains, cookies, and network endpoints