How This Briefing Works
This report opens with key findings, then maps the gaps between what Usergems discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Usergems was observed loading and executing before user consent was obtained on 2% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Requires claims extraction via CDT”
Defeat device, behavioral biometrics, session recording, cross-domain sync, consent bypass, and fingerprinting detected in runtime
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Usergems
- →Audit defeat device deployment within contact intelligence infrastructure
- →Review session recording scope in relationship tracking workflows
- →Verify cross-domain sync boundaries for contact continuity mechanisms
- →Require consent collection before UserGems surveillance initialization
If You're Evaluating Usergems
- →Contact tracking solutions without embedded visitor surveillance
- →Privacy-respecting relationship intelligence platforms
- →Self-hosted contact change monitoring eliminating cross-customer intelligence leakage
Negotiation Leverage
- →Challenge defeat device mechanisms within relationship intelligence platform
- →Require disclosure of all surveillance capabilities beyond contact tracking
- →Demand opt-out from cross-customer contact monitoring analysis
- →Request data processing agreement amendments addressing visitor surveillance through contact platform
- →Negotiate liability protection for comprehensive tracking deployed through relationship intelligence
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Detection evasion mechanisms obscure surveillance deployment within contact intelligence infrastructure.
Keystroke/mouse tracking
Impact: Interaction patterns captured to profile visitor engagement with relationship-building content.
Full session replay
Impact: Website sessions captured in full fidelity to contextualize contact relationship history.
Identity stitching
Impact: Contact tracking synchronized across organizational web properties and external relationship touchpoints.
Ignoring CMP signals
Impact: Visitor surveillance active before consent collection completes.
Device identification
Impact: Device characteristics harvested to maintain contact continuity across browsers and sessions.
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
No indicators in this category
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
17 detection signatures across scripts, domains, cookies, and network endpoints