How This Briefing Works
This report opens with key findings, then maps the gaps between what Vector discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Compliance Claim Mismatch
62.3% pre-consent tracking rate across 34 monitored sites
Pre-Consent Activity
Vector was observed loading and executing before user consent was obtained on 63% of sites where it was detected.
Undisclosed Subprocessor
pro.ip-api.com receives visitor IP addresses but is not disclosed
Security Vulnerabilities
Q4 2025 pentest found 1 Critical, 1 High, 5 Low vulnerabilities
Undisclosed Party
Not in privacy policy
Claims vs. Observed Behavior
Compliance Claim Mismatch
“GDPR compliant, CCPA compliant”
62.3% pre-consent tracking rate across 34 monitored sites
BLACKOUT runtime detection data from intel_detections table
Undisclosed Subprocessor
“Privacy policy lists data recipients”
pro.ip-api.com receives visitor IP addresses but is not disclosed
Pixel script makes requests to pro.ip-api.com/json/ with API key 82LH3HgJ6w0DP7N
Security Vulnerabilities
“SOC2 ready, security-focused”
Q4 2025 pentest found 1 Critical, 1 High, 5 Low vulnerabilities
Oneleet Penetration Test Report Q4 2025 - VCTR-001 through VCTR-007
Self-Contradictory Privacy Practice
“Privacy-aware platform”
21 third-party vendors running pre-consent on vector.co, only 3 disclosed
BLACKOUT scan of www.vector.co showing AOL, Clarity, DoubleClick, LiveIntent etc.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Vector
- →Audit consent flow — Vector's 62.3% pre-consent rate suggests improper CMP integration; verify your deployment blocks Vector until explicit consent
- →Review subprocessor agreements — 21 undisclosed vendors means your DPA likely has gaps; request updated subprocessor list
- →Implement server-side gating — do not rely on client-side consent checks given Vector's pre-consent behavior patterns
- →Request Vector's latest pentest report — critical vulnerabilities were documented in their infrastructure
If You're Evaluating Vector
- →Request Vector's consent architecture documentation before any trial
- →Compare with RB2B, Clearbit, and 6sense on pre-consent behavior — Vector's 62.3% rate is among the highest in identity resolution
- →Require contractual guarantees that your visitor data will not be used for competitive advertising targeting
- →Verify Vector's GDPR and CCPA compliance claims against BLACKOUT runtime evidence
Negotiation Leverage
- →Pre-consent rate documentation: BLACKOUT runtime data shows 62.3% of Vector tracking fires before consent across 34 monitored sites — use this to negotiate consent architecture improvements or termination rights
- →Undisclosed subprocessor gap: 21 vendors detected that are not in Vector's privacy disclosures — request updated subprocessor list and contractual indemnification for regulatory exposure
- →Competitive signal leakage: Vector's model explicitly identifies your visitors for retargeting on LinkedIn and Google — negotiate data usage restrictions preventing your demand signals from reaching competitors
- →Pentest vulnerability evidence: Critical security findings documented in Vector's infrastructure — leverage for security audit requirements and data protection guarantees in your contract
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
55 detection signatures across scripts, domains, cookies, and network endpoints
HAR Forensics
| Destination | Algorithm |
|---|---|