How This Briefing Works
This report opens with key findings, then maps the gaps between what Vertoz discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Claims vs. Observed Behavior
Pending Analysis
“Claims extraction pending”
Claims extraction pending — CDT analysis required.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Vertoz
- →Audit programmatic contracts for data sharing clauses that allow competitor access to behavioral profiles
- →Demand Vertoz data retention schedule and third-party disclosure list
- →Implement consent requiring explicit opt-in for behavioral advertising and session recording
If You're Evaluating Vertoz
- →Contextual advertising alternatives that don't require behavioral profiles
- →Ad tech vendors with contractual prohibitions on data sharing with competitors
Negotiation Leverage
- →Session recording detected for advertising purposes — require explicit consent mechanism per ePrivacy Directive Article 5(3) and GDPR Article 6(1)(a)
- →CAC subsidization: demand contractual prohibition on sharing behavioral data with DSPs, SSPs, or data brokers that competitors can access
- →Legal exposure: session recordings create permanent evidence of consent violations — require liability cap and indemnification for regulatory penalties
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Full session replay
Impact: Session capture in advertising context creates dual risk: behavioral data leaks to demand-side platforms that competitors access, while recording user interactions without explicit consent violates ePrivacy requirements.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
99 detection signatures across scripts, domains, cookies, and network endpoints