How This Briefing Works
This report opens with key findings, then maps the gaps between what Visual Visitor discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Analysis pending. Findings will appear here once intelligence collection is complete.
Claims vs. Observed Behavior
consent
“Consent-based person-level identification”
The specific consent mechanism is not clearly documented. It is unclear whether identified visitors have explicitly consented to being identified by name and email when visiting the customer's website
accuracy
“Identifies up to 35% of visitors by name”
The identification rate and accuracy depend on the quality and freshness of the underlying contact database. Match rates may vary significantly and false positives create outreach risk
compliance
“Compliance with CCPA and international data regulations”
B2C person-level deanonymization of website visitors is under active regulatory scrutiny. Multiple US state privacy laws now restrict sale and sharing of personal data without opt-in consent
pending
“Awaiting scanner verification”
Pre-consent loading behavior, cookie deployment patterns, third-party network requests, and actual data transmission payloads not yet verified by BLACKOUT scanner
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
Recommended Actions for Visual Visitor
- →- Immediately assess whether WebID +Person (B2C individual identification) is active and evaluate whether your privacy policy and consent flows adequately disclose person-level deanonymization - Request detailed documentation of Visual Visitor's consent mechanism for person-level identification, specifically what consent the identified visitor has provided - Audit all downstream activation channels (email, direct mail, custom audiences) to ensure identified visitor data is being used within lawful boundaries - Review Visual Visitor's data retention and deletion policies, particularly for visitor data that does not result in a conversion - Verify that opt-out requests from identified individuals propagate through all systems that received data from Visual Visitor
Negotiation Leverage
- →Customers have significant leverage because Visual Visitor's identification accuracy and database freshness depend on broad pixel deployment across customer websites. Key questions to ask: What is the specific consent mechanism for person-level identification and can you demonstrate that identified visitors have consented to being identified by name and email? What third-party data sources feed the 600M-900M contact database? How frequently is contact data validated for accuracy and opt-out compliance? What happens to visitor data collected from our website if we terminate the agreement?
- →Contractual protections to demand include: explicit prohibition on using your website visitor data to enrich Visual Visitor's database for other customers, data deletion certification upon termination, indemnification for claims arising from misidentified individuals or individuals who have exercised privacy rights, accuracy guarantees with remediation obligations for false matches, and a right to audit the consent chain for person-level identification data.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
137 detection signatures across scripts, domains, cookies, and network endpoints