How This Briefing Works
This report opens with key findings, then maps the gaps between what VWO discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
VWO was observed loading and executing before user consent was obtained on 47% of sites where it was detected.
Pending Analysis
9 BTI behavioral codes detected across 47 instances on 29 sites. Full claims extraction required for gap analysis.
Claims vs. Observed Behavior
Pending Analysis
“Claims analysis pending”
9 BTI behavioral codes detected across 47 instances on 29 sites. Full claims extraction required for gap analysis.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use VWO
- →Immediately audit whether VWO session recordings capture sensitive form fields (passwords, payment data, health information)
- →Verify your CMP blocks ALL VWO scripts and cookies until explicit consent for session recording and behavioral biometrics
- →Update your privacy policy to specifically disclose session recording, behavioral biometrics, and identity resolution
- →Review VWO's data retention settings and enforce minimum retention periods
If You're Evaluating VWO
- →Conduct a DPIA specifically for VWO's behavioral biometrics (C06) and session recording (C07) capabilities
- →Assess whether VWO's 8-domain infrastructure triggers cross-border data transfer obligations
- →Evaluate server-side A/B testing alternatives that do not require client-side behavioral capture
- →Request VWO's SOC 2 report and verify data isolation between customers
Negotiation Leverage
- →9 BTI behavioral codes detected — the most extensive behavioral footprint in this analysis batch. Demand a complete technical disclosure of all data collection capabilities
- →47% pre-consent firing rate across 29 sites demonstrates systemic consent bypass, not isolated misconfiguration
- →Behavioral biometrics (C06) + session recording (C07) = sensitive personal data processing that likely triggers DPIA requirements under GDPR Article 35
- →9 cookies and 8 domains represent an unusually large persistence footprint for an optimization tool — demand justification for each cookie and domain
- →Identity resolution (C14) transforms a testing tool into a surveillance platform — require contractual prohibition on using your visitor data for cross-customer profiling
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Evasion infrastructure means VWO can alter its behavior during compliance audits, making it impossible to verify through standard testing what data is collected during normal visitor sessions.
Keystroke/mouse tracking
Impact: Keystroke dynamics and mouse movement tracking captures unique behavioral signatures of your visitors. This biometric data is classified as sensitive personal data under multiple privacy frameworks and requires explicit consent with specific purpose limitation.
Full session replay
Impact: Full session replay means every click, scroll, and form interaction on your site is captured and transmitted to VWO servers. Visitors typing passwords, credit card numbers, or health information have no visibility into this recording.
Identity stitching
Impact: Identity stitching across 8 domains means VWO correlates visitor behavior across multiple properties, building behavioral profiles that extend beyond your site and beyond your data processing disclosures.
Ignoring CMP signals
Impact: VWO fires before consent on 47% of observed deployments. Every pre-consent session recording and biometric capture is a separate GDPR violation with potential fines up to 4% of annual turnover.
Device identification
Impact: Device fingerprinting creates persistent visitor identifiers that survive cookie clearing, undermining the right to withdraw consent and creating compliance gaps with ePrivacy regulations.
Long-lived identifiers
Impact: Long-lived identifiers across 9 cookies ensure visitor tracking persists beyond reasonable session boundaries. Combined with fingerprinting, this creates a dual-layer persistence architecture that is extremely difficult for visitors to escape.
PII deanonymization
Impact: PII deanonymization transforms VWO from a testing tool into an identification system. Anonymous visitors can be resolved to real identities, creating data processing that most privacy policies do not disclose.
Container/loader (neutral)
Impact: Tag management capabilities mean VWO can dynamically load additional scripts and trackers, expanding the data collection surface beyond what was initially deployed or audited.
IOC Manifest
Indicators of compromise across 6 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
64 detection signatures across scripts, domains, cookies, and network endpoints