How This Briefing Works
This dossier opens with key findings, then maps the gap between what Warmly discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 9 sites
vendor fires before consent
1 HIGH
Briefing
Warmly is an AI-powered visitor deanonymization platform that resolves anonymous website visitors to company and individual identities in real time. BLACKOUT detected it on 8 sites across 21 observations, triggering 8 distinct BTI-C codes — the densest behavioral footprint in this analysis group. Its signal corruption score of 70 is the highest in the entire VRS 85 tier, reflecting aggressive data collection that distorts first-party analytics. The detection of real-time exfiltration (C16) via WebSocket/SSE streaming means Warmly is not batching data for later processing — it is streaming visitor intelligence off your site in real time as users browse.
What This Means For You
If Warmly is on your site, your visitors are being identified in real time and their data is streaming off your property via WebSocket connections as they browse. With 8 BTI-C codes triggered — the most of any vendor in this group — Warmly represents the most behaviorally aggressive deanonymization tool we have observed at this risk tier. The real-time exfiltration (C16) means visitor data leaves your site before you could intervene even if you detected it. Your signal corruption score of 70 means your first-party analytics are significantly compromised whenever Warmly is active. Under GDPR, the combination of deanonymization, consent bypass, and real-time data transfer to a third party creates compounding liability that cannot be addressed through privacy policy updates alone.
Risk Channel Breakdown
Signal corruption score of 70 — the highest in the VRS 85 tier — reflects Warmly's severe impact on measurement integrity. Its real-time streaming architecture injects substantial network and JavaScript overhead that distorts page performance metrics, attribution models, and engagement signals. When Warmly is active, your analytics data cannot be trusted at face value.
CAC subsidization score of 100 — maximum severity. Warmly's cross-domain sync (C08) and identity resolution (C14) feed deanonymized visitor data into its AI platform, where it is processed and enriched. Real-time exfiltration (C16) means your visitor intelligence leaves your property instantly, before you have any opportunity to control or audit what is transmitted.
Expands attack surface
Legal tail risk score of 100 — maximum severity. The combination of deanonymization, consent bypass (33% pre-consent rate), and real-time data exfiltration creates a triple-layer compliance failure. WebSocket streaming (C16) makes data exfiltration invisible to standard network monitoring tools. Under GDPR, real-time transfer of personal data to a third party without consent and without adequate disclosure is among the most serious processing violations.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
WebSocket/SSE streaming
Claims-vs-Reality (BTI-X)
False certification claims
Gated or missing due diligence docs
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Warmly's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
liveintent_advertising, googletagmanager, liveintent_id_exchange…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →