ZoomInfo's FormComplete product captures email addresses from form fields before users click submit, including data populated by browser autofill. The script monitors input field changes and immediately transmits emails to ZoomInfo servers for validation, without any user submission action.
This advisory exists to warn companies running ZoomInfo on their sites. We do not notify vendors. We do not provide remediation windows. If you're using this vendor, this is your evidence.
- ZoomInfo's own website
- Enterprise customers using FormComplete product
If You're Running ZoomInfo
Remove FormComplete script if deployed
Effort: trivialAudit all form handling scripts for pre-submit capture
Effort: moderateImplement consent-first form tracking
Effort: significantWhat It Costs You
CAC Subsidization
Visitor data captured on a site can flow into data broker networks and identity graphs, eventually surfacing in competitor prospecting tools. The original company paid to acquire the traffic; competitors pay pennies to intercept the lead.
Signal Corruption
Overlapping tracking mechanisms corrupt attribution data. Multiple sources claim credit for single conversions. Pipeline metrics diverge from reality. Marketing decisions get made on numbers that can’t be trusted.
Legal Tail Risk
Pre-consent data collection, undisclosed data sharing, and consent signal violations create regulatory exposure. Class actions and regulatory fines can exceed entire annual marketing budgets. Liability sits with the site owner, not the vendor.
GTM Attack Surface
Third-party scripts execute with full privileges on every page load. Dangerous code patterns, external dependencies, and data interception turn marketing infrastructure into attack vectors. One compromised dependency compromises the entire site.
Attack Parallel: Form Grabbers (Banking Trojans)
Zeus, SpyEye, and other banking trojans use "form grabbing" to intercept credentials before they reach legitimate servers. The technique hooks form events, captures input values, and exfiltrates data. FormComplete uses the identical technique: hook input events, capture email values, exfiltrate to ZoomInfo servers. The only difference is FormComplete is a "legitimate" product sold to enterprises.
ReferenceBTSS Score Breakdown
Technical Evidence
Code Evidence
FormComplete input monitoring (conceptual reconstruction)
// formcomplete.js attaches to all inputs
document.querySelectorAll('input').forEach(input => {
input.addEventListener('change', function(e) {
const value = e.target.value;
if (isEmail(value)) {
sendToZoomInfo(value, formId);
}
});
input.addEventListener('blur', function(e) {
const value = e.target.value;
if (isEmail(value)) {
sendToZoomInfo(value, formId);
}
});
});
Sardine.ai biometrics configuration (decoded from base64)
{
"loaderInitTime": 1764084620894,
"enableBiometrics": true,
"enableDNS": true,
"revision": "2025-10-28-d4021d2",
"origin": "https://www.zoominfo.com",
"collectorDomain": "frapi.zoominfo.com",
"dBaseDomain": "d.sardine.ai"
}
Network Evidence
https://ws.zoominfo.com/formcomplete-internal/getNeverbounce{"email":"clark@deployronin.com","formId":"79afc4d1-7040-4e49-945c-57ba17399b28"}This request was captured during a visit to zoominfo.com/products/gtm-studio. The email was NOT submitted - it was browser autofill. No form was completed. The email was immediately transmitted and validated against NeverBounce.
https://collector-pxosx7m0dx.px-cloud.net/api/v2/collectorPerimeterX fingerprinting - fires BEFORE consent
https://*.d.sardine.ai/bg.png?h=...Sardine.ai fingerprinting pixels (7 simultaneous requests)
Evidence Package
Reproduction Steps
## Reproduction Steps 1. **Open Chrome DevTools** on the Network tab 2. **Enable "Preserve log"** to capture all requests 3. **Visit** https://www.zoominfo.com/products/gtm-studio 4. **Let browser autofill** populate any form fields - Do NOT click submit - Do NOT type anything manually 5. **Search Network tab** for "formcomplete" or "neverbounce" 6. **Observe**: Your autofilled email was transmitted without action ## What to Look For - POST to `ws.zoominfo.com/formcomplete-internal/getNeverbounce` - Request body contains `"email": "your@email.com"` - This happens WITHOUT clicking submit
Legal Touchpoints
No lawful basis for processing. Capturing autofilled data without any user action cannot be based on consent (no action = no consent) or legitimate interest (too intrusive, not expected by users).
Consent must be freely given, specific, informed, and unambiguous. Autofill capture meets none of these criteria.
Right to know what personal information is collected. Users have no idea their autofilled email is being captured and validated.
Requires consent for accessing information stored on user equipment. Monitoring form field values to capture autofill data is accessing information from the user's browser.
Citation Templates
“Vendor shall not engage in behaviors classified under BTI-2025-0002 (ZoomInfo), including BTI-C02 (BTI-C02).”“BTI Advisory BTI-2025-0002 documents ZoomInfo engaging in BTI-C02 (BTSS 8.1, HIGH).”“We have identified ZoomInfo as exhibiting BTI-C02 behavior per BTI Advisory BTI-2025-0002. Full details: deployblackout.com/bti/BTI-2025-0002”