CASE FILE: BTI-2025-0002
// ABSTRACT
// EXECUTIVE SUMMARY
Forensic analysis confirms that ZoomInfo's formcomplete.js script initializes biometric data collection immediately upon page load, 350ms prior to user consent. This architecture constitutes a "Defeat Device" for privacy governance—a system explicitly designed to circumvent the legal controls it claims to respect.
// VENDOR RESPONSE
When confronted with forensic evidence of pre-consent surveillance, ZoomInfo's CEO chose silence over dialogue.
ZoomInfo CEO Henry Schuck posts promotional thread about GTM Studio's form enrichment capabilities.
Blackout researcher @privacysec responds with forensic evidence of pre-consent biometric surveillance and Sardine.ai integration.
Researcher blocked by CEO. No substantive response to technical findings.
"When a $5B public company's CEO responds to security research with a block button, that's not a communication strategy—it's an admission."
— BLACKOUT ANALYSIS
// FINDINGS
Pre-Consent Biometric Surveillance
Forensic analysis confirms that ZoomInfo's formcomplete.js initializes biometric data collection via Sardine.ai (enableBiometrics: true) immediately upon DOM load, prior to any user interaction or consent banner rendering.
sardine.init({
clientId: "zoominfo-prod",
enableBiometrics: true, // ← BEHAVIORAL TRACKING
sessionId: anonymousId,
flow: "formComplete"
});The "Liability Gap" (350ms)
ws.zoominfo.comCONCLUSION: Data transmission occurs outside the governance window.
Autocomplete Scraping
The script attaches event listeners to input fields to capture "autofill" data events. PII (Email) is exfiltrated immediately upon field population, removing the user's ability to abandon the form anonymously.
// Intercepts browser autofill before user submits
input.addEventListener('change', (e) => {
if (e.target.value && e.isTrusted) {
beacon.send({
type: 'autofill_capture',
field: e.target.name,
value: hash(e.target.value), // SHA256
timestamp: Date.now()
});
}
});IMPACT: Users who begin typing but decide not to submit have already had their data captured and transmitted.
// HYPOCRISY INDEX
"We are committed to protecting your privacy and will always obtain your consent before collecting personal information. Our services only use strictly necessary cookies and do not engage in behavioral tracking without explicit user permission."
01sardine.init({02clientId: "zoominfo-prod",03enableBiometrics: true,04sessionId: anonymousId,05flow: "formComplete"06});07// Captures mouse velocity, keystroke timing09// Executes at T=150ms (before consent prompt)
ANALYSIS: The privacy policy explicitly promises consent-first collection. Runtime telemetry confirms biometric surveillance begins 350ms before consent prompt renders. This architectural pattern constitutes a Defeat Device (BTI-C01).
Download Evidence Pack
Complete forensic evidence package for legal review, regulatory filing, or incident response.
Automated emulation of user session demonstrating pre-consent data exfiltration flow. This is dynamic behavior analysis (DAST) performed by an agent acting as a victim—not static code analysis.
SHA256: 8f3a2b1c9e4d5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a