How This Briefing Works
This report opens with key findings, then maps the gaps between what Ahrefs discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Subprocessor Disclosure
Runtime scan detected 17 third-party vendors on ahrefs.com including Meta, Google, LinkedIn, Twitter, TrenDemon
Undisclosed Party
Not in privacy policy
Undisclosed Sharing
Hidden data recipients
Compliance Claim Mismatch
False certification claims
Claims vs. Observed Behavior
Subprocessor Disclosure
“Subprocessor list shows 4 vendors: AWS, CloudFlare, Mailchimp, SendGrid”
Runtime scan detected 17 third-party vendors on ahrefs.com including Meta, Google, LinkedIn, Twitter, TrenDemon
intel_detections table shows 17 distinct vendor_slugs for hostname containing ahrefs.com
Pre-Consent Tracking
“GDPR and CCPA compliant per DPA and privacy policy”
7 vendors fire before consent: Cloudflare Insights, CookieYes, DoubleClick, Google Ads, LinkedIn, MetaPixel, TwitterPixel
pre_consent=true for 7 vendors in intel_detections
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Ahrefs
- →Review your DPA and ensure the disclosed 4 subprocessors align with actual runtime vendor count of 17
- →Note that ISO 27001 certification is recent — verify scope covers your data processing requirements
- →Be aware that visiting ahrefs.com exposes your SEO research activity to 5 advertising platforms pre-consent
- →Request updated subprocessor list and compare against runtime detection data
If You're Evaluating Ahrefs
- →Request complete subprocessor list beyond the 4 disclosed before signing
- →Verify ISO 27001 certification scope covers third-party vendor management
- →Compare with SEMrush and Moz on vendor disclosure transparency and pre-consent behavior
- →Negotiate data isolation guarantees for your keyword and competitor research data
Negotiation Leverage
- →Subprocessor undercount: 17 vendors detected vs. 4 disclosed — 4x gap; require complete named vendor disclosure as a contract condition
- →Pre-consent advertising: DoubleClick, Google Ads, LinkedIn, Meta, and Twitter fire before consent — use this to negotiate removal of advertising pixels from your account data scope
- →SEO intelligence sensitivity: Keyword targets and competitor analysis reveal strategic priorities — negotiate data usage restrictions preventing competitive intelligence from your research patterns
- →Recent ISO 27001: Certification obtained in 2025 — verify scope covers third-party vendor management and pre-consent behavior controls
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Device identification
Long-lived identifiers
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
338 detection signatures across scripts, domains, cookies, and network endpoints