How This Briefing Works
This dossier opens with key findings, then maps the gap between what CHEQ discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 7 sites
vendor fires before consent
3 CRIT · 2 HIGH
Briefing
CHEQ (cheq.ai) positions itself as "The Global Leader in Go-to-Market Security," offering bot detection, click fraud prevention, and compliance tools. However, BLACKOUT runtime analysis reveals CHEQ operates exactly the surveillance infrastructure they market protection against. Their own website exhibits an 88.3% pre-consent tracking rate across 103 detections, with 18 vendors firing before consent and tracking persisting after consent rejection. This represents a textbook case of compliance theater: SOC2, ISO 27001, GDPR, and CCPA badges displayed alongside systematic privacy violations including undisclosed Clearbit B2B de-anonymization and Hotjar session recording. The irony is foundational: CHEQ sells tools to detect the exact behaviors they deploy against their own visitors.
What This Means For You
If CHEQ's "GTM Security" tools are deployed on your site, you are partnering with a vendor that operates the exact surveillance behaviors they claim to detect. Their 88.3% pre-consent rate and consent rejection bypass (29 cookies persist after "Reject All") mean CHEQ's own JavaScript may violate your consent architecture. Under GDPR Art 7, their tracking persists after consent denial, creating direct regulatory liability for you. CHEQ owns Deduce (identity resolution), ClickCease, and Ensighten (consent management) — creating a surveillance conglomerate with visibility across 15,000+ customer websites. Undisclosed Clearbit deanonymization on cheq.ai means prospects evaluating CHEQ are identified and targeted, a practice that may extend through their deployed JavaScript. The irony is structural: CHEQ sells bot detection while deploying undisclosed session recording and identity resolution against their own visitors.
Risk Channel Breakdown
CHEQ corrupts measurement by operating undisclosed Clearbit B2B de-anonymization and ZoomInfo identity resolution on their own site while selling tools that claim to detect similar surveillance. Companies evaluating CHEQ for bot detection may be unknowingly submitting their visitors to the same identification techniques they seek protection from. Attribution data from CHEQ-monitored properties may be influenced by CHEQ's own data collection agenda.
CHEQ owns Deduce (identity resolution), ClickCease, and Ensighten - creating a surveillance conglomerate with visibility across thousands of customer websites. Clearbit integration on cheq.ai actively de-anonymizes business visitors, potentially feeding intelligence about competitor prospects. With 15,000+ customer deployments, CHEQ has unprecedented access to cross-site visitor behavior that could inform their own go-to-market activities.
CHEQ deploys obfuscated tracking infrastructure (takingbackjuly.com CNAME cloaking) that mirrors botnet evasion techniques they claim to detect. Hotjar session recording on a security vendor site creates attack surface for session replay attacks. The 29 cookies set pre-consent include persistent device IDs that could be exploited if CHEQ infrastructure is compromised.
CHEQ displays GDPR, CCPA, SOC2, and ISO 27001 compliance badges while maintaining 88.3% pre-consent tracking - a direct violation of GDPR Article 6 and 7. After consent rejection, all tracking cookies persist (documented in forensic analysis). This consent theater creates regulatory liability for any organization citing CHEQ's compliance claims in their own vendor assessments. The gap between displayed certifications and runtime behavior is the largest we have documented in the GTM security space.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Long-lived identifiers
PII deanonymization
Container/loader (neutral)
Claims-vs-Reality (BTI-X)
Not in privacy policy
Hidden data recipients
Behavior contradicts marketing
False certification claims
Tracking continues after opt-out
Collection exceeds disclosed scope
CMP vendor list vs runtime
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed CHEQ's public claims against observed runtime behavior and identified 5 contradictions.
"SOC2 Type II, ISO 27001, GDPR, CCPA compliant"
88.3% pre-consent tracking rate, consent rejection ignored, 29 cookies set before consent interaction
4 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 3, observed 5
hubspot, googletagmanager, googleanalytics4…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →