How This Briefing Works
This dossier opens with key findings, then maps the gap between what Clay discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 17 sites
vendor fires before consent
1 CRIT · 2 HIGH
Briefing
Clay Labs is a $3.1B-valued GTM data enrichment platform that aggregates 150+ data providers and AI agents. As a self-admitted data broker, Clay sells professional contact information to customers. Key finding: Clay deploys 44+ third-party vendors on their own website including identity resolution (RB2B), advertising pixels (Meta, Google, LinkedIn), and intent vendors, yet their subprocessor list only discloses infrastructure providers. With 28.2% pre-consent tracking rate while claiming SOC2/GDPR/CCPA compliance, Clay exemplifies the gap between compliance theater and runtime behavior.
What This Means For You
YOUR enrichment queries through Clay expose YOUR prospect lists to a platform aggregating data from 150+ sources — every query teaches Clay more about YOUR target accounts and ideal customer profile. YOUR compliance posture is directly affected: as a self-admitted data broker, Clay triggers additional regulatory obligations under CCPA that flow through to YOUR data processing agreements. If YOUR sales team uses Clay for contact enrichment, YOUR organization may be processing personal data without adequate legal basis, since Clay's subprocessor list at trust.clay.com undercounts actual vendors by 10+. YOUR competitive intelligence is at risk — enrichment queries reveal YOUR ICP to a platform serving YOUR competitors.
Risk Channel Breakdown
Clay corrupts measurement by creating data asymmetry. Their 150+ enrichment providers enable customers to identify and profile prospects, while the same customers may appear in Clay databases without knowledge. Clay users gain visibility into their targets while contributing to a surveillance ecosystem.
As a data broker with access to 150+ data sources, Clay is a demand signal aggregator. Intent data, job changes, and enrichment queries all flow through Clay, creating a comprehensive view of market activity that could advantage competitors or buyers of Clay data.
Clay integrates with 150+ external APIs and data providers, creating significant third-party attack surface. Each integration is a potential data exfiltration vector. The RB2B identity resolution on their own site demonstrates willingness to deploy aggressive tracking technology.
Clay admits to being a data broker in their privacy policy. With 28.2% pre-consent tracking and undisclosed advertising vendors on their own site, organizations using Clay inherit consent liability. The gap between their disclosed subprocessors and actual site behavior creates audit exposure.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Claims-vs-Reality (BTI-X)
Not in privacy policy
Hidden data recipients
False certification claims
Collection exceeds disclosed scope
Gated or missing due diligence docs
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Clay's public claims against observed runtime behavior and identified 4 contradictions.
"Subprocessor list at trust.clay.com discloses 34 vendors"
44+ third-party vendors detected on clay.com, including 15+ advertising/tracking vendors completely absent from disclosures
3 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 34, observed 34
googletagmanager, metapixel, googleanalytics4…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →