How This Briefing Works
This report opens with key findings, then maps the gaps between what CompanyTarget discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
CompanyTarget was observed loading and executing before user consent was obtained on 20% of sites where it was detected.
Claims vs. Observed Behavior
consent
“Pending claims extraction via CDT”
Consent bypass during visitor identification detected
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use CompanyTarget
- →Configure CompanyTarget to activate only after consent for visitor identification collected
- →Verify identification occurs server-side (not client-side tracking)
- →Limit CompanyTarget use to internal reporting (not visitor-facing personalization without consent)
If You're Evaluating CompanyTarget
- →Request DPA confirming visitor IP data is not retained beyond identification process
- →Verify CompanyTarget honors consent signals before initiating deanonymization
- →Assess whether CompanyTarget deployment is necessary vs. aggregated analytics alternatives
Negotiation Leverage
- →CompanyTarget consent bypass (BTI-C09) during identification creates pre-consent deanonymization—require technical controls to delay identification until after consent for visitor tracking
- →Clarify IP retention period and whether visitor data is used for CompanyTarget's own analytics products
- →Negotiate maximum 24-hour IP data retention with automated deletion
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Ignoring CMP signals
Impact: Initiates visitor-to-company identification before consent collection, creating automatic legal violations for deanonymization workflows.
PII deanonymization
IOC Manifest
Indicators of compromise across 2 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
No indicators in this category
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
9 detection signatures across scripts, domains, cookies, and network endpoints