How This Briefing Works
This report opens with key findings, then maps the gaps between what Foundry ABM discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Consent Bypass
SourcePoint CMP determines GDPR does not apply and renders zero consent UI. All 20+ third-party trackers fire on page load without any consent mechanism presented to visitors.
Undisclosed Data Sharing
20+ specific ad networks, analytics services, and retargeting platforms receive visitor data on every page load. None are named in the privacy policy as specific recipients.
Identity Resolution Without Consent
KickFire (Foundry-owned) performs IP-to-company identity resolution on every visitor, linking IP addresses to company identities without explicit consent. This is individual-level identification masquerading as aggregate B2B research.
Session Replay Without Disclosure
Microsoft Clarity session replay is active, recording mouse movements, clicks, scrolls, and form interactions. This captures behavioral biometric data without specific disclosure.
CNAME Cloaking
SourcePoint CMP is hosted on cmpv2.foundryco.com, a first-party subdomain CNAME-cloaked to disguise third-party consent management infrastructure as first-party.
Claims vs. Observed Behavior
Consent Bypass
“Claims GDPR compliance and references ePrivacy Directive in privacy policy”
SourcePoint CMP determines GDPR does not apply and renders zero consent UI. All 20+ third-party trackers fire on page load without any consent mechanism presented to visitors.
CDT MCP investigation: CMP metadata response shows gdpr.applies=false. Network log shows 20+ third-party domains firing pre-consent including Google Analytics, Google Ads, Meta Pixel, LinkedIn Insight, Bing UET, Reddit Pixel, The Trade Desk, Microsoft Clarity, HubSpot, SalesLoft, and KickFire.
Undisclosed Data Sharing
“Privacy policy states data shared with business partners and sponsors”
20+ specific ad networks, analytics services, and retargeting platforms receive visitor data on every page load. None are named in the privacy policy as specific recipients.
CDT MCP network analysis: Google Ads (AW-325207805, AW-933723986), Meta Pixel (1215706755128807), LinkedIn Insight (pid:4249626), Bing UET (ti:187120442), Reddit Pixel, The Trade Desk, Microsoft Clarity, SalesLoft, KickFire, WordPress Stats all fire pre-consent.
Identity Resolution Without Consent
“Privacy policy describes processing for B2B market research and analysis”
KickFire (Foundry-owned) performs IP-to-company identity resolution on every visitor, linking IP addresses to company identities without explicit consent. This is individual-level identification masquerading as aggregate B2B research.
CDT MCP network log: api.kickfire.com/gip and twin-iq.kickfire.com/twin.js fire on page load. KickFire API returns company identification data based on visitor IP.
Session Replay Without Disclosure
“No mention of session recording in privacy policy”
Microsoft Clarity session replay is active, recording mouse movements, clicks, scrolls, and form interactions. This captures behavioral biometric data without specific disclosure.
CDT MCP: scripts.clarity.ms loaded via GTM, n.clarity.ms/collect POST requests observed, _clck and _clsk cookies set.
CNAME Cloaking
“Cookie policy references use of third-party cookies”
SourcePoint CMP is hosted on cmpv2.foundryco.com, a first-party subdomain CNAME-cloaked to disguise third-party consent management infrastructure as first-party.
CDT MCP network analysis: cmpv2.foundryco.com serves SourcePoint CMP JavaScript and configuration data. This makes the third-party CMP appear as first-party infrastructure.
Data Broker Registration
“CCPA page discloses: Foundry is registered as a data broker”
Confirmed registered data broker selling personal data via cookies for personalized advertising, while simultaneously positioning as a trusted B2B content and research platform.
CCPA page verbatim: Foundry may sell your personal data, including information collected by cookies, with third parties for the purpose of personalized advertising.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Foundry ABM
- →Audit your deployment to confirm whether KickFire or other Foundry scripts fire before consent is obtained on your properties
- →Request a complete list of all data recipients who receive visitor data collected through Foundry integrations on your sites
- →Add contract clause requiring Foundry to honor consent signals (GPC, TCF) before processing any visitor data from your properties
- →Implement server-side integration for any Foundry intent data feeds to eliminate client-side script execution and associated supply chain risk
- →Review your GDPR Art 28 data processing agreement to ensure it covers all observed third-party data flows, including the 20+ ad/analytics vendors Foundry loads on its own infrastructure
If You're Evaluating Foundry ABM
- →Require Foundry to disclose all third-party vendors loaded by their technology stack before signing
- →Negotiate explicit data broker liability indemnification given Foundry's registered data broker status under CCPA
- →Request documentation of how KickFire IP-to-company resolution handles consent requirements across jurisdictions
- →Compare intent data quality against TechTarget, Bombora, or G2 who do not operate as registered data brokers
- →Require right-to-audit clause allowing independent verification of consent compliance on your deployment
Negotiation Leverage
- →Data broker liability: Foundry is a registered California data broker that admits selling personal data via cookies. Any contract should include full indemnification for regulatory actions arising from Foundry's data broker activities on your properties.
- →Consent compliance SLA: Investigation found zero consent UI rendered and 20+ trackers firing pre-consent on Foundry's own site. Require contractual guarantee that all Foundry technology respects consent signals on your deployment, with liquidated damages for violations.
- →Third-party disclosure: Foundry's privacy policy does not name the 20+ specific ad networks and analytics platforms receiving visitor data. Require complete vendor disclosure and 30-day advance notice before adding new data recipients.
- →KickFire transparency: Foundry's IP-to-company identity resolution technology identifies visitors without explicit consent. Require documentation of legal basis for this processing and contractual limitation on downstream use of identification data.
- →Vertical integration conflict: Foundry controls the content network, the intent data platform, and the identity resolution technology. Require independent audit rights to verify that intent signals are not inflated by Foundry's control of the measurement environment.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
72 detection signatures across scripts, domains, cookies, and network endpoints