How This Briefing Works
This report opens with key findings, then maps the gaps between what FullContact discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Analysis pending. Findings will appear here once intelligence collection is complete.
Claims vs. Observed Behavior
data_collection
“Privacy-first identity resolution that does not rely on third-party cookies or PII”
The identity graph explicitly contains PII including names, postal addresses, email addresses, phone numbers, and Mobile Ad IDs. Privacy policy acknowledges sensitive-inference data (health, religion, politics) is included and shared. Awaiting scanner verification.
data_sharing
“Customers access identity graph without giving away their data”
Identity Streme cooperative framework is designed for bidirectional data exchange using persistent Person IDs. The enrichment model inherently requires data input to produce data output. Awaiting verification of data flow directionality.
compliance
“CCPA and GDPR compliance applied universally”
Graph contains sensitive-inference data categories (health, religion, politics, citizenship) that require explicit consent under GDPR Article 9. Universal compliance claim needs verification against actual data handling for special category data. Awaiting runtime verification.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
Recommended Actions for FullContact
- →- Audit all FullContact API integrations to map which customer record fields are being enriched and from what sources - Assess regulatory exposure from sensitive-inference data categories (health, religion, politics) in enriched records - Review Identity Streme participation agreements to understand bidirectional data sharing obligations - Implement data provenance tracking for any FullContact-enriched fields in your CRM - Evaluate whether enriched records containing sensitive-inference data trigger GDPR Article 9 obligations in your jurisdiction
Negotiation Leverage
- →FullContact's acknowledged inclusion of sensitive-inference data (health, religion, politics, citizenship) in its identity graph is the primary negotiation lever. Under GDPR Article 9 and various US state privacy laws, processing this data requires explicit consent or a specific legal basis. Demand contractual warranties that enrichment responses will exclude sensitive-inference categories unless explicitly requested, and require documentation of lawful basis for each data source contributing to your enriched records.
- →For Identity Streme participation, negotiate strict controls on how your contributed data is used within the cooperative framework. Require transparency on which partners receive data derived from your customer records, implement contractual limits on downstream data use, and secure audit rights over the cooperative data flows. Demand data deletion SLAs that cover not just your direct records but any derived or enriched data that has propagated through the identity graph and partner network. The 900+ attribute depth means deletion must be comprehensive across all attribute categories.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Identity stitching
Impact: Identity Streme enables cross-organization data sharing using persistent Person IDs, synchronizing identity data across partner boundaries and enabling cross-domain identity resolution.
Ignoring CMP signals
PII deanonymization
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
80 detection signatures across scripts, domains, cookies, and network endpoints