How This Briefing Works
This report opens with key findings, then maps the gaps between what Intentsify discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Consent Divergence
80% of vendors load before consent obtained on their own website. Six surveillance vendors (Clearbit, CookieYes, Demandbase, HubSpot, IDVisitors, TradeDesk) fire pre-consent.
Pre-Consent Activity
Intentsify was observed loading and executing before user consent was obtained on 80% of sites where it was detected.
Subprocessor Transparency
21 distinct third-party vendors detected on their website with no disclosure mechanism
Data Sale Contradiction
Consumer privacy policy: We may have sold or shared identifiers, personal information, professional information
Scope Misrepresentation
Identity resolution with 382M contacts, 5B MAIDs, hashed emails for person-level tracking
Claims vs. Observed Behavior
Consent Divergence
“SOC2 Type II certified, GDPR compliant, CCPA compliant”
80% of vendors load before consent obtained on their own website. Six surveillance vendors (Clearbit, CookieYes, Demandbase, HubSpot, IDVisitors, TradeDesk) fire pre-consent.
Runtime scan of intentsify.io detected pre_consent=true for 6 vendors
Subprocessor Transparency
“No public subprocessor list provided”
21 distinct third-party vendors detected on their website with no disclosure mechanism
intel_detections shows Clearbit, Demandbase, HubSpot, IDVisitors, TradeDesk, Hotjar, RB2B, Reddit, and 13 others
Data Sale Contradiction
“Website privacy policy: We do not sell or share personal information”
Consumer privacy policy: We may have sold or shared identifiers, personal information, professional information
Conflicting statements between website-data-privacy-policy and consumer-data-privacy-policy pages
Scope Misrepresentation
“B2B intent data and buying group intelligence”
Identity resolution with 382M contacts, 5B MAIDs, hashed emails for person-level tracking
Identity Graph page explicitly states contact records, MAIDs, and IP resolution capabilities
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Intentsify
- →Audit your DPA and verify subprocessor notification rights exist — Intentsify has no public subprocessor list despite 21 detected vendors
- →Verify your privacy policy adequately discloses Intentsify's identity resolution capabilities, not just 'intent data' — they operate 382M contacts and 5B MAIDs
- →Review consent basis for all Intentsify-sourced data — their 80% pre-consent rate and contradicting privacy policies make consent chain verification critical
- →Document legitimate interest basis if applicable — 'intent data' framing may not cover person-level tracking through their Identity Graph
- →Request written reconciliation of their two contradicting privacy policies before your next contract renewal
If You're Evaluating Intentsify
- →Request SOC2 Type II report and verify scope covers data processing operations, not just infrastructure
- →Ask for written confirmation of GDPR legal basis for identity resolution processing across 382M contacts
- →Require complete subprocessor list as a pre-contract condition — their refusal to publish one is a transparency red flag
- →Verify their opt-out mechanism actually removes data from the Identity Graph — test with your own organization's records
- →Consider alternative providers with transparent data sourcing: Bombora for aggregate-only intent, G2 for declared intent signals
Negotiation Leverage
- →Privacy policy reconciliation: Intentsify's website policy says 'we do not sell personal information' while their consumer policy admits selling identifiers and professional information. Require written reconciliation of these contradictions and contractual commitment to the non-sale position for your data.
- →Consent chain verification: 80% pre-consent rate on intentsify.io raises questions about consent provenance for their 382M contact database. Require documented consent chain for all data provided to your organization, with right to audit quarterly.
- →Subprocessor disclosure: 21 third-party vendors detected on their website with no public subprocessor list. Require complete enumeration of all data processors in their supply chain with 30-day advance notice before additions.
- →Identity Graph opt-out: Require contractual mechanism for your organization's employees and customers to be permanently excluded from Intentsify's Identity Graph of 382M contacts, 5B MAIDs, and 203M IP addresses.
- →Data isolation guarantee: Multi-tenant intent data model means your research signals may inform competitor campaigns. Require contractual data isolation ensuring your account activity and intent signals are never used to enrich competitor targeting.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
73 detection signatures across scripts, domains, cookies, and network endpoints