How This Briefing Works
This dossier opens with key findings, then maps the gap between what Intercom discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 56 sites
vendor fires before consent
1 HIGH
Briefing
Intercom is a customer messaging platform offering live chat, email campaigns, and knowledge base tools. BLACKOUT detected it on 42 sites across 65 total observations, with a payload of 25 distinct scripts — extraordinarily heavy for a chat widget. With 7 BTI-C codes triggered including cross-domain sync (C08) and identity resolution (C14), Intercom is not merely facilitating customer conversations — it is building cross-site identity graphs from your visitors. The 51% pre-consent firing rate means the majority of observed Intercom deployments activate their full tracking suite before any consent mechanism engages.
What This Means For You
If Intercom is on your site, you are loading 25 scripts for what most visitors perceive as a chat bubble. That payload performs cross-domain identity stitching, behavioral tracking, and device fingerprinting well beyond what customer messaging requires. Your visitors' chat conversations, browsing patterns, and device characteristics flow into Intercom's platform where they are merged into persistent identity profiles. The 51% pre-consent rate means your CMP is likely not controlling Intercom effectively — creating direct ePrivacy liability. Your privacy policy probably describes Intercom as a "customer support tool" while it operates as a cross-site identity resolution platform.
Risk Channel Breakdown
Signal corruption score of 40 reflects Intercom's impact on measurement integrity. Its 25-script payload injects significant JavaScript execution that can interfere with page performance metrics, attribution models, and first-party analytics accuracy. What appears as engagement data may be Intercom's own instrumentation.
CAC subsidization score of 100 — maximum severity. Intercom's cross-domain sync and identity resolution capabilities mean visitor data from your site feeds into Intercom's platform intelligence. With identity stitching across 42+ customer sites, Intercom accumulates behavioral profiles that inform its product recommendations and potentially its broader data partnerships.
Expands attack surface
Legal tail risk score of 100 — maximum severity. 51% pre-consent firing rate with 25 scripts creates substantial ePrivacy exposure. Cross-domain identity stitching without explicit consent violates GDPR's purpose limitation principle. Intercom's identity resolution (C14) turns anonymous chat interactions into identifiable user profiles — a processing activity most privacy policies do not adequately disclose.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Long-lived identifiers
PII deanonymization
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Intercom's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
googletagmanager, googleanalytics4, linkedinads…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →