How This Briefing Works
This report opens with key findings, then maps the gaps between what Lead411 discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
consent
8 third-party tracking services fire pre-consent including GA4, Smartlook, Clarity, PostHog, and expertise.ai visitor resolution with HEM identity matching
disclosure
8+ distinct third-party services detected on marketing site including undisclosed cookie sync domain a.usbrowserspeed.com and visitor resolution service expertise.ai
session_recording
Two separate session replay tools active simultaneously: Smartlook (web-sdk.smartlook.com/recorder.js) and Microsoft Clarity (clarity.ms/tag). Neither named specifically in privacy policy
identity_resolution
expertise.ai chat widget includes visitor-enrichment module that performs identity resolution via HEM (SHA-256 hashed email) sent to a.usbrowserspeed.com cookie sync, then to api.expertise.ai/visitor-resolution endpoint
Undisclosed Sharing
Hidden data recipients
Claims vs. Observed Behavior
consent
“GDPR compliance with consent-based processing for marketing (Privacy Policy Section 7)”
8 third-party tracking services fire pre-consent including GA4, Smartlook, Clarity, PostHog, and expertise.ai visitor resolution with HEM identity matching
Network requests show google-analytics.com/g/collect, web-sdk.smartlook.com, clarity.ms, us.i.posthog.com, and api.expertise.ai/visitor-enrichment/visitor-resolution all loaded before any consent interaction
disclosure
“No subprocessor list published; privacy policy lists generic categories (service providers, advertising partners)”
8+ distinct third-party services detected on marketing site including undisclosed cookie sync domain a.usbrowserspeed.com and visitor resolution service expertise.ai
Network request to a.usbrowserspeed.com/cs returns HEM and sets tuid cookie (Max-Age=31536000). POST to api.expertise.ai/visitor-enrichment/visitor-resolution sends platformId, visitorId, and hem_sha256
session_recording
“Privacy policy acknowledges session-replay technologies generically”
Two separate session replay tools active simultaneously: Smartlook (web-sdk.smartlook.com/recorder.js) and Microsoft Clarity (clarity.ms/tag). Neither named specifically in privacy policy
Both Smartlook and Clarity scripts confirmed loading and active via window.smartlook and window.clarity global objects
identity_resolution
“No disclosure of visitor de-anonymization on marketing site”
expertise.ai chat widget includes visitor-enrichment module that performs identity resolution via HEM (SHA-256 hashed email) sent to a.usbrowserspeed.com cookie sync, then to api.expertise.ai/visitor-resolution endpoint
POST body to visitor-resolution contains platformId, visitorId, hem_sha256. Response from a.usbrowserspeed.com returns matching HEM and tuid with 1-year cookie
transparency
“Privacy policy does not honor Do Not Track signals”
Explicit statement: We currently do not respond to a Do Not Track signal. At least transparent about this.
Privacy Policy Section 5.5
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Lead411
- →Audit your outbound sequences sourced from Lead411 data for consent chain compliance under GDPR Art 14
- →Request Lead411 DPA and subprocessor list -- if they cannot provide one, that is a material gap for GDPR Art 28 compliance
- →Verify Lead411 data sources are disclosed in your own privacy policy if you use their data for outreach
- →Check if Lead411 Chrome Extension is deployed by your team and what data it captures
If You're Evaluating Lead411
- →Request Lead411 documentation of consent basis for contact data collection before signing
- →Ask specifically about expertise.ai and a.usbrowserspeed.com integrations and whether customer data flows through these services
- →Compare Lead411 CCPA metrics page disclosure rates against your compliance requirements
- →Benchmark against competitors (ZoomInfo, Apollo) on subprocessor transparency
Negotiation Leverage
- →Lead411 is a registered data broker in California (#185769) and Texas -- ask them to confirm all state registrations are current and whether they registered in Vermont and Oregon as required
- →Their privacy policy admits to selling consumer data to customers but publishes no subprocessor list -- request one as a condition of any agreement
- →Investigation found 8+ third-party services on lead411.com firing before Cookiebot consent, contradicting their GDPR compliance claims -- use this as leverage for a robust DPA
- →The undisclosed expertise.ai visitor-resolution pipeline with a.usbrowserspeed.com cookie sync is not mentioned in their privacy policy -- ask them to explain this data flow before signing
- →They run two simultaneous session replay tools (Smartlook + Clarity) on a site that sells PII -- request confirmation this behavioral data is not correlated with contact records
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Long-lived identifiers
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
205 detection signatures across scripts, domains, cookies, and network endpoints