How This Briefing Works
This report opens with key findings, then maps the gaps between what LiveIntent Advertising discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
LiveIntent Advertising was observed loading and executing before user consent was obtained on 57% of sites where it was detected.
Claims vs. Observed Behavior
email_web_tracking
“Unknown - requires claims extraction”
C09+C13+C14 detected - cross-channel email advertising surveillance
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use LiveIntent Advertising
- →Audit LiveIntent identity resolution scope - how are email and web identities linked?
- →Map persistence mechanisms across email and web channels
- →Enforce consent gate before LiveIntent tracking on web properties
- →Document consent timestamp vs advertising execution for compliance
- →Verify newsletter monetization works with consent-aware web tracking
If You're Evaluating LiveIntent Advertising
- →Request LiveIntent technical documentation of cross-channel identity resolution
- →Evaluate newsletter advertising without web-side identity tracking
- →Consider contextual email ads eliminating cross-channel correlation
- →Investigate first-party newsletter monetization alternatives
Negotiation Leverage
- →LiveIntent deploys C09+C13+C14 - vendor must explain cross-channel identity tracking
- →Demand disclosure of email-to-web identity resolution methodology
- →Require consent-first operation on web properties - no pre-consent advertising tracking
- →Negotiate opt-out of cross-channel identity resolution if email-only monetization sufficient
- →Establish liability terms for cross-channel tracking and consent violations
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Ignoring CMP signals
Long-lived identifiers
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
83 detection signatures across scripts, domains, cookies, and network endpoints