How This Briefing Works
This report opens with key findings, then maps the gaps between what LiveRamp discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Subprocessor Disclosure
Runtime scan detects 21+ third-party vendors receiving data including Clearbit, Criteo, Marketo, Salesloft, Bizible, Wistia, TrenDemon, Pubrio, Intellimize
Pre-Consent Tracking
10 vendors fire pre-consent on liveramp.com including identity resolution (Clearbit) and retargeting (Criteo)
Pre-Consent Activity
LiveRamp was observed loading and executing before user consent was obtained on 19% of sites where it was detected.
Privacy Marketing Claims
Website deploys aggressive tracking stack including identity resolution and retargeting before user consent
Undisclosed Party
Not in privacy policy
Claims vs. Observed Behavior
Subprocessor Disclosure
“Subprocessor list shows 5 vendors (AWS, GCP, Snowflake, Azure, Cognizant)”
Runtime scan detects 21+ third-party vendors receiving data including Clearbit, Criteo, Marketo, Salesloft, Bizible, Wistia, TrenDemon, Pubrio, Intellimize
Comparison of https://liveramp.com/legal/subprocessors/ against runtime detection on liveramp.com
Pre-Consent Tracking
“SOC2 Type II, GDPR, CCPA compliance certified”
10 vendors fire pre-consent on liveramp.com including identity resolution (Clearbit) and retargeting (Criteo)
Runtime scan shows Clearbit, Criteo, Bizible, DoubleClick, GoogleAds, GA4, Ketch, Marketo, Salesloft, Wistia all pre-consent=true
Privacy Marketing Claims
“We put people first...consumer privacy a priority”
Website deploys aggressive tracking stack including identity resolution and retargeting before user consent
Privacy policy quote vs runtime scan results
Competitive Intelligence Risk
“LiveRamp is a neutral identity resolution platform”
Uses competing identity vendor (Clearbit/HubSpot) to identify visitors, potentially feeding prospect data to competitor ecosystem
Clearbit detected pre-consent on liveramp.com
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use LiveRamp
- →Audit your consent implementation against LiveRamp's own pre-consent behavior — if they cannot maintain compliance on their own site, review their handling of your data
- →Compare your DPA and subprocessor list against LiveRamp's actual vendor stack — 21+ detected versus 5 disclosed is a material gap
- →Request evidence of consent capture for any LiveRamp-processed data flowing through your identity resolution workflows
- →Consider whether competitor identity vendors (Clearbit/HubSpot) receiving your prospect data through LiveRamp's site visits is acceptable risk
- →Verify LiveRamp's data retention and deletion practices align with your contractual requirements
If You're Evaluating LiveRamp
- →Request complete subprocessor list beyond the 5 infrastructure providers — 21+ vendors at runtime is a critical disclosure gap
- →Ask specifically about the Clearbit deployment on liveramp.com — why does an identity resolution company use a competitor's identity resolution?
- →Verify consent architecture for data onboarding workflows and cross-device matching before procurement
- →Assess whether LiveRamp's central position in the ad ecosystem (92% coverage) creates concentration risk for your identity strategy
- →Negotiate robust audit rights given the scale and criticality of identity data flowing through their platform
Negotiation Leverage
- →Subprocessor reconciliation: 5 disclosed versus 21+ detected including Clearbit (competitor identity resolution), Criteo, Marketo, and TrenDemon. Require complete enumeration of all data recipients on liveramp.com and any data sharing that affects your audience data.
- →Clearbit competitor exposure: LiveRamp deploys Clearbit (HubSpot-owned) on their own site, meaning your prospect evaluations are visible to a competitor ecosystem. Require written explanation of this relationship and contractual guarantee your data does not flow to competing identity platforms.
- →Consent chain verification: As the identity backbone for 92% of ad ecosystem, consent provenance is critical. Require documented consent chain for all data processed through LiveRamp on your behalf under GDPR Art 7.
- →Pre-consent SLA: 10 vendors fire pre-consent on liveramp.com. Require contractual guarantee that LiveRamp's data processing respects your consent signals with zero pre-consent activity.
- →Data flow audit rights: Require quarterly right to audit which parties receive your audience data through LiveRamp's 600+ advertiser network, with right to restrict specific data flows.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
No indicators in this category
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
14 detection signatures across scripts, domains, cookies, and network endpoints