How This Briefing Works
This report opens with key findings, then maps the gaps between what Madison Logic discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
identity_resolution
SA pixel documentation confirms matching cookie/device IDs against DMP database of companies and their respective cookies. Account-level identification via cookie-to-company mapping is identity resolution.
consent_bypass
Scanner confirmed pre_consent=TRUE on madisonlogic.com self-scan (SCAN-1769099737063, HIGH confidence, 142 evidence items). 15% pre-consent rate across all detections. Tracking fires before consent banner is actioned.
Pre-Consent Activity
Madison Logic was observed loading and executing before user consent was obtained on 15% of sites where it was detected.
certification_opacity
Trust center page (trust.madisonlogic.com) redirects away from Madison Logic domain to unrelated third-party sites. SOC 2 report not publicly accessible or verifiable.
supply_chain_opacity
Shares with Marketing/Advertising Partners, Data Analytics Providers, and Social Networks for cross-contextual behavioral advertising. No named subprocessor list accessible. Trust center non-functional.
Claims vs. Observed Behavior
identity_resolution
“Privacy policy: does not use this information to discern your identity”
SA pixel documentation confirms matching cookie/device IDs against DMP database of companies and their respective cookies. Account-level identification via cookie-to-company mapping is identity resolution.
consent_bypass
“OneTrust consent management platform deployed with Reject All option”
Scanner confirmed pre_consent=TRUE on madisonlogic.com self-scan (SCAN-1769099737063, HIGH confidence, 142 evidence items). 15% pre-consent rate across all detections. Tracking fires before consent banner is actioned.
certification_opacity
“SOC 2 Type II certified (per trust center)”
Trust center page (trust.madisonlogic.com) redirects away from Madison Logic domain to unrelated third-party sites. SOC 2 report not publicly accessible or verifiable.
supply_chain_opacity
“Data sharing disclosed in privacy policy with categories of recipients”
Shares with Marketing/Advertising Partners, Data Analytics Providers, and Social Networks for cross-contextual behavioral advertising. No named subprocessor list accessible. Trust center non-functional.
data_classification
“SA pixel does not collect PII - only domain and account-level data”
SA pixel reads cookie/device ID and references against DMP. While technically not individual PII, cookie-to-company mapping enables account-level deanonymization. GDPR definition of personal data includes any information relating to an identifiable natural person.
opt_out_fragility
“Cookie-based opt-out mechanism available”
Opt-out relies on a cookie. If cookies cleared, opt-out is lost. Must opt out per device/browser. Privacy policy explicitly warns: this opt-out relies on a cookie and so if you wipe all of your cookies, we will no longer know that you have opted out.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Madison Logic
- →Audit SA pixel consent-gate timing on your properties - verify pixel does not fire before visitor consent is captured
- →Request Madison Logic SOC 2 Type II report directly - trust center is non-functional and report cannot be independently verified
- →Document cookie-to-company DMP matching in your DPIA - Madison Logic claim of non-identification may not hold under GDPR Art. 4(1)
- →Monitor Madison Logic abm.madisonlogic.com form injection scope - Marketo munchkin integration enables dynamic capability deployment
- →Verify cookie-based opt-out persistence - if visitors clear cookies the opt-out is lost requiring re-action per device and browser
If You're Evaluating Madison Logic
- →Request Madison Logic technical architecture documentation for SA pixel data flows before signing
- →Evaluate whether account-level cookie matching constitutes identity resolution under your applicable privacy regulations
- →Assess alternative ABM platforms that operate consent-first without pre-consent tracking architectures
- →Negotiate contractual consent-timing guarantees - require Madison Logic to gate all tracking behind verified consent
- →Request named subprocessor list with data flow documentation - current trust center redirects away from Madison Logic domain
Negotiation Leverage
- →Madison Logic SA pixel fires before consent capture on their own website (SCAN-1769099737063 HIGH confidence) - demand contractual guarantee that pixel will not execute pre-consent on your properties
- →Privacy policy claims tracking does not discern identity but SA pixel documentation explicitly describes cookie-to-company DMP matching - require written clarification of what identity resolution means in their context
- →Trust center (trust.madisonlogic.com) redirects to unrelated third-party sites - demand direct access to SOC 2 Type II report and named subprocessor list before proceeding
- →Cookie-based opt-out architecture means any cookie clearing voids the opt-out - negotiate server-side opt-out mechanism that persists regardless of browser state
- →Data shared with unnamed Marketing and Advertising Partners for cross-contextual behavioral advertising - require complete list of data recipients and contractual right to audit data flows
- →Marketo munchkin integration (759-DDC-106) via abm.madisonlogic.com enables dynamic form injection - negotiate explicit approval requirement before any capability changes on your properties
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Ignoring CMP signals
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
162 detection signatures across scripts, domains, cookies, and network endpoints