How This Briefing Works
This report opens with key findings, then maps the gaps between what Google Marketing Platform discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pending Analysis
8 BTI behavioral codes detected including cross-domain sync. Full claims extraction required for gap analysis.
Claims vs. Observed Behavior
Pending Analysis
“Claims analysis pending”
8 BTI behavioral codes detected including cross-domain sync. Full claims extraction required for gap analysis.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Google Marketing Platform
- →Audit all GMP tags deployed on your properties — enumerate conversion pixels, remarketing tags, and audience signals
- →Review your Google DPA to verify it covers cross-domain identity sync data flows through DoubleClick and DV360
- →Implement GMP restricted data processing mode for visitors in regulated jurisdictions
- →Verify your consent notice explicitly discloses cross-domain tracking and identity synchronization
- →Monitor GMP's data sharing settings and disable audience sharing features you have not explicitly authorized
If You're Evaluating Google Marketing Platform
- →Assess whether GMP's cross-domain sync creates joint controller obligations under GDPR Article 26
- →Evaluate server-side conversion tracking to reduce client-side data exposure to Google's network
- →Request transparency report from Google on where your GMP data flows within their advertising ecosystem
- →Consider whether GMP's identity resolution capabilities exceed what your privacy policy discloses to visitors
Negotiation Leverage
- →0% pre-consent firing rate demonstrates consent-aware deployment is technically achievable — use this as a benchmark for all other advertising vendors on your stack.
- →Cross-domain identity synchronization (BTI-C08) means your visitor data flows beyond your site boundary into Google's broader ad network — verify your DPA explicitly covers these flows.
- →270 detections across 260 sites shows near-universal deployment in enterprise advertising stacks — regulators are building enforcement expertise against exactly this pattern.
- →8 BTI behavioral codes detected despite 0% pre-consent rate — consent-aware firing does not eliminate the downstream data flow risks through Google's identity graph.
- →Signal corruption score of 40 reflects GMP's role in creating measurement dependency — your attribution data is inseparable from Google's advertising intelligence unless you deploy independent measurement.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: GMP exhibits consent-state-dependent behavior patterns — the platform adapts its data collection based on detected audit conditions, meaning compliance reviews may not reflect production behavior.
Keystroke/mouse tracking
Impact: GMP's conversion tracking captures interaction patterns beyond click events, building behavioral profiles that inform ad targeting across Google's network.
Full session replay
Impact: GMP's event-level tracking reconstructs detailed user journeys including page sequences, interaction timing, and conversion paths — equivalent to session-level behavioral records.
Identity stitching
Impact: GMP synchronizes visitor identities across domains through cookie matching and identity graph integration — your visitors are tracked across the entire Google advertising ecosystem regardless of your site boundaries.
Device identification
Impact: GMP collects device and browser signals that contribute to fingerprinting capabilities, enabling visitor identification that persists beyond cookie-based tracking.
Long-lived identifiers
Impact: GMP deploys long-lived identifiers across Google's domain infrastructure, creating persistent tracking that operates independently of your site's cookie policies.
PII deanonymization
Impact: GMP's integration with Google's identity graph links anonymous advertising interactions to authenticated Google account identities, creating PII-linked behavioral profiles from ad impressions.
Container/loader (neutral)
Impact: GMP tags are typically deployed through GTM, creating a layered infrastructure where container governance gaps compound with advertising platform data flows.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
20 detection signatures across scripts, domains, cookies, and network endpoints