How This Briefing Works
This dossier opens with key findings, then maps the gap between what Google Marketing Platform discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 366 sites
vendor fires before consent
1 HIGH
Briefing
Google Marketing Platform encompasses Google's enterprise advertising suite including DoubleClick, Display & Video 360, Campaign Manager, and Search Ads 360. Detected on 260 sites across 270 observations, GMP operates with a 0% pre-consent firing rate — suggesting deliberate consent-aware deployment. However, 8 BTI behavioral codes reveal extensive data collection capabilities including cross-domain identity synchronization (C08), fingerprinting, and identity resolution. With a signal corruption score of 40, GMP actively distorts the measurement landscape by connecting behavioral data across domains through Google's identity graph, making it impossible for site operators to contain where their visitor data ultimately flows.
What This Means For You
If GMP is on your site, your visitor behavioral data feeds directly into Google's advertising auction infrastructure. Cross-domain identity synchronization means visitors you identify on your site can be targeted by competitors across Google's entire ad network — your first-party data becomes a shared resource in the advertising ecosystem. While GMP's 0% pre-consent rate suggests consent-aware deployment, the downstream data flows through Google's identity graph extend far beyond what most consent notices disclose. Your DPA with Google may not cover all the ways GMP connects your visitor data to third-party advertising systems.
Risk Channel Breakdown
GMP's cross-domain sync capability (BTI-C08) means visitor signals collected on your site are correlated with behavioral data from every other site in Google's advertising network. Signal corruption score of 40 reflects the platform's role in creating measurement dependencies where your attribution data is inseparable from Google's broader intelligence apparatus.
GMP is the mechanism through which Google monetizes behavioral data across its advertising ecosystem. Every conversion pixel, remarketing tag, and audience signal you share through GMP feeds directly into auction systems where your competitors bid on your visitors. CAC subsidization score of 100 reflects complete integration with competitive intelligence flows.
Expands attack surface
Cross-domain identity synchronization (BTI-C08) creates data flows that extend beyond your DPA with Google. When GMP syncs visitor identities across domains, you lose control over where your visitors' data ultimately resides. Under GDPR's purpose limitation principle, this cross-domain correlation may exceed the legal basis your consent mechanism provides.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Device identification
Long-lived identifiers
PII deanonymization
Container/loader (neutral)
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Google Marketing Platform's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →