How This Briefing Works
This report opens with key findings, then maps the gaps between what Mountain discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Tracking
23 tracking vendors load pre-consent on mountain.com including identity resolution (Demandbase, Contactout) and advertising pixels (MetaPixel, LinkedIn, Criteo)
Undisclosed Party
Not in privacy policy
Undisclosed Sharing
Hidden data recipients
Compliance Claim Mismatch
False certification claims
Scope Creep
Collection exceeds disclosed scope
Claims vs. Observed Behavior
Pre-Consent Tracking
“GDPR/CCPA compliance referenced in Terms & Conditions”
23 tracking vendors load pre-consent on mountain.com including identity resolution (Demandbase, Contactout) and advertising pixels (MetaPixel, LinkedIn, Criteo)
Runtime scan detected pre_consent=true for 23 vendors
Subprocessor Disclosure
“Information Sharing Partners page lists data recipients”
12 advertising vendors observed but not disclosed: Criteo, Demandbase, DoubleClick, Doubleverify, LinkedIn, MetaPixel, Reddit, TwitterPixel, CrazyEgg, Contactout, Bizible, Qualified
Comparison of disclosed subprocessors (22) vs observed vendors (52)
Privacy Signal Support
“Opt-out mechanisms available via NAI/DAA”
No Global Privacy Control (GPC) support acknowledged. Browser Do Not Track mentioned but not GPC.
Privacy policy and opt-out page do not mention GPC
Security Certification
“Working toward SOC2 compliance”
SOC2 Type I not yet achieved as of January 2025. Security documentation available upon request but not publicly accessible.
Security page states working on SOC2 Type I by end of January 2025
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Mountain
- →Review your Data Processing Agreement to ensure it covers all observed third-party data flows, particularly to identity resolution providers (Demandbase, LiveRamp, Contactout)
- →Audit what visitor data from your campaigns is being enriched through LiveRamp and Demandbase integrations on MNTN infrastructure
- →Request security documentation (pentest results, security policies) given SOC2 is not yet achieved for a platform handling campaign data
- →Ensure your consent management covers the tracking vendors MNTN loads on conversion tracking pages on your property
- →Monitor CTV campaign data flows to verify your audience intelligence is not shared through undisclosed vendor relationships
If You're Evaluating Mountain
- →Note the absence of SOC2 certification — significant gap for a platform handling advertiser data and campaign strategies
- →Request complete subprocessor list and compare against 52 vendors detected at runtime on mountain.com
- →Assess pre-consent behavior (23 vendors) as an indicator of MNTN's operational privacy maturity before trusting compliance claims
- →Evaluate whether LiveRamp and Demandbase integrations create competitive intelligence exposure for your campaign data
- →Compare MNTN's vendor density and compliance posture against alternative CTV platforms before committing
Negotiation Leverage
- →Security certification: MNTN does not hold SOC2 certification despite handling advertiser campaign data and creative assets. Require SOC2 Type II as a contract condition or negotiate significant liability indemnification.
- →Subprocessor reconciliation: 52 vendors detected versus 22 disclosed. Require complete enumeration of all third-party vendors processing advertiser data, with right to audit quarterly.
- →Pre-consent SLA: 23 vendors fire pre-consent on mountain.com. Require contractual guarantee that MNTN conversion tracking on your property loads only after consent.
- →Campaign data isolation: As a CTV platform with LiveRamp and Demandbase integrations, advertiser audience data and campaign performance signals flow through their infrastructure. Require contractual data isolation for your campaign intelligence.
- →Creative asset protection: QuickFrame acquisition means campaign creative assets flow through their platform. Require contractual protections for creative IP and limits on data derived from your campaigns.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Long-lived identifiers
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
94 detection signatures across scripts, domains, cookies, and network endpoints