How This Briefing Works
This dossier opens with key findings, then maps the gap between what Pardot discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 13 sites
vendor fires before consent
Briefing
Pardot (Salesforce Marketing Cloud Account Engagement) activates visitor tracking before consent collection. Identity resolution links anonymous sessions to lead records in Salesforce CRM. Pre-consent tracking enables behavioral scoring and campaign attribution without lawful basis.
What This Means For You
Marketing loses lead scoring, behavioral nurture triggers, and campaign attribution if Pardot tracking is gated. Sales visibility into prospect engagement disappears. Marketing automation workflows break without visitor behavior signals. However, retention creates exposure: regulatory complaints for pre-consent identity linking, GDPR Article 6 violations for behavioral processing without lawful basis, potential data breach if Salesforce ecosystem is compromised containing visitor behavioral profiles.
Risk Channel Breakdown
Distorts attribution data
Lead behavioral data and scoring models feed Salesforce ecosystem, potentially accessible to AppExchange partners and third-party integrations.
Expands attack surface
Pre-consent identity resolution and behavioral tracking violate GDPR Article 6 lawful basis requirements and create consent bypass liability.
Threat Indicators
Runtime-observed (BTI-C)
Ignoring CMP signals
PII deanonymization
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Pardot's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
linkedinads, googletagmanager, googleanalytics4…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →