How This Briefing Works
This report opens with key findings, then maps the gaps between what Pitchbook discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Pitchbook was observed loading and executing before user consent was obtained on 5% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Pitchbook
- →Require data processing addendum with explicit research query retention limits
- →Demand consent framework integration that blocks tracking until user acceptance
- →Implement query data minimization to exclude deal-sensitive information from logs
- →Configure analytics to separate platform usage from competitive intelligence gathering
- →Establish retention limits for search history and behavioral profiles
If You're Evaluating Pitchbook
- →Request technical documentation on tracking initialization and consent detection
- →Verify whether research query data is used for product development or market intelligence
- →Test session recording scope to understand what research activity is captured
- →Review data flows to third-party analytics and enrichment platforms
- →Assess fingerprinting techniques and cross-session identity resolution mechanisms
Negotiation Leverage
- →Pitchbook deploys session recording and consent bypass that captures all research behavior—demand explicit DPA terms covering query data processing and regulatory liability protection
- →Research patterns reveal deal pipeline, investment thesis, and competitive analysis—negotiate contractual limits on secondary use of behavioral data for vendor intelligence
- →Platform tracking creates GDPR/CCPA exposure that compliance cannot fully remediate—require technical controls for consent enforcement and data deletion
- →Usage analytics may distort platform value assessment for renewals—establish baseline measurement methodology for research productivity
- →Legal tail risk of 100% reflects tracking necessity for platform analytics—evaluate whether data value justifies privacy exposure or negotiate enhanced privacy controls
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Pitchbook can detect privacy analysis tools and alter tracking behavior during security assessments, masking production data collection scope.
Keystroke/mouse tracking
Impact: Research velocity, query patterns, and content consumption behavior create persistent user profiles for usage analytics.
Full session replay
Impact: Session capture records all research queries, data views, and navigation patterns for profile refinement and usage analysis.
Ignoring CMP signals
Impact: Tracking begins before consent capture, processing user research behavior regardless of privacy preferences.
Device identification
Impact: Device and browser fingerprinting creates persistent identifiers for user recognition across research sessions.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
15 detection signatures across scripts, domains, cookies, and network endpoints