How This Briefing Works
This report opens with key findings, then maps the gaps between what Qualified discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Tracking
75% of detections show tracking firing before consent obtained
Pre-Consent Activity
Qualified was observed loading and executing before user consent was obtained on 76% of sites where it was detected.
Undisclosed Vendors
45 third-party vendors detected on qualified.com, 12 completely undisclosed
DNT Non-Compliance
Explicitly states: We do not recognize or respond to browser-initiated DNT signals
Undisclosed Party
Not in privacy policy
Claims vs. Observed Behavior
Pre-Consent Tracking
“GDPR compliant, CCPA compliant, SOC2 Type II certified”
75% of detections show tracking firing before consent obtained
32 detections across 27 sites, 24 instances of pre-consent tracking
Undisclosed Vendors
“13 subprocessors disclosed”
45 third-party vendors detected on qualified.com, 12 completely undisclosed
Runtime scan: Bytemine, Criteo, DoubleClick, G2, Google Ads, Lavender, Mapbox, Meta Pixel, Scoreplex, Scrapemagic, TrenDemon, Upcell
DNT Non-Compliance
“Honors opt-out preferences”
Explicitly states: We do not recognize or respond to browser-initiated DNT signals
Privacy policy direct quote
Identity Resolution Disclosure
“Clearbit provides firmographic data enrichment”
Clearbit performs visitor-level identity resolution, not just company identification
Privacy policy mentions unique visitor IDs and returning visitor identification
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Qualified
- →Audit your CMP to ensure Qualified scripts are blocked until explicit consent is obtained — 75% pre-consent rate indicates likely consent violations
- →Update your privacy policy to disclose Clearbit identity resolution at the person level, not just company-level identification
- →Review undisclosed vendors loading via Qualified and add to your data processing disclosures under GDPR Art 30
- →Assess post-Salesforce acquisition data sharing implications — your visitor data now enters a significantly larger ecosystem
- →Implement server-side data flow controls to prevent unauthorized data sharing with advertising networks (Criteo, Meta, DoubleClick)
If You're Evaluating Qualified
- →Require pre-consent script blocking capabilities and test in sandbox with consent denied to verify tracking cessation
- →Demand complete vendor disclosure including all fourth parties beyond the 13 disclosed subprocessors
- →Evaluate post-Salesforce acquisition data sharing implications — visitor identification data feeds into the broader Salesforce ecosystem
- →Request contractual guarantees that DNT and GPC signals will be honored by Qualified's platform
- →Compare against ABM alternatives that do not integrate with advertising pixels or require person-level deanonymization
Negotiation Leverage
- →Pre-consent SLA: 75% pre-consent rate contradicts GDPR compliance claims. Require contractual guarantee that Qualified scripts fire only after consent on your property, with consent-denied testing verification before deployment.
- →Salesforce data isolation: Post-acquisition, your visitor identification data enters the Salesforce ecosystem. Require contractual commitment that data processed through Qualified is not shared with other Salesforce products, CRM enrichment, or advertising without explicit opt-in.
- →Undisclosed vendor disclosure: 12 vendors detected on qualified.com not in their 13-vendor subprocessor list, including Criteo, Meta, and DoubleClick. Require complete enumeration of all fourth-party data flows triggered by Qualified's JavaScript on your property.
- →Clearbit identity resolution scope: Qualified uses Clearbit for person-level identification, not just company-level. Require contractual specification of identification granularity and ensure your privacy policy discloses person-level deanonymization.
- →DNT/GPC compliance: Require contractual commitment that Qualified honors Do Not Track and Global Privacy Control signals, with documented implementation evidence.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
67 detection signatures across scripts, domains, cookies, and network endpoints