How This Briefing Works
This report opens with key findings, then maps the gaps between what TechTarget discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Consent Infrastructure Absent
No cookie consent banner exists on techtarget.com. All tracking, including session replay (Microsoft Clarity) and 72 MathTag tracking pixels, fires immediately on page load with zero consent interaction.
Session Replay Without Consent
Microsoft Clarity session replay (tag mc1aheaw4v) records visitor interactions including clicks, scroll behavior, and form interactions. Initialized pre-consent with no opt-in mechanism.
Undisclosed Subprocessors
10+ additional third-party services observed receiving visitor data at runtime that are not listed as subprocessors: Microsoft Clarity, Chartbeat, Optimizely, StackAdapt, MediaMath/MathTag, AppNexus/Xandr, DoubleVerify, dpmsrv.com, Cloudflare analytics, usbrowserspeed.com.
Cross-Domain Cookie Syncing
Hidden DoubleClick partner pixel iframe (cm.g.doubleclick.net/partnerpixels) and AppNexus segment pixels (ib.adnxs.com/seg) with hundreds of segment IDs observed loading in hidden iframes. These enable identity graph construction across ad exchanges.
Undisclosed Sharing
Hidden data recipients
Claims vs. Observed Behavior
Consent Infrastructure Absent
“Claims GDPR compliance and EU-US Data Privacy Framework certification”
No cookie consent banner exists on techtarget.com. All tracking, including session replay (Microsoft Clarity) and 72 MathTag tracking pixels, fires immediately on page load with zero consent interaction.
CDT MCP investigation: homepage load captured 14+ third-party scripts, 72 pixel requests, session replay initialization, all pre-consent
Session Replay Without Consent
“Claims GDPR compliance”
Microsoft Clarity session replay (tag mc1aheaw4v) records visitor interactions including clicks, scroll behavior, and form interactions. Initialized pre-consent with no opt-in mechanism.
CDT MCP investigation: clarity.ms script and 4 XHR collection requests observed pre-consent
Undisclosed Subprocessors
“Subprocessor list names 18 vendors”
10+ additional third-party services observed receiving visitor data at runtime that are not listed as subprocessors: Microsoft Clarity, Chartbeat, Optimizely, StackAdapt, MediaMath/MathTag, AppNexus/Xandr, DoubleVerify, dpmsrv.com, Cloudflare analytics, usbrowserspeed.com.
CDT MCP network request analysis and performance resource timing API
Do Not Track Explicitly Rejected
“Claims to honor GPC signal for device/browser information”
Privacy policy explicitly states: our websites currently do not respond to do not track browser headers. GPC honored only for device/browser info, not direct identifiers like name or email.
Privacy policy Section 12 and Section 13 verbatim text
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use TechTarget
- →Audit your DPA with TechTarget to confirm the subprocessor list matches the 10+ undisclosed third-party services observed at runtime (Clarity, Chartbeat, Optimizely, StackAdapt, MediaMath, AppNexus, DoubleVerify, dpmsrv.com)
- →Request documentation of the legal basis for intent data collection from EU visitors given the absence of consent infrastructure on the editorial network
- →Evaluate whether your use of TechTarget intent data for outreach to EU-based contacts creates GDPR Art 6 liability for your organization
- →Add contract clause requiring TechTarget to notify you within 30 days of any new third-party tracking added to their editorial network
If You're Evaluating TechTarget
- →Request evidence of consent infrastructure deployment timeline for the editorial network before signing
- →Require contractual warranty that intent data provided has a valid legal basis under GDPR for EU-sourced signals
- →Compare TechTarget intent data pricing against alternatives that operate with consent infrastructure (Bombora, G2)
- →Negotiate right-to-audit clause with access to real-time tracking inventory on editorial sites that generate your intent data
Negotiation Leverage
- →Subprocessor disclosure gap: Runtime investigation identified 10+ third-party services receiving visitor data that are not listed on TechTarget's subprocessor page. Request a complete and current subprocessor list that includes all client-side tracking services, not just server-side infrastructure vendors.
- →Consent infrastructure absence: TechTarget's editorial sites have no cookie consent banner, yet the company certifies EU-US Data Privacy Framework compliance. Request contractual warranty that intent data delivered to you was collected with a valid legal basis under GDPR Art 6, with indemnification for regulatory action stemming from unlawful collection.
- →Data broker disclosure leverage: TechTarget is a registered data broker in California (Registration #186791) and explicitly states it sells personal data. Use this disclosure to negotiate data minimization requirements and purpose limitations in your DPA.
- →Session replay exposure: Microsoft Clarity session replay on the editorial network records visitor interactions without consent. If your employees research vendors on TechTarget sites, their behavior is being recorded. Request exclusion of session replay data from intent signals provided to your account.
- →Competitive intelligence risk: TechTarget sells intent data to multiple competing vendors simultaneously. Request contractual exclusivity provisions or at minimum a disclosure of how many of your direct competitors receive intent signals from the same topic categories you purchase.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Identity stitching
Ignoring CMP signals
Long-lived identifiers
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
87 detection signatures across scripts, domains, cookies, and network endpoints