How This Briefing Works
This report opens with key findings, then maps the gaps between what TrenDemon discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Scope Misrepresentation
Product explicitly performs Account Deanonymization, persona-level tracking, and distinguishes individuals within companies over extended periods
Pre-Consent Tracking
15.9% pre-consent tracking rate across customer sites, 8 pre-consent vendors on own site
Pre-Consent Activity
TrenDemon was observed loading and executing before user consent was obtained on 16% of sites where it was detected.
Undisclosed Subprocessors
Runtime shows Crunchbase, Sojern, Semcasting, IntentData, CHEQ, DoubleClick receiving data
Document Inconsistency
Security policy explicitly lists IP address, email, cookies as Confidential PII data collected
Claims vs. Observed Behavior
Scope Misrepresentation
“Does not collect, retain or share any data regarding a particular user or device on sites not owned by TrenDemon”
Product explicitly performs Account Deanonymization, persona-level tracking, and distinguishes individuals within companies over extended periods
Privacy policy scope statement vs product overview features
Pre-Consent Tracking
“GDPR compliant”
15.9% pre-consent tracking rate across customer sites, 8 pre-consent vendors on own site
Runtime scan data from 261 sites, TrenDemon.com scan
Undisclosed Subprocessors
“Privacy policy lists LinkedIn, Twitter, AWS, Google”
Runtime shows Crunchbase, Sojern, Semcasting, IntentData, CHEQ, DoubleClick receiving data
TrenDemon.com scan detections
Document Inconsistency
“Privacy policy says no IP/user identifier collection on third-party sites”
Security policy explicitly lists IP address, email, cookies as Confidential PII data collected
Privacy Policy vs Information and Data Security Policy comparison
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use TrenDemon
- →Audit consent flow — verify TrenDemon JavaScript loads ONLY after explicit consent, given 15.9% pre-consent rate with undisclosed ad networks
- →Update your privacy policy to disclose Account Deanonymization capability — TrenDemon's own policy contradicts what the product actually does
- →Request subprocessor list and compare against runtime detections on your site — advertising networks like Sojern and DoubleClick may load without disclosure
- →Review DPA scope to ensure identity resolution and persona-level tracking are explicitly covered as processing activities
- →Implement consent-gated loading in GTM or your tag manager to control when TrenDemon fires relative to consent
If You're Evaluating TrenDemon
- →Ask for reconciliation of privacy policy scope statement ('no data collection on non-owned sites') versus the Account Deanonymization product feature
- →Demand complete subprocessor list with data flow documentation before procurement decision
- →Verify no SOC2 certification exists — this is a significant gap for a vendor performing person-level identification
- →Include identity resolution and persona-level tracking explicitly in contract scope and DPA terms
- →Consider alternatives (Mutiny, Qualified) with clearer alignment between privacy claims and product capabilities
Negotiation Leverage
- →Privacy policy reconciliation: TrenDemon's privacy policy claims no data collection on non-owned sites while the product performs Account Deanonymization. Require written reconciliation of this contradiction and contractual commitment to update privacy policy to accurately reflect product capabilities.
- →Scope documentation: Product performs persona-level tracking beyond stated 'attribution software' scope. Require contractual specification of exactly what identification capabilities are active on your property and what data is collected, stored, and shared.
- →Pre-consent SLA: 15.9% pre-consent rate with undisclosed advertising networks (Sojern, DoubleClick) loading before consent. Require contractual guarantee of 0% pre-consent activity on your property.
- →Security certification: No SOC2 or ISO certifications visible for a vendor performing person-level identification. Require SOC2 Type II as a contract condition given the sensitivity of deanonymization data.
- →Subprocessor transparency: 8 vendors fire pre-consent on TrenDemon's site including Crunchbase and advertising networks. Require complete subprocessor list with data flow documentation for all third parties.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
156 detection signatures across scripts, domains, cookies, and network endpoints