All Vendors
deanon

Trovo Tag

De-anonymization platform with identity resolution and pre-consent activation.

3 IOCs11 detections64% pre-consent8 sites
70
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what Trovo Tag discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Key Findings

11 detections across 8 sites64% pre-consent activity
CRITICAL

Pre-Consent Activity

Trovo Tag was observed loading and executing before user consent was obtained on 64% of sites where it was detected.

GDPRePrivacy
Disclosure Gaps

Claims vs. Observed Behavior

1 gaps

disclosure

HIGH
They Claim

“Pending claims extraction”

Observed Behavior

Runtime detection shows C09 (consent bypass) and C14 (identity resolution)

Customer Impact

What This Means For You

Revenue teams using Trovo Tag face consent liability when visitor identification begins before user authorization. Identity resolution creates persistent visitor profiles that may expose competitive intelligence through sales platform integrations.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

If You Use Trovo Tag

  • →Audit Trovo Tag initialization timing relative to consent collection
  • →Implement consent-gated de-anonymization activation
  • →Review identity resolution data sources and matching methodology

If You're Evaluating Trovo Tag

  • →Document pre-consent identification scope and data capture
  • →Request technical controls to defer identity resolution until consent obtained
  • →Obtain written confirmation of data deletion procedures and third-party sharing restrictions

Negotiation Leverage

  • →Pre-consent de-anonymization: Identification engine activates before consent — require technical mechanism to defer all matching until authorization.
  • →Identity resolution sales: Visitor profiles may feed sales intelligence platforms — negotiate restrictions on data resale and demand deletion rights.
  • →Data retention: Identification data persists beyond opt-out — demand specific deletion timelines and verification procedures.
Runtime Detections

Runtime Detections

2 BTI-C CODES

BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.

BTI-C09Consent Bypass

Ignoring CMP signals

BTI-C14Identity Resolution

PII deanonymization

IOC Manifest

IOC Manifest

3 INDICATORS

Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

TRACK
tag.trovo-tag.com
Tracking script
Ecosystem

Ecosystem & Supply Chain

Trovo Tag competes with RB2B, Koala, Clearbit Reveal, and other de-anonymization platforms. Common co-deployments: CRM systems (Salesforce, HubSpot), sales engagement platforms (Outreach, SalesLoft).
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

3 detection signatures across scripts, domains, cookies, and network endpoints

Vendor Details