How This Briefing Works
This report opens with key findings, then maps the gaps between what ZoomInfo discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
ZoomInfo was observed loading and executing before user consent was obtained on 27% of sites where it was detected.
Compliance Claim Mismatch
26.6% pre-consent tracking rate across 60 detected sites
Scope Misrepresentation
Registered California data broker selling personal information
Compliance Claim Mismatch
False certification claims
Scope Creep
Collection exceeds disclosed scope
Claims vs. Observed Behavior
Compliance Claim Mismatch
“SOC2 Type II, ISO 27001, GDPR, CCPA certified/compliant”
26.6% pre-consent tracking rate across 60 detected sites
BLACKOUT runtime scans show systematic tracking before consent banner interaction
Scope Misrepresentation
“B2B intelligence platform, business-related data only”
Registered California data broker selling personal information
CA AG registration #185627, privacy policy explicitly states sale of personal information
Third-Party Vendors on Own Site
“Privacy-first company with comprehensive security”
Deploys pre-consent tracking vendors (HumanSecurity, NeverBounce) on own website
BLACKOUT scan of zoominfo.com shows pre-consent vendor loading
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use ZoomInfo
- →Audit consent basis for all ZoomInfo-sourced leads — 26.6% pre-consent rate means a quarter of contact data may lack valid consent
- →Review your Data Processing Agreement for GDPR Article 28 compliance, specifically around their registered data broker status
- →Assess liability exposure from pre-consent tracking deployed on your properties under ePrivacy Directive and GDPR Art 6/7
- →Check whether your employees appear in ZoomInfo's database without consent via their email integration harvesting
- →Evaluate whether email integration is exposing your contacts to third-party sale through their data brokerage operation
If You're Evaluating ZoomInfo
- →Request their California data broker registration documentation (#185627) and ask how this reconciles with B2B-only marketing claims
- →Verify the consent chain for any data they would provide — ask specifically how GPC signals are honored
- →Assess whether competitor access to the same ZoomInfo database creates strategic risk for your sales intelligence
- →Compare against alternatives that do not operate as registered data brokers (Apollo, Lusha, Cognism)
- →Negotiate right-to-audit clause with access to live runtime behavior monitoring before signing
Negotiation Leverage
- →Pre-consent SLA: ZoomInfo fires before consent on 26.6% of detected sites. Require contractual guarantee of 0% pre-consent activity on your properties with liquidated damages per violation detected by independent audit.
- →Data broker disclosure: ZoomInfo is registered as California data broker #185627 and explicitly sells personal information. Require written confirmation that your organization's data will not be resold, with right to audit data flows quarterly.
- →Email integration data rights: ZoomInfo harvests contact information through email client integrations. Negotiate explicit prohibition on using your employees' email contacts as inventory, with immediate deletion clause upon request.
- →Subprocessor transparency: ZoomInfo operates NeverBounce and Chorus.ai as part of their data ecosystem. Require complete subprocessor list with 30-day advance notice before additions and right to object.
- →Termination for cause: Include right to terminate without penalty if independent audit reveals undisclosed data sharing, pre-consent tracking, or data brokerage activity involving your organization's information.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
WebSocket/SSE streaming
IOC Manifest
Indicators of compromise across 6 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
43 detection signatures across scripts, domains, cookies, and network endpoints