How This Briefing Works
This dossier opens with key findings, then maps the gap between what ZoomInfo discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 81 sites
vendor fires before consent
2 HIGH
Briefing
ZoomInfo (formerly DiscoverOrg) is a publicly-traded B2B intelligence platform headquartered in Vancouver, WA. While marketing as a business data provider, ZoomInfo is officially registered as a California data broker and explicitly sells personal information including names, emails, and phone numbers. Despite claiming SOC2 Type II, ISO 27001, and GDPR/CCPA compliance, BLACKOUT runtime scans detect ZoomInfo on 60 websites with a 26.6% pre-consent firing rate, indicating systematic tracking before user consent. This creates material compliance gap between their certifications and actual runtime behavior.
What This Means For You
If ZoomInfo is deployed on your site, you are exposed to GDPR Art 6/7 violations from their 26.6% pre-consent tracking rate — over a quarter of your visitors are tracked before consenting. As a registered California data broker, ZoomInfo explicitly sells personal information including names, emails, and phone numbers. If your employees' contacts flow into their database through email integrations, that data becomes inventory available to your competitors. Under CCPA §1798.140, you may bear shared liability for data sold by a vendor you deployed. ZoomInfo's SOC2 Type II and ISO 27001 certifications cover their internal operations — they do not indemnify you against regulatory action for pre-consent tracking on your property.
Risk Channel Breakdown
ZoomInfo corrupts measurement by harvesting contact data from email integrations and third-party sources, creating shadow profiles that influence sales targeting without accurate consent provenance. Organizations using ZoomInfo-sourced leads may be making decisions based on data obtained through undisclosed collection methods.
As a registered data broker, ZoomInfo aggregates and resells business contact information to competitors and third parties. Companies whose employees appear in ZoomInfo database effectively leak demand signals - who they are hiring, their tech stack, growth patterns - to anyone paying for access.
ZoomInfo creates attack surface through extensive data aggregation. Their database of 300M+ business professionals provides reconnaissance value to threat actors. The 26.6% pre-consent tracking rate exposes client websites to regulatory enforcement risk.
Critical consent liability: ZoomInfo claims GDPR and CCPA compliance while operating as a registered data broker with documented pre-consent tracking. California AG registration confirms personal data sales. Organizations using ZoomInfo face vicarious liability for their data collection practices.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
WebSocket/SSE streaming
Claims-vs-Reality (BTI-X)
False certification claims
Collection exceeds disclosed scope
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed ZoomInfo's public claims against observed runtime behavior and identified 3 contradictions.
"SOC2 Type II, ISO 27001, GDPR, CCPA certified/compliant"
26.6% pre-consent tracking rate across 60 detected sites
2 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 3, observed 3
googletagmanager, googleanalytics4, linkedinads…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →