Privacy finding
A third party's service is served from the site's own subdomain
Privacy Warning Severity: Medium
Part of the audit Trackers and third-party requests. Finding id: privacy.cnameCloakedThirdParty.
What it costs you
Browsers and blockers that limit third parties do not see it. Visitors and regulators may see it as hiding who processes their data.
What to do
Name the vendor in the privacy notice and the cookie list, and load it only after consent if it needs consent.
What it checks
- Third party hidden behind your domain
How to fix it
Make the vendor visible
- List the vendor behind the subdomain in the privacy notice and the cookie declaration.
- If the service needs consent, make it wait for consent like any other third party.
How to check: The cookie list names the vendor, and its cookies are not set before consent.
How to verify by hand
A DNS lookup of the subdomain, and the vendor's documentation for custom domains.
What this relies on
A subdomain that is an alias of another company's server lets that company's code and cookies pass as the site's own.