Privacy finding
A form that collects personal data sends it unsafely, elsewhere or without telling the visitor
Privacy Error Severity: High
Part of the audit Data collection forms. Finding id: privacy.formFindings.
What it costs you
A form is where visitors hand you their data.
What to do
Send every form over https, link the privacy policy next to the submit button, leave marketing boxes unticked and ask only for what the form needs.
What it checks
- Form has no privacy policy link
- Form sends data to another company
- Form sent without HTTPS
- Marketing box already ticked
- Sensitive question without explanation
How to fix it
Send the form over https
- Change the form's action attribute to an https address, and check that the target answers over https.
How to check: View the page source: the action starts with https. Then run this rule again.
Leave the consent box empty
- Remove the checked attribute from the consent checkbox, in the template or in the form tool's settings.
How to check: Open the form in a private window: the box is empty.
Link the policy next to the submit button
- Add a sentence with a link to the privacy policy next to the submit button.
How to check: Run this rule again after the next crawl.
Name the receiving service in the policy
- Find out which service runs [action host].
- Name it in the privacy policy, or post the form to your own site and pass the data on from there.
How to check: Run this rule again after the next crawl.
Remove the field or explain it
- Ask whoever uses the form's data whether the field is needed.
- Remove it, or make it optional and say next to it why you ask.
How to check: Run this rule again after the next crawl.
A real case
Researchers found email addresses typed into forms were sent to tracking and marketing companies before the form was submitted, on 1,844 websites in the EU crawl.