Privacy finding
Forms collect or send data in a way the policy and the form wording do not cover
Privacy Warning Severity: High
Part of the audit Forms collect or send what the policy does not mention. Finding id: privacy.formsVsPolicy.
What it costs you
Forms are where visitors hand over names, addresses and more. A form that sends them somewhere the policy does not mention, or takes consent for granted, is the kind of gap that is easy to show.
What to do
Give the list to the person responsible for data protection and correct the form or the policy.
What it checks
- Form sends data to unnamed third party
- Claims no sharing but posts to third party
- Marketing consent box pre-ticked
- Form lacks policy link while others have one
- Different consent wording on similar forms
How to fix it
Leave the consent box empty
- Leave the consent box empty by default.
How to check: Open the form in a private window: the box is empty.
Add the policy link as on the other forms
- Add the link next to the submit button, as on the other forms.
How to check: Crawl the site again. The form no longer appears in this rule.
Use one consent text
- Choose one consent text and use it on every form that asks for the same data.
How to check: Crawl the site again. The forms no longer appear in this rule.
Name the party or host the form yourself
- Give the list to the person responsible for data protection.
- Name the party in the policy, or host the form yourself.
- If the site says it never shares data, reword that sentence or stop sending the data.
How to check: Crawl the site again. The form no longer appears in this rule.
A real case
Researchers found email addresses typed into forms were sent to tracking and marketing companies before the form was submitted, on 1,844 websites in the EU crawl.
How to verify by hand
The data protection officer.
What this relies on
The policy states the intent; the form tool was embedded without review.