Privacy finding
What the visitor types, says or does on the page is sent to a third party without consent
Privacy Error Severity: High
Part of the audit What visitors type, say or do is captured. Finding id: privacy.interactionCapturedWithoutConsent.
What it costs you
Visitors' words and behaviour leave the site without their agreement. Session recording and chat capture are the basis of a large number of wiretapping claims in California.
What to do
Load the recording or chat-analytics script only after consent, and keep it from reading form fields and chat text.
What it checks
- Visits recorded without consent
- Typing sent before form is submitted
- Chat messages sent to another company
- Data sent on exit after refusal
- Live visitor activity sent to another company
- Recording before everyone agreed
How to fix it
Fix
Keep the script away from what visitors type
- In the session-recording tool's settings, turn on masking of all input fields and exclude the chat widget.
- Check that the form and chat scripts do not send field contents anywhere before the visitor submits.
How to check: Type a test value into each field without sending it: no request to another host contains it.
How to verify by hand
Open the page with the browser's network panel, type into the field without sending it, and look for the typed text in requests to other hosts.
What this relies on
Our test values are made up and typed by the crawler, so a request that contains them can only come from a script reading the field.