Web Trackers Caught Intercepting Online Forms Before Users Even Hit Submit

A new study published by academics from KU Leuven, Radboud University and the University of Lausanne has found that users’ email addresses are exfiltrated to tracking, marketing and analytics domains before they are submitted and without prior consent.

The study involved by crawling 2.8 million pages of the top 100 websites, and found that up to 1,844 websites allowed trackers to capture email addresses before form submission in the European Union, a number which increased to 2,950 when the same set of websites were visited from the United States.

“The emails (or their hashes) were sent to 174 separate domains (eTLD+1) in the American crawl, and 157 distinct domains in the European crawl”, the researchers mentioned. Additionally, 52 websites were determined to similarly collect passwords, an issue that has since been resolved following responsible disclosure.

LiveRamp, Taboola, Adobe, Verizon, Yandex, Meta Platforms, TikTok, Salesforce, Listrak, and Oracle were some of the top third-party tracking domains to which email addresses were passed, while Yandex, Mixpanel, and LogRocket lead the list in the password entry category.

“Some third parties send email addresses character by character as the user types in their address,” the researchers said. “This behavior appears to be caused by session replay scripts that collect user interactions with the page, including key presses and mouse movements.”

fashion/beauty, online shopping and general news emerge as top categories ->

fashion/beauty, online shopping, general news, software/hardware and business emerging as top categories

Email addresses have a number of advantages. Not only are they unique, allowing third parties to track users across devices, but they can also be used to match their online and offline activities, for example, in scenarios where they make an in-store purchase that obliges them to share their e-mail address or subscribe to a loyalty card.

The idea behind collecting email addresses entered into online forms, even in cases where users do not submit any form, has also been fueled by browser vendors’ continued attempts to drop support for third-party cookies, requiring marketers to search for other static identifiers. to track users.

This is not the first time such concerns have been raised. In June 2017, Gizmodo discovered that a third party called NaviStone was collecting personal information from mortgage calculation forms before they were submitted, and very few websites explicitly disclosed this practice in their privacy policies.

cyber security

Fast forward five years later, not much has changed, the researchers said, with websites related to fashion/beauty, online shopping and general news emerging as the top categories with the most “leaky shapes.”

“Despite filling in email fields on hundreds of websites classified as pornographic, we have not had a single email leak,” the results show, noting how this correlates to previous studies which showed that adult websites have relatively fewer third-party trackers compared to general sites of comparable popularity.

Additionally, such a practice may violate at least three different General Data Protection Regulations (GDPR) in the EU, in violation of the principles of transparency, purpose limitation and user consent.

In recent years, browser makers, with the notable exception of Google Chrome, have introduced new mechanisms to reduce cross-site cookies, but Apple Safari and Mozilla Firefox have proven to do nothing to protect against scripts that export cookies. email addresses for tracking purposes.

A countermeasure against this tracking method is to install browser extensions such as uBlock Origin or switch to browsers with built-in ad blocking functionality, regardless of the type of device used.

“Users should assume that personal information they enter into web forms may be collected by trackers, even if the form is never submitted,” the researchers concluded, calling for further investigation by browser vendors. , privacy tool developers and data protection agencies.

Melvin G. Rodriguez