Is Google Analytics HIPAA Compliant?
Google says it “makes no representations that Google Analytics satisfies HIPAA requirements,” offers no business associate agreement for it, and advises HIPAA-regulated customers to “refrain from exposing to […]
Read the evidence
Broadcast, Not Stolen: How Passwords and Customer Records Reach Third Parties by Default
Passwords and personal data don’t have to be stolen to end up somewhere they shouldn’t. When an application writes them into a URL or a page title, ordinary analytics, monitoring, and fraud tools collect them by default. A Klaviyo sign-up form with no method attribute sent our test password to 31 third-party hostnames – the same omission we measured on 7,874 websites with credential- or PII-bearing forms across the top 100,000 websites