Many of the top 100,000 sites found are collecting user-entered data before hitting the ‘submit’ button

Some of the top 100,000 websites were discovered to be collecting data from their online forms even before you hit the Submit button, a study conducted by researchers has revealed. In some cases, many of these top visited websites even collect visitor’s password data without user consent. A large number of websites that collect personal data including users’ email addresses without their prior permission appear to have this behavior due to built-in third-party trackers for the purpose. advertising and marketing.

Conducted by researchers from Leuven, Radboud University and the University of Lausanne, the study is based on a system that allows to crawl and analyze the top 100,000 websites from two different locations – the European Union and the United States. It showed that of the total websites analyzed, 1,844 websites collected data including the email addresses of visitors from the EU region without their consent. In the case of visitors coming from the United States, that number rises to 2,950 websites, according to the study.

In most cases, the followers are from companies including Meta and TikTok get user data from the top websites analyzed. However, the researchers also found 41 previously unknown tracker domains were found to be involved in collecting user data from top websites before users hit the Submit button.

While conducting the study, the researchers specifically avoided looking at cases where websites might have a good reason to collect users’ email addresses before submitting them. For example, in some cases, websites check if an email or username is already in the database.

However, researchers have discovered many popular websites where online trackers are capturing email addresses before users give their consent.

In the US, the top ten sites where email addresses were found exposed to trackers include USAToday, Business Insider, Fox News, Time and Trello, while in the EU the list includes Independent, Shopify , Newsweek and Marriott.

The researchers also found 52 websites in which third parties, including Russian Yandex accidentally collected the password before sending. Yandex has released a fix to prevent password collection when contacted by the research team.

“Based on our findings, users should assume that the personal information they enter into Web forms may be collected by trackers — even if the form has never been submitted,” the researchers said. research speak in an 18-page paper detailing their research. “Considering the scale, infiltration, and unintended side effects, the privacy issue we investigate deserves the attention of browser vendors, privacy tool developers, and other agencies.” more concerned data protection authorities”.

Along with regularly capturing email addresses, the researchers found that Meta and TikTok trackers were in some cases collecting hashed personal information from Web forms. This is because the “advanced matching” feature is considered responsible for collecting hashed user data including email addresses before sending.

“We believe the leaks are caused by Facebook scripts that interpret clicks of unrelated buttons as ‘submit button clicked’ events,” the researchers said.

Gadgets 360 has reached out to both Meta and TikTok to clarify the research and will update this article as the companies respond.

Apple and other tech giants have begun blocking third-party cookies and trackers to help reduce users’ online tracking. However, the idea of ​​tracking online visitors through email addresses can provide marketers with an effective solution despite the ongoing limitations.

The researchers also note in their co-authored paper that email addresses act as an “ideal identifier” and help fill the gap for online trackers because they can enable tracking across platforms and for longer than other parameters.

The findings from the study will be detailed at the Usenix security conference in August.