Millions of email addresses leaking to advertising and analytics companies

‘One important trend to notice is how often Google Analytics, Google’s DoubleClick, Facebook, and Twitter are ingesting the user emails — these are organizations that should be receiving deletion requests en-masse and they should all have processes to handle this type of effort already (Facebook likely has this tech already based on conversations on this research and additional research from a private report from several years ago).‘

‘This type of email user data in a URL bar synced into Javascript pixels is most typically blocked by a regular person through “Ad blockers” or through browsers like Safari, Brave, and Firefox — those browsers use Javascript/cookie blocking as a default features to protect users (each browser handles it slightly differently). This breach and research included here would impact all Chrome users of these websites who went through these specific user flows and who didn’t proactively block all Javascript (a rarely used option) or use a Chrome “Ad blocker” extension that blocked this type of Javascript. Some people using the other “safe” browsers (Safari/Brave/Firefox) could have been protected from the leak due to their 3rd party Javascript requests being blocked.’

Original title too long. It was: The 2020 URL Querystring Data Leaks — Millions of User Emails Leaking from Popular Websites to Advertising & Analytics Companies

This may be the first time I've seen an article try to sensationalize webhooks and third-party APIs. When I read the headline, I was expecting some kind of hack, not a story about how Dave in IT hooked the contact us form up to the CRM using webhooks and Zapier...

The meat in the story, is a real problem - irresponsible mingling of PII in analytics data.

Worked for a an analytics company, and this was a problem for us, because we didn't want to collect pii at all.

So as soon as there was an @\S+\. in a url we were anonymizing the full url. Customers were not happy though

But I can tell you that this was present on a lot of websites including Bank websites

This is explicitly against the Google Analytics ToS - what's the bet they do nothing about it?

This covers query strings, but in theory, if you've got any third party JS on your registration/private page, that JS can get the contents of the form and exfiltrate it.

So, basically any 3rd party analytics has the ability to do this, query string or no?

How I am handling it (required mail server):

Each email adhering to some rule (magicmarker[a-f0-9]+)goes to my account.

Each registration anywhere gets unique email address generated as magicmarker<b64(hash(domain+salt))>@mydomain.com Salt is there to keep it unguessable.

When I get any spam, I can redirect it to /dev/null and verify from where it came from to sent hate mail to domain owner or whatever.

0 spam. 0 tracability. Ability to track who sold/leaked my mail address.

On a side note, on Firefox Android the page here freezes for about 10 or 15 seconds while loading. It's really annoying.

I am working as a data analyst. We had some cases were we were called to fix issues from other agencies.

The clients had forms data being sent as get-requests and from there email addresses and even more personal data in the URL (street, date of birth, and even more) was being transmitted into the analytics tools and also into marketing tools.

Regarding GDPR this is a breach and needs to be communicated to officials as well as the people affected.

Even a bank was affected by this type of implementation when customers wanted to open an account or make a loan application.

Everyone in sales is using the leaked emails. I have so many one-time emails that leaked (haveibeenpwned.com) and someone was smart enough to just use those leaked databases and sell the emails to sales departments.

I always ask the sales person where the hell they found the email because I just used it once somewhere long time ago.

I have a bit of a contrarian view on data on the web. I think, eventually any data on the web is going to be in the public domain at some capacity. Data will be everywhere and readily available, mostly for free.

For many of the examples described in the article, it is the site (not Google or Facebook) that left the email address in the URL. That is bad coding practice. Just so we are clear, it isn’t the “evil advertising companies did this”. Now asking Google to randomly search all unwanted referral URLs received for a customer specific pattern and delete what may look like an email address seems unfair. Google in no position to use or recognize that data as email. If they tried that, it would be brittle and unmanageable.

One could argue Advertising shouldn’t exist or that Google should not store anything. But the GDPR argument is BS, although admittedly legal.

It is like throwing a small rock in to the neighbors yard and asking them to retrieve it for you.

Emails on query strings are leaks that should be patched. That said you can bet these companies are sending emails over formal integrations to tons of 3rd parties for analysis, targeting, advertising, etc.

CCPA is not nearly as strict as the GDPR and it is not illegal, unfortunately.

Email addresses not emails.

They are leaking email _addresses_ not emails. I was irritated how they manage to leak emails in a context where no emails are involved (but email addresses are).

I which people would be a bit more clear in the language they use, especially if it's about vulnerabilities.