Insights & Analysis

Blog

Insights on data privacy, compliance, and website security.

Current view

All posts 12/12 posts shown
Latest Quarterly Report 2026-Q1

Quarterly Risk Report – Q1 2026

The digital privacy landscape is in constant motion, shaped by new litigation, shifting regulations, and rapid changes in tracking technology. This quarter’s report delivers a clear, data-backed look at where the risks are rising and how businesses can respond before they face legal or reputational fallout.

Download Report
Understanding the Search Bar Privacy Threat: CIPA, Vivek Shah, and What to Do Next
CIPA
BlogJocelyne De La Cruz Jocelyne De La Cruz

Understanding the Search Bar Privacy Threat: CIPA, Vivek Shah, and What to Do Next

A wave of California Invasion of Privacy Act (CIPA) lawsuits, led by litigants like Vivek Shah, targets websites nationwide by recording search bars transmitting data to third parties before consent is given. To block these automatic $5,000-per-instance claims, companies must engage defense counsel and use live scanning tools like Lokker to audit real-time script behavior and stop pre-consent leaks.

If Your Site Still Uses Polyfill.io, It’s Now Phishing Your Customers
BlogPeter Joles Peter Joles

If Your Site Still Uses Polyfill.io, It’s Now Phishing Your Customers

A critical credential-harvesting exploit is actively targeting websites that still load the hijacked, legacy polyfill.io script, tricking visitors with fake browser-level login prompts on trusted banking and e-commerce sites. Any credentials entered into this HTTP Basic Authentication box are sent directly to malicious actors, who also receive a header revealing exactly which website the user came from. While the original compatibility service was sold and weaponized in 2024, thousands of forgotten tags remain buried in website architectures; website owners must immediately audit their codebases and remove all references to polyfill.io to protect their users, while consumers should immediately close any unexpected login popups.

Retargeting Pixels and Privacy Law: What Marketing Teams Need to Get Right
Marketing Privacy Retargeting Consent Management
BlogPeter Joles Peter Joles

Retargeting Pixels and Privacy Law: What Marketing Teams Need to Get Right

Retargeting pixels transmit behavioral data to Meta, Google, TikTok, and other ad platforms with every page load. Under GDPR, CCPA/CPRA, and state health data laws, that transmission requires valid consent that most cookie banners do not actually collect. This post explains the exposure and what a compliant retargeting setup actually requires.

Understanding Session Replay: A Guide to Technical Privacy Management
Jocelyne De La Cruz Jocelyne De La Cruz

Understanding Session Replay: A Guide to Technical Privacy Management

Organizations must align their website’s technical execution with their privacy commitments, specifically regarding session replay technology. While these tools provide valuable user experience insights by logging real-time interactions via the Document Object Model (DOM), they create privacy risks if scripts execute before consent or capture unsubmitted data. To ensure integrity, privacy leaders should implement active controls such as conditional script loading, third-party script auditing, and local data masking. By synchronizing technical behavior with public disclosures and maintaining verifiable audit trails, organizations move beyond static policy to a model where website code serves as proof that privacy obligations are being met.

2-Part ECPA Analysis from Troutman Pepper
Blog

2-Part ECPA Analysis from Troutman Pepper

This two-part series from Troutman Pepper explores a major shift in the legal landscape: the move from state-level privacy disputes to federal class actions under the Electronic Communications Privacy Act (ECPA). Part One analyzes the "Crime-Tort" formula—a legal strategy that leverages a company's own privacy disclosures as the primary evidence for federal wiretapping claims. It details how recent court rulings have turned technical inaccuracies into a nationwide litigation risk that bypasses traditional state-border defenses. Part Two shifts from legal theory to real-world data, examining a surge in filings across the country. The analysis highlights how discrepancies between a website’s technical behavior and its public-facing promises—particularly regarding consent and tracking—are driving a new wave of litigation. It concludes with strategic recommendations for aligning technical operations with legal disclosures to mitigate these emerging risks.

Beyond the Banner: Closing the Technical Gaps in Consent Management
Consent Management Privacy Compliance
BlogJocelyne De La Cruz Jocelyne De La Cruz

Beyond the Banner: Closing the Technical Gaps in Consent Management

A consent banner is just a user interface, not a compliance program. Regulators are looking past the "Reject" button to verify that data transmission actually stops at the network layer. Moving from cosmetic privacy to technical verification is the only way to close the gap between your stated policy and the digital trail of non-compliance created by misconfigured trackers...

Managing Meta Pixel Data Exposure: A Technical Governance Perspective
Web Governance Privacy Compliance Privacy Regulations
Jocelyne De La Cruz Jocelyne De La Cruz

Managing Meta Pixel Data Exposure: A Technical Governance Perspective

Marketing tools like the Meta Pixel often operate outside traditional server-side controls, creating a dangerous "governance gap" where client-side scripts transmit sensitive data in real time—regardless of what your privacy policy promises. In regulated industries like healthcare and finance, this isn't just a technical glitch; it’s a massive compliance liability.

You Still Can’t See or Control Your Website
Consumer Privacy Consent Management Privacy Regulations
BlogIan Cohen Ian Cohen

You Still Can’t See or Control Your Website

Companies believe they have control over data collection through policies, consent tools, and governance, but in practice, they lack visibility into what actually executes in the browser. Modern websites are dynamic and constantly changing, creating a growing gap between intended behavior and real data flows. Without continuous, real-time insight and control at the point of collection and execution, organizations are operating on assumptions, leaving them exposed to unseen risk and liability.

Is Your Website Ignoring the Digital Handshake?
Privacy Compliance Web Governance GPC
BlogJocelyne De La Cruz Jocelyne De La Cruz

Is Your Website Ignoring the Digital Handshake?

Global Privacy Control (GPC) has evolved from a niche browser setting into a critical legal mandate that regulators now enforce through "outside-in" technical audits. It is no longer enough to have a compliant privacy policy; organizations must ensure their website’s code actually honors these automated opt-out signals at the network layer to avoid costly settlements and misrepresentation charges. Lokker bridges this gap by providing real-time, network-layer enforcement that blocks unauthorized data flows and generates the technical evidence required to prove that a company’s privacy promises match its actual website behavior.

Check out Marsh’s latest webinar featuring Troutman Pepper and LOKKER!
Consumer Privacy
Latest News Sebastian Crumpacker

Check out Marsh’s latest webinar featuring Troutman Pepper and LOKKER!

We were proud to join our partners at Marsh and Troutman Pepper for an in-depth discussion on evolving privacy regulations and the growing risks surrounding website tracking technologies. Hear from our CEO, Ian Cohen, alongside leading experts in privacy law and cyber-risk, as they discuss practical strategies organizations can take today to mitigate regulatory exposure […]

Page 1