Evidence And Education

Resources

Use our whitepapers, guides, and toolkits to understand tracker behavior, consent and GPC, remediation, and website privacy risk in practice.

If Your Site Still Uses Polyfill.io, It’s Now Phishing Your Customers
Blog

If Your Site Still Uses Polyfill.io, It’s Now Phishing Your Customers

A critical credential-harvesting exploit is actively targeting websites that still load the hijacked, legacy polyfill.io script, tricking visitors with fake browser-level login prompts on trusted banking and e-commerce sites. Any credentials entered into this HTTP Basic Authentication box are sent directly to malicious actors, who also receive a header revealing exactly which website the user came from. While the original compatibility service was sold and weaponized in 2024, thousands of forgotten tags remain buried in website architectures; website owners must immediately audit their codebases and remove all references to polyfill.io to protect their users, while consumers should immediately close any unexpected login popups.

Read more
Understanding Session Replay: A Guide to Technical Privacy Management
Blog

Understanding Session Replay: A Guide to Technical Privacy Management

Organizations must align their website’s technical execution with their privacy commitments, specifically regarding session replay technology. While these tools provide valuable user experience insights by logging real-time interactions via the Document Object Model (DOM), they create privacy risks if scripts execute before consent or capture unsubmitted data. To ensure integrity, privacy leaders should implement active controls such as conditional script loading, third-party script auditing, and local data masking. By synchronizing technical behavior with public disclosures and maintaining verifiable audit trails, organizations move beyond static policy to a model where website code serves as proof that privacy obligations are being met.

Read more
2-Part ECPA Analysis from Troutman Pepper
Blog

2-Part ECPA Analysis from Troutman Pepper

This two-part series from Troutman Pepper explores a major shift in the legal landscape: the move from state-level privacy disputes to federal class actions under the Electronic Communications Privacy Act (ECPA). Part One analyzes the "Crime-Tort" formula—a legal strategy that leverages a company's own privacy disclosures as the primary evidence for federal wiretapping claims. It details how recent court rulings have turned technical inaccuracies into a nationwide litigation risk that bypasses traditional state-border defenses. Part Two shifts from legal theory to real-world data, examining a surge in filings across the country. The analysis highlights how discrepancies between a website’s technical behavior and its public-facing promises—particularly regarding consent and tracking—are driving a new wave of litigation. It concludes with strategic recommendations for aligning technical operations with legal disclosures to mitigate these emerging risks.

Read more