User Tracking Without Consent
Overview
Session recording tools (Hotjar, FullStory, LogRocket), heatmap tools, and behavioral analytics that collect user interactions may capture sensitive data entered by users. Loading these unconditionally without consent violates GDPR and may capture passwords, payment data, or health information.
Remediation
- Integrate tracking scripts with consent management
- Configure tools to mask sensitive form fields
- Provide opt-out mechanism for tracking