The replay services offer a combination of manual and automatic redaction tools that allow publishers to exclude sensitive information from recordings. However, to avoid leaks, publishers must diligently check and scrub all pages, which display or accept user information. For dynamically generated sites, this process involves inspecting the underlying web application’s server-side code. Further, this process needs repeating every time an update or a change to the site or web application takes place.

San Francisco-based digital threat management firm RiskIQ just released a follow-up blog, exploring how these scripts also put companies at risk of violating EU's General Data Protection Regulation, taking effect on May 25, 2018, and revealing its own research. Querying its data, RiskIQ uncovered that the domains of 38 of the top 50 U.S. online retailers contain session replay scripts, especially relevant as consumers take to the web for holiday shopping.

“While great for marketing purposes, using these scripts can be a big problem,” Mike Browning, a manager at RiskIQ, said. On May 25, 2018, the EU’s General Data Protection Regulation goes into effect, which applies to any organization that collects, stores, and uses personal information about an EU citizen. “As part of the regulation’s fairness and transparency guidelines, organizations must clearly state at the point of capture how they’ll be using an individual’s data. Permission to use their data must be explicit and demonstrated through an action such as ticking a box, a significant departure to the ‘opt out’ process most organizations have in place today. Evidence of violations and negligence serves as cause for significant fines.”

Thousands of American companies, including credit unions, that do business with European customers need to reckon with GDPR.

To support GDPR specifications, organizations need a comprehensive understanding of their digital footprint—all of the various internet-exposed assets that belong to them. They must be able to discover which external assets collect personally identifiable information, including a user’s name, phone number, address, social media presence, photos, lifestyle preferences, location data, and even their IP address.

“For multinational companies with expansive web infrastructure, merely compiling and assessing site details is often fraught with gaps and inaccuracies,” Browning said. When looking at 25 of the 50 largest financial institutions in the U.S. (2017), the RiskIQ Threat Research team discovered that 68% had significant security gaps in PII collection.