I see this very often when auditing sites with Vault JS. There are two main scenarios:
- as a result of embedding supposedly "free" 3rd party tools which pay themselves by collecting and selling data to advertisers;
- or when including rich features such has chatbots, form handlers and the like which wants to collect their own data.
Either way, both situations are bad! As a #datacontroller under the #GDPR (and other regulations), YOU are responsible.
This is also why loading JS libraries from 3rd parties before consent is given is so risky. Those libraries can launch a cascade of trackers without your knowledge, and the only way to dig into it is with sophisticated data auditing tools like Vault.JS.
It also goes further: if one of those libraries change and suddenly starts doing something rogue like setting new cookies, doing fingerprinting, calling other endpoints through XHR, Vault will detect it.
#NoConsentNoTracking #dataprivacy #datacompliance #digitalmarketing #digitalanalytics