The fallout from our research continues: we reveal how website operators are in the dark about privacy violations by third-party scripts on their own sites. Includes HIPAA-protected and FERPA-protected data. Thousands of websites are affected.
freedom-to-tinker.com/2018/01/12/web…
freedom-to-tinker.com/2018/01/12/web…
Ironically, Princeton's own Information Security course was also affected by the student data exfiltration. We badly need more systematic ways of figuring out what other sensitive data is going where it shouldn't go. 
This one was an absolute doozy. Ad tracking is so wantonly complex that website owners can't figure out what's going on even after we tell them that data is being exfiltrated from their site. Here's the thread where the hapless developer reached out: freedom-to-tinker.com/2017/12/27/no-… 
Here's the worst part. Because of the way real-time ad auctions work, the set of third parties present on a page can differ each time it is loaded. So no matter how thoroughly they test their sites, website operators can never be sure that users' privacy isn't being violated.
Most of the ad tech / analytics industry is premised on keeping not just users but also website operators in the dark about privacy violations. The effort required by website operators to fully audit third parties would negate much of the benefit of offloading tasks to them.
It comes full circle — someone pointed out the trackers on Freedom to Tinker. Embarrassingly enough, I never thought to check this. 
