Privacy Horror Stories: The Newest Privacy Monster

Modern websites are constantly getting both easier and more complex at the same time. The marketing team needs better conversion tracking. The developers are updating the checkout functionality. An agency is adding a new advertising partner. Each of these tasks can change where visitor data goes, and the privacy team needs to understand the consequences. Now AI coding tools are joining that workflow, and they add another source of changes for teams to monitor who are already stretched thin.

The unnerving part is what can happen in the gap between a change going live and someone checking it.

The change nobody approved

In a GitHub survey of 2,000 enterprise developers, more than 97% said they’d used AI coding tools at work - and that was all the way back in 2024. The appeal is easy to understand: less time writing code, more time getting a website or product out the door. 

But the privacy team usually isn’t the one asking the tool to update a page or add a feature. Worse yet - they may never see the request, let alone approve what gets added along the way.

And there usually are a few surprises - not all of them treats. In a controlled test last year, Pillar Security showed how hidden instructions in project files could get Cursor and GitHub Copilot to insert an external script into generated web code, without mentioning it in the response to the developer. 

If the developers aren’t even aware, how does Privacy find out? Is someone checking for new scripts and connections to third parties when a change goes live? Can they see what information is being sent, where it’s going, and whether an opt-out actually stops it? Odds are, probably not. Someone may have approved the new feature, but that doesn’t mean anyone checked what happened to the data (or even knew how). 

400 sites. One skeleton crew.

A media company’s small privacy team was responsible for more than 400 sites. By design, the scans are occasional and don’t cover every page. Even then, they produce reports that are often too big to act on. On just one site, 13 of 36 tags and 91 of 169 cookies remained active after a visitor opted out.

Multiply that across 400 sites, add a steady stream of changes from editors, developers, agencies and partners, and no team that size can review everything. Most changes get ghosted - not because nobody cares, but because there’s nobody available to check them.

What chains bind all of this together?

The common thread isn’t bad tools or careless teams. It’s something we see haunting even the best-laid privacy plans:

• Configuration isn’t the same as behavior. An internal dashboard or a vendor’s report may tell you how a tool is configured. But asking that tool to confirm its own settings can amount to grading its own homework. The real test is what happens in a visitor’s browser: which scripts run, what data leaves, and whether their choices are respected.
• Change is constant and often automated. A script, integration or setting can change without a person reviewing what it means for privacy.
• Websites scale. Privacy teams don’t. More sites, more partners and more ways to make changes rarely come with enough people to check them all.
• Clear, definitive evidence is getting harder to produce. Knowing what should happen after an opt-out is one thing. Showing what actually happened (which requests stopped, what data still left, and where it went) is another.

What in your privacy program is changing faster than you can check it?

‍