{"id":12287,"date":"2020-01-27T08:25:10","date_gmt":"2020-01-27T16:25:10","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=12287"},"modified":"2021-11-18T01:31:52","modified_gmt":"2021-11-18T09:31:52","slug":"the-national-cyber-security-alliances-data-privacy-day-honeypot-on-staysafeonline-org","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/the-national-cyber-security-alliances-data-privacy-day-honeypot-on-staysafeonline-org\/","title":{"rendered":"The National Cyber Security Alliance\u2019s Data Privacy Day Honeypot on StaySafeOnline.org"},"content":{"rendered":"\n

I was preparing to do something for Data Privacy Day on January 28th, when I discovered something truly alarming\u2026<\/p>\n\n\n\n

This year and every year since 2007, Data Privacy Day is sponsored by the\u00a0 \u201cNational Cyber Security Alliance\u201d, or NCSA for short. The NCSA took over the \u201cStay Safe Online\u201d website from Microsoft sometime in 2005 and heavily promotes their Data Privacy Day page each year.<\/p>\n\n\n\n

The Stay Safe Online website features a tool to \u201chelp people\u201d check the privacy settings for a variety of popular websites and services in a variety\u00a0 of categories.\u00a0 The problem, is that the NCSA website has a Hotjar tracking script on every page.<\/p>\n\n\n\n

What is Hotjar?<\/h2>\n\n\n\n

Hotjar is a \u201cbehavior analytics\u201d company that offers click, move and scroll heatmaps as well as full blown visitor recordings (a recreation of the persons viewing session, showing where and when they scrolled, where they moved their mouse, what they hovered over \u2013 EVERYTHING they did on the website.<\/p>\n\n\n\n

Someone using this tool on the Stay Safe Online website to \u201cupdate their privacy settings\u201d, would actually be helping Hotjar build a profile of information about themselves, including the sites they shop on, the email service they use, the type of mobile device they have, how they listen to music, share photos and videos, the ride share services they use, their favorite search engines, social networks, web browsers and more.<\/p>\n\n\n\n

Here is an archive of the page, so you can view it without Hotjar tracking you: http:\/\/archive.is\/fp4Br<\/a><\/p>\n\n\n\n

Here is the link to the original live \u201cUpdate your privacy settings\u201d page (Disclaimer: click at your own risk \u2013 this page WILL track you!)<\/strong><\/em>
https:\/\/staysafeonline.org\/stay-safe-online\/managing-your-privacy\/manage-privacy-settings\/<\/a><\/p>\n\n\n\n

Hotjar Tracking Script on Every Page<\/h3>\n\n\n\n

The StaySafeOnline website uses WordPress for its CMS, and the tracking script for Hotjar appears to be placed in the footer template of their WordPress theme, so it is not unique to the \u201cUpdate your privacy settings\u201d page.\u00a0 Hotjar is tracking your behavior on every single page of the \u201cStay Safe Online\u201d website.\u00a0 While the use of these behavioral analysis tools is especially dangerous on that page, a website claiming to help people protect their privacy should not be tracking and analyzing user behavior in any capacity, but especially not to the extent done by using tools like Hotjar.<\/p>\n\n\n\n

Here is the code as seen in the source code of their website:<\/strong><\/em><\/p>\n\n\n\n

<script>
\n(function(h,o,t,j,a,r){
\nh.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};
\nh._hjSettings={hjid:1038682,hjsv:6};
\na=o.getElementsByTagName('head')[0];
\nr=o.createElement('script');r.async=1;
\nr.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;
\na.appendChild(r);
\n})(window,document,'https:\/\/static.hotjar.com\/c\/hotjar-','.js?sv=');
\n<\/script><\/code><\/p>\n\n\n\n

What is Hotjar?<\/h3>\n\n\n\n

In their own words: \u201cBehavior analytics made easy.\u201d\u00a0 They help people visualize their users\u2019 behavior with tools such as:<\/p>\n\n\n\n