Category: Data Governance & Privacy

Privacy compliance has come a long way. Most organizations today have data maps, consent management platforms, vendor assessments, and governance frameworks in place, which is genuinely good progress. But there’s a blind spot most of those programs share: the browser.

Data Starts in the Browser, Not Your Systems

Here’s the mental model that underpins most privacy programs: a user interacts with a service, data gets collected at a defined point, then it flows into your systems, where your governance controls kick in. Works great for server-side infrastructure: your CRM, payment processor, HR tools, etc.

The problem? The web doesn’t actually work this way.

Data starts being generated in the browser long before anyone hits “submit.” Every keystroke in a form field, every click, every scroll, every letter typed — that’s all happening client-side, before your backend ever sees a single byte. If your privacy program draws the line at form submission, it’s in the wrong place.

Third-Party Pixels Have More Access Than Most Teams Realize

Around 92% of websites load some form of third-party pixels. On e-commerce sites, over half the pixels and tracking tags executing in the browser come from outside your codebase — analytics tools, ad pixels, tag managers, session replay tools, chat widgets, and more.

Browsers fail to make one thing obvious: by default, these scripts aren’t isolated from each other. There’s no sandbox wall between your analytics vendor and your advertising pixel. Each has access to the same page, the same DOM, and the same form fields that users interact with.

That means including a third-party pixel isn’t just adding a feature — it’s giving that vendor’s code the technical ability to observe what users do on your page. That can include email addresses as they’re typed, phone numbers digit by digit, health information entered into a search bar, financial details in a mortgage calculator, or sensitive data filled into an employment form, even if none of it is ever submitted.

There’s a further complication that vendor reviews and data processing agreements often miss: third-party scripts can quietly update their own behavior after deployment. A pixel that was reviewed and scoped at integration may later expand what it collects — without triggering a new vendor assessment or contract amendment. Some vendors also inject fourth-party scripts, pulling in additional code from other domains entirely, without any direct contractual relationship with your organization. By the time that happens, your DPA is already describing a version of the tool that no longer exists.

The Consent Timing Gap

In web architecture, milliseconds matter—and so does the sequence in which scripts execute. While many privacy teams assume that installing a Consent Management Platform (CMP) automatically pauses all tracking until a user clicks “Accept,” the default behavior of web browsers tells a different story.

In reality, scripts start executing the moment a page loads. The consent banner appears, the user makes a choice, and only then does the Consent Management Platform act. But by that point, observation has already begun, creating a critical, often-overlooked consent timing gap.

Unless your web architecture is specifically configured to block third-party pixels from loading before consent is captured and confirmed, there’s a window of exposure your governance framework doesn’t account for.

Proof in Practice: What Popular Pixels Actually Collect

Jscrambler’s security research team analyzed what Meta and TikTok advertising pixels — two of the most widely deployed client-side technologies on the web — actually do at runtime on real websites across retail, hospitality, and healthcare.

The findings were eye-opening. These pixels collect detailed behavioral and transactional data: product names, prices, cart values, and the full customer journey. TikTok pixels were observed capturing physical addresses from store-locator fields at a major European retailer and sending them to TikTok servers. Meta’s pixel has a feature called automatic events — enabled by default — that scans page elements and captures data, including cardholder names and partial credit card numbers during checkout.

There’s also a timing dimension. In several cases, data was transmitted before the site’s consent management platform could intervene. In some cases, it continued even after a user clicked “reject all.”

The Compliance Risk

For privacy teams, the concern isn’t simply what data is collected, but whether collection aligns with user consent, regulatory obligations, and internal policy. If data is collected before consent is established — or continues after it’s withdrawn — organizations may be exposed to privacy compliance risks they don’t realize. And because third-party pixels can update their behavior post-deployment, the gap between what a vendor agreement says and what code actually does at runtime can widen over time without any visible trigger.

The Business Risk Nobody Talks About

Privacy isn’t the only concern. The same technologies that can observe customer interactions can also capture commercially sensitive behavioral data. Product interest, pricing comparisons, checkout behavior, feature evaluation, and conversion patterns are valuable intelligence. Many technology vendors operate across entire industries, meaning the data generated on your website may contribute to broader datasets that extend well beyond your organization. Your analytics vendor almost certainly serves your competitors, too.

Data observed in your users’ browsers doesn’t automatically stay with you.

Why Client-Side Governance Matters

Traditional privacy programs focus on governing data once it reaches enterprise systems. But modern web applications create and expose data before that point. Effective governance increasingly requires visibility into what third parties execute in the browser, what data they can access, and whether their behavior matches what was agreed to at procurement. Without that visibility, your program is governing a downstream slice of a much larger data flow.

Where to Start

Getting control of your client-side environment doesn’t require ripping everything up. This is where Jscrambler can help.  A useful first step is to understand what’s actually running on your web properties—not based on documentation, but on what’s executing at runtime.

From there, you can assess which pixels have access to form inputs, identify any fourth-party scripts introduced without formal review, and test whether your consent implementation actually delays pixel execution or simply assumes it does.

Your website is the first place users interact with your service. If your privacy program can’t see what’s happening there, the gap between your commitments and your technical reality is likely bigger than you think.

Jscrambler recently joined thousands of privacy and legal professionals at the IAPP Global Summit 2026 in Washington, D.C. It was an invaluable opportunity to connect with experts and leaders dedicated to the evolving landscape of data protection. As we look back, a few themes dominated the stage: the relentless march of AI, the need to challenge current data collection practices, the growing gap between policy and enforcement, and a big realization that the client-side “blind spots” are far larger than previously assumed.

1. Privacy Starts in the Browser: Confronting the Client-Side Blind Spot

A recurring topic throughout our discussions at the summit was the insufficiency of focusing solely on the network perimeter. Most organizations have spent years maturing programs designed to protect data once it passes into their network and lands in databases and servers. While this “systems of record” approach is effective for the traditional perimeter, it fundamentally ignores where data governance actually begins: the web browser.

While the industry acknowledges that data collection starts in the browser, a dangerous governance assumption persists. Most privacy frameworks assume collection begins only after a user clicks “submit.” In reality, data collection begins the moment a user interacts with a page, typing into fields, submitting search queries, or simply navigating the website. If data cannot be governed at the precise moment it is formed, it cannot be fully protected.

The Loss of Control

Unlike servers and databases that operate on controlled infrastructure, code in the browser executes on the user’s device alongside dozens of third-party scripts. This environment is highly privileged but remains one of the least governed parts of the enterprise. 

Our discussions with the privacy experts at the summit highlighted several critical risks:

• Observation Before Submission: Analytics, advertising pixels, and AI assistants can observe and collect sensitive personal data as it is first typed. This means names, emails, and even health symptoms can be collected before a user officially submits the data.

• Scope Creep and Piggybacking: Many professionals were surprised by the prevalence of scope creep and “piggybacking.” Third-party scripts can quietly update their own permission scopes or add “fourth-party” dependencies without oversight from the privacy team.

• The DPA Enforcement Gap: This lack of visibility quickly renders data processing agreements (DPAs) and privacy notices obsolete. If a script deployed for simple analytics begins observing form fields for ad targeting without approval, it creates a purpose-limitation violation that exists entirely outside traditional server-side controls.

• The Audit Record Deficit: Compliance is an evidence-based discipline. Most privacy programs rely on server-side logs, which only record what your servers received. They have no record of what a third-party script exfiltrated directly to an external server from the website, leaving legal teams without a complete audit trail for regulatory inquiries.

2. AI: The Dual-Edged Sword of Modern Privacy

AI was arguably the most ubiquitous topic at the summit, presenting both a transformative opportunity and a significant hurdle for privacy and legal teams. The conference featured a wealth of sessions focused on how to use AI tools to support privacy initiatives, ensuring sensitive data isn’t fed to or surfaced by AI on the backend, and establishing robust strategies for vetting and onboarding new AI vendors.

However, amidst these deep dives into server-side security, one critical area remained largely unaddressed: AI running directly in the browser. While backend governance is essential, AI-powered tools like chatbots, assistants, and copilots increasingly operate client-side. These tools observe live page content and user interaction signals as input to provide real-time assistance. By doing so, they assemble context within the browser and transmit it to the outside world instantly, often falling under the vendor’s privacy policy rather than your own.

Navigating evolving global mandates, such as the EU AI Act, requires a fundamental shift toward data traceability and a granular understanding of exactly where AI inputs originate. Because many AI systems are non-deterministic, data collection is no longer strictly bounded by static, predictable logic. This makes runtime governance an absolute necessity to prevent a strategic loss of control over the data being fed into these models at the point of origin.

3. The Reality of Ad Pixels and Personal Data Exposure

The backbone of many conversations Jscrambler had was our research into TikTok and Meta ad pixels, which was eye-opening for many. It sparked deep concern regarding the sheer volume of personal data harvested without clear oversight. While privacy teams knew these tags were active, they were often unaware of the extent: these pixels quietly ingest granular personal identifiers and interaction data directly from the browser.

When a pixel observes a user’s behavior before they have even consented or submitted a form, it creates a massive “consent timing gap”. This unauthorized collection of sensitive information, from health queries to shipping addresses, represents a major compliance risk under GDPR and CCPA. For privacy leaders, the takeaway was clear: relying on a static vendor list is no longer enough when ad tags can unilaterally expand their data-collection reach at the browser layer.

4. Data Minimization: Challenging the Status Quo

One of the most impactful sessions, “Less is More: Why Data Minimization Matters to Privacy Laws,” emphasized that personal data should only be processed if it is reasonably necessary for a specific, lawful purpose. 

It wasn’t just Jscrambler highlighting the issue of unchecked data collection by third parties on the web; speakers opened by challenging the status quo, noting that ad trackers like TikTok and Meta are collecting far too much data. They discussed the current “take it or leave it” reality where customers feel forced to either accept egregious over-collection or not use the service entirely.

Crucially, the session debunked the myth of the “check-the-box” privacy policy. Just because you disclose every data category you collect doesn’t give you carte blanche to ignore minimization principles—a point made evident in the Healthline Media CCPA case. As more states pass regulations, the foundation of collection is shifting toward the customer’s reasonable expectation. You must only collect what is expected and strictly necessary to deliver the specific product or service requested.

This shift represents a fundamental move away from “notice and choice” models that overwhelm consumers with endless pop-ups and fine print. Instead, we are entering an era of the “Burden Shift,” where the responsibility is placed back on companies to align their technical practices with user expectations. 

Another key point covered by the panel was that keeping up with U.S. state regulations is becoming increasingly complicated, as seen in the diverging philosophies of different jurisdictions. Maryland, for instance, has adopted a “substantive” approach where collection is tied strictly to requested services. In contrast, California utilizes a “hybrid” model centered more on the context of the user interaction. This fragmented landscape underscores the importance of visibility into what data is being collected and why at the browser level, to simplify compliance with the varied requirements and philosophies across regional regulations.

5. The Governance Gap: Accountability Without Control

Another point of tension that Jscrambler discussed with attendees was the widening gap between written policy and actual enforcement. While privacy and legal professionals are not typically the ones deploying enforcement controls, they are ultimately the owners of their organization’s compliance posture.

In a traditional server-side environment, enforcement has become relatively straightforward – organizations have a litany of tools in place, including data security posture management (DSPM), data loss prevention (DLP), data governance tools, and endpoint protection, to enforce their governance and privacy policies.  

However, the client-side is a low-visibility environment that makes it nearly impossible for legal teams to verify compliance before it reaches their servers. Without client-side visibility, they cannot see if a script is capturing search queries before a user clicks “submit.” Furthermore, most privacy programs rely on server-side logs, which have no record of what a third-party script observed and exfiltrated directly to an external server.

This leaves privacy and legal teams without the necessary audit trail to defend their practices during a regulatory inquiry. To close this gap, organizations must adopt technical controls that provide interaction-level awareness at the browser layer.

Is Your Technical Reality Aligned with Your Privacy Commitments?

To evaluate your current governance stack, we encourage you to ask these five critical questions:

1. Inventory: Do we have a complete inventory of all scripts executing in the browser—not just our server-side processors?

2. Data Access: Which of these scripts can observe and collect form field input before submission?

3. Contractual Review: Do our data processing agreements cover the data these scripts can technically access at all times, or only what we intend them to collect?

4. Consent Timing: Has our consent implementation been tested to confirm it captures user choice before other scripts begin observation?

5. AI Governance: Are browser-deployed AI tools included in our AI governance register?

Try Jscrambler

If you’re interested in learning more about how Jscrambler can help you extend data governance and privacy enforcement beyond the traditional perimeter into the browser, schedule a demo today!

A BBC investigation published in February 2026 showed TikTok using a tracking pixel to collect highly sensitive data from websites across the Internet, including disclosures about cancer diagnoses, fertility treatment, and mental health concerns. The BBC found pixel-intercepting data that websites were transmitting to Google, without those sites knowingly authorizing any sharing with TikTok. What was especially troubling was that the tracking included individuals who had never even created a TikTok account. 

The Ubiquity of Third-Party Scripts

While the findings raise serious privacy concerns, they also underscore a broader risk: the lack of visibility and control organizations often have over third-party scripts embedded in their websites. Numerous studies have shown that modern websites can load more than two dozen third and fourth-party scripts, including analytics tags, ad pixels, chat widgets, and A/B testing tools. Often, website owners deploy them to support business needs but rarely implement any controls or oversight.

What many may not realize is that once loaded, a third-party script operates with the same browser-level privileges as the site’s own code. They have access to the entire DOM, meaning a third-party script can read every element in that page in real time, including form fields as users type into them, drop-down and checkbox selections, and any data that a browser might auto-fill on behalf of the user.

Critically, third-party scripts don’t need to wait for the user to submit a form. They simply capture values as a user inputs them, and before the web app itself has had a chance to do anything with the data. Even if an application never transmits the data, a script can capture it independently and send it elsewhere anyway. That’s not all. Scripts can also read cookies, access data in the browser’s local storage, and fingerprint users by collecting browser and device characteristics that survive cookie deletion and account logout. This form of “cookieless” tracking is becoming an increasingly common way for sites to track users without requiring their consent and without any indication that it is happening.

BBC’s investigation of TikTok, for instance, showed website owners had no idea or indication that a user selecting a checkbox, such as “I am a cancer patient”, for instance, could trigger a background network request sending the user’s email address and disclosure to TikTok.  The site owners didn’t approve it and, in many cases, likely didn’t even realize it was happening.

Broad Implications

The implications for website operators are enormous. Under privacy and security regulations such as GDPR, CCPA, HIPAA, and PCI DSS, the website owner is responsible for protecting user data, even if a third-party script collected it in violation of compliance requirements.  If sensitive information is exposed through a third-party script, regulators will hold the site owner accountable. Even TikTok, in comments to the BBC, noted how it is up to the website owners themselves to ensure they comply with privacy requirements and to take advantage of the notifications and tools the company provides to help them do so.

For most website owners, removing all third-party scripts is clearly not an option, as they enable essential capabilities, from logging and analytics to customer engagement. What’s needed instead is the ability to continuously monitor script behavior and enforce clear boundaries on what they can do to prevent unauthorized data access or transmission. Monitoring needs to be done without disrupting legitimate functionality.

Governance and Oversight

Fine-grained script governance begins with visibility. Organizations must be able to identify every script running on their pages, understand what data each script accesses, and track where that data is sent. This visibility cannot be limited to development. It must also extend continuously into production, where scripts can change behavior after deployment without notice.

Access controls are equally essential. Scripts should interact with sensitive page elements only when explicitly authorized. A marketing pixel, like TikTok’s, for instance, has no legitimate reason to read responses in a medical form, and neither does a chat widget need access to payment fields.  Organizations should implement isolation and behavioral policies to ensure scripts operate within clearly defined boundaries and only access the data necessary for their intended function. Controlling outbound data flows is another critical requirement. Security teams must be able to monitor script communications, restrict connections to approved domains, detect unexpected destinations, and block unauthorized transmissions in real time. 

The TikTok pixel investigation is a reminder that third-party scripts operate as trusted insiders within modern websites, often with far more access than organizations realize. Without continuous visibility and control, these scripts can quietly expose sensitive user data and create significant security, privacy, and regulatory risk. 

Customers may trust you with their data, but regulators expect you to prove you deserve it. Legislation from the European Union’s General Data Protection Regulation (GDPR) to California’s Consumer Privacy Act (CCPA) and the US Health Insurance Portability and Accountability Act (HIPAA) is designed to facilitate the use and sharing of data. It also penalizes the misuse and breach of personal data.

Businesses are increasingly being seen as stewards or custodians of their customers’ data. Failure to meet their obligations could result in hefty fines – up to €20 million or 4% of annual turnover under the GDPR – reputational damage and loss of customer trust. Yet opportunities and risks exist in the same future.

Empowering customers to derive more value from their own data lies at the heart of the GDPR. This is similar to other EU legislation, such as the revised Payment Services Directive (PSD2), on access to bank data. Businesses can turn privacy and data protection into a basis for innovation, enhanced customer trust and loyalty, operational efficiency, competitive advantage, and more.

This guide summarizes the essentials of data privacy compliance, helping you stay informed and prepared to protect your customers, your business, and your bottom line.

What Is the General Data Protection Regulation (GDPR)?

The General Data Protection Regulation, or GDPR for short, is European data privacy legislation that came into effect on 25 May 2018. It gives individuals in the EU/EEA (European Economic Area) rights over how their personal information is used. It explains what businesses worldwide must do when processing personal data of EU/EEA citizens. The regulation applies across EU member states under the ‘one-stop-shop’ principle, where pan-EU businesses have a lead regulator to give guidance.

Where Did the GDPR Come From?

The GDPR updated and strengthened existing EU data protection legislation, namely the Data Protection Directive 1995 and the UK’s Data Protection Act 1998.

An EU ‘regulation’ is a binding legislative act to be applied in its entirety across the EU. A regulation carries more weight and offers less flexibility in implementation than a ‘directive’, which sets out a goal to be achieved. Individual EU member states then devise their own laws to reach these goals.

The GDPR builds on existing principles, namely that privacy is a fundamental human right, enshrined in the Universal Declaration of Human Rights (Article 12), the European Convention of Human Rights (Article 8), and the European Charter of Fundamental Rights (Article 7). 

There are parallels with other countries, such as the US, where privacy has often been regarded as an element of liberty and the right to be free from state intrusions.

What Are the Principles of the GDPR?

The principles of the GDPR are outlined at the beginning and explain the foundation or ‘spirit’ of the legislation. Compliance with both the letter and the spirit of the law is the cornerstone of good data protection practice. Article 5 outlines seven data protection principles:

1. Lawfulness, fairness, and transparency – Personal data must be processed lawfully, fairly, and in a transparent manner to the individual

2. Purpose limitation – Personal data must be processed in accordance with the explicit and legitimate purposes specified to the individual on collection

3. Data minimization – Personal data must be processed in an adequate, relevant, and limited to what is necessary in relation to the purposes for which the data is processed.

4. Accuracy – Personal data processed must be accurate and kept up to date, where necessary

5. Storage limitation – Personal data must only be stored for as long as necessary for the specified purpose

6. Integrity and confidentiality (security) – Personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage 

7. Accountability – Businesses processing personal data are responsible for and must be able to demonstrate compliance with the principles above

What Are the Key Rights for Individuals Contained in the GDPR?

The GDPR sets out various rights and responsibilities related to the processing and free movement of personal data. ‘Personal data’ is basically information relating to an individual who can be identified either directly or indirectly. 

Names, addresses, and social security numbers are clearly personal data. But so too is data related to gender, biometrics, health, political beliefs, and even online browsing habits, if the individual can be uniquely identified.

Individuals have certain key rights under the GDPR as follows:

1. Right to be informed – Individuals must be informed of how their personal data is collected and used.

2. Right to object – Individuals may object to the processing of their personal data in certain circumstances.

3. Right of access – Individuals may request a copy of the personal data and any supplementary information that the business holds about them.

4. Right to rectification – Individuals may ask for inaccurate personal data to be corrected or completed if it is incomplete.

5. Right to be forgotten – Individuals may request that businesses delete personal data, sometimes also known as the ‘right to erasure’.

6. Right to restrict processing – Individuals have the right to request the restriction or suppression of their personal data.

7. Right to data portability – Individuals may request that a business transfer their personal data to a commonly used format so they can easily share it.

8. Rights related to automated processing – Decisions affecting individuals cannot be made solely on the basis of automated processing, unless required by law or contract.

To What Extent Does the GDPR Apply in Jurisdictions Outside the EU?

The GDPR applies to businesses established in the EU/EEA, regardless of where the data processing takes place. However, as it’s extra-territorial in scope, the GDPR also applies to businesses outside the EU/EEA, if they process personal data of individuals in the EU/EEA. That includes where the processing activities relate to:

• Offering goods or services to data subjects in the EU/EEA, even if no payment takes place

• Monitoring the (online) behavior of data subjects in the EU/EEA

How Does the GDPR Apply to Small Businesses vs. Large Businesses?

The core principles of the GDPR apply to all businesses irrespective of size. However, small businesses with fewer than 250 employees may be exempt from record-keeping requirements detailed in Article 30, under certain circumstances.

How small businesses administer compliance with the GDPR may also differ to large companies. For example, whether they appoint a dedicated data protection officer (DPO) and whether they draw on internal legal and compliance resources. But this is less about business size and more about the nature and amount of personal data they process.

What’s the Impact of the GDPR on Businesses?

The GDPR brings both obligations and opportunities. The main ones include:

Fines and sanctions 

Serious breaches of the GDPR could result in businesses being fined up to €20 million or 4% of annual turnover, whichever is higher. Less serious violations may result in fines of up to €10 million or 2% of the company’s annual turnover, whichever is higher.

Accountability

Businesses are required to not only comply with the GDPR but also demonstrate their compliance, including:

• Maintaining records of data processing activities (e.g., what personal data you collect, where it’s stored, how it’s used, and who has access to it)

• Implementing data protection by design and by default

• Conducting data protection/privacy impact assessments (DPIA) for high-risk data processing 

• Monitoring appropriateness of accountability measures over time

Data security

The ‘security principle’ of the GDPR stipulates that businesses must take “appropriate technical and organizational measures” to process personal data securely. 

Businesses must consider risk analysis, organizational policies, and physical and technical measures to determine what is necessary and proportionate to the risks of processing data and their circumstances.

Data security measures should ensure the confidentiality, integrity, availability, and resilience of systems and services, as well as the personal data processed within them, for example, through pseudonymization and encryption.

Businesses must be able to restore access to and availability of personal data promptly in the event of a physical or technical incident. And have appropriate processes in place to test the effectiveness of their measures and improve them as necessary.

Consent

Consent must be freely given, specific, informed, and unambiguous. Requests for consent must be made in clear and plain language, unbundled from other matters, and require positive action to opt in.

Trust as the ‘killer app’

Trust is the guiding thought in privacy and data protection. Demonstrating strong data protection not only builds credibility with customers but also with partners, investors, regulators, and others.

Customers are more likely to share information with businesses they perceive as responsible and trustworthy. This, in turn, enables companies to unlock more value from data, benefiting both customers and themselves.

Mapping and streamlining data flows often reveals redundancies and inefficiencies. Meanwhile, effective data governance practices also enhance organizational information management, leading to greater operational efficiencies.

What’s the future of the GDPR?

Nearly seven years after it took effect, initiatives are underway to simplify GDPR rules. This aims to ease compliance burdens for small and medium-sized businesses, expedite cross-border investigations, and enhance cooperation between national data protection authorities (DPAs).

Work is also underway to clarify the interplay between the GDPR and the Digital Services Act (DSA). The latter aims to complement the GDPR, ensuring the highest level of data privacy protection in the digital space.

How Does Jscrambler Help Ensure Data Privacy Compliance?

The GDPR was designed to safeguard personal data, but there’s a blind spot that many businesses are missing. Specifically, the hidden risks of third-party scripts used to enhance customer experiences, such as chatbots and online checkout pages.

These scripts can access forms and data outside their intended business purpose, which was one of the areas designed to be prevented. Malicious actors can also view and manipulate third-party scripts to gain access to highly confidential information, including intellectual property (IP) and customers’ personally identifiable information (PII), credit card data, and more. 

Businesses must protect their clients’ information from unlawful data collection by third-party pixels and tags. That’s all, while keeping their websites compliant with PCI DSS v4, GDPR, CCPA, NIST, OWASP, and HIPAA privacy regulations.

The Jscrambler platform provides fine-grained control over how third-party tags can behave and what data they can access, enhancing application resilience. Connect with our experts to try our solutions to ensure data privacy compliance.

Classic games like Pong, Tetris, and Pac-Man remain ever-present because their gameplay is addictive and uncomplicated. Reverse engineering these games with JavaScript is not only retrospective but can also become a handy teaching tool when it comes to web development. Because JavaScript is browser-based and has libraries like HTML5 Canvas and p5.js available, developers can create interactive, web-based games.

In this article, we’ll cover ten evergreen games (and two special extras) that can be recreated with JavaScript, explaining their mechanics, implementation strategies, and pedagogical value. Each of these sections references a GitHub repository of sample code from which developers can start.

Why Recreate Classic Games in JavaScript?

Building classic games in JavaScript sharpens skills such as game loop design, collision detection, and state management. These projects are accessible, running directly in browsers without installation, and they offer insights into game design principles that shaped modern gaming. Additionally, protecting your JavaScript code is crucial when sharing games online, and tools like Jscrambler can safeguard your work from theft or tampering.

1. Pong

Pong (1972) is a classic game where you volley a ball back and forth using paddles and score points. Mathematically, what makes Pong elegant is that the movement of the ball is just velocity algebra, collision detection with paddles is fast boundary checks, and points are just increment operations. And within that elegance is the foundation of game development: game loop, entity updates, and rendering cycles that form the basis of all game engines.

• Key Features: Real-time paddle movement, ball physics, score tracking.

• JavaScript Implementation: Use HTML5 Canvas to render paddles and the ball. Implement a game loop with requestAnimationFrame for smooth updates. Handle keyboard inputs (e.g., arrow keys) for paddle control and use basic collision detection for ball bounces.

• Learning Focus: Event listeners, game loops, basic physics.

• GitHub Repository: Pong JavaScript Code

2. Snake

Snake (1970s) puts students up against the challenge of navigating a growing snake to eat while steering clear of crashes. Snake takes the simple ‘don’t run into yourself’ idea and turns it into a fun spatial awareness and forward-thinking test. From a programming standpoint, it is a great introduction to dynamic arrays and movement based on a grid.

• Key Features: Grid-based movement, snake growth, game-over conditions.

• JavaScript Implementation: Render a grid on Canvas, represent the snake as an array of coordinates, and update positions via keyboard input. Randomly place food and extend the snake upon eating.

• Learning Focus: Array manipulation, input handling, and collision detection.

• GitHub Repository: Snake JavaScript Code

3. Tetris

Tetris (1984) is a puzzle game where falling tetrominos are stacked and cleared to eliminate lines. Rotation of the tetromino pieces involves high-level transformation matrices, and clearing lines involves efficient array manipulation. Increasing the speed of the game results in a natural escalation of difficulty that maintains the player within the ‘flow state’—engaged yet not frustrated.

• Key Features: Block rotation, line clearing, and increasing speed.

• JavaScript Implementation: Use a 2D array for the game grid, store tetromino shapes as matrices, and implement rotation logic. Use setInterval for timed block drops, accelerating over time.

• Learning Focus: Matrix operations, timing functions, state management.

• GitHub Repository: Tetris JavaScript Code

4. Space Invaders

Space Invaders (1978) involves shooting aliens that come downwards in waves before they fall below. It creates intrinsic tension with the pattern of movement of the invaders: shifting sideways and then falling downwards. It creates an emergent difficulty curve by itself without explicit programmatic instructions.

• Key Features: Player shooting, enemy movement patterns, barriers.

• JavaScript Implementation: Render sprites on Canvas, move enemies in a grid pattern, and manage player projectiles. Add simple AI for enemies to fire back.

• Learning Focus: Sprite rendering, projectile mechanics, enemy AI.

• GitHub Repository: Space Invaders JavaScript Code

5. Pac-Man

Pac-Man (1980) involves navigating mazes, munching dots, and avoiding ghosts, with their role reversed when they eat power pellets. This is one of the lovely examples of simple rules generating complex behavior of game AI. Blinky is a direct pursuer, Pinky points ahead of Pac-Man, Inky uses relative positions, and Clyde alternates between attack and defensive strategies.

• Key Features: Maze generation, ghost AI, power-up mechanics.

• JavaScript Implementation: Create a tile-based maze with a 2D array. Use simple pathfinding (e.g., rule-based or A*) for ghost movement. Render sprites for Pac-Man and ghosts, with collision detection for dots and power-ups.

• Learning Focus: Pathfinding algorithms, sprite animation.

• GitHub Repository: Pac-Man JavaScript Code

6. Breakout

Breakout (1976) challenges players to destroy bricks using a ball and paddle. The ball’s interaction with different surfaces requires sophisticated collision response calculations. Bricks disappear upon contact, but paddle collisions must modify the trajectory based on the contact point and paddle movement.

• Key Features: Ball trajectory, brick destruction, paddle control.

• JavaScript Implementation: Use Canvas for rendering, calculate ball angles for bounces, and remove bricks on collision. Add multiple levels with varied brick layouts.

• Learning Focus: Physics simulation, level design.

• GitHub Repository: Breakout JavaScript Code

7. Minesweeper

Minesweeper (1989) involves uncovering safe tiles while avoiding hidden mines, guided by number clues. The core flood-fill algorithm, which reveals empty cells, demonstrates recursive programming beautifully—when a cell with zero adjacent mines is clicked, all connected empty cells should automatically reveal themselves. This creates the satisfying chain reactions that make Minesweeper addictive.

• Key Features: Random mine placement, number clues, flagging system.

• JavaScript Implementation: Build a grid with DOM elements or Canvas. Randomly place mines, calculate adjacent numbers, and handle click events for revealing tiles and right-clicks for flagging.

• Learning Focus: Recursive algorithms, DOM interaction.

• GitHub Repository: Minesweeper JavaScript Code

8. Asteroids

Asteroids (1979) has players piloting a ship to destroy asteroids while avoiding collisions. The ship accelerates in the direction it’s facing, but momentum carries it forward regardless of its current orientation. This creates a unique movement challenge that requires players to consider physics rather than relying solely on simple directional input.

• Key Features: Ship rotation, thrust mechanics, asteroid fragmentation.

• JavaScript Implementation: Use vector math for ship movement and rotation. Render asteroids as polygons and split them on impact. Implement screen wrap-around for seamless movement.

• Learning Focus: Trigonometry, dynamic object management.

• GitHub Repository: Asteroids JavaScript Code

9. Tic-Tac-Toe

Tic-Tac-Toe is a game of strategy where X and O are placed within a 3×3 table by players to achieve alignment of three symbols. It is beautiful because the state space is limited to 362,880 possible game positions. It is ideal software to implement your first game AI. It employs the minimax algorithm, which guarantees optimal play, and serves as a great introduction to game theory and recursive thinking.

• Key Features: Turn-based play, win condition checking, and an AI opponent.

• JavaScript Implementation: Use DOM elements for the grid and click events for moves. Implement a minimax algorithm for an unbeatable AI opponent.

• Learning Focus: Game tree logic, basic AI.

• GitHub Repository: Tic-Tac-Toe JavaScript Code

10. Frogger

Frogger (1981) involves crossing roads and rivers while avoiding obstacles like cars and logs. Each lane operates independently with different speeds and patterns, yet players must coordinate movement across all layers. The river section adds complexity by making logs into moving platforms rather than obstacles.

• Key Features: Moving obstacles, timed jumps, and a live system.

• JavaScript Implementation: Render sprites on Canvas, move obstacles in patterns, and handle player jumps with keyboard input. Track lives and reset on collisions.

• Learning Focus: Animation timing, collision detection.

• GitHub Repository: Frogger JavaScript Code

Bonus Game: Chess

Chess (6th century; modern rules established by the 15th century) is a strategic board game in which players move pieces to checkmate their opponent’s king. Chess represents the pinnacle of strategic board games, with rules that have remained virtually unchanged for over 1500 years. From a programming perspective, it’s an extraordinary challenge that combines complex rule validation, sophisticated AI implementation, and elegant user interface design.

• Key Features: Turn-based movement, piece-specific rules, check/checkmate detection.

• JavaScript Implementation: Use a 2D array to represent the 8×8 board, with objects for each piece’s position and type. Implement legal move validation and checkmate detection. Render the board using Canvas or DOM, supporting both mouse and touch input for moves.

• Learning Focus: Complex state management, rule-based logic, AI for single-player.

• GitHub Repository: Chess JavaScript Code

Bonus Game: Mortal Kombat

Mortal Kombat (1992) is a fighting game in which two players battle each other using attacks until one’s health is depleted. The fighting game genre demands precision, impossible in other game types. Every frame matters. Attacks have startup frames, active frames, and recovery frames that must be perfectly timed. Input buffering allows players to enter complex combinations while maintaining responsive controls.

• Key Features: Player movement, attacks, health bars, and win conditions.

• JavaScript Implementation: Use Canvas to render two characters with health bars. Implement movement (left/right, jump) and attack mechanics with keyboard (e.g., A/D/W/S, Arrow keys) or touch controls. Detect collisions for attacks and update health.

• Learning Focus: Real-time input handling, collision detection, animation.

• GitHub Repository: Mortal Kombat JavaScript Code

Bonus Game: Super Mario Bros

Super Mario Bros. (1985) is a platformer where players navigate Mario through levels, jumping on enemies and collecting items. Super Mario Bros didn’t just define the platformer genre—it perfected it. Nintendo’s masterpiece established gameplay conventions that remain standard today while introducing level design principles that transformed interactive entertainment into an art form.

• Key Features: Platform physics, enemy AI, collectibles, and level progression.

• JavaScript Implementation: Use Canvas for side-scrolling levels with tiles for platforms and enemies. Implement physics for jumping and gravity, and handle collisions with enemies and items: support keyboard or touch controls for movement and jumping.

• Learning Focus: Platformer physics, tile-based rendering, scrolling levels.

• GitHub Repository: Super Mario JavaScript Code

Conclusion

These thirteen games span difficulty from very simple input handling up to complex AI and are suited for developers of all experience levels.

However, when making your games available online, you must protect your JavaScript code. Products like Jscrambler provide powerful client protection that thwarts reverse engineering of your game logic, code lifting or theft, and unauthorized modifications. Using Jscrambler’s obfuscation and run-time protection features, you can securely protect your games while making them globally available.

It’s easier than ever to get around a city, country, or anywhere on the planet, thanks to the current digital sophistication in booking flights, rides, and other modes of transportation online. However, to offer customers a complete experience that meets all their travel needs requires transportation companies to integrate third-party tags from partner companies that an organization’s development team may never even see, let alone secure.

Transportation companies use these third-party service tags to connect their websites to external sites, allowing them to upsell services to partner companies, such as car rental, hotel, or travel insurance companies. Website tags also collect data on user behavior, demographic information, and purchase history to personalize a customer’s experience, as well as link to third-party chatbots for customer support.

These tags have certainly enabled players in the transportation industry to transform their digital business, integrating new functionality into their websites quickly to make it easier than ever for customers to make purchases and receive customer or technical support, quite literally on the fly. However, they also leave digital transactions exposed to external risks that an organization may not even be aware of.

Risks of Third-Party Tags in the Transportation Industry: An Aviation Use Case

British Airways, for example, in 2019 was the victim of a Magecart attack in which attackers skimmed the information of about 500,000 customers from the company’s website. The UK-based airliner not only lost customer data and confidence, but even incurred a fine of £183.39 million ($229.2 million at the time) for not reporting the incident according to the European Union’s General Data Protection Regulation (GDPR), which mandates the time frame in which a company must disclose a breach.

In fact, this incident spurred another airline serving international customers to approach Jscrambler and its client-side solution to secure their website, hoping to avoid a similar scenario.  Company officials suddenly wondered if their own website also had security gaps that cybercriminals could use to their advantage, threatening the safety of their customer data and dooming them to a similar fate.

When the company examined its practices, officials discovered a common problem among non-digital native organizations that are rapidly upgrading their digital business: their approach to security was more manual than technical, involving checklists and paperwork rather than a deeper understanding of how JavaScript and third-party tags on their websites function.
Even though the organization had security staff who could do the heavy lifting to secure new scripts as they were added, they prioritized innovation over process, finding workarounds to get things up and running quickly rather than doing due diligence to monitor new scripts in real-world conditions. This created security risks that could inadvertently open the door to compromise or be exploited by a threat actor.

Addressing the Security Risks

Enter Jscrambler’s comprehensive client-side monitoring solution, which can help organizations not only discover places where third-party tags are putting data at risk, but also help them control these tags. Jscrambler provides policies and controls through which third-party tags must pass, ensuring that only the approved tag behaviors and data captured during a third-party transaction or interaction leave their secure website.
In fact, during implementation, Jscrambler made a critical discovery that one of the third-party tags the client was using to connect to a partner website was leaking customer booking codes from the client’s website to the partner site during the transaction.

This is no minor data leak, as these codes are the key to a person’s reservation and hold a trove of personal and sensitive data about customers – including personally identifiable information (PII), travel plans, transaction data, passport information and the like – that could be exploited if it falls into the wrong hands.

Jscrambler’s Client-Side Solution

While companies need to expand their partner ecosystem by connecting with third-party companies through tags, they also need to have controls like those provided by Jscrambler’s client-side solution because “people make mistakes,” says Rui Ribeiro, Jscrambler’s CEO.
“The overall picture is: we need to have controls and make sure that all the third parties that you need to build an effective and practical website only have access to the data that they need to do the work that they need to do,” he says.

Luckily, it was an easy fix to prevent the booking code from being shared with the partner company; however, this is a scenario that could occur with any transportation organization that uses tags to connect with partners for a modern website experience.

This type of inadvertent exchange of sensitive data, such as booking codes, is a security issue that many airlines and other transportation companies aren’t aware of, Ribeiro says. That’s why it’s essential for Jscrambler to provide companies with visibility into the data exchanged between third-party tags and their website, and to give them control over the type of data exchanged.

To put such controls in place, the client used Jscrambler’s Form Fencing feature, which offers behavioral control over third-party tag access to form data based on polices and user-defined rules. In this way, the client is the one in the captain’s chair, ensuring that only necessary scripts can read and access form data, thereby preventing malicious actors from siphoning sensitive information found in web forms.

Jscrambler’s solution also provides clients with tag visibility by alerting them to significant modifications or non-compliant behavior in third-party tags, enabling continuous assessment of a company’s exposure to third-party vendor risk. This feature is a competitive advantage over the static policies that other modern client-side protection solutions use, which can’t keep up with third-party tag software updates.

Transportation companies want to focus on the digital experience they present to customers and not on worrying about how third-party tags might expose customer information. Jscrambler’s client-side protection can help them maintain digital agility while ensuring cybercriminals don’t use malicious scripts to fly away with booking codes – or any other sensitive data.

Data fencing security: Cybercriminals are opportunists. As the level of interaction between users and websites escalates, an increasing amount of private data is being exposed in the browser – and these criminals are ready to pounce. 

The subsequent exacerbation of client-side cyberattacks is a symptom of businesses expanding their investment in the end-user digital experience without reinforcing their cybersecurity controls. In 2023, the global average cost of a data breach — the biggest risk of a client-side attack — reached $4.45 million, a 15% increase over the last three years.

Amid this relentless barrage of threats, the fragility of web security perimeters is being exposed. Whether they have been the victims of client-side attacks or feel they could be next, businesses are becoming acutely aware of the need to implement proactive measures to safeguard sensitive data by controlling and restricting access to it—known as data fencing.

Recognizing you must do something to fence off your data is not enough. Businesses must understand how to prevent unauthorized users or processes from accessing, modifying, or stealing valuable information – and take necessary action.

Unfortunately, data fencing blind spots lead to gaps in the web security perimeter that cybercriminals are primed to exploit, perpetuating the proliferation of client-side attacks. So, what are the benefits of data fencing, and how do you go about solving this data security dilemma?

Data fencing: Why?

Data fencing supports a fundamental element of data security that has its roots in regulatory compliance: data integrity. This assurance that digital information is uncorrupted and can only be accessed or modified by authorized users fosters complete, accurate, consistent, and safe data throughout its lifecycle.

With integrity at its core, robust data fencing offers compelling benefits that combine to build a strong web security perimeter:

Data protection

By setting up access controls—we’ll get into that later—you can ensure that only authorized users or systems can access specific data, reducing the risk of costly data breaches. Protecting sensitive data from unauthorized access and manipulation is crucial to maintaining its confidentiality, integrity, and availability—and your business’s reputation. 

Regulatory compliance

A slew of new and existing data privacy laws, regulations, and standards, such as the General Data Protection Regulation (GDPR), have been introduced to reinforce defense against escalating client-side attacks, both in terms of frequency and sophistication. 

By maintaining data confidentiality, integrity, and availability, fencing can align your business with regulatory requirements and industry standards – shielding it from the legal and financial consequences of non-compliance. 

Data availability

If data is compromised, inaccessible, missing, or incomplete, your business’s performance and continuity will suffer. By restricting unauthorized access to sensitive data, data fencing can also ensure that the right people have timely access to the data they need and that it remains useful—promoting data availability while maintaining security. 

Customizable policies

Data fencing empowers you to establish specific access control policies that align with your business’s unique data security and management requirements. These policies can be tailored to different data types and user roles and can adapt to the dynamic cyber landscape as data evolves and new threats emerge – maintaining your resilience.

Trust and reputation

Data breaches can harm your business’s reputation and erode the trust of customers, partners, investors, and stakeholders. Implementing strong data fencing measures and communicating them clearly will help you build and maintain trust and reputation by reassuring customers that their data is secure amid the prevalent threat of cyberattacks. 

Data fencing: How?

There’s no silver bullet for safeguarding your business’s data. The process of creating a protective virtual boundary around sensitive data to control access and usage is multifaceted. 

Let’s explore the arsenal of methods that you can leverage to build a strong web security perimeter:

Data classification

This process of ranking data sensitivity within a system using pre-defined categories – typically Public, Private, Internal, Confidential, and Restricted – provides the foundations for fencing. Once the data has been categorized, you can achieve a ‘need to know’ approach to data security by tailoring measures for each category and determining what data is public versus private – making it easier to access and secure.

A robust classification system safeguards highly sensitive data, such as customers’ personal information, and helps you focus on confidentiality and security policy requirements, such as user permissions and encryption.

Data encryption

Data encryption is a web security measure that defends your sensitive data against cyber-attacks, including malware and ransomware. Encryption algorithms disarrange the data transmitted between the user’s browser and the web server, making it exceptionally difficult for cybercriminals to intercept and decipher.

This technique for translating data from plaintext (unencrypted) to ciphertext (encrypted) permits users to access encrypted data with an encryption key and decrypted data with a decryption key – securing transmitted data on the cloud and computer systems.

For example, secure communication protocols like HTTPS and SSL/TLS are used to perform web form fencing through encryption. By encrypting sensitive form data, you can ensure its integrity, authenticate the server, and create a trust framework through certificate authorities.

Data masking

Like encryption, data masking is an obfuscation method that transforms data to make it unintelligible for security purposes. Unlike encrypted data, which will always have an encryption key to view the initial data set, masking permanently replaces the original data with fictional data that looks similar. With all the authentic data masked, it becomes useless if intercepted by an attacker. 

To be effective, the masked data must preserve the distinguishing characteristics of the original unmasked data to ensure that requests and analysis still produce the desired results. This requires the new masked data set to sustain referential integrity across systems and databases.

Tokenization

Tokenization is the process of replacing sensitive data with non-sensitive identification symbols—referred to as tokens—that cannot be exploited but retain the essential elements of the data.

De-tokenization retrieves the original data element associated with a given token. Applications often necessitate access to the original data or a specific component of it to make informed decisions, conduct analysis, or facilitate personalized messaging. To reduce de-tokenization and mitigate security risks, tokens can preserve certain attributes of the original data. This enables the utilization of token values for processing and analysis rather than exposing the original data in full.

This technique is typically used to reinforce the security of e-commerce transactions by tokenizing the data so that organizations can use and process credit cards without storing them in the application database. Moreover, it reduces the cost and complexity of compliance with industry standards and government regulations.

Multi-factor authentication (MFA)/ Two-Factor Authentication (2FA)

Multi-factor authentication (MFA) is a multi-step account login process that requires users to provide more than one method of authentication from independent categories of credentials. 

MFA secures data by augmenting the traditional username and password authentication (something you know) with something you have, like a one-time code or response to a push notification and/or something you are, such as a fingerprint or facial recognition.

This layered approach to web security places more than one barrier in the defence of a network or database for an attacker to breach. 

According to Microsoft, 99.9% of the compromised accounts they track every month don’t use MFA –  a powerful testament to its effectiveness in protecting data and systems from cybercriminals.

Reinforce network security

Network security is a catch-all term for the security solutions available to better protect sensitive data from being accessed and compromised. Tools like antivirus software, virtual private networks (VPN), and firewalls help create a secure IT environment for users by protecting the integrity of your computer network and the data within it.

For example, each day, the AV-TEST Institute registers over 450,000 new malicious programs (malware) and potentially unwanted applications (PUA) – amplifying the value of these tools for your business in guarding against malicious attacks.

Conclusion

With an understanding of data fencing’s benefits and its methods, you can establish a web security perimeter that keeps your data in and cybercriminals out. 

By fortifying sensitive data against cyberattacks, your business will achieve data integrity and reap the rewards: enhanced reputation, regulatory compliance, informed decision-making, business continuity, and competitive advantage. 

Watch the Jscrambler on-demand webinar with Sikich experts to explore why CSP/SRI fall short, the risks of incomplete web protection, and best practices for robust, cost-effective PCI DSS v4 compliance. Learn how automated, client-side solutions deliver real-time threat monitoring, tamper detection, and scalable security.

Healthcare organizations ushered in the new year with the stark realization that healthcare data breaches were rampant in 2024. New Year’s resolution or not, the time to strengthen client-side protection against data loss, security vulnerabilities, and malicious threats is now.

The data doesn’t lie; 2024 marked a record-breaking year for healthcare-related data breaches in the U.S. and globally. According to information shared by the U.S. Department of Health and Human Services’ Office for Civil Rights, by December 20, 2024, there had been 677 major healthcare data breaches affecting more than 182.4 million people in that year alone. Hacking and IT incidents represented the most significant type of attack, and client-side threats can allow attackers to steal sensitive medical data, leading to potentially larger attacks, privacy violations, and financial losses.

Recent data shows that third-party tracking technology is present on nearly 99% of “hospital websites, which includes transfers to large tech companies, social media companies, advertising firms, and data brokers.” 

The omnipresence of these technologies demands the healthcare industry proactively protect patient data, mitigate data leakage, and prevent bad actors from executing malicious code by injecting scripts or manipulating application functionality on the client side. 

Identifying Client-Side Vulnerabilities for Healthcare Data

When discussing threats to data integrity, it is often assumed that a bad actor is actively working to compromise systems to gain access to valuable data. It is a fair assumption. However, with the way third-party vendor services operate, sensitive user data can be unwittingly exposed to unauthorized access due to third-party tags (or scripts) being present on the website pages where they should be restricted. And in many scenarios, that is the case. However, some third-party tagging technologies can unwittingly expose sensitive user data to unauthorized third parties.

Take data leakage, for instance. Data leakage via third-party tags happens when an organization inadvertently gives access to sensitive user information by allowing third-party tags to “roam” the website freely, including login and payment data forms. Vulnerabilities in third-party vendor software or misconfigurations can lead to unauthorized access to customer, patient, or user data.

When a website integrates code from a third-party ad network, analytics platform, or other service, the code may unintentionally collect and transmit user data, like browsing history, demographics, or even personal details such as date of birth or social security numbers, with unauthorized third parties. Even when small, these data leaks could lead to significant consequences such as legal issues, identity theft, financial loss, and disruption to operations. With multiple tags from various sources running on websites, the risk of data leakage grows exponentially.

Another more intentional threat is digital skimming. Digital skimming is a fraudulent process of capturing and transferring payment card data. It involves bad actors injecting malicious code into third-party scripts on a website. The code then skims the credit card data when entered into payment forms. 

Because hackers continuously look for vulnerabilities to exploit, client-side vulnerabilities can be especially appealing. By exploiting weaknesses in the applications the end user is actively using, attackers cannot only steal data on a client device but also install malware and gain unauthorized access to systems. 

Hackers target client-side vulnerabilities because they are less secure and give them direct access to user data such as login credentials or credit card details. The client-side also represents a much wider attack surface to hackers because of the number of applications and browser extensions running on an end-user device. Hackers also depend on users not being current with software updates, leaving known vulnerabilities open to attacks.

For healthcare organizations, all of this will negatively impact patient care and a slew of other potential risks. The adverse outcomes of client-side data breaches run the gamut of:

• Disruption of patient care: When healthcare data are compromised, it can lead to delays in treatment, difficulty accessing records, and disruption of essential medical procedures.

• Data breaches: Hackers exploit vulnerabilities in web applications to steal sensitive data such as diagnoses, prescriptions, and insurance details—which can lead to privacy violations, identity theft, and potential lawsuits and settlements.

• Digital skimming attacks: Bad actors use the lack of visibility into third-party scripts on websites to introduce malicious code into the patient’s browser, primarily to steal cardholder data. 

• Phishing attacks: Attackers create a fake or mirrored website hosted on a fraudulent URL to trick end users into divulging personal and sensitive information.

• Reputation damage: A data breach can significantly damage a healthcare organization’s reputation, which could ultimately lead to lost patient trust and business. 

Tracking Codes and Compliance

While common across websites, third-party tracking codes must follow different rules on healthcare provider sites. 

Healthcare websites utilize third-party trackers to improve provider services, but the same technology becomes a risk vector when unauthorized data is shared with technology providers. Examples of third-party tags include Meta pixel, Google Analytics, LinkedIn Insights, Snapchat pixel, TikTok pixel, Twitter conversion tracking, and other custom tracking pixel tags implemented by a third-party ad network or marketing platform. 

These code snippets utilize cookies, web beacons or pixel tags, and other tracking technologies to identify users across different websites. The data collected can help healthcare providers gain insights into patient behavior, identify trends in health needs, optimize website usability, and deliver more personalized and proactive care. Problems arise with third-party tracking technologies when patient privacy is put at risk, and those collecting the data potentially misuse sensitive health information. A lack of transparency regarding how data is collected and utilized could also put healthcare providers in a precarious compliance situation. 

Guidance from the U.S. HHS’ Office for Civil Rights details how HIPAA-regulated organizations must have a business associate agreement (BAA) in place with the provider of the code or authorization from patients—or be found in violation of the Health Insurance Portability and Accountability Act. And while the guidance is clear, a recent analysis of healthcare websites found that one-third of those websites analyzed still use Meta Pixel tracking code—even with the risk of repercussions such as “lawsuits, data breaches, and fines for non-compliance with the HIPAA Rules.” 

For instance, Novant Health settled a $6.6 million pixel privacy breach lawsuit in January 2024. The Lawsuit involved pixel code that collected personally identifiable information on their patient portal, intending to improve care with virtual visits. In this case, the tracking pixels also transferred the data of more than 1.3 million individuals to third-party technology companies that were not authorized to receive the data. 

Closing the Loop on Client-side Threats

Fortunately, healthcare organizations can follow key security steps to keep this year’s resolution and protect their end users on the client side.

To safeguard against client-side attacks, healthcare organizations can implement strict access controls, deploy robust endpoint protections, conduct regular security audits, protect mobile devices, limit network access, educate employees on cybersecurity best practices, and more. Client-side protection platforms offer healthcare providers an additional required layer of security against hackers and data leakage by protecting end users when interacting with websites and applications in a few critical ways.

Managing Script Inventory

By automatically identifying all third-party vendors and scripts present on each web page, script inventory management allows users to maintain a real-time list of all scripts running on their website—including third-party tags. This provides visibility into potential security risks and helps ensure organizations stay compliant with regulations such as PCI DSS. Client-side protection platforms act as a comprehensive script tracking system by identifying and managing potentially unauthorized scripts on payment pages. 

Blocking Access to Data

By identifying and limiting third-party vendors’ access to forms and data input into those forms, client-side protections such as form fencing allow clients to control which scripts can read and access form data. These platforms offer powerful and granular rules engines that give healthcare organizations full control of each script running on their website. 

Controlling Data Exfiltration

By setting specific rules for how third-party tags interact with data, protection platforms can restrict access to sensitive information and prevent unauthorized data transfer.

Stopping Formjacking and Magecart Attacks

By monitoring and security forms on healthcare websites, client-side protection can stop attackers from capturing sensitive data such as healthcare interests searched by patients. Client-side protection can also prevent Magecart attacks, which target e-commerce sites by injecting malicious code into checkout pages and allowing threat actors to skim user card details in the HTML form. 

Detecting Threats and Data Leakage in Real Time

By continuously monitoring end-user sessions, client-side platforms can identify suspicious activity, quickly intervene, and mitigate threats. For instance, client-side protection platforms can identify potential data leaks by analyzing how third-party tags interact with sensitive data on a website.

Complying with Standards & Regulations

By providing additional protections on the client side, healthcare organizations can adhere to data privacy regulations like HIPAA and PCI DSS v4 when accepting payments on their websites. 

Jscrambler provides even more protection against client-side data leakage and attacks, from which healthcare providers can benefit. 

• Comprehensive: Jscrambler is the only client-side security and compliance platform to natively combine first-party JavaScript obfuscation with third-party tag protection. Jscrambler’s Code Integrity obscures JavaScript code used in healthcare, making it difficult for hackers to understand and exploit vulnerabilities to steal patient data. Jcrambler’s Webpage Integrity blocks unauthorized behavior and offers protection against data breaches, form jacking, web skimming attacks, and data exfiltration.
  
  

• Fine-Grained Control: Employ fine-grained rules for managing forms and sensitive data. Our solution provides real-time detection and response capabilities, issuing alerts for suspected fraudulent or risky activities.
  
  

• Top-Notch Performance: Jscrambler is designed to effortlessly scale to support the largest and most demanding websites without causing any slowdown or disruption to the online user experience.
  
  

• Sweeping Client-Side Security & Compliance Policy:  Jscrambler is unique in its ability to support the formulation by all involved teams (product management, software development, security, digital, marketing, as well as governance, risk, and compliance) of a centralized security policy encompassing all client-side related risks and regulatory compliance requirements. The policy is sweeping, comprehensive, fine-grained, company-wide, and future-proof. Out of the box, businesses can comply with one or several security standards, including HIPAA, PCI DSS v4, PSD3, and others. 
  
  

• Trusted Expertise: Jscrambler helps its clients succeed in using its industry-leading platform at every step. For third-party tags, skilled consultants are available to guide them in setting up the best risk mitigation strategies, including suitable data fencing tactics. Jscrambler also offers Managed Services for PCI DSS v4 Compliance (requirements 6.4.3 and 11.6.1) so that security teams don’t have to orchestrate script authorizations or have compliance concerns. 

Learn more about how Jscrambler can mitigate the risk of client-side attacks for healthcare organizations.