Third-Party Data Leaks on Municipal Websites

Abstract

This paper addresses the use of third-party services on public sector websites. We focus on Finnish municipalities and their use of third-party services, analyzing network traffic from 309 municipal websites to explore what kind of personal data is transmitted to third parties. Our findings show that 51.8% of municipal websites reveal the pages visited by the user to third parties without consent. This way, sensitive data such as search terms used by website visitors can be leaked to third parties. The paper also offers recommendations to improve privacy on public sector websites. We have also contacted the municipalities with serious data leaks and recommended privacy improvements by disabling or replacing problematic third-party services.