Facebook Advanced Matching + HTML Cache: personal data leak

  • Resolved Andrej Mernik

    (@r33d3m33r)


    2 months, 4 weeks ago

    Hello,

    we discovered that in some cases user data can get embedded in the pysOptions => advancedMatching and if you are using a HTML caching plugin like WP Rocket, this data gets exposed to everyone. This was a pretty shocking discovery, since Use Ajax is enabled, and you would expect that personal data wouldn’t be passed to HTML directly, but filled with Ajax instead.

    Is there anything that can be done to avoid this except turning off Advanced Matching?

    Best regards,
    Andrej

    • This topic was modified 2 months, 4 weeks ago by Andrej Mernik. Reason: title change
Viewing 4 replies - 1 through 4 (of 4 total)
  • ehamati

    (@ehamati)

    2 months, 3 weeks ago

    @r33d3m33r We are investigating this matter and will provide you with an update as soon as possible.

    ehamati

    (@ehamati)

    2 months, 3 weeks ago

    Hi @r33d3m33r, we’ve resolved the issue and released an update. We’ve added a new feature that allows to receive the up-to-date client data using an additional AJAX request before executing events. Please update the plugin on your end and let me know if everything works fine.

    You can find it in the plugin’s global settings page: https://prnt.sc/0Sjr-FpJVYpN


    robertzollner

    (@robertzollner)

    2 months, 3 weeks ago

    @ehamati is the data fetched using the REST API saved locally in the browser (ex: localStorage) when that option is enabled? Or is it really fetched on every pageload as mentioned in the screenshot?

    If that’s the case what do you think about reducing the performance impact using localStorage as the user data isn’t changing on every page load?

    ehamati

    (@ehamati)

    2 months, 3 weeks ago

    @robertzollner No, this data is not stored in the browser (for example, in localStorage). Instead, it is fetched directly from the server on every page load, with browser caching explicitly disabled for that request.

    Regarding caching it in localStorage for performance: We don’t recommend doing so. The data includes consent status and identity-related information tied to a specific visitor, and it is intentionally not cached. Consent can change between visits (for example, if a visitor updates their cookie preferences), so using a cached value could result in an outdated consent state being applied.

    • This reply was modified 2 months, 3 weeks ago by ehamati.
Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.