Privacy Violation

This category covers mishandling of personal data in ways that breach user privacy expectations or regulatory obligations (GDPR, CCPA, and similar) rather than a technical access-control failure - collecting more data than disclosed in a privacy policy, sharing data with third parties without proper consent, retaining data past a user's deletion request, or exposing analytics/tracking data that reveals more about a user than intended. The data may be perfectly access-controlled and still constitute a privacy violation, because the issue is about what's collected and how it's used, not who can reach it.

This is fundamentally a policy and compliance question - what data is collected, why, with what consent, and what happens to it after a deletion request - none of which is observable from watching HTTP traffic. Confirming it requires reading the actual privacy policy and data-handling practices and comparing them against what the system actually does internally.

Privacy audits, legal/compliance review, and reading the actual data-retention and third-party-sharing implementation are how these get caught - this sits with privacy/compliance teams and manual audits, not automated scanning.

Tip: These are usually found by someone deliberately reasoning about what data a given cache, log, include file, or response should and shouldn't contain, rather than through a technical exploitation technique — a manual data-flow review specifically for sensitive content is the most reliable discovery method.

Real-World Impact

Privacy and sensitive-data-handling flaws cover exposure that happens even when every conventional technical control (authentication, authorization, encryption) is working as designed — data ends up somewhere it shouldn't through a policy gap, an over-broad cache, an included file left in a public build, or a mismatch between what one part of the system assumes about data sensitivity and what another part actually does with it.

The severity depends entirely on what data is exposed and to whom, but the regulatory dimension is often the larger practical concern: unauthorized exposure of personal data can trigger GDPR, CCPA, or sector-specific (HIPAA, and similar) reporting and penalty obligations regardless of whether the exposure was ever actually exploited by a third party, since the obligation is typically triggered by the exposure itself.

These flaws are also disproportionately likely to be found by researchers rather than automated tooling, since they usually require understanding what data a given context should and shouldn't have access to — a judgment call a generic scanner has no basis for making.

Prevention and Secure Design

Preventing Privacy Violation takes a defense-in-depth approach — no single control below is sufficient alone, but together they close off both the primary path and the most common bypasses.

Classify data sensitivity explicitly, and enforce handling rules by classification. Treat "what's sensitive" as an explicit, documented decision propagated through caching, logging, and inclusion policies — not an assumption each component makes independently.

Apply data minimization. Don't retain, cache, log, or transmit sensitive data that isn't actually needed for the current operation — the cheapest way to reduce exposure risk is reducing what could be exposed at all.

Audit caches, includes, and build artifacts for sensitive content specifically. Files included at build time, cached responses, and log output are common places sensitive data ends up without anyone deciding it should be there.

Align policy across every component that touches the data. A privacy commitment made at the product or legal level has to be reflected consistently in every technical component that handles that data — a gap between the two is exactly where this class lives.

Have privacy/data-handling reviewed as its own discipline. This overlaps with but isn't identical to general security review — someone specifically thinking about data lifecycle and exposure paths catches issues a pure access-control review misses.