Study guide
11.1 Privacy Risks and Impacts of E-Commerce
Certified Information Privacy Technologist CIPT
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CIPT Exam Overview and Study Plan
1.1 CIPT Exam Facts, Blueprint, and Study Plan
2 Chapter 2: The Privacy Technologist's Legal and Procedural Role
2.1 Privacy Function Roles: DPO, Data Owner, Steward, Custodian, Legal, and Security 2.2 Translating Legal and Regulatory Requirements into Technical Controls 2.3 Notices, Policies, and Oversight of Privacy Operations, Audits, and Third Parties
3 Chapter 3: Technical Responsibilities: Risk Concepts and Incident Response
3.1 Risk Concepts: Threat, Vulnerability, Attack, Exploit, and Privacy Risk 3.2 Technical Support for Privacy Incident and Breach Response
4 Chapter 4: Privacy Risk Models, Frameworks, and Threat Models
4.1 Privacy Risk Models and Frameworks: Contextual Integrity, Calo, Solove, FIPPs, OECD, NIST, and FAIR 4.2 Privacy Threat Models: LINDDUN and MITRE PANOPTIC
5 Chapter 5: Data Ethics and Automated Decision-Making
5.1 Legal Versus Ethical Processing and the Social Impact of Privacy-Affecting Designs 5.2 Identifying and Minimizing Bias in Automated Decision-Making
6 Chapter 6: Minimizing Privacy Risk During Data Collection
6.1 Notice, Consent Management, and Choice Architecture 6.2 Managing Privacy Risk in Automatic Collection and Telemetry 6.3 Extracting Personal Data from Publicly Available Sources 6.4 Data Retention, Destruction, and Cryptographic Erasure 6.5 Data Minimization Techniques 6.6 Implementing Data Processing Segregation
7 Chapter 7: Minimizing Privacy Risk During Data Use: Aggregation, PETs, and Secondary Use
7.1 Minimizing Privacy Risk from Aggregation and Inference 7.2 De-identification, Pseudonymization, and Tokenization 7.3 Microdata Protection: k-Anonymity, l-Diversity, and t-Closeness 7.4 Advanced PETs: Differential Privacy, Secure Multi-Party Computation, and Homomorphic Encryption 7.5 Secondary Use, Function Creep, and Purpose Limitation Controls
8 Chapter 8: Minimizing Privacy Risk During Dissemination
8.1 Disclosure and Accessibility Controls: APIs, Egress, and Clean Rooms 8.2 Countering Distortion, Exposure, Breach of Confidentiality, Blackmail, and Appropriation 8.3 Defense in Depth: Identity, Access Management, and Authentication
9 Chapter 9: Intrusion, Decisional Interference, and Dark Patterns
9.1 Minimizing Intrusion and Decisional Interference: Behavioral Advertising, Profiling, Cyberbullying, and Social Engineering 9.2 Dark Patterns and Deceptive Design
10 Chapter 10: Privacy Risks Related to Software Security
10.1 Detecting and Fixing Software Privacy Vulnerabilities 10.2 Intrusion Detection and Prevention, and Privacy in Change Management 10.3 Service Providers, Third-Party SDKs, and Supply Chain Risk
11 Chapter 11: Tracking and Surveillance Technologies
11.1 Privacy Risks and Impacts of E-Commerce 11.2 Audio and Video Surveillance, Wearables, and IoT 11.3 Privacy Issues Around Biometrics: Facial, Voice, Fingerprint, and DNA Data 11.4 Privacy Risks and Impacts of Location Tracking 11.5 Internet Monitoring and Web Tracking: Cookies, Fingerprinting, and GPC
12 Chapter 12: Workplace Technologies: AI, Communications, and Monitoring
12.1 Identifying and Minimizing Privacy Risks in AI, Machine Learning, and Deep Learning 12.2 Privacy Risks of Communications Technologies: Video Calls, Messaging, Mobile Devices, Social Media, and Gaming 12.3 Workplace Monitoring and BYOD Privacy
13 Chapter 13: Monitoring and Managing Privacy Risk
13.1 Privacy Audits, IT Control Reviews, KRIs, and KPIs 13.2 Completing Privacy and Data Protection Impact Assessments
14 Chapter 14: Implementing Privacy by Design
14.1 Cavoukian's Seven Foundational Principles of Privacy by Design 14.2 Privacy Goals, Objectives, and Translating High-Level Specifications into Low-Level Specifications 14.3 Hoepman's Privacy Design Strategies: Data-Oriented Strategies 14.4 Hoepman's Privacy Design Strategies: Process-Oriented Strategies
15 Chapter 15: Evaluating Privacy Risks in User Experiences
15.1 Privacy in User Experience: UX Concepts and Usability Testing 15.2 Value Sensitive Design
16 Chapter 16: Privacy Engineering Objectives, Architecture, and the Development Life Cycle
16.1 NIST Privacy Engineering Objectives: Predictability, Manageability, and Disassociability 16.2 Enterprise Architecture, Data Flow Mapping, Lineage, and Cross-Border Transfers 16.3 Managing Privacy Risk in the Software Development Life Cycle 16.4 Applying LINDDUN Threat Modeling in Engineering
17 Chapter 17: Managing and Monitoring Privacy Controls
17.1 Data Inventories, Records of Processing Activities, and Asset Discovery 17.2 Privacy Code Review and Runtime Behavior Monitoring
11.1 Privacy Risks and Impacts of E-Commerce
Key Takeaways Explain This Topic AI
E-commerce sites share data with payment processors, fraud vendors, analytics, advertising platforms, chat vendors, and carriers, so each integration needs a purpose, contract, and consent check.
Hashing an email before sending it to an advertising platform's conversion API pseudonymizes it but does not anonymize it; the platform can match it, so the transfer can still be a sale or sharing under the CCPA.
PCI DSS prohibits storing sensitive authentication data such as the card verification code after authorization, and limits displayed card numbers to at most the first six and last four digits.
PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1, effective March 31, 2025, target payment-page script attacks by requiring script inventories and tamper detection.
Chatbots collect unpredictable free text, so they need disclosure that users are talking to a bot, redaction of card numbers and sensitive data, authentication before account access, and limited retention.
Last updated: October 2026
11.1 Privacy Risks and Impacts of E-Commerce
Quick Summary: The BoK lists e-commerce risks explicitly: behavioral advertising, cookies, chatbots, payments, and behavioral profiling . An online store is a dense network of third parties, and each page view can send data to a dozen vendors. Privacy technologists map those flows, keep payment data inside a small, well-defended zone, govern advertising and personalization with consent and opt-outs, and treat chat transcripts as sensitive data.
The E-Commerce Data Flow
Loading diagram...
Each arrow is a disclosure that needs a purpose, a legal basis, a contract, and an entry in the data inventory. The most common failures are tags that send more than intended (search terms, product names that reveal health conditions, or email addresses in URLs) and vendors added by marketing teams without review.
Cookies, Pixels, and Behavioral Advertising
Retailers use cookies and pixels for sessions and carts (strictly necessary), analytics, and advertising. Advertising tags enable retargeting (showing ads for products a person viewed) and conversion measurement .
Consent and opt-outs. In the EU, non-essential cookies and pixels require prior consent. Under the CCPA and other state laws, sending data to ad platforms for cross-context behavioral advertising is usually a sale or sharing that must stop when a consumer opts out, including by Global Privacy Control. California's 2022 settlement with Sephora ($1.2 million) centered on undisclosed sales through tracking and ignored GPC signals, and its 2025 settlement with Healthline Media ($1.55 million) added a purpose-limitation finding because article titles suggesting medical diagnoses were shared with advertisers.
Server-side tracking. Conversion APIs send events directly from the retailer's server to ad platforms, often with hashed email addresses or phone numbers. Hashing is pseudonymization, not anonymization : the platform hashes its own users' emails the same way and matches them. The data remains personal data, and the transfer must respect consent and opt-outs.
Sensitive products. Product and search data can reveal health, pregnancy, religion, or sexuality (a pregnancy test, a mobility aid, a prayer rug). Exclude these categories from advertising feeds.
Behavioral Profiling and Personalized Pricing
Recommendation engines, segment-based promotions, and dynamic pricing all rely on profiles. Risks include unanticipated revelation (Section 7.1), discrimination, and personalized pricing that charges people differently based on inferred willingness to pay. In January 2025, the U.S. Federal Trade Commission released preliminary findings from its study of "surveillance pricing," describing how intermediaries use data such as location, browsing, and demographics to set individualized prices.
Controls: limit profile inputs to shopping behavior on the site, exclude sensitive inferences, give customers a non-personalized option, explain personalization ("Recommended because you viewed..."), and test pricing models for disparate outcomes across groups.
Chatbots
Retail chatbots, increasingly powered by large language models, collect free text , so customers type whatever they like: card numbers, medical details, passwords, or complaints about family members. Risks and controls:
Risk Control
Users do not realize they are talking to a bot Clear disclosure. California's BOT Act (2019) prohibits using an undisclosed bot to mislead people in order to sell goods, and the EU AI Act requires disclosure of AI interaction from August 2, 2026
Card numbers and sensitive data in transcripts Real-time redaction of payment card numbers and identifiers; send payments to a PCI-compliant payment flow instead of chat
Bot reveals account data to the wrong person Require authentication before the bot accesses orders, addresses, or payment methods
Transcripts used to train models Contract terms prohibiting vendor training on customer data, and retention limits
Wrong answers about orders or policies Grounding in verified data; companies remain responsible for what their bots say (a Canadian tribunal held Air Canada liable for its chatbot's incorrect refund advice in 2024)
Session-replay style capture of chat widgets Disclosure and consent; US wiretap-law class actions have targeted chat and replay vendors
Payments
Payment card data is governed by the Payment Card Industry Data Security Standard (PCI DSS) . Version 4.0.1 , published in June 2024, is current, and its "future-dated" requirements became mandatory on March 31, 2025 .
Key rules that intersect with privacy:
Never store sensitive authentication data after authorization: the full magnetic-stripe or chip data, the card verification code (CVV2/CVC2), and PINs.
Mask card numbers when displayed: at most the first six (BIN) and last four digits, unless a person has a business need to see more.
Render stored card numbers unreadable using strong cryptography, truncation, tokenization, or one-way hashes.
Protect payment pages from script attacks. Requirement 6.4.3 requires an inventory and authorization of every script on payment pages, and 11.6.1 requires a mechanism to detect unauthorized changes to payment pages, countering "Magecart" skimming (Section 10.3).
Reduce scope: hosted payment pages or embedded payment fields from the processor keep card data off the merchant's servers entirely, and network or processor tokens replace card numbers for recurring payments.
3-D Secure (EMV 3DS) supports risk-based authentication by sending device and transaction data to the card issuer. It reduces fraud but shares more data, so merchants should send only the data elements the protocol requires and disclose the processing.
Fraud Prevention and Profiling
Fraud tools collect device fingerprints, IP addresses, and behavioral signals. Fraud prevention is a recognized legitimate interest under GDPR Recital 47, but the data must not drift into marketing (purpose limitation), retention should match chargeback windows, and automated declines may trigger rights related to automated decision-making.