Monitor Your Suppliers' Terms of Services

The inclusion of other people's code in your own web pages increases the potential number of vulnerabilities and it can have an effect on compliance.

Seemingly harmless code from third party sites is often included to provide:

• advertisements (e.g. Google AdSense, DoubleClick, Amazon Associates)
• widgets (e.g. bookmarking and social networking tools)
• web analytics (e.g. Google Analytics, Omniture, Hitbox).

But these normally come with their own terms of service. Like any other component of your site you need to ensure your own privacy policy and, if there is personally identifiable information, your data protection act registration include the purposes (collection, use, retention, transfer) that the third party code requires.

Then the terms of service need to be actively monitored, since they can change unannounced. A recent example of this was the purchase of AddThis, a popular bookmarking widget provider, by Clearspring Technologies Inc at the end of September 2008.

The AddThis terms of service were updated and their widget code changed to include tracking cookies. This meant the widget created cookies on the host web site's domain, as if the host had set them themselves. This is because the widget's code is running in the context of the hosted page. See John Haller's write up for further information. Here's one snippet from the new terms of service:

If you have AddThis on your web site, are your users aware of these terms? A more common issue for web site owners than widgets is the use of web analytics services that have client-side code - typically JavaScript - embedded on each page.

Try to keep third party hosted code off your site, and certainly never have it in more sensitive areas such as registration, log in, password recovery, payments and restricted-access pages. If possible use server-side web analytics rather than adding client-side code.