ASVS 5.0 V14.2.3 is a Level 2 requirement. Data you have defined as sensitive must not be sent to untrusted parties, such as analytics and user tracking services, where you lose control over how it is collected and used.
Why it matters
Tracking scripts read page content, URLs and form values. A page address like /patients/48213/results sent to an analytics endpoint is a data transfer, even if nobody meant to send it. Once the data has left, you cannot recall it, and you may owe users or regulators an explanation.
How to implement it
Start from your classification (see V14.1.1) and keep an allowlist of third parties.
Strip sensitive parts before events leave the browser:
function safeEvent(name, props) {
const clean = { ...props };
delete clean.email;
delete clean.accountId;
clean.page = location.pathname.replace(/\/\d+/g, "/:id");
analytics.track(name, clean);
}
Restrict what the browser may contact with a Content Security Policy:
Content-Security-Policy: default-src 'self'; connect-src 'self' https://metrics.example.com
Load trackers only on pages that hold no sensitive data, and honour consent choices before firing anything.
How to test it
Open the application with browser developer tools on the network tab, perform a sensitive journey such as viewing a record, and read every request that goes to a different host. Look for names, identifiers, tokens and full URLs in query strings and bodies. Repeat after each new third party script is added.
Common mistakes
- Sending full page URLs that contain identifiers.
- Session replay tools that record form fields, including masked looking ones.
- A tag manager that lets non engineers add scripts without review.
Quick check
Does self hosting the analytics tool solve this?
It removes the third party recipient, which is the point of the requirement, but the classification rules still apply to who inside your company may see the data.
