FormspillResources Is my email shared when I fill in a form?
Is my email shared when I fill in a form?
Often, yes. Besides the site itself, a form’s email can reach advertising pixels, analytics tools and session recorders running on the page, sometimes while you are still typing. A 2022 study found it happening on thousands of popular websites before the form was ever submitted.
Who can receive it
- The site itself, when you press send. That is expected.
- Advertising pixels, such as Meta’s, Google’s or TikTok’s, often as a hash: a scrambled code that still identifies you (why hashes still identify you).
- Analytics tools, when a form puts your details in the page address, which analytics then records.
- Session recorders, which capture what you type to replay your visit (what session recording is).
Even before you press send
The Leaky Forms study (USENIX Security 2022) measured the 100,000 most popular websites. It found email addresses sent to tracking, marketing and analytics companies before the form was submitted, and without consent, on 1,844 sites when visited from the EU and 2,950 when visited from the US. The authors call these numbers lower bounds. Typing your email and then closing the page is not enough to keep it private.
How to protect yourself
- Check the form before you type. See below.
- Use a forwarding address, such as iCloud Hide My Email or Firefox Relay, so the address that spreads is not your real one and can be switched off.
- Fill in only what is required. Optional fields are often there for marketing.
- Untick marketing boxes that were ticked for you.
How Formspill checks a form
Formspill fills the form with obviously made-up details, never yours, and watches every request the page makes. The sidebar then lists, company by company, who received what and when: while typing or on send, plain or hashed. Every request carrying the made-up details is blocked inside the browser, so nothing is submitted.
Check a form before you type into it. Formspill is free for Chrome: no account, and nothing leaves your browser.
