Dual-Technique Privacy & Security Analysis for E-Commerce Websites Through Automated and Manual Implementation

TL;DR

This study analyzes 90 US e-commerce websites using automated tools and manual checks, revealing significant privacy and security gaps, especially in cookie management, authentication, and data validation, with recommendations for compliance and user protection.

Contribution

It introduces a dual-technique approach combining automated and manual evaluations to identify privacy and security weaknesses in e-commerce platforms.

Findings

38.5% of websites used over 50 cookies per session

Many cookies were unnecessary or unclear, risking user PII

Critical security gaps like lack of MFA and input validation

Abstract

As e-commerce continues to expand, the urgency for stronger privacy and security measures becomes increasingly critical, particularly on platforms frequented by younger users who are often less aware of potential risks. In our analysis of 90 US-based e-commerce websites, we employed a dual-technique approach, combining automated tools with manual evaluations. Tools like CookieServe and PrivacyCheck revealed that 38.5% of the websites deployed over 50 cookies per session, many of which were categorized as unnecessary or unclear in function, posing significant risks to users' Personally Identifiable Information (PII). Our manual assessment further uncovered critical gaps in standard security practices, including the absence of mandatory multi-factor authentication (MFA) and breach notification protocols. Additionally, we observed inadequate input validation, which compromises the integrity of user data and transactions. Based on these findings, we recommend targeted improvements to privacy policies, enhanced transparency in cookie usage, and the implementation of stronger authentication protocols. These measures are essential for ensuring compliance with CCPA and COPPA, thereby fostering more secure online environments, particularly for younger users.