All publisher problemsBuild my stack
It's a compliance risk
How do we avoid taking on someone else's compliance risk?
The short answer
Compliance problems surface late, usually during an audit. Check data residency, consent handling and sub-processors before signature rather than after.
Publishers have raised this 499 times across the mentions we analyse, naming 182 specific tools.
Find tools you can clear with legal
We'll weight data residency, consent handling and sub-processors.
What publishers reported
The tools this comes up about most, and what was actually said. Counted from public publisher mentions rather than our own verdict, and each quote is attributed to the tool it was about.
Pushwoosh21 mentions
“The Centers for Disease Control and Prevention (CDC)... said it had been deceived into believing Pushwoosh was based in the U.S. capital. After learning about its Russian roots from Reuters, it removed Pushwoosh software from seven public-facing apps, citing security concerns.”
Ad-Shield20 mentions
“The website is infected by AdShield, Inc.”
Imperva19 mentions
“the company acknowledged in August 2019 that some Imperva WAF users had their email addresses, hashed passwords, API keys and SSL certificates exposed.”
Akamai Bot Manager16 mentions
“Akamai bot manager is flagging firefox on linux as a bot again.”
DataDome12 mentions
“DataDome (l'anti-bot de leboncoin) a durci son scoring ces dernières semaines.”
Mailchimp11 mentions
“Mailchimp says it was hacked and that dozens of customers’ data was exposed. It's the second time the company was hacked in the past six months.”
Disqus10 mentions
“Disqus announced Friday that it experienced a breach of its systems in 2012 that resulted in 17.5 million user email addresses and passwords being stolen by hackers.”
Chartbeat10 mentions
“Bit hypocritical of the publisher to be decrying intrusive analytics when their site is running Comscore and Chartbeat tracking.”
dotCMS7 mentions
“Hacking a Bank by Finding a 0day in DotCMS”
Mailchimp7 mentions
“It's the second time the company was hacked in the past six months. Worse, this breach appears to be almost identical to a previous incident.”
What to check before you sign
The questions that surface this problem while you can still walk away.
- Confirm where data is stored and processed
- Ask for the sub-processor list and how changes are notified
- Check how consent signals are handled and passed downstream
- Ask for the latest security attestation and the date on it
Not sure which of these applies to you?
Answer four questions about your newsroom and we'll shortlist the tools that fit. We'll carry this problem across with you.
