An 18-month tag leak behind a login screen. Is it a breach?

Summary A rule in the tag manager was written to fire an ad network tag on public signup pages. A loose URL match meant it also fired on the authenticated billing dashboard, so for 18 months every logged-in customer's account ID and plan tier went to a third-party ad vendor, and nobody saw it because QA only ever ran anonymous scripts. Indulekshmi Rajeswari, Head of Data Privacy at Uniper, joins host Ethan Prete on The Web Privacy Podcast to work the scenario the way a GDPR lawyer actually would. Indu explains why "behind a login screen" is not the same as secure, why a customer ID is still personal data, where a privacy team should sit and why the DPO needs a measure of independence, why the first move on a Friday afternoon is the legal definition and not the kill switch, the two gates an incident has to pass before it is a reportable breach, when the 72-hour clock really starts, what a useful vendor breach notice looks like, and why the business, not privacy, owns the risk. Essential listening for privacy, legal, marketing and analytics leaders who share a tag manager. Chapters 00:00 Cold open: an 18 month leak behind a login screen 01:06 Intro 01:50 Meet Indu: Singapore, Zooplus and Uniper 04:16 Why marketing tags escape the scrutiny core code gets 06:11 A login screen is not security 10:42 Where privacy sits and why the DPO needs independence 15:02 Incognito audits and the Friday scenario 23:23 Is it a reportable breach? The 2 gates 29:20 The 72 hour clock and what a good breach notice looks like 33:52 Who's to blame? The business, and the privacy champions who help Takeaways - Marketing and analytics tags are deployed by people who never touch the core application, which is why they get a fraction of the scrutiny and cause a disproportionate share of the leaks. - A login screen is a gate, not security; test every user flow authenticated as well as anonymous, because incognito-only QA misses half the site. - On the Friday the incident lands, the first job is the legal definition of personal data and the contract with the counterparty, not the kill switch; after 18 months, two more hours changes nothing. - An incident is only a reportable breach if it passes two gates, a breach of security and unauthorized disclosure or access, and the 72-hour clock starts when you ascertain a breach, not when the ticket arrives. - The business owns the risk and the decision; privacy advises, trains and builds a network of champions in the teams that actually deploy the tags. Connect with the Guest Indulekshmi Rajeswari LinkedIn: https://www.linkedin.com/in/indulekshmi-rajeswari Company Website: https://www.uniper.energy Indu speaks at the IAPP European Privacy KnowledgeNet 2026 in Munich and at the IAPP conference in Brussels in November: https://www.linkedin.com/pulse/european-privacy-knowledgenet-2026-programme-kai-traubinger-vauxe/ Sponsor Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it. Learn more about your website here: https://www.observepoint.com/