New Research Exposes Critical Gap: 64% of Third-Party Applications Access Sensitive Data Without Authorization

According to Reflectiz, its 2026 State of Web Exposure Research analysing 4,700 leading websites found that 64% of third‑party applications now access sensitive data without legitimate business justification, up from 51% last year. The report highlights a sharp rise in client‑side risk driven by third‑party tools and unmanaged digital integrations, with 64% of apps accessing sensitive data lacking justification.

It also identifies top drivers of exposure, including Google Tag Manager (8%), Shopify (5%), and Facebook Pixel (4%), which were frequently found to be over‑permitted or deployed without adequate scoping. The findings note that government and education sectors show elevated malicious activity, while marketing and digital departments account for a large share of third‑party risk.

“Organizations are granting sensitive‑data access by default rather than exception — and attackers are exploiting that gap,” said Simon Arazi, VP of Product at Reflectiz. The full 43‑page analysis is available for download.