New Research: 64% of 3rd-Party Applications Access Sensitive Data Without Justification

According to Reflectiz, analysis of 4,700 leading websites over 12 months ending in November 2025 found that 64% of third-party applications now access sensitive data without business justification, up from 51% in 2024. The research highlights a governance gap where marketing or digital teams deploy apps without IT oversight, leading to over-permissioning and unjustified access to data.

It also identifies specific offenders, with Google Tag Manager responsible for 8% of violations, Shopify 5%, and Facebook Pixel 4%. The study notes a broader awareness-action gap among security leaders, reporting that 81% view web attacks as a priority, yet 39% have deployed solutions to stop the bleeding. It adds that 24% of organisations rely solely on general security tools, while 34% are still evaluating dedicated solutions, leaving 58% without proper defences despite recognising the threat. Overall, the findings underscore a surge in unjustified access and its potential risk to critical infrastructure and consumer data.