PII harvesting is the systematic collection of personally identifiable information — names, emails, phone numbers, addresses, identifiers — from websites, usually by scripts that read form fields and page data directly in the visitor's browser. It ranges from criminal skimming for fraud and resale to legitimate vendor tags quietly over-collecting, and both look identical in your network tab.
PII vs PII harvesting
PII is the data: anything that identifies a person alone or in combination. Harvesting is the activity — extraction at scale. A site can hold PII responsibly and still be a harvesting venue, because the collectors are scripts running on its pages, not its own backend.
How PII harvesting works
| Technique | What it captures | Who typically does it |
|---|---|---|
| Form scraping / keystroke capture | What users type — including before submit, and in abandoned forms | Criminal skimmers; aggressive marketing tags |
| Formjacking | Credentials and personal data from targeted forms | Criminal actors |
| Session-replay over-capture | Everything on screen, including unmasked PII fields | Misconfigured analytics tooling |
| Autofill abuse | Data browsers auto-populate into hidden or off-screen fields | Malicious and gray-area scripts |
| Pixel/tag over-collection | Emails, identifiers, and context passed to ad platforms | Mis-set marketing tags — the pattern behind health-data enforcement |
The uncomfortable common thread: every one of these executes as ordinary JavaScript with the page's full privileges. The criminal and the misconfigured cases differ only in intent — the injection mechanics and the data flows are the same.
Why it is hard to see
Harvesting happens after the page is served, in the browser, where server logs and WAFs have no view. The scripts involved are often ones you installed on purpose — a chat widget, a replay tool, a marketing tag — doing more than you believed. Nothing errors; conversion is unaffected; the data simply leaves. Discovery typically comes from the outside: a regulator, a researcher, or the PII blind spot surfacing in an audit.
How to stop it
- Inventory scripts on PII-bearing pages — login, signup, checkout, account, forms — and require a justification for each, the discipline PCI DSS formalizes for payment pages.
- Verify actual behavior, not vendor claims. cside's monitoring observes what each script reads and where it transmits, per real session, and privacy monitoring flags PII flows specifically.
- Mask replay and analytics capture on every sensitive field, and re-verify after each tooling update.
- Constrain destinations with a Content Security Policy so harvested data has fewer places to go — while remembering an allowlisted vendor can still be the harvester.
