Know When Third Parties Access Sensitive Browser APIs
Permissions Policy lets you control which browser features third-party scripts can access. Monitor violations to create audit trails, prove compliance, and govern vendor behavior.
The Problem
Third-Party Scripts Have Silent Access to Sensitive APIs
Your website loads dozens of third-party scripts — analytics, advertising, widgets, chat tools. Each one runs with full access to powerful browser APIs. They can request the user's camera, microphone, geolocation, and payment credentials without your knowledge or consent.
Under GDPR and CCPA, you're liable for data collection happening on your property — even when third parties do the collecting. Regulators don't care that you didn't know. Penalties reach €20 million under GDPR and $7,988 per violation under CCPA. By 2025, over 20 US states have enacted comprehensive privacy laws.
The problem is visibility. When an ad script tries to access the microphone, there's no alert. When an analytics widget requests geolocation, there's no log. You have no way to audit what third parties are doing, no way to prove governance to regulators, and no way to detect policy violations before they become compliance failures.
The Solution
Permissions Policy: Declare What Third Parties Can Access
Permissions Policy is a W3C standard that lets you explicitly control which browser features your site and embedded third-party content can use. Define an allowlist via HTTP headers, and browsers enforce it automatically.
Control over 50 sensitive APIs: camera, microphone, geolocation, payment requests, fullscreen,
autoplay, sensors (accelerometer, gyroscope), screen capture, and more. Block features entirely with
Permissions-Policy: geolocation=() or restrict them to specific origins.
Browser support is 76.73% for Permissions Policy (Chrome 88+, Edge 88+, Opera 95+).
Configuration is pure HTTP headers—no JavaScript SDK, no build process changes, no client-side weight. Add a
Permissions-Policy header to your responses and browsers start enforcing your rules immediately.
The Challenge
But Blocked Access Happens Silently
Here's the gap: when a third-party script violates your Permissions Policy, the browser blocks it silently. No error in the console. No exception thrown. The API call simply fails, and you never know it happened.
This creates a compliance blind spot. You've deployed a policy, but you have no evidence it's working. When auditors ask for proof that third parties are blocked from accessing sensitive APIs, you have nothing to show them. The policy exists, but there's no audit trail.
Worse, you can't identify which vendors are attempting unauthorized access. Is your analytics provider trying to access geolocation? Is that chat widget requesting microphone permissions? Without violation reports, you can't govern vendor behavior or make informed decisions about which scripts to keep.
The Permissions-Policy-Report-Only header exists for testing policies without enforcement — but the
reports need somewhere to go. Building and maintaining a reporting endpoint is undifferentiated infrastructure
work.
The Answer
The Reporting API Creates Your Compliance Audit Trail
We collect violation reports and route them to your existing tools for governance and compliance.
-
Automated Audit Trails
- Every violation logged with timestamp, blocked feature, source file, and origin. Know exactly when and where third-party scripts attempted to access camera, microphone, geolocation, or payment APIs.
-
Compliance Evidence
- Prove to GDPR and CCPA auditors that your policies are working. Export violation logs showing that unauthorized API access attempts were blocked. Turn "we have a policy" into "here's the evidence."
-
Vendor Governance
- See which third-party scripts are attempting unauthorized access. Make informed decisions about vendor relationships. Identify problematic scripts before they become compliance incidents.
-
Route to Your Stack
- Send Permissions Policy violations to AppSignal, webhooks, or Google Chat. Integrate with your existing compliance workflows and alerting tools. Act on violations where you already manage incidents.
Ready to Monitor Permissions Policy Violations?
Create audit trails for browser feature access. Prove compliance and govern third-party vendor behavior.