@streetcoder @kuketzblog The troubling part is, these institutions can move all of that (a/b testing, personalization, push notifications etc) to the backend and we'll never know by looking at the client-side network logs. Perhaps, due to GDPR, we can expect to see these 3P providers listed as "sub processors".