Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

If people in California use your website or app, assume CIPA applies. CIPA was written for telephone wiretapping, and courts have applied its "technology-neutral" terms to online communications for years. The business's location does not matter; the visitor's does.

If the CCPA covers your business, you must treat an opt-out preference signal as a valid request to opt out of the sale or sharing of personal information. "Sharing" includes disclosures for cross-context behavioral advertising, which is what most advertising pixels do.

An AI shopping assistant can recommend a product without being allowed to buy it. An agentic AI system may go further: access an account, select a payment method, interact with a checkout, and initiate a transaction. Each added permission changes the payment-security questions you need to answer. Before adding an agent to a payment journey, draw its boundary. What can it read? What can it change? What can it authorize? What happens when it encounters content controlled by someone else?

Before you buy another security tool or remove an existing control, answer one question: how does your website actually present the payment form? For e-commerce merchants completing PCI DSS Self-Assessment Questionnaire A (SAQ A), that architectural detail matters. An embedded payment form, a redirect, and a fully outsourced payment process are different arrangements, with different implications for how the SAQ A script-attack eligibility criterion applies.

At the 2026 PCI SSC North America Community Meeting in Vancouver, continuous compliance was a recurring theme: how do organizations move beyond point-in-time validation and keep security controls working as their environments change? For payment-page security, that question is especially practical. Your last assessment captured your environment at a point in time. Since then, a release may have added a checkout dependency. A vendor may have updated its JavaScript. Marketing may have changed a tag.