I Never Willingly Consented to This! Investigate PII Leakage via SSO Logins

Social login platforms like Google and Facebook allow users to sign into multiple websites using the same login credentials through a process known as Single Sign-On (SSO). However, Personally Identifiable Information (PII) can be leaked to third-party domains without the user's awareness during this process. In this paper, we present the first in-depth analysis of PII leakage in SSO authentication flows. By analyzing the SSO authentication flows from the Tranco top 10 K domains, we find that 30.1% of first-party domains leak PII to third-party domains with Google SSO login and 16.6% of first-party domains leak PII with Facebook SSO login. Furthermore, 60 third-party domains have received PII from both SSO logins. In addition, significant leakage occurs across multiple channels, encoding methods, and PII types, with even plaintext transmissions occurring through both direct and intermediaries to third-party domains. Considering Google and Facebook as SSO Identity Providers (IdPs), we observe that PII is transmitted across multiple domains within their ecosystems for tracking and advertising services, without the user's explicit awareness or consent. Specifically, 28.9% and 41.9% of third-party domains during SSO login with Google and Facebook belong to advertising/tracking companies. Since PII leakage via SSO login introduces notable compliance risks under the GDPR and CCPA framework, our findings raise awareness of the associated risks of SSO and encourage the implementation of more secure practices for online authentication.