Customer data is information that can identify or relate to a user, account, or session. It may include names, email addresses, account numbers, device identifiers, session tokens, IP addresses, browsing events, or page context that can be linked back to a person or customer relationship. In cybersecurity and privacy work, the key issue is not just whether a field is “sensitive,” but whether it can be combined with other signals to reveal identity, behavior, or access patterns.
Customer data matters because it is often protected by law, contract, and internal policy. If it is exposed, copied to unauthorized services, or sent through third-party scripts, it can create privacy violations, compliance risk, and attack opportunities such as account correlation or session tracking. Defenders reduce this risk by inventorying where customer data enters and exits a system, limiting what trackers and APIs can receive, enforcing consent and data-minimization rules, and reviewing outbound browser requests and logs for unintended disclosures.