I believe myself to be a pretty security conscious person, and I hate webdev as much as the next system programmer, but even I don't see anything fundamentally

I believe myself to be a pretty security conscious person, and I hate webdev as much as the next system programmer, but even I don't see anything fundamentally wrong with what papa johns is doing here. I chose to use their website. Any interaction with the site should be assumed to be input that they are allowed to take and use how they want. If I don't want these inputs to be sent, it's my responsibility to configure my browser to 1) tell me it's happening, 2) block the site from seeing those inputs or 3) just shut everything like that off (disable js). Browsers sandbox websites for a reason, whatever I put into the sandbox is my own responsibility, and whatever happens in that sandbox is allowed.