A fair warning: We’re about to get a bit technical.
But please don’t let that stop you from reading because there are some critical updates in this month’s digital roundup that affect nonprofit organizations of all shapes and sizes. We’ll cover:
Let’s start with PCI DSS v4.0 (see, I warned you).
Most nonprofit organizations don’t wake up thinking about credit card security standards. However, if you accept donations via credit card—online or offline—you’re considered a “merchant” in the eyes of the credit card companies.
That means you must comply with the Payment Card Industry Data Security Standard (PCI DSS). This isn’t optional—it’s a requirement. And with PCI DSS v4.0.1, there are notable changes that impact nonprofits of every size.
One of the most talked-about updates in PCI v4.0 revolves around JavaScript on your website and donation forms. Why? Because hackers have increasingly turned to injecting rogue code (“web skimmers”) that quietly collects credit card numbers.
One of the most talked-about updates in PCI DSS v4.0 revolves around JavaScript security on websites and donation forms. Hackers have increasingly used web skimming attacks, injecting rogue code to quietly steal credit card data.
The new requirements demand:
At first glance, this seemed to apply to all merchants, but on Jan. 30, the PCI Committee clarified that SAQ-A merchants are exempt from these JavaScript inventory and monitoring requirements.
However, this doesn’t mean nonprofits using SAQ-A donation platforms can ignore security. Instead, the update specifies that SAQ-A merchants must ensure the scripts on their website are secure and not susceptible to attack—which sounds a lot like following the JavaScript requirements anyway.
For nonprofits that rely on donation platforms—like Blackbaud, Classy or Fundraise Up—this still matters. Even if your donation form provider manages compliance on the secured payment step, your website likely loads additional JavaScript before the donation form is complete. That means it’s up to you to confirm those scripts aren’t compromised.
Your nonprofit may not think about donation form security every day, but all it takes is one privacy breach to change your mind. By staying proactive, you’ll protect your cause, preserve donor confidence and maintain the steady flow of gifts that fuel your mission.
Starting April 10, Google Tag Manager (GTM) will automatically ensure that the Google Tag loads first before firing Google Ads and Floodlight tags.
This is a good thing, and here’s why:
For nonprofits and digital marketers, clean conversion tracking is critical for optimizing ad spend. This change helps prevent errors that could lead to underreporting or lost data.
A Google Tag was already a prerequisite for conversion tracking. However, some GTM setups have allowed conversion events to fire before the Google Tag, causing timing issues and data inconsistencies.
With this change, GTM will automatically enforce the correct firing order, improving the reliability of your data and reducing tracking errors.
What you need to do:
If you’re considering starting a text messaging program in 2025, you may have heard some warnings about a new regulation, called the 10DLC rules, under the Telephone Consumer Protection Act (TCPA).
But Dan Foster at Tatango said there’s nothing to worry about.
“Nothing changed in 2024 that would cause any delay or disruption of launching new SMS campaigns,” he said. “There is a LOT of inaccurate information out there.”
If you are setting up your first text messaging campaign, it is important to note that there are several steps to get started, according to Synergy:
10DLC is short for 10-digit-long codes and distinguishes them from the five- or six-digit “short codes” that can also be used for texting, as Tatango explains. Under current regulations, both options are still available, and both must follow the processes outlined above.
In last month’s digital roundup, we pondered the question, “Should nonprofits move on from TikTok?” With the app’s future in limbo over a U.S. ban, our advice was that short-form video is here to stay—regardless of channel or app.
Well, there seems to be some good news around TikTok’s future.
President Trump said his administration is in talks with four groups about a potential TikTok sale, with less than a month until the ban is set to go into effect on April 5. He also indicated that he would likely extend that deadline if talks continue to go well.
Meanwhile, all of this ban talk hasn’t slowed TikTok down a bit. It remained at the top of app store downloads in February—despite being removed from app stores for half the month.