Sessieopname
De sessie zelf wordt opgenomen, niet alleen de paginaweergave.
- Familie
- Gegevens
- Status
- actief
- Geldt voor
- web
Wat er gebeurt
A session-recording script captures behaviour inside the page: mouse movement, scrolling, clicks and often keystrokes in form fields, replayable afterwards as a film of the visit.
Waarom het ertoe doet
This is a different order of collection from counting page views. What someone typed and then deleted, where they hesitated, which field they returned to: none of that is needed to run a website, and all of it is revealing.
Veelvoorkomende oorzaken
- recording script loaded outside the consent gate
- field masking left off, so entered text is captured too
Dit is het níet
Ordinary page-view analytics is not this entry. The distinguishing feature is capture of in-page behaviour.
Hoe je het vaststelt
Indicator
Requests to a host under a different registrable domain carrying a stream of in-page behaviour: serialised DOM mutations, pointer coordinates over time, scroll offsets or key events, batched at an interval unrelated to navigation and tied to a site identifier. The content of the payload settles it, not the identity of the receiving party. Where the payload is compressed or encoded, the volume and the cadence relative to mouse movement are the observable, and that has to be stated as such.
Methode
network-with-identifier
Kwaliteit van de detectie
95 van 100
De grenzen van deze bevinding
Wat dit patroon zou weerleggen
- The vendor processes only aggregated data without session capture.met de hand te toetsende bevinding vervalt
- Recording starts only after consent is granted.machinaal te toetsende bevinding vervalt
- All input fields are masked at source.met de hand te toetsende bevinding wordt zwakker
Wat dit patroon níet vaststelt
- harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
- severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
- unlawfulness; that is for a supervisory authority or a court
- intent; a fault is usually a build decision, not a plan
- absence: not finding it in one capture is not evidence that it is not there
Reproduceren
- manual
METHOD.mdno dedicated reproduction exists yet; follow the general method and the indicator above - script
repro/web/check.mjsthe run reports DPE-2026-0005 as present, with the detail behind it
Ook zichtbaar met openbare scanners
Juridisch kader
Bepalingen
Veelgehoorde tegenwerpingen
The recording servers are in the EU.
Where the recording is stored says nothing about whether it should have been made. Location is a separate question from lawfulness of collection.
Geldt wanneer
to-processing
Aangetroffen in
De onderzoeken waarin dit patroon gemeten is.