Formulier bij een derde
Een formulier dat bij de site lijkt te horen, staat bij een derde die voor eigen rekening profileert.
- Familie
- Keten
- Status
- actief
- Geldt voor
- web
Wat er gebeurt
A signup, contact or newsletter form lives on a domain belonging to a marketing platform. The visitor believes they are dealing with the site; the platform sets its own identifiers and builds its own record.
Waarom het ertoe doet
The visitor cannot see who they are actually handing data to. Interest categories ticked on such a form become a profile at a party the person never chose.
Veelvoorkomende oorzaken
- marketing platform hosting the form on a vendor subdomain
- embedded form in an iframe from another registrable domain
Dit is het níet
A processor hosting a form under the controller's own domain and instructions is not this entry.
Hoe je het vaststelt
Indicator
Set-Cookie from a host under a different registrable domain than the site that linked to the form, at page load and before any submission.
Methode
network-with-identifier
Kwaliteit van de detectie
95 van 100
De grenzen van deze bevinding
Wat dit patroon zou weerleggen
- The cookies are strictly necessary to operate the form.niet uit de meting af te leidende bevinding wordt zwakker
- The form domain is a CNAME under the controller's own domain, operated as a processor.met de hand te toetsende bevinding krijgt een ander patroon
Wat dit patroon níet vaststelt
- harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
- severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
- unlawfulness; that is for a supervisory authority or a court
- intent; a fault is usually a build decision, not a plan
- absence: not finding it in one capture is not evidence that it is not there
Reproduceren
- manual
METHOD.mdno dedicated reproduction exists yet; follow the general method and the indicator above
Ook zichtbaar met openbare scanners
Juridisch kader
Bepalingen
Rechtspraak
Veelgehoorde tegenwerpingen
That is our supplier's platform, not our site.
Fashion ID holds that a controller who arranges for visitor data to reach a third party is jointly responsible for the collection and the transmission, and not for what the third party does afterwards. That reasoning transfers directly where the form is embedded in your page: the transmission happens without the visitor doing anything. Where the visitor clicks through to the platform's own domain, the reasoning is weaker and the finding rests on the presentation instead: whose name is on the form, whose privacy statement applies, and whether the visitor could see who they were dealing with. State which of the two you measured.
Geldt wanneer
to-processing