Derde partij onder een eigen subdomein
Een subdomein van de site zelf wijst naar een derde, zodat diens verzameling leest als die van de site.
- Familie
- Keten
- Status
- actief
- Geldt voor
- web, api
Wat er gebeurt
A host under the site's own registrable domain is aliased in the domain name system to infrastructure operated by a measurement or advertising party. To the browser the requests and the cookies are first-party: they survive third-party cookie restrictions, they get first-party lifetimes, and blocklists that work on domain names do not match. The party at the other end is unchanged.
Waarom het ertoe doet
Every tool the person has to see who is collecting on a page reports the site itself. A visitor who checks, a researcher who scans by domain, and a browser that limits third parties all reach the same wrong conclusion, and the conclusion is wrong by construction rather than by accident.
Veelvoorkomende oorzaken
- a measurement supplier offering a first-party endpoint as a way of surviving browser restrictions
- an alias configured once by whoever manages the domain, with no record in the tag inventory
- a collection endpoint on the site's own domain that forwards onward between servers, where the recipients are no longer visible to the browser at all
Dit is het níet
A resource served from a delivery network under the operator's own contract is not this entry: nothing collects there on its own account. Third-party resource loading is the opposite case, where the third party is visible as a third party. Here the recipient is a third party while presenting as the first.
Hoe je het vaststelt
Indicator
A host under the site's own registrable domain whose name resolves through an alias chain to a name in a domain operated by another party, and which sets or receives an identifier cookie. The alias chain as resolved at capture time is the finding.
Methode
network-with-identifier
Kwaliteit van de detectie
92 van 100
De grenzen van deze bevinding
Wat dit patroon zou weerleggen
- The alias points at infrastructure the operator itself controls, such as a delivery network under its own contract, and nothing collects there.met de hand te toetsende bevinding vervalt
- The receiving party acts strictly as a processor and the endpoint serves only the operator's own measurement.niet uit de meting af te leidende bevinding krijgt een ander patroonThe transparency question survives that: the person still cannot see who is at the other end.
- The privacy statement names the subdomain and the party behind it.met de hand te toetsende bevinding wordt zwakker
- No identifier is set or transmitted on that host.machinaal te toetsende bevinding wordt zwakker
Wat dit patroon níet vaststelt
- harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
- severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
- unlawfulness; that is for a supervisory authority or a court
- intent; a fault is usually a build decision, not a plan
- absence: not finding it in one capture is not evidence that it is not there
Reproduceren
- manual
METHOD.mdno dedicated reproduction exists yet; follow the general method and the indicator above
Juridisch kader
Bepalingen
Rechtspraak
Veelgehoorde tegenwerpingen
It is our own subdomain, so it is first-party data.
First-party is a browser concept, not a legal one. Who receives the data is established by where the name resolves, and that is measurable.
We did it for measurement accuracy, not to evade anything.
The effect is the same whatever the motive: the recipient becomes invisible to the visitor and to every domain-based control. Motive is not measurable, effect is.
A scan of our site shows no trackers.
A scan that works on domain names cannot see this by design. That is the finding, not a rebuttal of it.
Geldt wanneer
to-processing
Aangetroffen in
De onderzoeken waarin dit patroon gemeten is.