{
  "id": "DPE-2026-0005",
  "name": "Session recording",
  "family": "data",
  "summary": "The session itself is recorded, not merely the page view.",
  "mechanism": {
    "what": "A session-recording script captures behaviour inside the page: mouse movement, scrolling, clicks and often keystrokes in form fields, replayable afterwards as a film of the visit.",
    "why_it_matters": "This is a different order of collection from counting page views. What someone typed and then deleted, where they hesitated, which field they returned to: none of that is needed to run a website, and all of it is revealing.",
    "common_causes": [
      "recording script loaded outside the consent gate",
      "field masking left off, so entered text is captured too"
    ],
    "not_this": "Ordinary page-view analytics is not this entry. The distinguishing feature is capture of in-page behaviour."
  },
  "detection": {
    "indicator": "A request to a session-recording endpoint of a recording vendor, carrying a site identifier, at page load.",
    "method": "network-with-identifier",
    "qod": 95,
    "capture_requirements": [
      "clean profile",
      "no interaction",
      "note whether field masking is active; unmasked input raises the stakes considerably"
    ],
    "attribution": [
      "har-pageref",
      "cdp-initiator"
    ]
  },
  "falsifiers": [
    {
      "condition": "The vendor processes only aggregated data without session capture.",
      "checkable": "manual",
      "if_true": "drop"
    },
    {
      "condition": "Recording starts only after consent is granted.",
      "checkable": "automated",
      "if_true": "drop"
    },
    {
      "condition": "All input fields are masked at source.",
      "checkable": "manual",
      "if_true": "weaken"
    }
  ],
  "reproduction": {
    "methods": [
      {
        "tier": "manual",
        "path": "METHOD.md",
        "expect": "no dedicated reproduction exists yet; follow the general method and the indicator above"
      },
      {
        "tier": "script",
        "path": "repro/web/check.mjs",
        "expect": "the run reports DPE-2026-0005 as present, with the detail behind it"
      }
    ],
    "public_scanners": [
      "blacklight",
      "urlscan.io"
    ]
  },
  "legal": {
    "provisions": [
      "eu-gdpr-6-1-a",
      "nl-tw-11-7a"
    ],
    "rebuttals": [
      {
        "objection": "The recording servers are in the EU.",
        "answer": "Where the recording is stored says nothing about whether it should have been made. Location is a separate question from lawfulness of collection."
      }
    ]
  },
  "seen_in_the_wild": {
    "confirmed": false,
    "note": "Observed in practice by the authors but not yet backed by a published reference. Set to false until a citation exists: a claim without a source is exactly what this catalogue holds others to."
  },
  "schema_version": "2.0",
  "applies_to": [
    "web"
  ],
  "status": "active",
  "credit": [
    {
      "name": "Mick Beer",
      "role": "proposed",
      "date": "2026-07-26"
    }
  ],
  "does_not_establish": [
    "harm; the catalogue standardises a finding so it can be referred to, it does not weigh it",
    "severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case",
    "unlawfulness; that is for a supervisory authority or a court",
    "intent; a fault is usually a build decision, not a plan",
    "absence: not finding it in one capture is not evidence that it is not there"
  ],
  "changes": [
    {
      "at": "2026-07-26T00:00:00Z",
      "actor": "registry",
      "entries": [
        "Entry created.",
        "Name assigned.",
        "Detection method and falsifiers defined.",
        "Legal provisions linked."
      ]
    }
  ],
  "slug": "session-recording",
  "name_nl": "Sessieopname",
  "summary_nl": "De sessie zelf wordt opgenomen, niet alleen de paginaweergave.",
  "in_practice": {
    "dpia": "Verify whether in-page behaviour is captured and whether input fields are masked, rather than treating it as analytics.",
    "procurement": "No session recording is active before consent, and where used, input masking is enabled and demonstrated.",
    "complaint": "A capture showing the recording endpoint contacted at load, and whether field masking was active.",
    "audit_question": "Is anything recording mouse movement or keystrokes, and from what moment?",
    "audit_question_nl": "Wordt er muisbeweging of toetsaanslag opgenomen, en vanaf welk moment?",
    "complaint_nl": "Een opname of uitdraai die laat zien wat er werkelijk gebeurt, met de datum erbij en het land van waaruit is gemeten.",
    "objection_nl": "Het is alleen om de gebruikservaring te verbeteren.",
    "answer_nl": "Vraag of de opname invoervelden meeneemt. Dat verschil is groot en wordt zelden uit zichzelf genoemd."
  }
}