A signup, contact or newsletter form lives on a domain belonging to a marketing platform. The visitor believes they are dealing with the site; the platform sets its own identifiers and builds its own record.
Why it is a separate entry
The visitor cannot see who they are actually handing data to. Interest categories ticked on such a form become a profile at a party the person never chose.
How it arises
marketing platform hosting the form on a vendor subdomain
embedded form in an iframe from another registrable domain
Not to be confused with
A processor hosting a form under the controller's own domain and instructions is not this entry.
How to establish it
Set-Cookie from a host under a different registrable domain than the site that linked to the form, at page load and before any submission.
method network-with-identifierQoD 95
Requirements on the measurement
never submit the form; establish the fields, not the processing after sending
record the fields offered, since that shows what profile would be built
What would refute it
not from the captureThe cookies are strictly necessary to operate the form.weakens
by handThe form domain is a CNAME under the controller's own domain, operated as a processor.reclassify
Where this plugs into existing processes
The one question that surfaces itWhen someone fills in your contact form, whose domain are they on?
In a DPIA, verify this
Verify who actually hosts each form and what it sets, rather than treating a supplier form as an internal one.
As a procurement clause
Forms are served from the controller's own domain, or the third-party host sets nothing before submission.
With a complaint, hand over
A capture of the form page at load, showing the host and the cookies it sets.
Reproduction
METHOD.md · by hand · no dedicated reproduction exists yet; follow the general method and the indicator above
Third parties that can confirm it: urlscan.io, webbkoll
Legal framing
eu-gdpr-44
eu-gdpr-6-1-a
Case law
cjeu-fashion-id
Objections, and the answer
“That is our supplier's platform, not our site.”
Fashion ID holds that a controller who arranges for visitor data to reach a third party is jointly responsible for that collection and transmission. Linking to the form is arranging it.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0008: Third-party hosted form. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0008
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0008, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.