{
  "id": "DPE-2026-0023",
  "name": "Presence revealed by an automatic reply",
  "slug": "presence-by-automatic-reply",
  "name_nl": "Aanwezigheid via een automatisch antwoord",
  "family": "data",
  "applies_to": [
    "mobile-app",
    "api",
    "desktop",
    "iot"
  ],
  "summary": "A system answers an unsolicited signal by itself, and the answer discloses whether someone is there.",
  "not_a_vulnerability": "Nothing is exploited and no control is circumvented. The automatic answer is a feature, sent over the intended channel and within the intended protocol; that it also reports presence is a property of the design.",
  "mechanism": {
    "what": "Someone sends an ordinary, unrequested signal to an address belonging to a person: a message, a call setup, a lookup, a notification. The receiving system answers on its own, below the level at which the person is involved, and the answer or its absence is observable to the sender. Repeating it produces a timeline of when the device was on, awake, connected or nearby.",
    "why_it_matters": "The person is not told, sees nothing and has no record. Encryption of the content does not help, because the fact and the timing of the answer are the signal. A pattern of such answers describes sleep, work, travel and who is in the same place at the same time, and the exposure survives every setting the person can reach.",
    "common_causes": [
      "a delivery or read confirmation generated by the client before any human sees the message",
      "a fetch of a link preview triggered by receipt rather than by opening",
      "a status or availability field that any party may query",
      "a silent notification that reaches the device and produces an observable acknowledgement"
    ],
    "not_this": "A status a person deliberately publishes is not this entry. Nor is the content of the message, which may be perfectly protected. The distinguishing feature is that the answer is automatic, unrequested, and invisible on the receiving side."
  },
  "detection": {
    "indicator": "A stimulus sent to your own second account or device produces an observable response, with no notification on the receiving side, whose presence or timing changes with the state of that device. Establishing it requires repeating the stimulus while varying only the device state.",
    "method": "differential",
    "qod": 85,
    "capture_requirements": [
      "only your own accounts and your own devices, on both ends; probing someone else's device is outside the method",
      "vary one state at a time: powered off, screen off, application in the background, application open",
      "record the receiving side too, to establish that nothing was shown there",
      "run the same stimulus with the relevant privacy settings on and off, since the finding is often that they change nothing"
    ],
    "attribution": [
      "process-trace"
    ]
  },
  "falsifiers": [
    {
      "condition": "The response is also produced when the device is off, meaning it comes from a server rather than from the device.",
      "checkable": "manual",
      "if_true": "reclassify",
      "note": "Then it says something about the account, not about presence, which is a different and weaker finding."
    },
    {
      "condition": "The receiving side is notified of the stimulus.",
      "checkable": "manual",
      "if_true": "weaken",
      "note": "The person can then see it happening, which removes the invisibility that defines this entry."
    },
    {
      "condition": "A setting reachable by the person suppresses the response, and it holds.",
      "checkable": "manual",
      "if_true": "drop"
    },
    {
      "condition": "The response requires a prior relationship, such as an accepted contact, which the sender cannot obtain unilaterally.",
      "checkable": "manual",
      "if_true": "weaken"
    }
  ],
  "legal": {
    "provisions": [
      "eu-gdpr-5-1-c",
      "eu-gdpr-13",
      "eu-gdpr-6-1-a"
    ],
    "rebuttals": [
      {
        "objection": "No content is exposed, the encryption holds.",
        "answer": "The finding is not about content. Whether someone is awake, at home or beside a particular person is personal data, and it travels outside the encrypted payload."
      },
      {
        "objection": "The user can switch off confirmations.",
        "answer": "Test it. Where the setting suppresses the visible indicator but the underlying answer still leaves the device, the setting addresses the interface and not the disclosure."
      },
      {
        "objection": "This is theoretical.",
        "answer": "It is measurable on your own devices, repeatedly, with a stated state per run. That is the opposite of theoretical, and the measurement needs nobody else's account."
      }
    ]
  },
  "related": [
    "DPE-2026-0012",
    "DPE-2026-0014"
  ],
  "seen_in_the_wild": {
    "confirmed": false,
    "note": "Observed in practice by the authors but not yet backed by a published reference. Set to false until a citation exists: a claim without a source is exactly what this catalogue holds others to."
  },
  "in_practice": {
    "dpia": "Verify which signals the system answers without user action and what those answers disclose about the state of the device.",
    "procurement": "No unrequested signal from an arbitrary party produces a response that discloses device or user state, demonstrated on delivery.",
    "complaint": "A log of stimuli and responses with the device state per run, the setting state per run, and evidence that nothing was shown on the receiving side.",
    "audit_question": "What does this system answer all by itself, to someone the user never agreed to hear from?",
    "audit_question_nl": "Wat beantwoordt dit systeem uit zichzelf, aan iemand van wie de gebruiker nooit iets wilde horen?",
    "complaint_nl": "Een opname of uitdraai die laat zien wat er werkelijk gebeurt, met de datum erbij en het land van waaruit is gemeten.",
    "objection_nl": "Het systeem antwoordt alleen op een geldige aanvraag.",
    "answer_nl": "Vraag wie zo'n aanvraag kan sturen en of de gebruiker daarvan weet."
  },
  "schema_version": "2.0",
  "status": "active",
  "credit": [
    {
      "name": "Mick Beer",
      "role": "proposed",
      "date": "2026-07-26"
    }
  ],
  "does_not_establish": [
    "harm; the catalogue standardises a finding so it can be referred to, it does not weigh it",
    "severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case",
    "unlawfulness; that is for a supervisory authority or a court",
    "intent; a fault is usually a build decision, not a plan",
    "absence: not finding it in one capture is not evidence that it is not there"
  ],
  "reproduction": {
    "methods": [
      {
        "tier": "manual",
        "path": "METHOD.md",
        "expect": "no dedicated reproduction exists yet; follow the general method and the indicator above"
      }
    ]
  },
  "changes": [
    {
      "at": "2026-07-26T00:00:00Z",
      "actor": "registry",
      "entries": [
        "Entry created.",
        "Name assigned.",
        "Detection method and falsifiers defined.",
        "Legal provisions linked."
      ]
    }
  ],
  "summary_nl": "Een systeem antwoordt uit zichzelf op een ongevraagd signaal, en dat antwoord verraadt of er iemand is."
}