@consenttheater/playbill 0.2.0 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/README.md +6 -6
  2. package/dist/actors/advertising.json +426 -26
  3. package/dist/actors/analytics.json +319 -31
  4. package/dist/actors/consent.json +2 -2
  5. package/dist/actors/data_leak.json +7 -24
  6. package/dist/actors/fingerprinting.json +6 -4
  7. package/dist/actors/functional.json +862 -6
  8. package/dist/actors/marketing.json +364 -19
  9. package/dist/actors/security.json +24 -3
  10. package/dist/actors/session_recording.json +1 -3
  11. package/dist/actors/social.json +1 -5
  12. package/package.json +1 -1
package/dist/actors/consent.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "category": "consent",
3
3
  "description": "Consent Management Platforms (CMPs) — cookie banners, consent storage, preference management",
4
- "stats": { "cookies": 43, "domains": 46, "companies": 43 },
4
+ "stats": { "cookies": 44, "domains": 45, "companies": 43 },
5
5
  "cookies": {
6
6
  "CookieConsent": { "company": "Cookiebot", "service": "Cookiebot CMP", "category": "consent", "description": "Cookiebot consent cookie storing user consent state per category (necessary/preferences/statistics/marketing)", "consent_burden": "minimal", "lifetime": "1 year", "docs_url": "https://www.cookiebot.com/en/privacy-policy/" },
7
7
  "CookieLawInfoConsent": { "company": "Cookie Law Info", "service": "Cookie Law Info (WP)", "category": "consent", "description": "Cookie Law Info consent state cookie recording yes/no acceptance for each cookie category", "consent_burden": "minimal", "lifetime": "1 year", "docs_url": "https://developer.wordpress.org/plugins/privacy/" },
@@ -40,6 +40,7 @@
40
40
  "securiti_*": { "company": "Securiti.ai", "service": "Securiti Consent Manager", "category": "consent", "description": "Securiti.ai consent management platform cookie storing user privacy preferences", "consent_burden": "minimal", "pattern": true, "lifetime": "1 year", "docs_url": "https://securiti.ai/privacy-policy/" },
41
41
  "sp_consent_*": { "company": "Sourcepoint", "service": "Sourcepoint CMP", "category": "consent", "description": "Sourcepoint consent management cookie storing TCF and custom vendor consent decisions", "consent_burden": "minimal", "pattern": true, "lifetime": "1 year", "docs_url": "https://www.sourcepoint.com/privacy-policy" },
42
42
  "tarteaucitron": { "company": "CNIL/Tarteaucitron", "service": "Tarteaucitron CMP", "category": "consent", "description": "French open-source consent management platform storing user cookie preferences per service", "consent_burden": "minimal", "lifetime": "1 year", "docs_url": "https://tarteaucitron.io/en/" },
43
+ "tcm": { "company": "Transcend", "service": "Transcend Consent Manager", "category": "consent", "description": "Transcend Consent Manager (TCM) state cookie storing per-category consent choices", "consent_burden": "minimal", "lifetime": "1 year", "docs_url": "https://transcend.io/privacy" },
43
44
  "termly_gtm_*": { "company": "Termly", "service": "Termly CMP", "category": "consent", "description": "Termly consent management cookie for Google Tag Manager consent mode integration", "consent_burden": "minimal", "pattern": true, "lifetime": "1 year", "docs_url": "https://help.termly.io/support/solutions" },
44
45
  "transcend_*": { "company": "Transcend", "service": "Transcend Consent Manager", "category": "consent", "description": "Transcend consent management cookie recording user opt-in/opt-out preferences", "consent_burden": "minimal", "pattern": true, "lifetime": "1 year", "docs_url": "https://transcend.io/privacy" },
45
46
  "uc_settings": { "company": "Usercentrics", "service": "Usercentrics CMP", "category": "consent", "description": "Usercentrics consent settings cookie storing user privacy preferences per service", "consent_burden": "minimal", "lifetime": "1 year", "docs_url": "https://docs.usercentrics.com/" },
@@ -89,7 +90,6 @@
89
90
  "geolocation.onetrust.com": { "company": "OneTrust", "service": "OneTrust Geolocation", "category": "consent", "consent_burden": "minimal", "docs_url": "https://www.onetrust.com/privacy/" },
90
91
  "orejime.empreintedigitale.fr": { "company": "Orejime", "service": "Orejime Consent Manager", "category": "consent", "consent_burden": "minimal", "docs_url": "https://github.com/empreinte-digitale/orejime" },
91
92
  "policy.app.cookieinformation.com": { "company": "Cookie Information", "service": "Cookie Information Platform", "category": "consent", "consent_burden": "minimal", "docs_url": "https://cookieinformation.com/privacy-policy/" },
92
- "sdk.privacy-center.org": { "company": "Didomi", "service": "Didomi Privacy Center", "category": "consent", "consent_burden": "minimal", "docs_url": "https://developers.didomi.io/cmp/web-sdk/consent-notice/cookies" },
93
93
  "sourcepoint.mgr.consensu.org": { "company": "Sourcepoint", "service": "Sourcepoint TCF CMP", "category": "consent", "consent_burden": "minimal", "docs_url": "https://www.sourcepoint.com/privacy-policy" },
94
94
  "tarteaucitron.io": { "company": "CNIL/Tarteaucitron", "service": "Tarteaucitron CMP", "category": "consent", "consent_burden": "minimal", "docs_url": "https://tarteaucitron.io/en/" },
95
95
  "transcend-cdn.com": { "company": "Transcend", "service": "Transcend Consent Manager", "category": "consent", "consent_burden": "minimal", "docs_url": "https://transcend.io/privacy" },
package/dist/actors/data_leak.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "category": "data_leak",
3
3
  "description": "Third-party resources that expose visitor IP addresses — fonts, embeds, CDNs, maps",
4
- "stats": { "cookies": 0, "domains": 821, "companies": 568 },
4
+ "stats": { "cookies": 0, "domains": 804, "companies": 550 },
5
5
  "cookies": {},
6
6
  "domains": {
7
7
  "*.b-cdn.net": { "company": "BunnyCDN", "service": "BunnyCDN CDN", "category": "data_leak", "consent_burden": "contested", "pattern": true, "docs_url": "https://bunny.net/privacy" },
@@ -102,7 +102,6 @@
102
102
  "cdn.accessibe.com": { "company": "accessiBe", "service": "accessiBe Accessibility Widget", "category": "data_leak", "consent_burden": "contested", "note": "accessiBe AI accessibility overlay — leaks visitor IP and collects usage of accessibility features, revealing potential disability status", "docs_url": "https://accessibe.com/privacy-policy" },
103
103
  "cdn.accor.com": { "company": "Accor", "service": "Accor CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://group.accor.com/en/footer/privacy-policy" },
104
104
  "cdn.adidas.com": { "company": "Adidas", "service": "Adidas CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.adidas.com/us/privacy-policy" },
105
- "cdn.adjust.com": { "company": "Adjust", "service": "Adjust Attribution CDN", "category": "data_leak", "consent_burden": "contested", "note": "Adjust mobile measurement CDN leaking visitor IP for attribution SDK delivery", "docs_url": "https://www.adjust.com/terms/privacy-policy/" },
106
105
  "cdn.adobe.com": { "company": "Adobe", "service": "Adobe Creative Cloud CDN", "category": "data_leak", "consent_burden": "contested", "note": "Adobe Creative Cloud asset CDN leaking visitor IP for application delivery", "docs_url": "https://www.adobe.com/privacy/policy.html" },
107
106
  "cdn.agoda.com": { "company": "Booking Holdings/Agoda", "service": "Agoda CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.agoda.com/info/privacy-policy" },
108
107
  "cdn.agoda.net": { "company": "Booking Holdings", "service": "Agoda CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.agoda.com/info/privacy-policy.html" },
@@ -120,7 +119,6 @@
120
119
  "cdn.artstation.com": { "company": "ArtStation (Epic Games)", "service": "ArtStation CDN", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://www.artstation.com/privacy" },
121
120
  "cdn.auchan.fr": { "company": "Auchan", "service": "Auchan CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.auchan.fr/donnees-personnelles" },
122
121
  "cdn.audi.com": { "company": "Volkswagen Group/Audi", "service": "Audi CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.audi.com/en/data-protection.html" },
123
- "cdn.auth0.com": { "company": "Auth0 (Okta)", "service": "Auth0 SDK CDN", "category": "data_leak", "consent_burden": "contested", "note": "Auth0 identity SDK CDN leaking visitor IP for authentication widget loading", "docs_url": "https://auth0.com/privacy" },
124
122
  "cdn.aviva.com": { "company": "Aviva", "service": "Aviva CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.aviva.com/privacy-policy/" },
125
123
  "cdn.axa.com": { "company": "AXA", "service": "AXA CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.axa.com/en/about-us/privacy-policy" },
126
124
  "cdn.bamboohr.com": { "company": "BambooHR", "service": "BambooHR CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.bamboohr.com/privacy-policy/" },
@@ -137,7 +135,6 @@
137
135
  "cdn.booking.com": { "company": "Booking Holdings", "service": "Booking.com CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.booking.com/content/privacy.html" },
138
136
  "cdn.bootcdn.net": { "company": "BootCDN", "service": "BootCDN", "category": "data_leak", "consent_burden": "contested", "note": "Chinese CDN for front-end libraries — leaks visitor IP to Chinese infrastructure; previously caught injecting tracking scripts", "docs_url": "https://www.bootcdn.cn/" },
139
137
  "cdn.boots.com": { "company": "Boots (Walgreens)", "service": "Boots CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.boots.com/privacy-policy" },
140
- "cdn.branch.io": { "company": "Branch", "service": "Branch Deep Linking CDN", "category": "data_leak", "consent_burden": "contested", "note": "Branch deep linking SDK CDN leaking visitor IP for attribution and link routing", "docs_url": "https://branch.io/policies/privacy-policy/" },
141
138
  "cdn.braze.eu": { "company": "Braze", "service": "Braze EU SDK CDN", "category": "data_leak", "consent_burden": "contested", "note": "Braze customer engagement SDK EU CDN leaking visitor IP for messaging SDK delivery", "docs_url": "https://www.braze.com/company/legal/cookies" },
142
139
  "cdn.brightcove.com": { "company": "Brightcove", "service": "Brightcove Video CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.brightcove.com/en/legal/privacy/" },
143
140
  "cdn.bugsnag.com": { "company": "Bugsnag (SmartBear)", "service": "Bugsnag Error Monitoring", "category": "data_leak", "consent_burden": "contested", "note": "Bugsnag error monitoring CDN — captures and transmits JavaScript errors with user context data", "docs_url": "https://smartbear.com/privacy/" },
@@ -169,7 +166,6 @@
169
166
  "cdn.commonsensemedia.org": { "company": "Common Sense Media", "service": "Common Sense Media CDN", "category": "data_leak", "consent_burden": "contested", "note": "Children's media rating site CDN — despite child-safety mission, leaks visitor IP through CDN and embeds Google Analytics and ad trackers", "docs_url": "https://www.commonsensemedia.org/about-us/our-mission/privacy-policy" },
170
167
  "cdn.compound.finance": { "company": "Compound Labs", "service": "Compound DeFi CDN", "category": "data_leak", "consent_burden": "contested", "note": "Compound DeFi protocol CDN leaking visitor IP and potentially wallet interaction data", "docs_url": "https://compound.finance/privacy-policy" },
171
168
  "cdn.contentful.com": { "company": "Contentful", "service": "Contentful CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Contentful headless CMS CDN — leaks visitor IP for content delivery API requests", "docs_url": "https://www.contentful.com/legal/privacy-at-contentful/" },
172
- "cdn.convertkit.com": { "company": "ConvertKit", "service": "ConvertKit Forms CDN", "category": "data_leak", "consent_burden": "contested", "note": "ConvertKit email marketing CDN leaking visitor IP for form embed delivery", "docs_url": "https://convertkit.com/privacy" },
173
169
  "cdn.cookielaw.org": { "company": "OneTrust", "service": "OneTrust CMP CDN", "category": "data_leak", "consent_burden": "minimal", "note": "OneTrust consent banner CDN — ironically, the privacy tool itself leaks visitor IP to a third party", "docs_url": "https://www.onetrust.com/privacy/" },
174
170
  "cdn.coolblue.nl": { "company": "Coolblue", "service": "Coolblue CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.coolblue.nl/privacybeleid" },
175
171
  "cdn.costacoffee.com": { "company": "Costa Coffee (Coca-Cola)", "service": "Costa Coffee CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.costacoffee.com/privacy-policy" },
@@ -257,7 +253,6 @@
257
253
  "cdn.happn.com": { "company": "Happn", "service": "Happn CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.happn.com/en/privacy/" },
258
254
  "cdn.hashnode.com": { "company": "Hashnode", "service": "Hashnode CDN", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://hashnode.com/privacy" },
259
255
  "cdn.headwayapp.co": { "company": "Headway", "service": "Headway Changelog CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Headway changelog widget CDN leaking visitor IP for badge rendering", "docs_url": "https://headwayapp.co/privacy" },
260
- "cdn.heapanalytics.com": { "company": "Heap", "service": "Heap Analytics CDN", "category": "data_leak", "consent_burden": "required", "note": "Heap auto-capture analytics CDN — automatically records all clicks, form inputs, and page views", "docs_url": "https://heap.io/privacy" },
261
256
  "cdn.here.com": { "company": "HERE Technologies", "service": "HERE Maps", "category": "data_leak", "consent_burden": "contested", "note": "HERE Maps embedded widget transmits visitor IP to HERE Technologies", "docs_url": "https://legal.here.com/privacy" },
262
257
  "cdn.hertz.com": { "company": "Hertz", "service": "Hertz CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.hertz.com/rentacar/privacypolicy" },
263
258
  "cdn.hilton.com": { "company": "Hilton", "service": "Hilton CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.hilton.com/en/corporate/privacy/" },
@@ -306,7 +301,6 @@
306
301
  "cdn.linear.app": { "company": "Linear", "service": "Linear CDN", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://linear.app/privacy" },
307
302
  "cdn.linearicons.com": { "company": "Perxis", "service": "Linearicons Icon Font CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Icon font CDN — leaks visitor IP for each icon font request; consider self-hosting", "docs_url": "https://linearicons.com/" },
308
303
  "cdn.livekit.io": { "company": "LiveKit", "service": "LiveKit Video CDN", "category": "data_leak", "consent_burden": "contested", "note": "WebRTC video infrastructure CDN — leaks participant IP for real-time video and audio delivery", "docs_url": "https://livekit.io/privacy" },
309
- "cdn.loom.com": { "company": "Atlassian/Loom", "service": "Loom CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.loom.com/privacy-policy" },
310
304
  "cdn.loom.com/assets": { "company": "Atlassian/Loom", "service": "Loom Video Assets", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.loom.com/privacy-policy" },
311
305
  "cdn.lotame.com/tag.js": { "company": "Lotame", "service": "Lotame DMP Tag", "category": "data_leak", "consent_burden": "required_strict", "note": "Lotame data management platform tag — leaks visitor IP and behavioral data for audience segment building and data marketplace trading", "docs_url": "https://www.lotame.com/about-lotame/privacy/" },
312
306
  "cdn.lr-in-prod.com": { "company": "LogRocket", "service": "LogRocket CDN", "category": "data_leak", "consent_burden": "required", "note": "LogRocket session recording CDN — loads script that records all user interactions, DOM state, and network requests", "docs_url": "https://logrocket.com/privacy/" },
@@ -353,7 +347,6 @@
353
347
  "cdn.onesignal.com": { "company": "OneSignal", "service": "OneSignal Push CDN", "category": "data_leak", "consent_burden": "contested", "note": "OneSignal web push notification CDN — leaks visitor IP for subscriber identification", "docs_url": "https://onesignal.com/privacy_policy" },
354
348
  "cdn.onetrust.com": { "company": "OneTrust", "service": "OneTrust Cookie Banner CDN", "category": "data_leak", "consent_burden": "minimal", "note": "OneTrust consent banner CDN leaking visitor IP before consent is obtained", "docs_url": "https://www.onetrust.com/privacy/" },
355
349
  "cdn.openai.com": { "company": "OpenAI", "service": "OpenAI CDN", "category": "data_leak", "consent_burden": "contested", "note": "OpenAI CDN for ChatGPT widget and API resources — leaks visitor IP to OpenAI", "docs_url": "https://openai.com/policies/privacy-policy" },
356
- "cdn.optimizely.com": { "company": "Optimizely", "service": "Optimizely CDN", "category": "data_leak", "consent_burden": "contested", "note": "Optimizely experimentation SDK CDN — leaks visitor IP and loads A/B test configuration", "docs_url": "https://www.optimizely.com/legal/privacy-policy/" },
357
350
  "cdn.paddle.com": { "company": "Paddle", "service": "Paddle Checkout CDN", "category": "data_leak", "consent_burden": "contested", "note": "Paddle SaaS payment checkout CDN leaking visitor IP for subscription overlay delivery", "docs_url": "https://paddle.com/privacy/" },
358
351
  "cdn.pandora.net": { "company": "Pandora Jewelry", "service": "Pandora CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.pandora.net/en/privacy-policy" },
359
352
  "cdn.parship.com": { "company": "Parship Group", "service": "Parship CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.parship.com/privacypolicy" },
@@ -394,8 +387,6 @@
394
387
  "cdn.sainsburys.co.uk": { "company": "Sainsbury's", "service": "Sainsbury's CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.sainsburys.co.uk/shop/gb/groceries/get-ideas/about-us/privacy-policy" },
395
388
  "cdn.salomon.com": { "company": "Amer Sports", "service": "Salomon CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.salomon.com/en-us/privacy-policy" },
396
389
  "cdn.sanity.io": { "company": "Sanity", "service": "Sanity CMS CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Sanity headless CMS CDN — leaks visitor IP for image and asset delivery", "docs_url": "https://www.sanity.io/legal/privacy" },
397
- "cdn.segment.com": { "company": "Twilio (Segment)", "service": "Segment CDP CDN", "category": "data_leak", "consent_burden": "required", "note": "Segment CDP JavaScript CDN — loads the data pipeline that fans out visitor data to dozens of downstream tools", "docs_url": "https://segment.com/legal/privacy/" },
398
- "cdn.segment.io": { "company": "Twilio", "service": "Segment Analytics CDN", "category": "data_leak", "consent_burden": "contested", "note": "Segment CDP CDN leaking visitor IP for analytics script delivery", "docs_url": "https://segment.com/legal/privacy/" },
399
390
  "cdn.seloger.com": { "company": "SeLoger (Aviv/Axel Springer)", "service": "SeLoger CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.seloger.com/protection-des-donnees.htm" },
400
391
  "cdn.sentry.io": { "company": "Sentry", "service": "Sentry Error Tracking CDN", "category": "data_leak", "consent_burden": "contested", "note": "Sentry error monitoring CDN — error reports contain visitor IP, browser info, and potentially PII from error context", "docs_url": "https://sentry.io/privacy/" },
401
392
  "cdn.shein.com": { "company": "Shein", "service": "Shein CDN", "category": "data_leak", "consent_burden": "required", "docs_url": "https://www.shein.com/Privacy-Policy-a-282.html" },
@@ -405,7 +396,6 @@
405
396
  "cdn.shutterstock.com": { "company": "Shutterstock", "service": "Shutterstock CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.shutterstock.com/privacy" },
406
397
  "cdn.sixt.com": { "company": "Sixt", "service": "Sixt CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.sixt.com/privacy-policy/" },
407
398
  "cdn.sketch.com": { "company": "Sketch", "service": "Sketch Cloud CDN", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://www.sketch.com/privacy/" },
408
- "cdn.skypack.dev": { "company": "Skypack (Snowpack)", "service": "Skypack CDN", "category": "data_leak", "consent_burden": "minimal", "note": "JavaScript package CDN — leaks visitor IP for each module import", "docs_url": "https://www.skypack.dev/" },
409
399
  "cdn.socket.io": { "company": "Socket.IO", "service": "Socket.IO CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Socket.IO client library CDN; leaks visitor IP on load", "docs_url": "https://socket.io/" },
410
400
  "cdn.sofi.com": { "company": "SoFi", "service": "SoFi CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.sofi.com/privacy/" },
411
401
  "cdn.soundcloud.com": { "company": "SoundCloud", "service": "SoundCloud CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://soundcloud.com/pages/cookies" },
@@ -429,7 +419,6 @@
429
419
  "cdn.swiss.com": { "company": "Swiss International Air Lines", "service": "SWISS CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.swiss.com/ch/en/legal/privacy-policy" },
430
420
  "cdn.syndication.twimg.com": { "company": "X Corp", "service": "X/Twitter Embed CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://help.twitter.com/en/rules-and-policies/twitter-cookies" },
431
421
  "cdn.tailwindcss.com": { "company": "Tailwind Labs", "service": "Tailwind CSS CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Tailwind CSS CDN — leaks visitor IP when loading CSS framework; self-hosting recommended for production", "docs_url": "https://tailwindcss.com/" },
432
- "cdn.tawk.to": { "company": "Tawk.to", "service": "Tawk.to Chat CDN", "category": "data_leak", "consent_burden": "contested", "note": "Tawk.to live chat widget CDN leaking visitor IP and browsing context for support widget delivery", "docs_url": "https://www.tawk.to/privacy-policy/" },
433
422
  "cdn.telenor.no": { "company": "Telenor", "service": "Telenor CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.telenor.no/om/personvern/" },
434
423
  "cdn.telia.se": { "company": "Telia", "service": "Telia CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.telia.se/privat/om/integritetspolicy" },
435
424
  "cdn.temu.com": { "company": "Temu (PDD Holdings)", "service": "Temu CDN", "category": "data_leak", "consent_burden": "required", "docs_url": "https://www.temu.com/privacy-policy.html" },
@@ -440,7 +429,6 @@
440
429
  "cdn.ticketmaster.com": { "company": "Ticketmaster (Live Nation)", "service": "Ticketmaster CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.ticketmaster.com/h/privacy-policy" },
441
430
  "cdn.tiffany.com": { "company": "LVMH (Tiffany)", "service": "Tiffany CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.tiffany.com/privacy-policy/" },
442
431
  "cdn.tinder.com": { "company": "Match Group", "service": "Tinder CDN", "category": "data_leak", "consent_burden": "required", "note": "Dating app CDN may reveal visitor interest in dating services", "docs_url": "https://www.gotinder.com/privacy" },
443
- "cdn.tiny.cloud": { "company": "Tiny (TinyMCE)", "service": "TinyMCE Cloud", "category": "data_leak", "consent_burden": "minimal", "note": "TinyMCE rich text editor cloud — leaks visitor IP and may send editor content for spell-checking", "docs_url": "https://www.tiny.cloud/privacy/" },
444
432
  "cdn.tipico.de": { "company": "Tipico", "service": "Tipico CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.tipico.de/datenschutz" },
445
433
  "cdn.tiqets.com": { "company": "Tiqets", "service": "Tiqets CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.tiqets.com/privacy" },
446
434
  "cdn.tokopedia.com": { "company": "Tokopedia (GoTo)", "service": "Tokopedia CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.tokopedia.com/privacy" },
@@ -470,7 +458,6 @@
470
458
  "cdn.vueling.com": { "company": "Vueling", "service": "Vueling CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.vueling.com/en/legal/privacy-policy" },
471
459
  "cdn.wagamama.com": { "company": "The Restaurant Group/Wagamama", "service": "Wagamama CDN", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://www.wagamama.com/privacy-policy" },
472
460
  "cdn.waitrose.com": { "company": "Waitrose (John Lewis)", "service": "Waitrose CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.waitrose.com/ecom/help-information/policies/privacy" },
473
- "cdn.walkme.com": { "company": "WalkMe", "service": "WalkMe DAP CDN", "category": "data_leak", "consent_burden": "contested", "note": "WalkMe digital adoption platform CDN leaking visitor IP for overlay delivery", "docs_url": "https://www.walkme.com/privacy-policy/" },
474
461
  "cdn.wayfair.com": { "company": "Wayfair", "service": "Wayfair CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.wayfair.com/customerservice/general_info.html#privacy" },
475
462
  "cdn.webflow.com": { "company": "Webflow", "service": "Webflow CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://webflow.com/legal/privacy" },
476
463
  "cdn.whereby.com": { "company": "Whereby", "service": "Whereby Video CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://whereby.com/privacy-policy" },
@@ -520,7 +507,6 @@
520
507
  "crates.io": { "company": "Rust Foundation", "service": "crates.io Registry", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://foundation.rust-lang.org/policies/privacy-policy/" },
521
508
  "customer-*.cloudflarestream.com": { "company": "Cloudflare", "service": "Cloudflare Stream CDN", "category": "data_leak", "consent_burden": "contested", "pattern": true, "docs_url": "https://www.cloudflare.com/privacypolicy/" },
522
509
  "d1bxh8uas1mnw7.cloudfront.net": { "company": "Altmetric", "service": "Altmetric Badge CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Altmetric attention badge CDN leaks visitor IP for academic citation tracking", "docs_url": "https://www.altmetric.com/privacy-policy/" },
523
- "d2wy8f7a9ursnm.cloudfront.net": { "company": "Amazon CloudFront", "service": "CloudFront CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Common CloudFront distribution leaking IP to AWS infrastructure", "docs_url": "https://aws.amazon.com/privacy/" },
524
510
  "defillama.com": { "company": "DefiLlama", "service": "DefiLlama Analytics", "category": "data_leak", "consent_burden": "contested", "note": "DeFi analytics aggregator — tracks protocol TVL and usage; visitor IP exposed when querying chain data", "docs_url": "https://defillama.com/" },
525
511
  "deno.dev": { "company": "Deno", "service": "Deno Deploy", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://deno.com/deploy/docs/privacy-policy" },
526
512
  "digid.nl": { "company": "Logius (Netherlands)", "service": "Dutch DigiD", "category": "data_leak", "consent_burden": "required", "note": "Dutch national digital identity — citizen BSN and authentication data processed through DigiD infrastructure", "docs_url": "https://www.digid.nl/en/privacy" },
@@ -556,7 +542,6 @@
556
542
  "files.pythonhosted.org": { "company": "Python Software Foundation", "service": "PyPI Package CDN", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://policies.python.org/python.org/Privacy-Policy/" },
557
543
  "firebaseapp.com": { "company": "Google", "service": "Firebase Hosting (Legacy)", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://firebase.google.com/support/privacy" },
558
544
  "fly.dev": { "company": "Fly.io", "service": "Fly.io Edge Hosting", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://fly.io/legal/privacy-policy/" },
559
- "fonts.bunny.net": { "company": "Bunny CDN", "service": "Bunny Fonts", "category": "data_leak", "consent_burden": "minimal", "note": "Privacy-friendly Google Fonts alternative — still leaks visitor IP but does not track", "docs_url": "https://bunny.net/fonts/" },
560
545
  "fonts.googleapis.com": { "company": "Google", "service": "Google Fonts", "category": "data_leak", "consent_burden": "contested", "note": "Leaks visitor IP to Google; Austrian DPA (DSB, 2022-01-22) and LG Muenchen I (3 O 17493/20, 2022-01-20) ruled this a GDPR violation without consent", "docs_url": "https://developers.google.com/fonts/faq" },
561
546
  "fonts.gstatic.com": { "company": "Google", "service": "Google Fonts", "category": "data_leak", "consent_burden": "contested", "note": "Font asset CDN; transmits visitor IP to Google servers without necessity", "docs_url": "https://developers.google.com/fonts/faq" },
562
547
  "forms.office.com": { "company": "Microsoft", "service": "Microsoft Forms Embed", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://privacy.microsoft.com/en-us/privacystatement" },
@@ -568,7 +553,6 @@
568
553
  "geoip.maxmind.com": { "company": "MaxMind", "service": "MaxMind GeoIP", "category": "data_leak", "consent_burden": "required", "note": "MaxMind GeoIP — industry-standard IP geolocation database. Resolves IP addresses to physical locations, ISPs, and organization data. Used by millions of websites.", "docs_url": "https://www.maxmind.com/en/privacy-policy" },
569
554
  "geolocation-db.com": { "company": "Geolocation DB", "service": "Geolocation DB API", "category": "data_leak", "consent_burden": "required", "docs_url": "https://geolocation-db.com/privacy" },
570
555
  "getcomposer.org": { "company": "Composer", "service": "Composer PHP Package Manager", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://getcomposer.org/" },
571
- "giscus.app": { "company": "giscus", "service": "giscus GitHub Comments", "category": "data_leak", "consent_burden": "minimal", "note": "GitHub Discussions-based commenting — leaks visitor IP to giscus and GitHub servers", "docs_url": "https://github.com/giscus/giscus/blob/main/PRIVACY-POLICY.md" },
572
556
  "github.io": { "company": "GitHub (Microsoft)", "service": "GitHub Pages", "category": "data_leak", "consent_burden": "minimal", "note": "GitHub Pages static hosting leaks visitor IP to Microsoft/GitHub", "docs_url": "https://docs.github.com/en/site-policy/privacy-policies" },
573
557
  "gitlab.io": { "company": "GitLab", "service": "GitLab Pages", "category": "data_leak", "consent_burden": "minimal", "note": "GitLab Pages static hosting leaks visitor IP to GitLab infrastructure", "docs_url": "https://about.gitlab.com/privacy/" },
574
558
  "glitch.com/embed": { "company": "Glitch (Fastly)", "service": "Glitch Project Embed", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://glitch.com/legal/privacy/" },
@@ -607,9 +591,7 @@
607
591
  "json.geoiplookup.io": { "company": "GeoIP Lookup", "service": "GeoIP Lookup Service", "category": "data_leak", "consent_burden": "required", "note": "Free IP geolocation API — exposes visitor IP, location, ISP, and timezone data to third party", "docs_url": "https://geoiplookup.io/privacy-policy" },
608
592
  "jsonip.com": { "company": "jsonip", "service": "jsonip.com IP Lookup", "category": "data_leak", "consent_burden": "contested", "note": "Public IP-reveal API (JSONP-friendly) — when called from client-side JS, the visitor's IP leaks to jsonip.com AND gets handed back to the calling site, where it's often stored as a visitor identifier. 'Show consent based on country' argument is legitimate; storing IP is not", "docs_url": "https://jsonip.com/" },
609
593
  "jup.ag": { "company": "Jupiter (Solana)", "service": "Jupiter DEX Aggregator", "category": "data_leak", "consent_burden": "required", "note": "Solana DEX aggregator — routes token swaps and collects wallet addresses on Solana network", "docs_url": "https://station.jup.ag/legal/privacy-policy" },
610
- "ka-f.fontawesome.com": { "company": "Fonticons (Font Awesome)", "service": "Font Awesome Kit Analytics", "category": "data_leak", "consent_burden": "contested", "note": "Font Awesome Kit analytics — tracks page views and icon usage statistics across sites using Font Awesome kits", "docs_url": "https://fontawesome.com/privacy" },
611
594
  "keycdn.com": { "company": "KeyCDN", "service": "KeyCDN", "category": "data_leak", "consent_burden": "minimal", "note": "KeyCDN asset delivery — leaks visitor IP to KeyCDN servers", "docs_url": "https://www.keycdn.com/privacy" },
612
- "kit.fontawesome.com": { "company": "Fonticons (Font Awesome)", "service": "Font Awesome CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Font Awesome icon CDN — leaks visitor IP for icon font delivery; kit includes page view tracking", "docs_url": "https://fontawesome.com/privacy" },
613
595
  "ko-fi.com/btn": { "company": "Ko-fi", "service": "Ko-fi Donation Button", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://ko-fi.com/privacy" },
614
596
  "ko-fi.com/widget": { "company": "Ko-fi", "service": "Ko-fi Support Widget", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://more.ko-fi.com/privacy" },
615
597
  "kxcdn.com": { "company": "KeyCDN", "service": "KeyCDN", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://www.keycdn.com/privacy" },
@@ -656,6 +638,7 @@
656
638
  "pbskids.org": { "company": "PBS", "service": "PBS Kids", "category": "data_leak", "consent_burden": "contested", "note": "PBS Kids children's educational content — while publicly funded, embeds third-party analytics and CDN resources that leak child visitor IP addresses", "docs_url": "https://www.pbs.org/about/pbs-privacy-policy/" },
657
639
  "phantom.app/download": { "company": "Phantom", "service": "Phantom Wallet Download", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://phantom.app/privacy" },
658
640
  "picsum.photos": { "company": "Lorem Picsum", "service": "Lorem Picsum Placeholder Images", "category": "data_leak", "consent_burden": "minimal", "note": "Non-commercial open-source placeholder image service (picsum.photos + fastly.picsum.photos via subdomain match). No known profiling or analytics, but each request still leaks the visitor IP to Lorem Picsum and to Fastly (their CDN). Self-host images for strict zero-risk compliance", "docs_url": "https://picsum.photos/" },
641
+ "picus-news.com": { "company": "Picus Telemetry", "service": "Picus News Reader Telemetry", "category": "data_leak", "consent_burden": "contested", "note": "Embedded news-widget service that loads from third-party origin and emits visitor IP plus referrer to its own analytics on every article view." },
659
642
  "pins.pinterest.com": { "company": "Pinterest", "service": "Pinterest Pin Embed", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://policy.pinterest.com/en/privacy-policy" },
660
643
  "pitch.com/embed": { "company": "Pitch", "service": "Pitch Presentation Embed", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://pitch.com/privacy" },
661
644
  "pixel.eyeota.net": { "company": "Eyeota", "service": "Eyeota Data Collection", "category": "data_leak", "consent_burden": "required_strict", "note": "Eyeota audience data marketplace pixel — collects visitor data for resale to advertisers through data trading platforms", "docs_url": "https://www.eyeota.com/privacy-policy" },
@@ -699,7 +682,6 @@
699
682
  "scontent.cdninstagram.com": { "company": "Meta", "service": "Instagram CDN", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://help.instagram.com/519522125107875" },
700
683
  "scontent.xx.fbcdn.net": { "company": "Meta", "service": "Facebook Content CDN", "category": "data_leak", "consent_burden": "contested", "note": "Meta content delivery CDN for images and videos in Facebook embeds — leaks visitor IP and viewing context", "docs_url": "https://www.facebook.com/policies/cookies/" },
701
684
  "sdk.amazonaws.com": { "company": "Amazon", "service": "AWS SDK CDN", "category": "data_leak", "consent_burden": "minimal", "note": "AWS JavaScript SDK CDN leaking visitor IP to Amazon infrastructure", "docs_url": "https://aws.amazon.com/privacy/" },
702
- "sdk.split.io": { "company": "Split.io", "service": "Split Feature Flags", "category": "data_leak", "consent_burden": "contested", "note": "Split.io feature flag SDK — leaks visitor IP and user attributes for feature targeting and A/B testing", "docs_url": "https://www.split.io/product/data-privacy/" },
703
685
  "search.maven.org": { "company": "Sonatype", "service": "Maven Central Search", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://www.sonatype.com/privacy-policy" },
704
686
  "secure.gravatar.com": { "company": "Automattic", "service": "Gravatar", "category": "data_leak", "consent_burden": "contested", "note": "Gravatar avatar service leaking visitor email hashes and IP to Automattic", "docs_url": "https://automattic.com/privacy/" },
705
687
  "secure.quantserve.com": { "company": "Quantcast", "service": "Quantcast Measurement", "category": "data_leak", "consent_burden": "required", "note": "Quantcast measurement pixel — collects visitor data for audience measurement and interest-based advertising", "docs_url": "https://www.quantcast.com/privacy/" },
@@ -744,7 +726,6 @@
744
726
  "tags.bluekai.com/site": { "company": "Oracle", "service": "Oracle BlueKai Site Tag", "category": "data_leak", "consent_burden": "required_strict", "note": "Oracle BlueKai site-level data collection tag — leaks visitor IP and browsing behavior to Oracle's data cloud for audience profiling", "docs_url": "https://www.oracle.com/legal/privacy/marketing-cloud-data-cloud-privacy-policy.html" },
745
727
  "tally.so": { "company": "Tally", "service": "Tally Forms Embed", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://tally.so/help/privacy-policy" },
746
728
  "tidycal.com": { "company": "TidyCal (AppSumo)", "service": "TidyCal Scheduling", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://tidycal.com/privacy" },
747
- "tile.openstreetmap.org": { "company": "OpenStreetMap Foundation", "service": "OpenStreetMap Tiles", "category": "data_leak", "consent_burden": "minimal", "note": "OpenStreetMap tile server — leaks visitor IP; consider self-hosting tiles for full privacy compliance", "docs_url": "https://wiki.osmfoundation.org/wiki/Privacy_Policy" },
748
729
  "tiles.mapbox.com": { "company": "Mapbox", "service": "Mapbox Tiles", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.mapbox.com/legal/privacy" },
749
730
  "tokenterminal.com": { "company": "Token Terminal", "service": "Token Terminal Analytics", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://tokenterminal.com/privacy-policy" },
750
731
  "tomtom.com": { "company": "TomTom", "service": "TomTom Maps SDK", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.tomtom.com/privacy/" },
@@ -762,10 +743,8 @@
762
743
  "up.railway.app": { "company": "Railway", "service": "Railway App Hosting", "category": "data_leak", "consent_burden": "minimal", "docs_url": "https://railway.app/legal/privacy" },
763
744
  "upload.wikimedia.org": { "company": "Wikimedia Foundation", "service": "Wikipedia/Wikimedia CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Wikimedia Commons media CDN leaking visitor IP for encyclopedia image delivery", "docs_url": "https://foundation.wikimedia.org/wiki/Privacy_policy" },
764
745
  "uploads-ssl.webflow.com": { "company": "Webflow", "service": "Webflow Uploads CDN", "category": "data_leak", "consent_burden": "contested", "note": "Webflow uploads CDN — leaks visitor IP for media file delivery on Webflow-hosted websites", "docs_url": "https://webflow.com/legal/privacy" },
765
- "use.fontawesome.com": { "company": "Fonticons/Font Awesome", "service": "Font Awesome Kit CDN", "category": "data_leak", "consent_burden": "minimal", "note": "Font Awesome Kit CDN with usage analytics — tracks which icons are used on which sites", "docs_url": "https://fontawesome.com/privacy" },
766
746
  "use.typekit.net": { "company": "Adobe", "service": "Adobe Fonts (Typekit)", "category": "data_leak", "consent_burden": "contested", "note": "Adobe Fonts (formerly Typekit) — leaks visitor IP and referrer for web font delivery; tracks font usage across sites", "docs_url": "https://www.adobe.com/privacy/policies/typekit.html" },
767
747
  "user-images.githubusercontent.com": { "company": "GitHub (Microsoft)", "service": "GitHub User Images", "category": "data_leak", "consent_burden": "minimal", "note": "GitHub user-uploaded image hosting exposes viewer IP to Microsoft/GitHub", "docs_url": "https://docs.github.com/en/site-policy/privacy-policies" },
768
- "utteranc.es": { "company": "utterances", "service": "utterances GitHub Comments", "category": "data_leak", "consent_burden": "minimal", "note": "GitHub Issues-based commenting widget — leaks visitor IP to utterances and GitHub", "docs_url": "https://utteranc.es/" },
769
748
  "va.vercel-scripts.com": { "company": "Vercel", "service": "Vercel Analytics Script", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://vercel.com/legal/privacy-policy" },
770
749
  "vercel.app": { "company": "Vercel", "service": "Vercel Deployments", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://vercel.com/legal/privacy-policy" },
771
750
  "vitals.vercel-insights.com": { "company": "Vercel", "service": "Vercel Web Analytics", "category": "data_leak", "consent_burden": "contested", "note": "Vercel Web Analytics and Speed Insights — collects Core Web Vitals and visitor data for deployed sites", "docs_url": "https://vercel.com/legal/privacy-policy" },
@@ -795,9 +774,13 @@
795
774
  "www.dropbox.com/s": { "company": "Dropbox", "service": "Dropbox Shared File Embed", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.dropbox.com/privacy" },
796
775
  "www.dvla.gov.uk": { "company": "DVLA (UK)", "service": "DVLA Vehicle Services", "category": "data_leak", "consent_burden": "required", "note": "UK Driver and Vehicle Licensing Agency — processes driving license and vehicle registration data", "docs_url": "https://www.gov.uk/government/organisations/driver-and-vehicle-licensing-agency/about/personal-information-charter" },
797
776
  "www.elster.de": { "company": "German Tax Authority", "service": "ELSTER", "category": "data_leak", "consent_burden": "required", "docs_url": "https://www.elster.de/eportal/datenschutz" },
798
- "www.figma.com": { "company": "Figma", "service": "Figma Embed", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.figma.com/privacy/" },
799
777
  "www.gofundme.com/f": { "company": "GoFundMe", "service": "GoFundMe Campaign Embed", "category": "data_leak", "consent_burden": "contested", "docs_url": "https://www.gofundme.com/privacy" },
800
778
  "www.google.com": { "company": "Google", "service": "Google Cross-Site Endpoint", "category": "data_leak", "consent_burden": "contested", "note": "Cross-origin requests to www.google.com on a non-Google site are almost always reCAPTCHA (/recaptcha/api.js), Google Fonts CSS, OAuth/Login, or Maps — all leak visitor IP to Google regardless of consent", "docs_url": "https://policies.google.com/privacy" },
779
+ "www.google.com/ccm/collect": { "company": "Google", "service": "Google Customer Match Connect", "category": "data_leak", "consent_burden": "required_strict", "note": "Google Customer Match Connect — first-party data ingest endpoint. Sends hashed PII (emails, phone numbers) plus event metadata to Google Ads for audience matching. Used by consent-mode-aware deployments to bypass third-party cookie restrictions", "docs_url": "https://support.google.com/google-ads/answer/6379332" },
780
+ "www.google.com/gmp/conversion": { "company": "Google", "service": "Google Marketing Platform Enhanced Conversions", "category": "data_leak", "consent_burden": "required_strict", "note": "Google Marketing Platform Enhanced Conversions — sends hashed PII (typically email + name) as URL parameters for cross-device conversion attribution", "docs_url": "https://support.google.com/google-ads/answer/13258081" },
781
+ "www.google.com/pagead/1p-conversion": { "company": "Google", "service": "Google Ads First-Party Conversion", "category": "data_leak", "consent_burden": "required_strict", "note": "Google Ads First-Party Conversion endpoint — server-side-style conversion reporting through the visitor's browser. Consent-mode workaround that bypasses third-party-cookie restrictions", "docs_url": "https://support.google.com/google-ads/answer/14778942" },
782
+ "www.google.com/pagead/1p-user-list": { "company": "Google", "service": "Google Ads First-Party Audience List", "category": "data_leak", "consent_burden": "required_strict", "note": "Google Ads First-Party Audience List — the '1p' is literal. Successor to third-party-cookie-based audience targeting after Chrome's Privacy Sandbox transition. Sends visitor data to Google Ads to maintain audience membership", "docs_url": "https://support.google.com/google-ads/answer/12224748" },
783
+ "www.google.com/rmkt/collect": { "company": "Google", "service": "Google Ads Remarketing Collect", "category": "data_leak", "consent_burden": "required_strict", "note": "Google Ads Remarketing collect endpoint — fires for retargeting audience membership. Equivalent to a remarketing pixel via the gtag library", "docs_url": "https://support.google.com/google-ads/answer/2453998" },
801
784
  "www.gov.uk": { "company": "UK Government", "service": "GOV.UK", "category": "data_leak", "consent_burden": "contested", "note": "UK government services portal — browsing patterns reveal benefit claims, visa applications, tax filings, and health needs", "docs_url": "https://www.gov.uk/help/privacy-notice" },
802
785
  "www.gov.uk/dwp": { "company": "DWP (UK)", "service": "UK Department for Work and Pensions", "category": "data_leak", "consent_burden": "required", "note": "UK benefits and social security portal — browsing reveals claimant status and benefit types", "docs_url": "https://www.gov.uk/government/organisations/department-for-work-pensions/about/personal-information-charter" },
803
786
  "www.gstatic.com": { "company": "Google", "service": "Google Static Content", "category": "data_leak", "consent_burden": "minimal", "note": "Google static asset CDN — leaks visitor IP to Google on every page load", "docs_url": "https://policies.google.com/technologies/cookies" },
package/dist/actors/fingerprinting.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "category": "fingerprinting",
3
3
  "description": "Browser fingerprinting, device identification, cross-device tracking",
4
- "stats": { "cookies": 60, "domains": 145, "companies": 90 },
4
+ "stats": { "cookies": 61, "domains": 146, "companies": 93 },
5
5
  "cookies": {
6
6
  "TDID_v2": { "company": "The Trade Desk", "service": "The Trade Desk Unified ID 2.0", "category": "fingerprinting", "description": "The Trade Desk UID2 cookie for cookieless identity resolution using hashed email addresses", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://www.thetradedesk.com/general/privacy" },
7
7
  "_1p_uid": { "company": "1plusX (Triton Digital)", "service": "1plusX First-Party ID", "category": "fingerprinting", "description": "1plusX first-party data platform cookie for predictive audience identity resolution without cookies", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://www.1plusx.com/privacy-policy/" },
@@ -11,6 +11,7 @@
11
11
  "_exp_did": { "company": "Experian", "service": "Experian Digital Identity", "category": "fingerprinting", "description": "Credit bureau digital identity cookie — uses credit file data on 245M+ US consumers for digital advertising and identity resolution", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://www.experian.com/privacy/marketing-services-privacy-policy" },
12
12
  "_fabrick_id": { "company": "Neustar (TransUnion)", "service": "Fabrick ID", "category": "fingerprinting", "description": "Neustar Fabrick identity resolution cookie linking online identifiers to offline consumer data for cross-device targeting", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://www.home.neustar/privacy" },
13
13
  "_iidt": { "company": "FingerprintJS", "service": "FingerprintJS Pro", "category": "fingerprinting", "description": "FingerprintJS device identity cookie for cross-session browser fingerprint persistence", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://fingerprint.com/privacy-policy/" },
14
+ "_nbz_fp": { "company": "Nebuchadnezzar Trust", "service": "Nebuchadnezzar Device Trust", "category": "fingerprinting", "consent_burden": "required_strict", "description": "Device-trust signal fed into anti-fraud RTB bid-shading; combines canvas fingerprint, audio context, and TLS handshake telemetry into a per-visitor confidence score.", "lifetime": "180 days" },
14
15
  "_netid_*": { "company": "NetID Foundation", "service": "NetID European Login", "category": "fingerprinting", "description": "European single sign-on identity cookie enabling cross-site tracking across participating European media properties", "consent_burden": "required_strict", "pattern": true, "lifetime": "1 year", "docs_url": "https://netid.de/en/privacy-policy/" },
15
16
  "_onetag_uid": { "company": "OneTag", "service": "OneTag Identity", "category": "fingerprinting", "description": "OneTag publisher monetization identity cookie for audience identification in programmatic advertising", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://www.onetag.com/privacy-policy/" },
16
17
  "_publir_*": { "company": "Publir", "service": "Publir Identity", "category": "fingerprinting", "description": "Publir publisher monetization identity cookie for ad stack optimization and visitor identification", "consent_burden": "required", "pattern": true, "lifetime": "1 year", "docs_url": "https://www.publir.com/privacy-policy/" },
@@ -29,13 +30,13 @@
29
30
  "bn_device_id": { "company": "Binance", "service": "Binance Device Fingerprint", "category": "fingerprinting", "description": "Binance device fingerprint cookie for exchange security and anti-fraud device recognition", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://www.binance.com/en/privacy" },
30
31
  "browsing-topics": { "company": "Google", "service": "Topics API (Privacy Sandbox)", "category": "fingerprinting", "description": "Chrome Topics API header — exposes visitor interest categories derived from recent browsing history to sites and ad tech vendors via the Sec-Browsing-Topics header", "consent_burden": "required_strict", "lifetime": "3 weeks", "docs_url": "https://developer.chrome.com/docs/privacy-sandbox/topics/" },
31
32
  "cb_device_id": { "company": "Coinbase", "service": "Coinbase Device Fingerprint", "category": "fingerprinting", "description": "Coinbase device identifier cookie for fraud prevention and cross-device account security fingerprinting", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://www.coinbase.com/legal/privacy" },
33
+ "cg_uuid": { "company": "CHEQ AI Technologies", "service": "CHEQ Click-Fraud / Bot Detection (cheq4ppc)", "category": "fingerprinting", "description": "CHEQ visitor identifier set by /tracker/tc_imp.gif endpoint with 'ch=cheq4ppc' marker. Hosted on rotating cloak domains (greencolumnart.com, etc.) — CHEQ provisions per-tenant first-party-looking domains specifically to evade tracker blocklists. Payload includes WebGL, GPU, fonts, plugins, screen, timezone, ~80 capability flags", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://chq.ai/privacy" },
32
34
  "connectId": { "company": "Yahoo/Verizon", "service": "Yahoo ConnectID", "category": "fingerprinting", "description": "Yahoo ConnectID persistent identifier for cross-site identity matching using hashed email addresses", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://legal.yahoo.com/xw/en/yahoo/privacy/" },
33
35
  "criteo_fpc": { "company": "Criteo", "service": "Criteo First-Party Identity", "category": "fingerprinting", "description": "Criteo first-party cookie enabling persistent identity for retargeting when third-party cookies are blocked", "consent_burden": "required_strict", "lifetime": "13 months", "docs_url": "https://www.criteo.com/privacy/" },
34
36
  "euid": { "company": "The Trade Desk", "service": "European Unified ID", "category": "fingerprinting", "description": "The Trade Desk EUID cookie — European version of UID2 for GDPR-compliant deterministic identity using hashed email", "consent_burden": "required_strict", "lifetime": "1 year", "docs_url": "https://www.thetradedesk.com/general/privacy" },
35
37
  "euid_*": { "company": "The Trade Desk", "service": "EUID (European UID)", "category": "fingerprinting", "description": "European Unified ID cookie — same email-to-ad-ID system as UID 2.0 but marketed as GDPR-compliant persistent cross-site tracking", "consent_burden": "required_strict", "pattern": true, "lifetime": "1 year", "docs_url": "https://euid.eu/en/privacy-policy" },
36
38
  "floc_*": { "company": "Google", "service": "FLoC (Deprecated)", "category": "fingerprinting", "description": "Federated Learning of Cohorts cookie — deprecated Google experiment that grouped users into behavioral cohorts for ad targeting. Cookies may persist from earlier Chrome versions.", "consent_burden": "required", "pattern": true, "lifetime": "7 days", "docs_url": "https://privacysandbox.com/proposals/floc/" },
37
39
  "fpjs_*": { "company": "FingerprintJS", "service": "FingerprintJS Pro", "category": "fingerprinting", "description": "FingerprintJS browser fingerprinting cookie for highly persistent device identification", "consent_burden": "required_strict", "pattern": true, "lifetime": "1 year", "docs_url": "https://fingerprint.com/privacy-policy/" },
38
- "gpp_sid": { "company": "IAB Tech Lab", "service": "IAB Global Privacy Platform", "category": "fingerprinting", "description": "IAB GPP section ID cookie identifying which privacy regulation sections apply to the current user", "consent_burden": "contested", "lifetime": "1 year", "docs_url": "https://iabtechlab.com/gpp/" },
39
40
  "gpp_v": { "company": "IAB Tech Lab", "service": "IAB Global Privacy Platform", "category": "fingerprinting", "description": "IAB GPP version cookie tracking consent framework version for multi-jurisdiction consent management", "consent_burden": "contested", "lifetime": "1 year", "docs_url": "https://iabtechlab.com/gpp/" },
40
41
  "hadronId_*": { "company": "Audigent", "service": "Audigent Hadron ID", "category": "fingerprinting", "description": "Audigent Hadron real-time identity enrichment cookie combining device signals with contextual data for cookieless targeting", "consent_burden": "required_strict", "pattern": true, "lifetime": "1 year", "docs_url": "https://audigent.com/privacy-policy/" },
41
42
  "id5": { "company": "ID5", "service": "ID5 Universal ID", "category": "fingerprinting", "description": "ID5 universal identifier cookie for cross-publisher identity resolution in programmatic advertising", "consent_burden": "required_strict", "lifetime": "90 days", "docs_url": "https://id5.io/privacy" },
@@ -66,6 +67,7 @@
66
67
  },
67
68
  "domains": {
68
69
  "1plusx.com": { "company": "1plusX (Triton Digital)", "service": "1plusX Platform", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://www.1plusx.com/privacy-policy/" },
70
+ "a.usbrowserspeed.com": { "company": "Experian (Tapad)", "service": "Tapad Cross-Device Identity", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Cookie-sync endpoint disguised as 'browser speed' service. URL params expose 'purpose=Retargeting + ID Resolution' and partner identifiers. Tapad was acquired by Experian in 2020 — same cross-device identity-graph product, rebranded. NOT New Relic (separate vendor with different cookie/domain naming)", "docs_url": "https://www.experian.com/privacy/marketing-services-privacy-policy" },
69
71
  "accessibe.com/fingerprint": { "company": "accessiBe", "service": "accessiBe Device Fingerprinting", "category": "fingerprinting", "consent_burden": "required_strict", "note": "accessiBe accessibility overlay fingerprinting — collects device and browser characteristics under the guise of accessibility adaptation, creating persistent device fingerprints. Disability rights advocates have widely criticized this practice.", "docs_url": "https://accessibe.com/privacy-policy" },
70
72
  "acr.lgads.tv": { "company": "LG Electronics", "service": "LG ACR (Automatic Content Recognition)", "category": "fingerprinting", "consent_burden": "required_strict", "note": "LG Smart TV automatic content recognition — monitors and fingerprints content displayed on LG webOS TVs for viewer profiling and cross-device ad targeting", "docs_url": "https://www.lgads.tv/privacy-policy/" },
71
73
  "acr.samsungads.com": { "company": "Samsung", "service": "Samsung ACR (Automatic Content Recognition)", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Samsung Smart TV automatic content recognition — fingerprints TV content for viewer profiling and ad targeting across Samsung's 50M+ connected TVs", "docs_url": "https://www.samsung.com/us/account/privacy-policy/" },
@@ -164,6 +166,7 @@
164
166
  "fencedframes.googleapis.com": { "company": "Google", "service": "Fenced Frames (Privacy Sandbox)", "category": "fingerprinting", "consent_burden": "required", "note": "Fenced Frames — isolated rendering context for ads that prevents the embedding site from accessing the ad's network data, but still enables cross-site ad serving", "docs_url": "https://developer.chrome.com/docs/privacy-sandbox/fenced-frame/" },
165
167
  "fingerprint.com": { "company": "FingerprintJS", "service": "FingerprintJS Pro", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://fingerprint.com/privacy-policy/" },
166
168
  "fpjs.io": { "company": "FingerprintJS", "service": "FingerprintJS Pro", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://fingerprint.com/privacy-policy/" },
169
+ "greencolumnart.com": { "company": "CHEQ AI Technologies", "service": "CHEQ Click-Fraud / Bot Detection (cheq4ppc)", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Cloak domain operated by CHEQ. CHEQ provisions per-tenant first-party-looking domains (greencolumnart.com, oddstudious.com, etc.) specifically to evade tracker blocklists. Path signatures: /ct, /mon, /tracker/tc_imp.gif, /i/<hex>.js. Cookie: cg_uuid. URL marker: 'ch=cheq4ppc'", "docs_url": "https://chq.ai/privacy" },
167
170
  "id.rlcdn.com": { "company": "LiveRamp", "service": "LiveRamp ATS Identity", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://liveramp.com/privacy/" },
168
171
  "id.roku.com": { "company": "Roku", "service": "Roku Identity Graph", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Roku identity resolution — links Roku device IDs to household identity for cross-screen ad targeting using ACR data from 80M+ active accounts", "docs_url": "https://www.roku.com/en-us/legal/privacy-policy" },
169
172
  "id5-sync.com": { "company": "ID5", "service": "ID5 Cookie Sync", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://id5.io/privacy" },
@@ -187,12 +190,10 @@
187
190
  "parakeet.azurewebsites.net": { "company": "Microsoft", "service": "PARAKEET (Microsoft Privacy Sandbox)", "category": "fingerprinting", "consent_burden": "required", "note": "Microsoft PARAKEET proposal — alternative to Google's Privacy Sandbox using a proxy-based approach where Microsoft intermediates between advertisers and users", "docs_url": "https://github.com/nickhbg/nickhbg.github.io/blob/master/nickhbg-parakeet/README.md" },
188
191
  "pippio.com": { "company": "LiveRamp (Pippio)", "service": "LiveRamp Pippio", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://liveramp.com/privacy/" },
189
192
  "pixel.tapad.com": { "company": "Tapad", "service": "Tapad Device Graph", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://www.tapad.com/privacy" },
190
- "prebid.adnxs.com": { "company": "Microsoft (Xandr)", "service": "Xandr Prebid Server", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://www.xandr.com/privacy/platform-privacy-policy/" },
191
193
  "privacysandbox.googleapis.com": { "company": "Google", "service": "Google Privacy Sandbox API", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Google Privacy Sandbox central endpoint — coordinates Topics API, Attribution Reporting, Protected Audience, and other post-cookie tracking APIs that replace third-party cookies with browser-mediated surveillance", "docs_url": "https://privacysandbox.com/" },
192
194
  "reactor.chainalysis.com": { "company": "Chainalysis", "service": "Chainalysis Reactor", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Chainalysis Reactor investigation tool — clusters wallet addresses, maps transaction flows, and links blockchain activity to real-world entities for law enforcement", "docs_url": "https://www.chainalysis.com/privacy-policy/" },
193
195
  "reports.attribution-reporting.googleapis.com": { "company": "Google", "service": "Attribution Reporting Reports", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://developer.chrome.com/docs/privacy-sandbox/attribution-reporting/" },
194
196
  "retargetly.com": { "company": "Retargetly", "service": "Retargetly LATAM DMP", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Latin American data management platform for audience profiling across regional markets", "docs_url": "https://retargetly.com/privacy-policy/" },
195
- "sdk.privacy-center.org": { "company": "IAB Tech Lab", "service": "IAB GPP (Global Privacy Platform)", "category": "fingerprinting", "consent_burden": "contested", "note": "IAB Global Privacy Platform — standardizes consent signals but also enables identity resolution through consent-based tracking frameworks", "docs_url": "https://iabtechlab.com/gpp/" },
196
197
  "secure.adnxs.com": { "company": "Microsoft (Xandr)", "service": "Xandr Ad Serving", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://www.xandr.com/privacy/platform-privacy-policy/" },
197
198
  "security.kraken.com": { "company": "Kraken", "service": "Kraken Device Verification", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Kraken exchange device verification endpoint using browser fingerprinting for account security", "docs_url": "https://www.kraken.com/legal/privacy" },
198
199
  "sharedid.org": { "company": "Prebid/SharedID", "service": "SharedID (Prebid)", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Prebid SharedID provides first-party identity for header bidding across publishers", "docs_url": "https://docs.prebid.org/dev-docs/modules/userid-submodules/sharedid.html" },
@@ -206,6 +207,7 @@
206
207
  "topics.googleapis.com": { "company": "Google", "service": "Topics API (Privacy Sandbox)", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Topics API — replaces FLoC by categorizing users into interest-based topics from browsing history. Sites can query browsing-topics header to learn visitor interests without cookies.", "docs_url": "https://developer.chrome.com/docs/privacy-sandbox/topics/" },
207
208
  "track.adform.net": { "company": "Adform", "service": "Adform Tracking", "category": "fingerprinting", "consent_burden": "required_strict", "docs_url": "https://site.adform.com/privacy-center/" },
208
209
  "tracking.1plusx.com": { "company": "1plusX (Triton Digital)", "service": "1plusX Predictive Audiences", "category": "fingerprinting", "consent_burden": "required_strict", "note": "1plusX first-party data platform using predictive modeling for audience ID resolution", "docs_url": "https://www.1plusx.com/privacy-policy/" },
210
+ "usbrowserspeed.com": { "company": "Experian (Tapad)", "service": "Tapad Cross-Device Identity", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Cookie-sync domain disguised as a 'browser speed' service. Real product: Tapad cross-device identity graph (acquired by Experian, 2020). Catches a.usbrowserspeed.com and other subdomains via subdomain match. NOT New Relic", "docs_url": "https://www.experian.com/privacy/marketing-services-privacy-policy" },
209
211
  "userpilot.com": { "company": "Userpilot", "service": "Userpilot", "category": "fingerprinting", "consent_burden": "contested", "note": "Product adoption platform that fingerprints users for cross-session identification", "docs_url": "https://userpilot.com/privacy-policy" },
210
212
  "utiq.com": { "company": "Utiq", "service": "Utiq Telco Consent ID", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Utiq (European telco consortium) authenticated consent signal using network-level identity", "docs_url": "https://utiq.com/privacy/" },
211
213
  "wurfl.io": { "company": "ScientiaMobile", "service": "WURFL Device Detection", "category": "fingerprinting", "consent_burden": "required_strict", "note": "Wireless Universal Resource FiLe — industry-standard device fingerprinting database. Identifies 60,000+ device types from HTTP headers for content optimization and ad targeting.", "docs_url": "https://www.scientiamobile.com/privacy/" },