{
  "id": "DPE-2026-0010",
  "name": "Undisclosed recipient",
  "family": "transparency",
  "summary": "A recipient of personal data is missing from the party's own privacy statement.",
  "mechanism": {
    "what": "Measurement shows data going to a party that the published privacy statement does not mention, or the statement asserts something the traffic contradicts, such as that no personal data is processed or that all recipients are inside the EEA.",
    "why_it_matters": "The statement is the one place a person can check what happens to their data. If it is wrong, informed consent is impossible by construction, and every other control rests on nothing.",
    "common_causes": [
      "statement not updated when the measurement setup changed",
      "tags added by a team that does not maintain the statement"
    ],
    "not_this": "This is not about whether the processing was lawful. It is about the gap between the measurement and the party's own account of it."
  },
  "detection": {
    "indicator": "Set difference: recipients observed in the capture minus recipients named in the privacy statement of the same date is non-empty. Both sources belong to the party; the researcher only does the arithmetic.",
    "method": "document-comparison",
    "qod": 97,
    "capture_requirements": [
      "use the statement as it stood on the measurement date, from an archive",
      "search the whole statement and any cookie overview, not just the recipients list"
    ],
    "attribution": [
      "document-diff",
      "har-pageref"
    ]
  },
  "falsifiers": [
    {
      "condition": "The recipient is named elsewhere in the statement or in a linked cookie overview.",
      "checkable": "manual",
      "if_true": "drop"
    },
    {
      "condition": "The statement was updated outside the measured window.",
      "checkable": "manual",
      "if_true": "drop"
    }
  ],
  "reproduction": {
    "methods": [
      {
        "tier": "manual",
        "path": "METHOD.md",
        "expect": "no dedicated reproduction exists yet; follow the general method and the indicator above"
      }
    ],
    "public_scanners": [
      "wayback",
      "urlscan.io"
    ]
  },
  "legal": {
    "provisions": [
      "eu-gdpr-6-1-a"
    ],
    "rebuttals": [
      {
        "objection": "The statement is generic on purpose.",
        "answer": "Article 13 requires the recipients or categories of recipients. A statement that omits a category entirely is not generic but incomplete."
      }
    ]
  },
  "seen_in_the_wild": {
    "confirmed": false,
    "note": "Observed in practice by the authors but not yet backed by a published reference. Set to false until a citation exists: a claim without a source is exactly what this catalogue holds others to."
  },
  "schema_version": "2.0",
  "applies_to": [
    "web"
  ],
  "status": "active",
  "credit": [
    {
      "name": "Mick Beer",
      "role": "proposed",
      "date": "2026-07-26"
    }
  ],
  "does_not_establish": [
    "harm; the catalogue standardises a finding so it can be referred to, it does not weigh it",
    "severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case",
    "unlawfulness; that is for a supervisory authority or a court",
    "intent; a fault is usually a build decision, not a plan",
    "absence: not finding it in one capture is not evidence that it is not there"
  ],
  "changes": [
    {
      "at": "2026-07-26T00:00:00Z",
      "actor": "registry",
      "entries": [
        "Entry created.",
        "Name assigned.",
        "Detection method and falsifiers defined.",
        "Legal provisions linked."
      ]
    }
  ],
  "slug": "undisclosed-recipient",
  "name_nl": "Niet-vermelde ontvanger",
  "summary_nl": "Een ontvanger van persoonsgegevens ontbreekt in de eigen privacyverklaring van de partij.",
  "in_practice": {
    "dpia": "Compare the measured recipients against the recipients named in the published privacy statement of the same date.",
    "procurement": "Every party receiving personal data is named in the published statement, verified against a capture on delivery.",
    "complaint": "A capture of recipients plus the archived statement of that date, and the set difference between them.",
    "audit_question": "Name every party that receives data, then let me check that against the traffic.",
    "audit_question_nl": "Noem elke partij die gegevens ontvangt, dan leg ik dat naast het verkeer.",
    "complaint_nl": "Een opname of uitdraai die laat zien wat er werkelijk gebeurt, met de datum erbij en het land van waaruit is gemeten.",
    "objection_nl": "De verklaring is bewust algemeen gehouden.",
    "answer_nl": "De wet vraagt de ontvangers of categorieen ervan. Een categorie die ontbreekt is niet algemeen maar onvolledig."
  }
}