{
  "id": "DPE-2026-0011",
  "name": "Tag loaded outside the source",
  "family": "method",
  "summary": "Tags fire from a container while appearing nowhere in the page source.",
  "mechanism": {
    "what": "A tag manager loads measurement or advertising tags at runtime. The identifiers of those tags are not in the delivered HTML, so reading the source suggests they are gone while the traffic shows otherwise.",
    "why_it_matters": "Mostly a methodological trap rather than a harm in itself, and that is why it is catalogued. A researcher who checks only the source concludes that tracking stopped when it did not. It also means the operator can change what runs without any change to the site.",
    "common_causes": [
      "tags migrated from hardcoded to container-managed",
      "marketing team with dashboard access and no deployment"
    ],
    "not_this": "Not every container is this entry. It applies when a tag observed in traffic cannot be found in the delivered source."
  },
  "detection": {
    "indicator": "A property or measurement identifier present in network traffic and absent from the fetched HTML document. A set comparison, not an observation.",
    "method": "differential",
    "qod": 97,
    "capture_requirements": [
      "fetch and retain the HTML document in the same capture",
      "search for the full identifier and for split forms; dynamic assembly would otherwise be missed"
    ],
    "attribution": [
      "cdp-initiator",
      "har-pageref"
    ]
  },
  "falsifiers": [
    {
      "condition": "The identifier is present in the source but assembled dynamically.",
      "checkable": "automated",
      "if_true": "drop"
    },
    {
      "condition": "The initiator is another script rather than the container.",
      "checkable": "automated",
      "if_true": "reclassify"
    }
  ],
  "reproduction": {
    "methods": [
      {
        "tier": "manual",
        "path": "METHOD.md",
        "expect": "no dedicated reproduction exists yet; follow the general method and the indicator above"
      },
      {
        "tier": "script",
        "path": "repro/web/check.mjs",
        "expect": "the run reports DPE-2026-0011 as present, with the detail behind it"
      }
    ],
    "public_scanners": [
      "urlscan.io"
    ]
  },
  "legal": {
    "provisions": [
      "eu-gdpr-6-1-a"
    ],
    "rebuttals": [
      {
        "objection": "We removed the tracking; it is not in our code.",
        "answer": "Absence from the source is not absence from the traffic. The container is the reliable indicator, and its version history shows what ran when."
      }
    ]
  },
  "related": [
    "DPE-2026-0001"
  ],
  "seen_in_the_wild": {
    "confirmed": false,
    "note": "Observed in practice by the authors but not yet backed by a published reference. Set to false until a citation exists: a claim without a source is exactly what this catalogue holds others to."
  },
  "schema_version": "2.0",
  "applies_to": [
    "web"
  ],
  "status": "active",
  "credit": [
    {
      "name": "Mick Beer",
      "role": "proposed",
      "date": "2026-07-26"
    }
  ],
  "does_not_establish": [
    "harm; the catalogue standardises a finding so it can be referred to, it does not weigh it",
    "severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case",
    "unlawfulness; that is for a supervisory authority or a court",
    "intent; a fault is usually a build decision, not a plan",
    "absence: not finding it in one capture is not evidence that it is not there"
  ],
  "changes": [
    {
      "at": "2026-07-26T00:00:00Z",
      "actor": "registry",
      "entries": [
        "Entry created.",
        "Name assigned.",
        "Detection method and falsifiers defined.",
        "Legal provisions linked."
      ]
    }
  ],
  "slug": "tag-loaded-outside-source",
  "name_nl": "Tag buiten de broncode",
  "summary_nl": "Tags vuren vanuit een container terwijl ze nergens in de broncode staan.",
  "in_practice": {
    "dpia": "Verify what fires at runtime rather than reading the page source, and require the container version history.",
    "procurement": "The supplier delivers the tag container version history alongside the site, so what ran when is auditable.",
    "complaint": "A capture showing an identifier in traffic that is absent from the fetched HTML.",
    "audit_question": "Which tags does your container load that are not in the source, and who can change them?",
    "audit_question_nl": "Welke tags laadt uw container die niet in de broncode staan, en wie mag die wijzigen?",
    "complaint_nl": "Een opname of uitdraai die laat zien wat er werkelijk gebeurt, met de datum erbij en het land van waaruit is gemeten.",
    "objection_nl": "Wij hebben de tracking verwijderd, het staat niet in onze code.",
    "answer_nl": "Afwezig in de broncode is niet afwezig in het verkeer. De container is de betrouwbare indicator."
  }
}