Not a vulnerabilityThe component works exactly as documented by its maker. There is no flaw to fix, only a decision to include it, and vulnerability registers have nowhere to record a decision.
What it is
An application ships a third-party library that, beyond the service it provides to the app, gathers device identifiers, installed applications, location or contacts and sends them to its own infrastructure. The developer may not have read what it does.
Why it is a separate entry
The user chose the app, not the passenger. The collection continues in the background, is invisible in the interface, and often reaches parties that trade in the data rather than use it.
How it arises
analytics or advertising SDK with collection enabled by default
monetisation library added for revenue rather than function
component inherited from a framework or a white-label build
Not to be confused with
A processor library operating strictly on the developer's instructions is not this entry. The distinguishing feature is collection on the component's own account.
How to establish it
Outbound requests from the application to hosts of a bundled component, carrying device or user identifiers, at moments unrelated to any user action in that app.
method network-with-identifierQoD 95
Requirements on the measurement
intercept on the device with a trusted proxy; certificate pinning may need addressing and that fact belongs in the write-up
start from a fresh install and record what happens before the first screen is dismissed
list the bundled components statically as well, so traffic can be matched to a component
What would refute it
by handThe traffic serves the function the user invoked.finding falls
by handThe identifiers are resettable and not tied to the device permanently.weakens
by handThe component is configured to collect nothing and the traffic is a heartbeat only.weakens
Where this plugs into existing processes
The one question that surfaces itList every third-party library you ship and what each one sends home.
In a DPIA, verify this
Inventory the bundled components and what each contacts, rather than reviewing only the application's own code.
As a procurement clause
The supplier delivers a component inventory listing every bundled library and the hosts it contacts.
With a complaint, hand over
A static inventory plus a capture from a fresh install before the first screen is dismissed.
Reproduction
METHOD.md · by hand · no dedicated reproduction exists yet; follow the general method and the indicator above
Legal framing
eu-gdpr-6-1-a
eu-gdpr-44
Case law
cjeu-fashion-id
Objections, and the answer
“The SDK is the supplier's responsibility.”
The developer decided to ship it. Fashion ID holds that arranging for data to reach a third party makes you jointly responsible for that reaching.
“We only use it for crash reporting.”
Then the traffic should be limited to crashes. Establish what the payload contains when nothing has crashed.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0013: Bundled component collection. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0013
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0013, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.