Technology categories
| Observed technology | What to investigate |
|---|---|
| Session replay | Whether actual contents were captured or masked; whether and when they left the browser; recipient role and consent. |
| Advertising and analytics pixels | Request fields, identifiers, URLs, events, recipient and timing. Routine metadata does not automatically establish content interception. |
| Chat widgets and AI services | Actual interaction, disclosures, recipients, recording, confidentiality and vendor role. Merely loading chat software is insufficient. |
| Identity resolution and RTB | Observed destinations versus inferred downstream transfers; identifiers and evidence of sensitive cross-site profiling. |
| Fingerprinting and biometrics | Distinguish device signals from enumerated biometric identifiers. Determine what the defendant actually receives. |
WebAuthn is not proof of biometric collection
WebAuthn authenticators can verify users locally; the website relying party does not ordinarily receive biometric data. A WebAuthn API or typing-cadence signature is not, by itself, a BIPA violation. Remote face/voice products require their own coverage and collection analysis. W3C WebAuthn biometric privacy.
Verify the deployment
A vendor documentation page describes possible capabilities. Establish the configuration and payload observed on the selected run before attributing a capability to a real business. Retain original requests, responses, initiators, timestamps, storage state and the relevant page interaction. Identify evidence gaps explicitly.
Observe before inferring
A request to one vendor is not proof that every partner received the same information. Label downstream relationships as research leads unless supported by captured traffic, vendor records or discovery. Network captures also do not prove server-side use after receipt.
Standing is a separate inquiry
Popa v. Microsoft (9th Cir. 2025) rejected automatic federal standing from ordinary session-replay shopping data. Fons v. Grocery Outlet (N.D. Cal. Sept. 24, 2026) found an allegedly ignored Reject All choice insufficient on the ordinary-data facts there. Neither a tracker signature nor a broken banner establishes a person's concrete injury. Sensitive data and cross-site profiling require factual proof; a business category is not proof of sensitive disclosure.
Using Discover
Discover supplies technical observations and research questions for attorney review. Historical catalogue entries are not automatically available for purchase. The reviewed-package pilot requires a defined scan, checked artifacts and human review; availability and delivery dates are confirmed individually. View the synthetic sample or discuss a pilot investigation.
Deliberize LLC is a technology company, not a law firm. These materials are not legal advice and do not establish a violation, admissibility, standing, class certification or recovery. Legal reference date: October 5, 2026.