Bookcicle Labs · Scoring Engine 2026-09-v2 · Session Surveillance
Session Replay & Keystroke Recording
-25 pts Critical RiskSession replay scripts (such as FullStory, Hotjar, Contentsquare, LogRocket, and Microsoft Clarity) record your entire interaction on a webpage. They capture every cursor movement, mouse click, page scroll, mobile touch gesture, and keystroke in real time, transmitting a continuous stream of DOM mutation snapshots back to cloud analytics servers where operators can watch a DVR-style playback of your screen.
How the Technique Works
1. DOM Mutation Observers
Replay SDKs attach MutationObserver listeners to the root document. Every time text changes, a modal opens, or an element shifts, the script records the exact HTML delta and serializes the DOM state.
2. Mouse & Touch Coordinate Streaming
High-frequency event listeners record the (x, y) coordinates, timestamps, and target elements of every mouse move, hover, wheel scroll, and multi-touch tap, compressing them into telemetry packets sent every few seconds.
3. Form Input Logging & Keypress Trapping
Even before you click 'Submit', keystroke events (input, keydown, change) log the characters you type into forms, including search bars, checkout fields, and profile settings.
4. Screen Reconstruction
Cloud servers reconstruct the recorded DOM states, CSS styling, and recorded mouse coordinates into a high-fidelity visual movie that recreates everything you saw and did on the page.
How Replay Data and Customer Insights Are Syndicated
While session replay is often marketed to web developers as "user experience analytics", the data captured is extraordinarily intimate. Replay vendors frequently partner with customer data platforms (CDPs) like Segment, Tealium, and mParticle, synchronizing individual session recordings with CRM profiles, email marketing databases, and third-party advertising identifiers.
Furthermore, because masking rules for sensitive form fields frequently fail or are improperly configured by developers, session replay packets routinely leak sensitive personal information—including passwords, social security numbers, banking account balances, credit card fragments, and private medical questions—directly into third-party cloud logs.
Common Data Partners & Intermediaries
- Session replay cloud hosting providers and telemetry processing clusters
- Customer Data Platforms (CDPs) linking video playbacks to customer IDs
- Advertising attribution networks validating ad-click conversion journeys
- Third-party customer service and chat widgets ingesting replay streams
The Direct Risk to You
- Inadvertent leakage of Personally Identifiable Information (PII), medical queries, and financial inputs.
- Surveillance of draft messages, abandoned purchases, and deleted text you never meant to submit.
- Security vulnerabilities where compromised third-party replay scripts expose session tokens and confidential data.
- Complete erosion of user autonomy while browsing sensitive commercial or personal websites.
How Your Privacy Scores It
Your Privacy audits all loaded script URLs and DOM mutations against an authoritative signature database of known session replay engines. If any session replay SDK is detected recording page interactions, Engine 2026-09-v2 imposes a strict -25 point deduction.
Explore Other Penalized Vectors
Fingerprinting
Canvas & audio probing
-30 ptsPlatform Risk
Walled garden monopolies
-15 pts / trackerBehavioral Trackers
Ad network auctions
-8 pts / domainTracking Cookies
Cookie syncing & state
-5 pts / domainThird-Party Domains
IP & referrer leakage
-10 ptsTelemetry Beacons
Server-side proxies