Benjamin Admin
6c223c7c9b
CI / detect-changes (push) Successful in 10s
CI / branch-name (push) Has been skipped
CI / guardrail-integrity (push) Has been skipped
CI / secret-scan (push) Has been skipped
CI / dep-audit (push) Has been skipped
CI / sbom-scan (push) Has been skipped
CI / validate-canonical-controls (push) Successful in 14s
CI / loc-budget (push) Failing after 15s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / nodejs-build (push) Successful in 2m43s
CI / test-go (push) Has been skipped
CI / iace-gt-coverage (push) Has been skipped
CI / test-python-backend (push) Successful in 37s
CI / test-python-document-crawler (push) Has been skipped
CI / test-python-dsms-gateway (push) Has been skipped
P1 — Exec-Summary oben im Email-Report (4 KPIs + 2 CTAs, dunkler Gradient)
P3 — no_direct_sales-Flag fuer OEM-Konfigurator-Sites; AGB/Widerruf/AGB als
"NICHT ANWENDBAR" (grau) statt "NICHT GEFUNDEN" (rot)
P5 — Voll-Audit Unification: alle Findings (MC + Pflichtangaben + Vendor +
Redundanz) in /data/compliance_audits.db.unified_findings; neuer
/api/compliance/agent/findings/<id> Endpoint + FindingsTab im Audit-UI
mit Filter + CSV-Export
P7 — Crawl-Hardening: TDM-Reservation-Check (robots.txt / ai.txt / Header /
Meta) vor jedem Run mit 24h-Cache; HeadlessChrome-UA (Firma noch nicht
gegruendet — Switch via BREAKPILOT_BRANDED_UA env); per-Domain
Rate-Limit 1 req/s + max 2 concurrent
P2 — Cookie-Knowledge-DB additiv erweitert (35 -> 74 Cookies): Adobe, Meta,
Microsoft, LinkedIn, TikTok, HubSpot, Marketo, Salesforce, Hotjar,
FullStory, Mouseflow, Intercom, Drift, Zendesk, Cloudflare, Stripe,
OneTrust/Cookiebot/Usercentrics, Matomo, Pinterest, Snapchat, X/Twitter,
YouTube, Vimeo, Klaviyo, Mailchimp, Mixpanel, Segment, Amplitude,
Optimizely, Datadog; Wire-in in cookie_function_classifier liefert
compliance_risk-Label (kritisch/hoch/mittel/gering) pro Vendor
A — k-Anonymitaets-Helper (benchmark_k_anonymity) fuer P6-Vorbereitung
B — Cross-Tenant-Domain-Assertion im /findings-Endpoint (expected_domain
Query-Param -> 403 bei Mismatch)
C — Saving-Scan-Funnel: /api/compliance/agent/saving-scan/start mit
Validierung + 24h-Rate-Limit pro Domain + Lead-Persistenz in
saving_scan_leads + Auto-Discovery via _run_compliance_check; 6 Tests
D — Risk-Badge im Email-Vendor-Row
Rechtliche Leitplanken (Memory feedback_oem_data_legal.md): nur eigene
Knapp-Bewertungen + Source-Pointer, keine 1:1-Kopien fremder CMP-Texte.
TDM-Opt-Out-Respect nach § 44b UrhG. KEINE Schema-Aenderungen — alles in
Sidecar-SQLite.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
498 lines
22 KiB
Python
498 lines
22 KiB
Python
"""
|
|
Cookie-Knowledge Erweiterung — Adobe, Meta erweitert, Microsoft, LinkedIn,
|
|
TikTok, Salesforce/HubSpot/Marketo, Hotjar/Mouseflow/FullStory, Live-Chat,
|
|
Cloudflare/Akamai, Payment, CMP-eigene Cookies, EU-Analytics.
|
|
|
|
Hinweis zu Rechten: Eintraege enthalten ausschliesslich Identitaetsfelder
|
|
(Cookie-Name, Anbieter, Sitzland) + EIGENE Knappformulierungen + Verweise
|
|
auf oeffentliche EuGH-/CNIL-/EDPB-Quellen. KEINE 1:1-Kopien aus OneTrust,
|
|
Cookiepedia oder Vendor-eigenen Beschreibungstexten.
|
|
|
|
Quellen-Pointer: IAB TCF v2.2 Vendor List, CNIL Cookies & Trackers
|
|
Guidelines 2024, EDPB Guidelines 2/2023, EuGH-Rechtsprechung (Schrems II,
|
|
Planet49), DSK-Orientierungshilfen 2021/2024.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from compliance.services.cookie_knowledge_db import CookieKnowledge
|
|
|
|
|
|
_ADOBE_BASE = {
|
|
"vendor": "Adobe Inc.", "vendor_country": "US",
|
|
"schrems_ii_status": "Drittlandtransfer US. Mit DPF (2023) wieder "
|
|
"zulaessig; EU-Datenresidenz-Option in Adobe "
|
|
"Experience Platform verfuegbar.",
|
|
"eugh_rulings": [
|
|
"EuGH C-311/18 (Schrems II)",
|
|
"EDPB Recommendations 01/2020 — Supplementary Measures",
|
|
],
|
|
}
|
|
|
|
_META_BASE = {
|
|
"vendor": "Meta Platforms Ireland Ltd.", "vendor_country": "IE",
|
|
"schrems_ii_status": "Verarbeitung in IE + US-Transfer. DPC Ireland "
|
|
"Bussgeld 2023 (€1,2 Mrd) wegen unzureichender "
|
|
"Schutzmassnahmen — DPF deckt seit 2023.",
|
|
"eugh_rulings": [
|
|
"EuGH C-311/18 (Schrems II)",
|
|
"DPC Ireland 2023 — Meta 1,2 Mrd. EUR",
|
|
],
|
|
}
|
|
|
|
_MICROSOFT_BASE = {
|
|
"vendor": "Microsoft Corp.", "vendor_country": "US",
|
|
"schrems_ii_status": "DPF-zertifiziert; EU Data Boundary fuer Azure/365 "
|
|
"seit 2024 verfuegbar.",
|
|
"eugh_rulings": ["EuGH C-311/18 (Schrems II)"],
|
|
}
|
|
|
|
_LINKEDIN_BASE = {
|
|
"vendor": "LinkedIn Ireland Unlimited Co.", "vendor_country": "IE",
|
|
"schrems_ii_status": "Microsoft-Konzern, EU-Hauptsitz IE, Transfer US.",
|
|
"eugh_rulings": ["EuGH C-311/18 (Schrems II)"],
|
|
}
|
|
|
|
|
|
KB_EXT: dict[str, CookieKnowledge] = {
|
|
|
|
# --- Adobe Experience Cloud --------------------------------------
|
|
# AMCV_, s_cc, s_sq leben in Base-KB.
|
|
"demdex": {
|
|
**_ADOBE_BASE,
|
|
"vendor": "Adobe Inc. (Audience Manager)",
|
|
"exact_purpose": "Adobe Audience Manager DMP — Cross-Site-Profil "
|
|
"fuer Zielgruppen-Segmentierung.",
|
|
"data_collected": ["dpuuid", "segments"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9, 10],
|
|
"typical_lifetime": "180 Tage",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
},
|
|
|
|
# --- Meta erweitert -----------------------------------------------
|
|
# fr, _fbc leben in Base-KB.
|
|
"datr": {
|
|
**_META_BASE,
|
|
"exact_purpose": "Facebook Browser-Identifier — Anti-Abuse/Bot-Schutz.",
|
|
"data_collected": ["browser_fingerprint_id"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "2 Jahre",
|
|
"reid_risk": "high", "technical_necessity": "partial",
|
|
"notes": "Wird auch ohne Consent gesetzt; Meta argumentiert "
|
|
"Sicherheit. Trotzdem von DSK 2024 kritisch bewertet.",
|
|
},
|
|
# --- Microsoft / Bing ---------------------------------------------
|
|
# MUID lebt in Base-KB.
|
|
"MSCC": {
|
|
**_MICROSOFT_BASE,
|
|
"exact_purpose": "Microsoft Site Consent — Consent-Status-Speicherung "
|
|
"fuer Microsoft-eigene Properties.",
|
|
"data_collected": ["consent_string"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "low", "technical_necessity": "full",
|
|
"notes": "Strictly necessary nach §25(2) TDDDG.",
|
|
},
|
|
"ai_session": {
|
|
**_MICROSOFT_BASE,
|
|
"vendor": "Microsoft Corp. (Application Insights)",
|
|
"exact_purpose": "Azure Application Insights — Session-Tracking fuer "
|
|
"Telemetry.",
|
|
"data_collected": ["session_id"],
|
|
"typical_lifetime": "30 Minuten",
|
|
"reid_risk": "medium", "technical_necessity": "partial",
|
|
},
|
|
|
|
# --- LinkedIn ------------------------------------------------------
|
|
"li_at": {
|
|
**_LINKEDIN_BASE,
|
|
"exact_purpose": "LinkedIn-Authentifizierung — Login-Session.",
|
|
"data_collected": ["auth_token"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high", "technical_necessity": "full",
|
|
"notes": "Nur fuer eingeloggte Nutzer; auf externer Site = "
|
|
"Insight Tag (siehe li_sugr).",
|
|
},
|
|
"li_sugr": {
|
|
**_LINKEDIN_BASE,
|
|
"exact_purpose": "LinkedIn Insight Tag — Browser-ID fuer "
|
|
"Conversion-Tracking + Werbe-Targeting.",
|
|
"data_collected": ["browser_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [7, 9, 10],
|
|
"typical_lifetime": "90 Tage",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
},
|
|
# bcookie, lidc leben in Base-KB.
|
|
|
|
# --- TikTok --------------------------------------------------------
|
|
"_ttp": {
|
|
"vendor": "TikTok Pte. Ltd.", "vendor_country": "SG/CN",
|
|
"exact_purpose": "TikTok Pixel — User-ID fuer Conversion-Tracking + "
|
|
"Werbeoptimierung.",
|
|
"data_collected": ["pixel_id", "browser_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [7, 9, 10],
|
|
"typical_lifetime": "13 Monate",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "Drittlandtransfer in Drittstaaten ohne "
|
|
"Angemessenheitsbeschluss. CNIL 2023 — "
|
|
"TikTok 5 Mio EUR Bussgeld.",
|
|
"eugh_rulings": [
|
|
"CNIL SAN-2022-027 — TikTok 5 Mio EUR",
|
|
"Italienische DPA 2024 — TikTok 10 Mio EUR",
|
|
],
|
|
},
|
|
"ttwid": {
|
|
"vendor": "TikTok Pte. Ltd.", "vendor_country": "SG/CN",
|
|
"exact_purpose": "TikTok Web-Identifier — eindeutige Browser-ID auch "
|
|
"ohne Login.",
|
|
"data_collected": ["ttwid"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "Wie _ttp.",
|
|
},
|
|
|
|
# --- HubSpot / Marketo / Salesforce ------------------------------
|
|
"hubspotutk": {
|
|
"vendor": "HubSpot Inc.", "vendor_country": "US",
|
|
"exact_purpose": "HubSpot User-Token — Cross-Visit-Identitaet fuer "
|
|
"Lead-Tracking.",
|
|
"data_collected": ["user_token"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [7, 8],
|
|
"typical_lifetime": "6 Monate",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-zertifiziert.",
|
|
},
|
|
"__hssc": {
|
|
"vendor": "HubSpot Inc.", "vendor_country": "US",
|
|
"exact_purpose": "HubSpot Session-Tracking — Pageviews innerhalb "
|
|
"einer Session.",
|
|
"data_collected": ["session_count"],
|
|
"typical_lifetime": "30 Minuten",
|
|
"reid_risk": "low", "technical_necessity": "none",
|
|
},
|
|
"_mkto_trk": {
|
|
"vendor": "Adobe Inc. (Marketo)", "vendor_country": "US",
|
|
"exact_purpose": "Marketo Munchkin-Tracker — Lead-Identifikation "
|
|
"fuer Marketing-Automation.",
|
|
"data_collected": ["munchkin_id", "session_id"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "2 Jahre",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": _ADOBE_BASE["schrems_ii_status"],
|
|
},
|
|
"BrowserId_sec": {
|
|
"vendor": "Salesforce.com Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Salesforce Marketing Cloud Browser-Token — "
|
|
"Cross-Visit-Identifikation.",
|
|
"data_collected": ["browser_id"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "medium", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-zertifiziert.",
|
|
},
|
|
|
|
# --- Session-Recording / Heatmaps ---------------------------------
|
|
"_hjSessionUser_": {
|
|
"vendor": "Hotjar Ltd.", "vendor_country": "MT",
|
|
"exact_purpose": "Hotjar User-ID — Cross-Visit-Identifikation fuer "
|
|
"Session-Recording + Heatmaps.",
|
|
"data_collected": ["user_id"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "EU (Malta) — kein Drittland. Aber: parent "
|
|
"Contentsquare (FR) hostet teilweise in US.",
|
|
"notes": "Suffix `<site_id>`. Pattern-Match noetig. "
|
|
"DSGVO-Aufzeichnung = Einwilligung pflichtig.",
|
|
"eu_alternative_vendor": "Mouseflow / Smartlook (CZ)",
|
|
},
|
|
"_hjSession_": {
|
|
"vendor": "Hotjar Ltd.", "vendor_country": "MT",
|
|
"exact_purpose": "Hotjar Session-Token — eindeutige Session-ID "
|
|
"innerhalb 30min Inaktivitaet.",
|
|
"data_collected": ["session_id"],
|
|
"typical_lifetime": "30 Minuten",
|
|
"reid_risk": "medium", "technical_necessity": "none",
|
|
},
|
|
"fs_uid": {
|
|
"vendor": "FullStory Inc.", "vendor_country": "US",
|
|
"exact_purpose": "FullStory User-ID — Cross-Visit-Identifikation "
|
|
"fuer Session-Replay.",
|
|
"data_collected": ["user_id"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-zertifiziert. EU-Region verfuegbar (opt-in).",
|
|
},
|
|
"mf_user": {
|
|
"vendor": "Mouseflow Aps", "vendor_country": "DK",
|
|
"exact_purpose": "Mouseflow User-ID — Cross-Visit-Identifikation fuer "
|
|
"Heatmap + Recording.",
|
|
"data_collected": ["user_id"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "medium", "technical_necessity": "none",
|
|
"schrems_ii_status": "EU (DK) — kein Drittland.",
|
|
},
|
|
|
|
# --- Live-Chat ----------------------------------------------------
|
|
"intercom-id-": {
|
|
"vendor": "Intercom Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Intercom Visitor-ID — Wiedererkennung anonymer "
|
|
"Besucher fuer Chat-History.",
|
|
"data_collected": ["visitor_id"],
|
|
"typical_lifetime": "9 Monate",
|
|
"reid_risk": "medium", "technical_necessity": "partial",
|
|
"schrems_ii_status": "DPF-zertifiziert; EU-Datenresidenz optional.",
|
|
"notes": "Suffix `<app_id>`. Pattern-Match noetig.",
|
|
},
|
|
"driftt_aid": {
|
|
"vendor": "Salesforce.com Inc. (Drift)", "vendor_country": "US",
|
|
"exact_purpose": "Drift Anonymous-Visitor-ID fuer Chat-Personalisierung.",
|
|
"data_collected": ["visitor_id"],
|
|
"typical_lifetime": "2 Jahre",
|
|
"reid_risk": "medium", "technical_necessity": "partial",
|
|
},
|
|
"__zlcmid": {
|
|
"vendor": "Zendesk Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Zendesk Chat Visitor-ID fuer Session-Tracking.",
|
|
"data_collected": ["chat_visitor_id"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "medium", "technical_necessity": "partial",
|
|
"schrems_ii_status": "DPF-zertifiziert; EU-Datacenter optional.",
|
|
},
|
|
|
|
# --- CDN / Sicherheit (strictly necessary) -----------------------
|
|
# __cf_bm, cf_clearance leben in Base-KB.
|
|
"AKA_A2": {
|
|
"vendor": "Akamai Technologies Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Akamai Adaptive Acceleration — geroutete Best-Path-"
|
|
"Optimierung.",
|
|
"data_collected": ["a2_route"],
|
|
"typical_lifetime": "1 Stunde",
|
|
"reid_risk": "low", "technical_necessity": "full",
|
|
},
|
|
|
|
# --- Payment (strictly necessary fuer Checkout) ------------------
|
|
"__stripe_mid": {
|
|
"vendor": "Stripe Payments Europe Ltd.", "vendor_country": "IE",
|
|
"exact_purpose": "Stripe Fraud-Detection Merchant-ID — Risiko-Scoring "
|
|
"fuer Zahlungs-Authentifizierung.",
|
|
"data_collected": ["merchant_visitor_id"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "low", "technical_necessity": "full",
|
|
"schrems_ii_status": "EU (IE) — kein Drittland.",
|
|
"notes": "Strictly necessary nach §25(2) TDDDG fuer Zahlungsabwicklung.",
|
|
},
|
|
"__stripe_sid": {
|
|
"vendor": "Stripe Payments Europe Ltd.", "vendor_country": "IE",
|
|
"exact_purpose": "Stripe Session-ID — temporaere Zahlungs-Session.",
|
|
"data_collected": ["session_id"],
|
|
"typical_lifetime": "30 Minuten",
|
|
"reid_risk": "low", "technical_necessity": "full",
|
|
},
|
|
|
|
# --- CMP-eigene Cookies (strictly necessary) ---------------------
|
|
"CookieConsent": {
|
|
"vendor": "Cybot A/S (Cookiebot)", "vendor_country": "DK",
|
|
"exact_purpose": "Cookiebot Consent-Speicherung — gewaehlte "
|
|
"Kategorien + Zeitstempel.",
|
|
"data_collected": ["consent_categories", "consent_timestamp"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "low", "technical_necessity": "full",
|
|
"schrems_ii_status": "EU (DK). Wenn EU-Cloud, kein Drittland.",
|
|
},
|
|
"OptanonConsent": {
|
|
"vendor": "OneTrust LLC", "vendor_country": "US",
|
|
"exact_purpose": "OneTrust Consent-Speicherung — Kategorien + "
|
|
"Vendor-Liste + Zeitstempel.",
|
|
"data_collected": ["consent_categories", "consent_string"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "low", "technical_necessity": "full",
|
|
"schrems_ii_status": "DPF-zertifiziert; EU-Cloud optional.",
|
|
},
|
|
"OptanonAlertBoxClosed": {
|
|
"vendor": "OneTrust LLC", "vendor_country": "US",
|
|
"exact_purpose": "OneTrust UI-Flag — verhindert Re-Display des "
|
|
"Banners nach Schliessung.",
|
|
"data_collected": ["closed_timestamp"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "low", "technical_necessity": "full",
|
|
},
|
|
"usercentrics-uuid": {
|
|
"vendor": "Usercentrics GmbH", "vendor_country": "DE",
|
|
"exact_purpose": "Usercentrics Consent-Speicherung — UUID-basiert.",
|
|
"data_collected": ["consent_uuid", "consent_settings"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "low", "technical_necessity": "full",
|
|
"schrems_ii_status": "DE — kein Drittland.",
|
|
},
|
|
|
|
# --- Weitere Social / Werbeplattformen ---------------------------
|
|
# _pin_unauth lebt in Base-KB.
|
|
"_scid": {
|
|
"vendor": "Snap Group Ltd.", "vendor_country": "GB/US",
|
|
"exact_purpose": "Snapchat Pixel — Conversion-Tracking fuer "
|
|
"Snap Ads.",
|
|
"data_collected": ["snap_visitor_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [7, 9, 10],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "Drittlandtransfer; UK seit 2021 mit "
|
|
"Angemessenheitsbeschluss.",
|
|
},
|
|
"guest_id": {
|
|
"vendor": "X Corp. (Twitter)", "vendor_country": "US",
|
|
"exact_purpose": "X/Twitter Guest-Identifier — Tracking nicht "
|
|
"eingeloggter Besucher inkl. Embeds.",
|
|
"data_collected": ["guest_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9, 10],
|
|
"typical_lifetime": "2 Jahre",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-Status unklar seit Eigentuemerwechsel 2022. "
|
|
"Erhoehtes Risiko, EDPB beobachtet.",
|
|
},
|
|
"VISITOR_INFO1_LIVE": {
|
|
"vendor": "Google Ireland Ltd. (YouTube)", "vendor_country": "IE",
|
|
"exact_purpose": "YouTube Embed Visitor-ID — Bandbreiten-Optimierung "
|
|
"+ Empfehlungsalgorithmus.",
|
|
"data_collected": ["youtube_visitor_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [8, 10],
|
|
"typical_lifetime": "6 Monate",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"notes": "YouTube-NoCookie-Domain (youtube-nocookie.com) reduziert "
|
|
"Tracking — DSGVO-konformer.",
|
|
},
|
|
"vuid": {
|
|
"vendor": "Vimeo Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Vimeo User-Identifier — Wiedererkennung "
|
|
"wiederkehrender Besucher fuer Statistik.",
|
|
"data_collected": ["vimeo_user_id"],
|
|
"typical_lifetime": "2 Jahre",
|
|
"reid_risk": "medium", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-zertifiziert.",
|
|
},
|
|
|
|
# --- Marketing-Automation / Email --------------------------------
|
|
"__kla_id": {
|
|
"vendor": "Klaviyo Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Klaviyo Visitor-Tracking — fuer E-Mail-Marketing-"
|
|
"Attribution.",
|
|
"data_collected": ["klaviyo_id"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "2 Jahre",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-zertifiziert.",
|
|
},
|
|
"_mcid": {
|
|
"vendor": "Intuit Mailchimp", "vendor_country": "US",
|
|
"exact_purpose": "Mailchimp Email-Click-Tracking — Verknuepft "
|
|
"Pageviews mit gesendeter Kampagne.",
|
|
"data_collected": ["mc_email_id"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-zertifiziert.",
|
|
},
|
|
|
|
# --- Product-Analytics / CDP -------------------------------------
|
|
"mp_": {
|
|
"vendor": "Mixpanel Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Mixpanel Distinct-ID + Properties — "
|
|
"Pseudonyme Event-Analytics.",
|
|
"data_collected": ["distinct_id", "properties"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-zertifiziert; EU-Residency optional.",
|
|
"notes": "Suffix `<token>_mixpanel`. Pattern-Match noetig.",
|
|
},
|
|
"ajs_anonymous_id": {
|
|
"vendor": "Twilio Inc. (Segment)", "vendor_country": "US",
|
|
"exact_purpose": "Segment Anonymous-ID — Cross-Device-Identitaet "
|
|
"vor Login.",
|
|
"data_collected": ["anonymous_id"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-zertifiziert; EU-Datenresidenz optional.",
|
|
},
|
|
"AMP_": {
|
|
"vendor": "Amplitude Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Amplitude Device-ID — Cross-Session-Identitaet "
|
|
"fuer Product-Analytics.",
|
|
"data_collected": ["device_id", "session_id"],
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-zertifiziert.",
|
|
"notes": "Suffix `<api_key>`. Pattern-Match noetig.",
|
|
},
|
|
|
|
# --- A/B-Testing -------------------------------------------------
|
|
"optimizelyEndUserId": {
|
|
"vendor": "Optimizely Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Optimizely End-User-ID — konsistente "
|
|
"Experiment-Zuteilung pro Besucher.",
|
|
"data_collected": ["end_user_id", "variation_assignments"],
|
|
"typical_lifetime": "6 Monate",
|
|
"reid_risk": "medium", "technical_necessity": "none",
|
|
"schrems_ii_status": "DPF-zertifiziert.",
|
|
},
|
|
|
|
# --- RUM / Monitoring (oft strictly necessary diskutiert) --------
|
|
"_dd_s": {
|
|
"vendor": "Datadog Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Datadog RUM Session-Tracking — Performance- "
|
|
"Monitoring + Fehler-Telemetrie.",
|
|
"data_collected": ["session_id", "session_type"],
|
|
"typical_lifetime": "15 Minuten",
|
|
"reid_risk": "low", "technical_necessity": "partial",
|
|
"schrems_ii_status": "EU-Region (Frankfurt) verfuegbar.",
|
|
"notes": "Bei reiner Server-/Fehler-Telemetrie ohne Cross-Site-"
|
|
"Tracking Argument fuer berechtigtes Interesse moeglich.",
|
|
},
|
|
|
|
# --- EU-Analytics-Alternativen -----------------------------------
|
|
"_pk_ref": {
|
|
"vendor": "InnoCraft Ltd. (Matomo)", "vendor_country": "NZ",
|
|
"exact_purpose": "Matomo Referrer-Tracking — Quelle des Besuchs.",
|
|
"data_collected": ["referrer", "campaign"],
|
|
"typical_lifetime": "6 Monate",
|
|
"reid_risk": "low", "technical_necessity": "none",
|
|
"schrems_ii_status": "NZ hat Angemessenheitsbeschluss (2012). "
|
|
"Bei On-Premise-Hosting kein Transfer.",
|
|
"notes": "Self-Hosting empfohlen — dann zeroes Drittland.",
|
|
},
|
|
"_pk_cvar": {
|
|
"vendor": "InnoCraft Ltd. (Matomo)", "vendor_country": "NZ",
|
|
"exact_purpose": "Matomo Custom-Variables — pro Visit konfigurierbar.",
|
|
"data_collected": ["custom_vars"],
|
|
"typical_lifetime": "30 Minuten",
|
|
"reid_risk": "low", "technical_necessity": "none",
|
|
},
|
|
}
|
|
|
|
|
|
# Pattern-Lookups fuer dynamische Cookie-Namen
|
|
_EXT_PATTERNS: list[tuple[str, str]] = [
|
|
(r"^_hjSessionUser_", "_hjSessionUser_"),
|
|
(r"^_hjSession_", "_hjSession_"),
|
|
(r"^intercom-id-", "intercom-id-"),
|
|
(r"^mp_", "mp_"),
|
|
(r"^AMP_", "AMP_"),
|
|
]
|
|
|
|
|
|
def lookup_cookie_extended(name: str) -> CookieKnowledge | None:
|
|
"""Lookup in der KB_EXT (Extension). None wenn nicht gefunden."""
|
|
import re
|
|
if not name: return None # noqa: E701
|
|
if name in KB_EXT: return KB_EXT[name] # noqa: E701
|
|
for pat, key in _EXT_PATTERNS:
|
|
if re.search(pat, name): return KB_EXT.get(key) # noqa: E701
|
|
base = name.split(".", 1)[0]
|
|
if base != name and base in KB_EXT: return KB_EXT[base] # noqa: E701
|
|
return None
|