Overview
Bot detection tag that collects extensive behavioural and device fingerprinting data from every visitor, including mouse movements, keystroke dynamics, and network characteristics. While the security purpose may support a legitimate interest legal basis under GDPR Article 6(1)(f), the depth of data collection rivals that of the most invasive analytics tags. Organisations should document a balancing test and assess whether ePrivacy Directive consent obligations still apply despite the security justification.
Detection capabilities
- Signature count
- 6
- Detection methods
- network
- Property types
- hostnamepathname
Performance impact
Performance Impact
- Requests per page
- 3
Common mistakes
- 1Not disclosing bot detection in the privacy notice - even though it serves a security purpose, it involves collecting detailed behavioural and device fingerprint data from all visitors
- 2Assuming security tools are automatically exempt from consent requirements without assessing the specific data collected and whether it constitutes personal data under GDPR
- 3Failing to conduct a proportionality assessment - Human Security collects extensive behavioural signals, and organisations should verify that the level of data collection is proportionate to the bot threat
- 4Not reviewing the data retention period for bot detection signals, which may persist longer than necessary for the security purpose
- 5Overlooking the device fingerprinting aspect, which the ePrivacy Directive treats similarly to cookie-based tracking and may require consent in some jurisdictions
Related services
Scan your site for human-security
Run a free ConsentMark scan to see how human-security is loading on your site, whether it respects consent, and where governance gaps exist across your wider tag estate.
Start a free scan