Browsing behavior logs

Detects browsing behaviour logs and clickstream exports: a browsing history / clickstream / web analytics log phrase combined with populated log structure - URLs carrying a user or session identifier, web access log lines, or labelled visitor/session/device identifiers. Phrase-only mentions (privacy notices, cookie banners) stay discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Enforce tiers require populated log structure (identifier-bearing URLs, access-log lines, labelled visitor/session IDs) beside the log phrase; privacy notices and cookie banners name the same data without values and stay at 65, as do header-only exports. Medium because anonymised aggregate analytics exports can still carry session IDs.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
Frameworks: ISO 27001, ISO 27701
Data categories: pii
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:browsing\s+(?:behaviou?r|history)(?:\s+logs?)?|clickstream(?:\s+(?:data|logs?|exports?))?|page[\s-]?view\s+logs?|web\s+analytics\s+(?:exports?|logs?|data)|session\s+replays?|visitor\s+logs?|user\s+activity\s+logs?)\b

Corroborative evidence keywords

page view, dwell time, referrer, user agent, scroll depth, bounce, add to cart, search query, utm_source, session duration

Proximity: 300 characters

Should match

Clickstream export 2026-09-01 (web analytics) session_id,visitor_id,timestamp,page_url,referrer,dwell_time s-8841,v-2204471,2026-09-01T08:14:02Z,/health/ivf-clinic-costs,google,94 https://shop.harbourretail.com.au/checkout?step=2&uid=2204471 add to cart; user agent Mozilla/5.0; session duration 11 min — Clickstream export - header, identifier-bearing URL and analytics evidence (85)
Web analytics logs 203.0.113.45 - avery.t [12/Aug/2026:08:14:02 +1000] "GET /account/statements HTTP/1.1" 200 5120 — Access-log line with a user field (75)
Browsing history log Visitor ID: v-2204471 Retained for 90 days. — Single labelled visitor identifier (75)

Should not match

Privacy policy: we collect browsing behaviour such as page views, referrer and user agent through first party cookies. You can clear your browsing history at any time. — Privacy notice describing collection
Clickstream export session_id,visitor_id,timestamp,page_url,referrer — Blank export - column header only (65)
Regulators are examining how apps share browsing history with advertisers, a news report said. — News item
unrelated generic text without domain phrases — Unrelated
customer invoice — Generic word pair

Known false positives

Privacy notices, help-centre articles, product pages and policies describing browsing and clickstream data. Mitigation: They name the topic without populated rows, labelled values or identifiers, and guidance/help framing is excluded, so they stay at 65.
Analytics training material and documentation with worked examples of browsing and clickstream data. Mitigation: Training and template framing is excluded; unframed worked examples with realistic rows can still reach 75.
News and industry commentary with aggregate statistics. Mitigation: Aggregate percentages are not keyed to a record identifier, so they do not satisfy the row or labelled-value structures.