Contentsquare and Heap: what can interaction measurement record?

Are these tools just page counters?

Contentsquare's experience analytics and Heap's product analytics examine how an app is used. They can describe screens and interactions rather than just totals. Current Contentsquare documentation separates ordinary analytics collection from Session Replay and describes batches of events plus device/session metadata. Those current capabilities must not be read as proof that an older inspected SDK records full replay. Contentsquare data collection.

Heap's Android documentation describes autocapture, automatically collecting supported interactions after the relevant recording and integration setup, alongside explicit custom events and identity calls. “Automatic” still has implementation and component requirements; it does not mean every text field or screen is captured in every app. Heap Android guide.

How can individual taps become a behavioural picture?

Hypothetical example: a screen-view event is followed by two taps on an unresponsive button and a return to the previous screen. Joined by a session identifier, those records can show where someone struggled. Across visits, a persistent identity may connect repeated behaviour. A session is a period of use grouped by the measurement system, not necessarily an account login.

This example explains the purpose and possible sensitivity of interaction data. It does not claim that our inspected news apps recorded screenshots, passwords or a full visual replay. Those stronger claims require separate evidence.

What did we find in the news apps?

The de Volkskrant 7.53.1 audit traces Contentsquare startup, event/screen collection, pending events, consent opt-in, identity setters and WebView attachment. It separately finds Heap startup providers, recording, committed events, identity/properties, upload and WebView integration. A WebView is a web page displayed inside the app; its bridge can connect web activity to native measurement. Pinned Volkskrant audit.

Trouw and Parool, both 7.53.1, have independently checked related paths. Known policy domains include contentsquare.net, contentsquare.com, heapanalytics.com and heap.io; a policy entry is coverage when loaded, not a captured upload. Trouw audit, Parool audit.

What changes after patching?

The controls stop inventoried startup, recording/event, identity, upload and web-attachment paths. Required readiness callbacks still complete so app startup can continue. Callback-bearing web cookie/update functions are not indiscriminately removed. This preserves functional contracts while interrupting the identified measurement routes.

Evidence reviewed 28 October 2026. No packet capture proves every future remote embed silent. Read tracking mechanisms, identifiers and methodology.