Autofill can fill a form before you send it
A phone number does not have to wait for a Submit button to leave your device. When a browser’s autofill feature inserts saved contact details into a webpage’s form, the page can often read the filled-in field. The site’s own scripts—or tracking tools embedded on it—may then transmit that value to a server as soon as the field is populated or changed.
That is different from a browser handing a website your entire address book. The page generally gets access to information entered into its own fields, not every saved contact. But a form can be designed so that collecting a number happens separately from the action that appears to submit the form. A user might start filling out a checkout page, for example, and leave before completing the purchase.
Why the submit button is not a privacy boundary
Web forms are interactive: scripts can respond to typing, autofill, or a field losing focus. “Losing focus” simply means clicking or tapping somewhere else. If a script sends the field’s contents at one of those moments, closing the page or abandoning the form afterward does not undo the transmission.
Whether a business may collect or use the number depends on the site’s disclosures, the circumstances, and applicable privacy rules. The technical possibility alone does not make every collection lawful. Still, a familiar form can make data collection feel as though it happens only at the final click, when in reality the field may communicate earlier.
To reduce exposure, avoid autofilling sensitive details on unfamiliar sites, and check privacy settings or disclosures before entering a number. The revealing detail is that an unfinished form may already have delivered the one piece of information its owner wanted.
