The form can send data before it is submitted
A submit button is not the only way a website can transmit what you type. The page can run JavaScript—small programs that respond to your actions—and listen for changes in an email field. When you type, the script may send the text to the site’s server in the background, sometimes a character at a time and sometimes only after the address looks complete or you move to another field.
That can happen before the browser’s normal form submission. The page may appear to be doing nothing, even though a background request has already carried the address away.
Where the collection code comes from
The code may belong to the website itself, or arrive through a third-party tool used for analytics, advertising, customer support, or marketing. A site can also use “session replay” software, which records interactions to help operators see how visitors use a page. Depending on how it is configured, such a tool may capture form entries unless sensitive fields are excluded or masked.
A less conspicuous technique is to recognize an address the browser has filled in automatically. If the page can read the filled value and its scripts transmit it, the address may be collected without a person pressing submit. Browser protections and site settings affect what is possible, so this does not work identically everywhere.
Why collect an unfinished form?
A business may want to follow up when someone starts signing up or checking out but leaves before finishing. Sending the address early makes that possible—but it also means the visitor has shared information without completing the action that normally signals consent or intent. The same mechanism can be used more deceptively, with the data sent to parties the visitor did not expect.
The practical clue is that a form’s visible controls do not reveal every network action behind it. “I never clicked submit” does not necessarily mean the address stayed on the page.
