Most pages in Design assume your population is a sample of the web: a ranking stands in for “websites”, and you draw from it. This page is about the other case — when the population is one platform. You are not sampling the web any more; you are sampling whatever that platform lets you see, through a channel it controls and can close. The sampling frame, the instrument and the counterparty are the same organisation.

That changes four things, and this page is organised around them: how you get in (and which routes still exist in 2026), what the denominator of what you got actually is, what it costs and what the limits are, and what the rules of engagement are — terms of service, account bans, the login wall, and since December 2025 a European regulator that fines a platform for forbidding research scraping.

This is not a page about any one company's API surface; those change faster than a wiki does. It is a page about the design decisions that a platform study forces on you and a sample-of-the-web study does not. Where a fact about a specific service is load-bearing it is dated and linked to the primary source, and the provenance page records what was verified and what could not be.

Four papers, chosen because each demonstrates a different access route rather than a different topic:

• [2Bouchaud, Paul; Liénard, Jean F. (2024): "Beyond the Guidelines: Assessing Meta's Political Ad Moderation in the EU", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (IMC 2024) — an ad-transparency archive as the instrument. Uses “a comprehensive dataset provided by Meta under the European Digital Services Act, encompassing all ads targeting EU countries” and finds that only 7.7% of undeclared political ads were moderated as political, while 60.4% of the ads Meta did moderate did not match Meta's own criteria. Read it for how a regulator-mandated archive becomes a measurement instrument, and for the double-sided error analysis that an archive study needs.
• [3Vombatkere, Karan; Mousavi, Sepehr; Zannettou, Savvas; Roesner, Franziska; Gummadi, Krishna P. (2024): "TikTok and the Art of Personalization: Investigating Exploration and Exploitation on Social Media Feeds", in: Proceedings of the ACM Web Conference. (DOI)] (TheWebConf 2024) — sock-puppet accounts on a feed you cannot query. Five bot accounts plus a donated dataset of 347 real users; concludes that TikTok “exploits real users' interests in between 30% and 50% of all recommended videos in the first thousand videos”. Read it for how you measure a recommender with no API at all.
• [4Karnam, Sai Keerthana; Dash, Abhisek; Das, Antariksh; Mousavi, Sepehr; Bechtold, Stefan; Gummadi, Krishna P.; Mukherjee, Animesh; Weber, Ingmar; Zannettou, Savvas (2026): "Setting the Course, but Forgetting to Steer: Analyzing Compliance with GDPR's Right of Access to Data by Instagram, TikTok, and Youtube", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] (IEEE S&P 2026) — the data subject's right of access as the instrument. Sock-puppet accounts on Instagram, TikTok and YouTube, then GDPR Art. 15 requests, then a comparison of the returned data package against the ground truth the authors themselves generated. All three platforms failed to report purpose, recipients and retention period.
• [5Gegenhuber, Gabriel K.; Frenzel, Philipp E.; Günther, Maximilian; Ullrich, Johanna; Judmayer, Aljosha (2026): "Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (NDSS 2026) — enumeration at platform scale, and the ethics that go with it. Probes 63 billion candidate phone numbers and discovers 3,546,479,731 WhatsApp accounts across 245 countries, 57% of them with a public profile picture. Read it for what a platform-scale study has to say about disclosure and harm before a programme committee will accept it.

If you only read one thing about the rules, read the Commission's December 2025 decision fining X €120 million: it is the first DSA non-compliance decision, and one of the three grounds is research data access.¹⁾

The platform's name appearing in your methods section does not make it one. A name can play any of these roles, and only the first is what this page is about:

This distinction is not pedantry; it is the single largest source of error in counting this literature. In our corpus the string “Amazon” appears as a study-population source in 412 papers where it means the Alexa ranking list, 179 where it means Mechanical Turk, and 23 where it means AWS — against 39 where it means an Amazon platform. See Use in Publications.

The operator row deserves its own warning. A paper written with or inside the platform gets data nobody else can get and loses the ability to publish the population: [6Cohn-Gordon, Katriel; Damaskinos, Georgios; Neto, Divino; Cordova, Joshi; Reitz, Benoît; Strahs, Benjamin; Obenshain, Daniel; Pearce, Paul; Papagiannis, Ioannis (2020): "DELF: Safeguarding deletion correctness in Online Social Networks", in: Proceedings of the USENIX Security Symposium. (Link)] is a Facebook-authored study of Facebook's own deletion pipeline. Such papers are valuable and are not replicable by you. Do not cite one as evidence that a measurement is feasible from outside.

Every route below is real and in use somewhere. What differs is whether it is current, what it costs, and what population it yields. Dates are as of 2026-08-27 and verified against primary sources; the provenance page lists each URL, quote and fetch date, and names the claims that could not be verified.

The Status column is one word; the dated evidence for each verdict is in Which Methods Are Current at the foot of the page.

X's API is now pay-per-usage with no subscription: $0.005 per Post read, $0.010 per User read, and “Pay-per-usage plans are capped at 3 million Post reads per monthly billing cycle” with Enterprise above that.²⁾ One million posts is therefore $5,000 and the monthly ceiling on the self-serve route is 3 million posts. A study that used to be “collect the 1% stream for six months” is now a budget line and a cap.

This is not hypothetical, and the field has already adapted. [9Nguyen, Hoang Dai; Dhungana, Sumit; Itha, Madhulika; Vadrevu, Phani (2025): ""Please don't send that bot anything": A Mixed-methods Study of Personal Impersonation Attacks Targeting Digital Payments on Social Media", in: Proceedings of the USENIX Security Symposium. (Link)] (USENIX Security 2025) built its collection pipeline around the read cap: it polls a counts endpoint, which “does not add to our monthly tweet read limit”, and only fetches actual posts when the count is non-zero — because “the total number of tweets that can be downloaded is very small for the Basic tier”. That is still a sound pattern, but the tier it names is no longer what a new project gets: X's own changelog records that pay-per-usage “officially launched” on 6 February 2026 as the self-serve model, with the older Basic and Pro plans “remain[ing] available” only to existing subscribers, and then a further price change on 20 April 2026 introducing “Owned Reads” at $0.001 per resource for a developer's own account data.³⁾ The pricing model of the single most-measured platform in this corpus changed twice inside 2026. Date it, and re-check it before you submit.

The other side of the same story: [10Galeazzi, Alessandro; Paudel, Pujan; Conti, Mauro; Cristofaro, Emiliano De; Stringhini, Gianluca (2026): "Revealing The Secret Power: How Algorithms Can Influence Content Visibility on Twitter/X", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (NDSS 2026) states that academic access to the X API has “been restricted since June 2023” and therefore works from two previously published tweet datasets rather than collecting anything. Both papers are correct methodology for their moment. Neither is a template you can lift.

• Meta Content Library and Content Library API — covers public content from Facebook, Instagram, WhatsApp Channels and (in the web tool) Threads. Applications are reviewed not by Meta but independently by the Secure Data Access Center (CASD) in France. Eligibility is an accredited, degree-granting, not-for-profit academic institution, or a not-for-profit research institution.⁴⁾
• TikTok Research Tools — accounts, content and Shops data; open to “Academic institutions in the US, EEA, UK or Switzerland”, to a “Not-for-profit and/or independent research institution, organization, association, or body in the EU” — immediately followed on the same page by “We are currently beta testing this service with select researchers in the US, UK, Switzerland, Norway, Iceland and Liechtenstein”, so read the non-academic pathway as a beta rather than as open — and (for youth-safety research only) to Brazil. Stated turnaround “within 4 weeks”. The separate Commercial Content Library covers advertising and, as of this fetch, “we are ONLY including data from EU countries”.⁵⁾
• YouTube Researcher Program — “scaled, expanded access to global video metadata across the entire public YouTube corpus via our Data API”, for students, research staff and faculty at accredited institutions. Separate from, and not satisfied by, the ordinary Data API quota-increase form.⁶⁾

Every one of these is a controlled-access environment with an eligibility test, an application, and a review. Budget the lead time in your project plan, and note that eligibility is institutional: a researcher at a commercial lab is excluded from all three.

For services the European Commission has designated as very large online platforms (VLOPs), Article 40 of the Digital Services Act creates a vetted-researcher data-access right. The implementing instrument is Commission Delegated Regulation (EU) 2025/2050 of 1 July 2025, which lays down “the technical conditions and procedures under which providers of very large online platforms and of very large online search engines are to share data with vetted researchers” and enters into force on the twentieth day after its publication in the Official Journal — which was 9 October 2025, so it has been in force since 29 October 2025.⁷⁾ Vetting is done by a national Digital Services Coordinator, and applications go through the Commission's DSA Data Access Portal, which states “You can send applications as of 29 October 2025” and carries a public Research projects register of “ongoing research projects conducted by vetted researchers who have access to data under Article 40”.⁸⁾ The current designation list is maintained by the Commission and moves: it was last updated 24 July 2026 and now includes WhatsApp Ireland alongside Facebook, Instagram, TikTok, YouTube, X and the Amazon Store.⁹⁾

These are the two routes where the corpus shows a real upward trend, and both work by going through the user rather than the platform.

Two 2026 papers show the shape. [11McCrosky, Jesse; Malla, Ranadheer; Tanskanen, Aapo; Camargo, Chico Q. (2026): "Does This Button Work? Investigating YouTube's Ineffective User Controls", in: Proceedings of the ACM Web Conference. (DOI)] evaluates YouTube's “Don't recommend channel” and “Not interested” controls using 22,722 donating participants from Mozilla's YouTube Regrets project, and finds a control-group Bad Recommendation rate of “about 2.3% — meaning that roughly one in every 43 recommendations was a Bad Recommendation”, with no control eliminating them after four weeks. [12Benzaamia, Abir; El Fraihi, Asmaa; Abdelaziz, Ines; Goga, Oana (2026): "A Year Under the DSA: Ad Transparency's Uneven Landscape", Proceedings on Privacy Enhancing Technologies 2026(2):517-532. (DOI)] analyses 48,511 ad explanations across Facebook, Instagram, YouTube and X, collected through the Who Targets Me donation extension, and finds that “98.9% of all [YouTube] explanation texts cite only the main targeting form” without the attributes actually used.

Donation buys you the logged-in, personalised surface without creating a single fake account. It costs you control of the population: your denominator is now whoever installed the extension, which is a convenience sample with an activist skew. Say so, and see Biases.

This is the part a sample-of-the-web study does not have, and the part reviewers now ask about. Every platform access route hands you a filtered population, and the filter is usually documented. Read it, and put it in your paper as the denominator.

• A research archive is not the platform. The Meta Content Library includes Facebook posts to Pages, groups and events “as well as posts that appear on public profiles that are either verified or that have 100 or more followers”; Instagram business and creator accounts plus personal accounts “verified or that have 100 or more followers”; Threads public profiles with 100 or more followers.¹⁰⁾ A prevalence computed there is a prevalence among accounts above a follower threshold, not among users.
• An ad archive contains ads that ran. It cannot tell you what was rejected, and it can be wrong in both directions about what is political — which is exactly [2Bouchaud, Paul; Liénard, Jean F. (2024): "Beyond the Guidelines: Assessing Meta's Political Ad Moderation in the EU", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]'s finding, on both sides at once.
• A sampled stream is a sample. [13Kaleli, Beliz; Kondracki, Brian; Egele, Manuel; Nikiforakis, Nick; Stringhini, Gianluca (2021): "To Err.Is Human: Characterizing the Threat of Unintended URLs in Social Media", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] is explicit that its dataset came from “the 1% streaming API that Twitter provides to vetted researchers” and that consequently “all the numbers that we presented in this paper are lower bounds”. Say which stream and which sampling rate, and say which direction the bias runs.
• We could not establish what Reddit currently offers a researcher. Every Reddit-owned domain refused our fetches, so this page makes no claim about Reddit's API pricing, rate limits or researcher terms — only about what the corpus shows (63 papers measuring Reddit, 14 naming a Reddit API or PRAW, 35 naming Pushshift). Check it yourself before planning around it, and see platforms for exactly what failed.
• A third-party archive has the archiver's gaps, not yours. Pushshift is still the most-named Reddit source in this corpus (35 papers, e.g. [14Zannettou, Savvas; Caulfield, Tristan; Blackburn, Jeremy; Cristofaro, Emiliano De; Sirivianos, Michael; Stringhini, Gianluca; Suarez-Tangil, Guillermo (2018): "On the Origins of Memes by Means of Fringe Web Communities", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]), and its coverage window and completeness are properties of Pushshift, not of Reddit. It is also no longer a route you can open: Reddit's own moderator help page says Pushshift API access “will be reinstated for verified Reddit moderators”, that each one “need[s] explicit approval from Reddit”, and that “the use of Pushshift will be limited to moderation use cases only”.¹¹⁾
• A reused dataset freezes a platform that has since changed. 383 of the 897 platform-subject papers name an existing dataset (temporal.mode is multi-valued, so 175 of those also collected something themselves; 208 collected nothing). If that is you, date the snapshot and say what changed on the platform since — the four false positives in our Twitter/X audit were all papers using Twitter-derived benchmark corpora with no relationship to the platform at collection time.
• A cross-platform study has one denominator per platform, and they are not comparable. [15Acharya, Bhupendra; Lazzaro, Dario; López-Morales, Efrén; Oest, Adam; Saad, Muhammad; Cinà, Antonio Emanuele; Schönherr, Lea; Holz, Thorsten (2024): "The Imitation Game: Exploring Brand Impersonation Attacks on Social Media Platforms", in: Proceedings of the USENIX Security Symposium. (Link)] looked for brand-impersonation accounts targeting the top 10K Tranco brands on X, Instagram, Telegram and YouTube at once; [16Beluri, Mario; Acharya, Bhupendra; Khodayari, Soheil; Stivala, Giada; Pellegrino, Giancarlo; Holz, Thorsten (2025): "Exploration of the Dynamics of Buy and Sale of Social Media Accounts", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] tracked accounts advertised for sale across five platforms and found blocking efficacy ranging from 5.02% (YouTube) up to 48% — its own summary is that “TikTok and Instagram demonstrated the highest detection efficacy at 48%, whereas YouTube and Facebook showed the lowest efficacy at just 5%”. A cross-platform rate is only meaningful if you say what you could see on each platform, because the routes in differ and so does the visible surface. A gap between two platforms may be a gap between two access routes.
• The logged-out surface is not the platform either. Of the 260 platform-subject papers that report a crawl configuration, 145 (55.8%) are labelled as using no authentication at all, 22 as registering an account, 4 as logging in manually, and none as using automated login or SSO. Whatever those studies measured, it is mostly what an anonymous visitor sees. These are schema labels, not audited ones, and Registration is explicit about why that matters for this exact field: crawlConfig carries one evidence quote for the whole object, so the authentication label cannot be checked against its quote, and a hand-audit of another field of that same object, consentAction, found 19.4% false positives (consent). We did not audit these 145. Treat the shape as real and the precise share as unverified.

Platform papers talk about limits and rules markedly more than the corpus average, and increasingly so:

Read the ToS row as the headline: at 14.9%, a platform paper is roughly twice as likely as the average paper in these seven venues (7.8%) to discuss terms of service, and in 2025 more than one in five did. Against a narrower and fairer baseline — papers that ran a crawl, where Registration reports 11.5% — the ratio is about 1.3×. Either way the direction is the same, and it is the direction the reviewing is moving.

Four practical consequences:

• Design for the limit, not around it. [9Nguyen, Hoang Dai; Dhungana, Sumit; Itha, Madhulika; Vadrevu, Phani (2025): ""Please don't send that bot anything": A Mixed-methods Study of Personal Impersonation Attacks Targeting Digital Payments on Social Media", in: Proceedings of the USENIX Security Symposium. (Link)]'s counts-endpoint trigger is the pattern: find the cheap query that tells you whether the expensive query is worth making. Report the limit you worked under, because it bounds your recall.
• The limit can be the finding. [17Xue, Diwen; Ramesh, Reethika; S, Valdik S.; Evdokimov, Leonid; Viktorov, Andrey; Jain, Arham; Wustrow, Eric; Basso, Simone; Ensafi, Roya (2021): "Throttling Twitter: an emerging censorship technique in Russia", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] measured Russian ISPs throttling Twitter and showed the mechanism was SNI-based: “throttling is triggered upon observing Twitter-related domains (*.twimg.com, twitter.com, t.co) in the SNI”. If you are being throttled and can characterise by what, that is a result.
• Expect the platform to fight your crawler, and say whether it did. Only 14 of 260 platform-subject papers with a crawl configuration (5.4%) say anything about robots.txt — barely above the 4.7% baseline for all papers with a crawl configuration. If the platform served you a bot challenge, that is a measurement result about the platform, not an embarrassment.
• Sock puppets are the highest-risk route. They get you the personalised surface — [3Vombatkere, Karan; Mousavi, Sepehr; Zannettou, Savvas; Roesner, Franziska; Gummadi, Krishna P. (2024): "TikTok and the Art of Personalization: Investigating Exploration and Exploitation on Social Media Feeds", in: Proceedings of the ACM Web Conference. (DOI)] and [4Karnam, Sai Keerthana; Dash, Abhisek; Das, Antariksh; Mousavi, Sepehr; Bechtold, Stefan; Gummadi, Krishna P.; Mukherjee, Animesh; Weber, Ingmar; Zannettou, Savvas (2026): "Setting the Course, but Forgetting to Steer: Analyzing Compliance with GDPR's Right of Access to Data by Instagram, TikTok, and Youtube", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] both need them — and they are the fact pattern most likely to breach terms of service and, in the US, to have been litigated. Get ethics review first (see Ethics), keep the accounts minimal, and write down what you did: only 32.5% of the 841 empirical platform-subject papers state an ethics-review outcome — essentially at the 33.8% corpus baseline (no test was run, and the platform papers are inside that baseline). That is not good enough for a study whose method is creating fake accounts on someone else's service.

The traditional advice was “the ToS forbids automated access, so scraping is a risk you take.” As of December 2025 that is only half the picture in the EU. The Commission's first DSA non-compliance decision fined X €120 million, and one of the three grounds was researcher data access: “X's terms of service prohibit eligible researchers from independently accessing its public data, including through scraping”, and “X's processes for researchers' access to public data impose unnecessary barriers”.¹²⁾ A designated VLOP's blanket anti-research ToS clause is now itself an enforcement target.

This does not mean scraping is lawful because a regulator dislikes the clause. It means the legal position is moving and is different in the EU and the US, and it is not settled by anything on this page. The provenance page records the US case law we looked at, which of it we could verify against a primary source and which we could not, and why we did not put unverified case outcomes here. Talk to your institution.

All figures below come from the corpus of seven venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P), 2010–2026, 5,859 extracted papers. The script is scripts/platforms_report.mjs; its unedited output, and every query, is on platforms.

A paper counts as measuring platform P if P is matched, in a subject role, in at least one of: the title, a population source list, a measured phenomenon, or the name of a tool it used or produced. Roles that do not count: recruitment channel, infrastructure, hosted model, ranking list, benchmark corpus, operator-internal, token collision. For a paper with human participants, a source-list match alone does not count — that is a recruitment channel.

This is a candidate set with regex recall, not a curated set, so we hand-audited samples of it against the papers' own full text and publish the precision:

Treat the ranking below as a ranking. Do not quote a family's count as a precise number of papers without the precision above attached to it — and note that these samples are small: at n = 15 the 95% interval around 73% is roughly ±20 points. They are coarse corrections, not measurements.

Of the 5,712 papers that drew a study population, 897 (15.7%) name a large platform as the subject of measurement. A paper can name several, so the rows below do not sum to 897 — [15Acharya, Bhupendra; Lazzaro, Dario; López-Morales, Efrén; Oest, Adam; Saad, Muhammad; Cinà, Antonio Emanuele; Schönherr, Lea; Holz, Thorsten (2024): "The Imitation Game: Exploring Brand Impersonation Attacks on Social Media Platforms", in: Proceedings of the USENIX Security Symposium. (Link)] alone counts for four:

Rows 1 and 7 — Google and the Apple App Store — are largely app-store work, which is closer to Mobile and app measurement than to this page. Note also what this page does not cover: search-engine result auditing and the Google ads ecosystem are a real body of work inside these venues and have no page on this wiki yet; they are out of scope here and named in Open Questions. Note the last rows: TikTok is 7 papers, of which 4 survived a full audit. There is no body of TikTok measurement in these seven venues to systematise.

This is the fold that decides the numbers, so it is published in full. Counting the roles that a platform name plays in a paper's stated population source:

A substring match on “Amazon” therefore over-counts Amazon platform measurement by roughly sixteen to one. An earlier iteration of our own script did exactly this and reported 176 Amazon papers.

Three-year buckets, as a share of that bucket's whole corpus, so the growth of the corpus itself does not create a trend:

Access routes named in tool lists, over the 897 platform-subject papers. Free-text tool names matched by regex — a ranking, never a precise share:

That last row is the reporting gap on this page: for 61.5% of platform-subject papers, no named instrument survives into this corpus's tool lists. Read that as an upper bound on the gap rather than as “three in five do not state it”: extraction recall on free-text tool names is imperfect, and we did not hand-audit the 552. Even as an upper bound it is the largest single reporting hole the page found, because the route is the design decision.

Platform-subject papers release artefacts slightly less often than the corpus average, and withhold slightly more often:

The differences are small, and given the ~90% run-to-run stability of this field they are indicative rather than measured. What is not small is the reason: two 2025–2026 papers state outright that their data source no longer exists. [19Biswas, Md. Rafiul; Bessghaier, Mabrouka; Ibrahim, Shimaa; Mikros, George K.; Zaghouani, Wajdi (2026): "Longitudinal Trends in Global Climate Change Discourse on Facebook", in: Proceedings of the ACM Web Conference. (DOI)] collected 299,329 Facebook posts through CrowdTangle and records that “the use of the CrowdTangle API poses reproducibility challenges, as the tool was discontinued in 2024 and limits future data collection or temporal expansion”; [20Cinus, Federico; Minici, Marco; Luceri, Luca; Ferrara, Emilio (2025): "Exposing Cross-Platform Coordinated Inauthentic Activity in the Run-Up to the 2024 U.S. Election", in: Proceedings of the ACM Web Conference. (DOI)] refers to “(the now defunct) Crowdtangle”. CrowdTangle was withdrawn on 14 August 2024, and Meta's own page now reads “As of August 14, 2024, CrowdTangle is no longer available”.¹³⁾ See Artifacts for what to deposit when the collection channel may not outlive the paper.

`detection.phenomenon` is free text and only ~20% stable run-to-run, so this is a fold into families, published with its residue:

The residue is nearly half. Do not read this table as a partition of the field; read it as ten families that are definitely present, with a large remainder that our fold could not classify. The residue is printed in full on platforms.

The corpus carries the papers' own measured prevalences with their own denominators. A sample, each verified against the paper's full text:

Every query, the report script and its unedited output, the folds with their residue, the four hand-audits, the quote checks and the external sources with their fetch dates are on platforms. Corpus-level caveats — the seven-venue scope, the provisional 2025–2026 slice, field stability — are on corpus.

Three limits worth restating here. The corpus is seven security, privacy and measurement venues; the platform-measurement literature also lives in ICWSM, CHI, FAccT and communications journals, and none of those are in it, so “the field” on this page means those seven venues. The platform families are regex candidate sets with the precision measured above, not curated sets. And the full-text probes are keyword probes: a paper that hit a rate limit and did not use the words “rate limit” is invisible to them.

A platform study should let a reader reconstruct the population you actually saw. Report:

1. The route in, by name and version — which API, which programme, which archive, which extension, which dataset. 61.5% of platform-subject papers in this corpus do not.
2. The date window of collection, and what changed on the platform inside it. Platforms are not stationary; a six-month window can span a product change.
3. The filter the route applies — follower thresholds, sampling rate, ad-archive scope, region restriction — as an explicit denominator, not as a footnote.
4. The limit you worked under and how you designed around it, with your recall consequence.
5. Authentication state: logged out, an account you registered, a donated session. 34.2% of platform papers with a crawl configuration do not say.
6. Whether the platform pushed back: bot challenges, CAPTCHAs, throttling, bans. This is a result.
7. The account policy, if you made accounts: how many, how they were named, what they did, whether they interacted with real users, and what happened to them afterwards.
8. Ethics review and the terms-of-service position you took, and on whose advice. Only 32.5% of empirical platform-subject papers state a review outcome.
9. What you can deposit and what you cannot, and why — see Artifacts.

start has promised four sub-pages — Facebook, Twitter, TikTok, Amazon — since before this page existed. We are not writing them, and the red links have been removed rather than left dangling. The reasoning, so a future editor can overturn it on evidence:

A per-company page is the wrong axis anyway. What a platform study reuses across companies is the route in and the denominator that route implies; what does not transfer is the company's current API surface, which is precisely the part that goes stale fastest. This page is organised by route for that reason.

The one page that the evidence does support is not on the promised list: ad-transparency archives as a measurement instrument — 69 papers, a live regulatory driver, real double-sided error characteristics [2Bouchaud, Paul; Liénard, Jean F. (2024): "Beyond the Guidelines: Assessing Meta's Political Ad Moderation in the EU", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], and a 2026 cross-platform comparison [12Benzaamia, Abir; El Fraihi, Asmaa; Abdelaziz, Ines; Goga, Oana (2026): "A Year Under the DSA: Ad Transparency's Uneven Landscape", Proceedings on Privacy Enhancing Technologies 2026(2):517-532. (DOI)]. It is recorded as a candidate rather than linked, so this page does not create the very problem it just cleaned up.

• Automated measurements — crawl, scan, or app analysis. A platform study is usually a crawl with an unusual counterparty.
• Website selection — because “Alexa” on this page is 412 papers using a retired ranking list, not Amazon.
• User studies — because “Amazon” on this page is 179 papers using Mechanical Turk. Crowdworkers labelling your platform data are annotation, not a user study.
• Crawling location — the vantage point, and why a datacenter IP gets a different platform than a residential one.
• Mobile and app measurement — app stores, SDKs, static versus dynamic analysis, and certificate pinning. It does not currently cover voice-assistant skill stores or the on-device model-extraction route [8West, Jack; Thiemt, Lea; Ahmed, Shimaa; Bartig, Maggie; Fawaz, Kassem; Banerjee, Suman (2024): "A Picture is Worth 500 Labels: A Case Study of Demographic Disparities in Local Machine Learning Models for Instagram and TikTok", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] used; those are described here instead.
• Longitudinal — repeating a platform measurement when the platform, not just the web, moved between waves.
• Registration — the mechanics of the accounts a sock-puppet study needs.
• Interaction — driving a feed once you are in.
• Requests, Server side tracking — the platform as a third party on someone else's site, which is a different study.
• Ethics — fake accounts, enumeration, and disclosure.
• Artifacts — depositing data from a channel that may not outlive the paper.
• Biases — donation panels, follower thresholds, and convenience samples.
• platforms — every query, fold, audit and external check behind this page.

[1]

Saha Roy, Sayak; Pourabbas Vafa, Elham; Khanmohamaddi, Kobra; Nilizadeh, Shirin (2025): "DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)

[2]

Bouchaud, Paul; Liénard, Jean F. (2024): "Beyond the Guidelines: Assessing Meta's Political Ad Moderation in the EU", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[3]

Vombatkere, Karan; Mousavi, Sepehr; Zannettou, Savvas; Roesner, Franziska; Gummadi, Krishna P. (2024): "TikTok and the Art of Personalization: Investigating Exploration and Exploitation on Social Media Feeds", in: Proceedings of the ACM Web Conference. (DOI)

[4]

Karnam, Sai Keerthana; Dash, Abhisek; Das, Antariksh; Mousavi, Sepehr; Bechtold, Stefan; Gummadi, Krishna P.; Mukherjee, Animesh; Weber, Ingmar; Zannettou, Savvas (2026): "Setting the Course, but Forgetting to Steer: Analyzing Compliance with GDPR's Right of Access to Data by Instagram, TikTok, and Youtube", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[5]

Gegenhuber, Gabriel K.; Frenzel, Philipp E.; Günther, Maximilian; Ullrich, Johanna; Judmayer, Aljosha (2026): "Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[6]

Cohn-Gordon, Katriel; Damaskinos, Georgios; Neto, Divino; Cordova, Joshi; Reitz, Benoît; Strahs, Benjamin; Obenshain, Daniel; Pearce, Paul; Papagiannis, Ioannis (2020): "DELF: Safeguarding deletion correctness in Online Social Networks", in: Proceedings of the USENIX Security Symposium. (Link)

[7]

Schlinker, Brandon; Cunha, Ítalo S.; Chiu, Yi-Ching; Sundaresan, Srikanth; Katz-Bassett, Ethan (2019): "Internet Performance from Facebook's Edge", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[8]

West, Jack; Thiemt, Lea; Ahmed, Shimaa; Bartig, Maggie; Fawaz, Kassem; Banerjee, Suman (2024): "A Picture is Worth 500 Labels: A Case Study of Demographic Disparities in Local Machine Learning Models for Instagram and TikTok", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[9]

Nguyen, Hoang Dai; Dhungana, Sumit; Itha, Madhulika; Vadrevu, Phani (2025): ""Please don't send that bot anything": A Mixed-methods Study of Personal Impersonation Attacks Targeting Digital Payments on Social Media", in: Proceedings of the USENIX Security Symposium. (Link)

[10]

Galeazzi, Alessandro; Paudel, Pujan; Conti, Mauro; Cristofaro, Emiliano De; Stringhini, Gianluca (2026): "Revealing The Secret Power: How Algorithms Can Influence Content Visibility on Twitter/X", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[11]

McCrosky, Jesse; Malla, Ranadheer; Tanskanen, Aapo; Camargo, Chico Q. (2026): "Does This Button Work? Investigating YouTube's Ineffective User Controls", in: Proceedings of the ACM Web Conference. (DOI)

[12]

Benzaamia, Abir; El Fraihi, Asmaa; Abdelaziz, Ines; Goga, Oana (2026): "A Year Under the DSA: Ad Transparency's Uneven Landscape", Proceedings on Privacy Enhancing Technologies 2026(2):517-532. (DOI)

[13]

Kaleli, Beliz; Kondracki, Brian; Egele, Manuel; Nikiforakis, Nick; Stringhini, Gianluca (2021): "To Err.Is Human: Characterizing the Threat of Unintended URLs in Social Media", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[14]

Zannettou, Savvas; Caulfield, Tristan; Blackburn, Jeremy; Cristofaro, Emiliano De; Sirivianos, Michael; Stringhini, Gianluca; Suarez-Tangil, Guillermo (2018): "On the Origins of Memes by Means of Fringe Web Communities", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[15]

Acharya, Bhupendra; Lazzaro, Dario; López-Morales, Efrén; Oest, Adam; Saad, Muhammad; Cinà, Antonio Emanuele; Schönherr, Lea; Holz, Thorsten (2024): "The Imitation Game: Exploring Brand Impersonation Attacks on Social Media Platforms", in: Proceedings of the USENIX Security Symposium. (Link)

[16]

Beluri, Mario; Acharya, Bhupendra; Khodayari, Soheil; Stivala, Giada; Pellegrino, Giancarlo; Holz, Thorsten (2025): "Exploration of the Dynamics of Buy and Sale of Social Media Accounts", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[17]

Xue, Diwen; Ramesh, Reethika; S, Valdik S.; Evdokimov, Leonid; Viktorov, Andrey; Jain, Arham; Wustrow, Eric; Basso, Simone; Ensafi, Roya (2021): "Throttling Twitter: an emerging censorship technique in Russia", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[18]

Simko, Lucy; Hutchinson, Adryana; Isaac, Alvin; Fries, Evan; Sherr, Micah; Aviv, Adam J. (2024): ""Modern problems require modern solutions": Community-Developed Techniques for Online Exam Proctoring Evasion", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[19]

Biswas, Md. Rafiul; Bessghaier, Mabrouka; Ibrahim, Shimaa; Mikros, George K.; Zaghouani, Wajdi (2026): "Longitudinal Trends in Global Climate Change Discourse on Facebook", in: Proceedings of the ACM Web Conference. (DOI)

[20]

Cinus, Federico; Minici, Marco; Luceri, Luca; Ferrara, Emilio (2025): "Exposing Cross-Platform Coordinated Inauthentic Activity in the Run-Up to the 2024 U.S. Election", in: Proceedings of the ACM Web Conference. (DOI)

[21]

Knockel, Jeffrey; Dałek, Jakub; Aljizawi, Noura; Ahmed, Mohamed; Meletti, Levi; Lau, Justin (2026): "Banned Books: Analysis of Censorship on Amazon.com", Proceedings on Privacy Enhancing Technologies 2026(3):200-214. (DOI)

[22]

He, Jiahui; Zia, Haris Bin; Castro, Ignacio; Raman, Aravindh; Sastry, Nishanth; Tyson, Gareth (2023): "Flocking to Mastodon: Tracking the Great Twitter Migration", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[23]

Venkatadri, Giridhari; Sapiezynski, Piotr; Redmiles, Elissa M.; Mislove, Alan; Goga, Oana; Mazurek, Michelle L.; Gummadi, Krishna P. (2019): "Auditing Offline Data Brokers via Facebook's Advertising Platform", in: Proceedings of the ACM Web Conference. (DOI)

[24]

Capozzi, Arthur; Morales, Gianmarco De Francisci; Mejova, Yelena; Monti, Corrado; Panisson, André (2023): "The Thin Ideology of Populist Advertising on Facebook during the 2019 EU Elections", in: Proceedings of the ACM Web Conference. (DOI)

[25]

Cheng, Long; Wilson, Christin; Liao, Song; Young, Jeffrey; Dong, Daniel; Hu, Hongxin (2020): "Dangerous Skills Got Certified: Measuring the Trustworthiness of Skill Certification in Voice Personal Assistant Platforms", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[26]

Liao, Song; Aldeen, Mohammed; Yan, Jingwen; Cheng, Long; Luo, Xiapu; Cai, Haipeng; Hu, Hongxin (2024): "Understanding GDPR Non-Compliance in Privacy Policies of Alexa Skills in European Marketplaces", in: Proceedings of the ACM Web Conference. (DOI)