Measure The Web

User Tools

Site Tools

Trace: • requests
practices:legal_enforcement

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
practices:legal_enforcement [2026/08/18 11:21] – New page: taking a compliance finding to a regulator. Which authority is competent (the ePrivacy Art. 5(3) carve-out from the GDPR one-stop-shop, verified against EDPB Opinion 5/2019 and Conseil d'Etat 449209), what a filing contains, what 15 corpus paper karel.kubicek.claudepractices:legal_enforcement [2026/09/11 18:00] (current) – Carve-out drift: the domain-to-company ownership material moved from Programming:Crawler:webXray to the new Design:Ownership resolution on 2026-09-11; repoint the link. Authored by Claude karel.kubicek.claude
Line 30: Line 30:
 | 2025–2026* | 1,185 | 121 | 10.2% | | 2025–2026* | 1,185 | 121 | 10.2% |
  
-<wrap todo>* 2025–2026 is provisional: CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and TheWebConf 2026 abstracts are not in OpenAlex, so those venue-years are under-represented by construction. See [[Literature:Corpus]].</wrap>+<WRAP todo>* 2025–2026 is provisional: CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and TheWebConf 2026 abstracts are not in OpenAlex, so those venue-years are under-represented by construction. See [[Literature:Corpus]].</WRAP>
  
 It is also very unevenly distributed. **Almost a quarter of PoPETs papers assess a law**; at CCS it is one in thirty. If you are writing a compliance measurement and wondering where the reviewers who have read one before are, this table is the answer. It is also very unevenly distributed. **Almost a quarter of PoPETs papers assess a law**; at CCS it is one in thirty. If you are writing a compliance measurement and wondering where the reviewers who have read one before are, this table is the answer.
Line 215: Line 215:
  
   - **A named complainant who is a data subject**, with the evidence that they are one. Not "we crawled 100k sites" but "the following was written into //my// terminal at //this// timestamp".   - **A named complainant who is a data subject**, with the evidence that they are one. Not "we crawled 100k sites" but "the following was written into //my// terminal at //this// timestamp".
-  - **The controller, identified.** Reg. 2025/2518 Art. 4(1)(d) asks for //"information which facilitates the identification of the controller or processor"//. For a third-party tracker this is real work: the domain is not the company. See [[Programming:Crawler:webXray]] for the ownership databases and how much they disagree.+  - **The controller, identified.** Reg. 2025/2518 Art. 4(1)(d) asks for //"information which facilitates the identification of the controller or processor"//. For a third-party tracker this is real work: the domain is not the company. See [[Design:Ownership resolution]] for the ownership databases, how much they disagree, and how often each is right.
   - **The provision breached, named as an article of the //national// law.** "Art. 5(3) ePrivacy Directive, as transposed by § 25 TDDDG" is a case; "the site is not GDPR compliant" is not. This is also where the ePrivacy/GDPR split has to be made explicit — and note that the German provision is the same example this page would have written as "§ 25 TTDSG" two years ago: the statute was renamed to TDDDG in 2024, section number unchanged.((Verified 2026-08-18 at [[https://www.gesetze-im-internet.de/ttdsg/__25.html|gesetze-im-internet.de]], whose URL path still reads ''ttdsg'' while the heading reads "§ 25 TDDDG — //Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten//".))   - **The provision breached, named as an article of the //national// law.** "Art. 5(3) ePrivacy Directive, as transposed by § 25 TDDDG" is a case; "the site is not GDPR compliant" is not. This is also where the ePrivacy/GDPR split has to be made explicit — and note that the German provision is the same example this page would have written as "§ 25 TTDSG" two years ago: the statute was renamed to TDDDG in 2024, section number unchanged.((Verified 2026-08-18 at [[https://www.gesetze-im-internet.de/ttdsg/__25.html|gesetze-im-internet.de]], whose URL path still reads ''ttdsg'' while the heading reads "§ 25 TDDDG — //Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten//".))
   - **Reproducible evidence, not a table of percentages.** A HAR or a request log with timestamps, the screenshots of the banner state, the exact user journey, and the crawler configuration. See [[Programming:Traffic files]] and [[Design:Automated measurements]].   - **Reproducible evidence, not a table of percentages.** A HAR or a request log with timestamps, the screenshots of the banner state, the exact user journey, and the crawler configuration. See [[Programming:Traffic files]] and [[Design:Automated measurements]].
Line 289: Line 289:
   * [[Privacy:Consent]] — what you are measuring when you measure a cookie banner.   * [[Privacy:Consent]] — what you are measuring when you measure a cookie banner.
   * [[Privacy:Cookies]] and [[Privacy:Requests]] — the classification your legal claim rests on.   * [[Privacy:Cookies]] and [[Privacy:Requests]] — the classification your legal claim rests on.
 +  * [[Privacy:Policies|Measuring Privacy Policies and Terms]] — the //document// side of a compliance claim rather than the behavioural side. Most of that literature assesses a law, at many times the corpus rate; that page carries the counts and the test.
   * [[Design:Crawling location]] — the vantage point determines which national transposition applies to what you observed.   * [[Design:Crawling location]] — the vantage point determines which national transposition applies to what you observed.
   * [[Practices:Public relations]] — publication as the other enforcement route, per {[saemann2022_fines]}.   * [[Practices:Public relations]] — publication as the other enforcement route, per {[saemann2022_fines]}.
-  * [[Artifacts]] — the evidence pack and the crawl configuration a regulator would need.+  * [[:Artifacts]] — the evidence pack and the crawl configuration a regulator would need.
  
 ===== Methodology and limitations of these figures ===== ===== Methodology and limitations of these figures =====
practices/legal_enforcement.1787052091.txt.gz · Last modified: by karel.kubicek.claude