| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| practices:legal_enforcement [2026/08/18 11:21] – Fix [[Artifacts]] -> [[:Artifacts]]: an unqualified link resolves inside the current namespace, so it pointed at practices:artifacts. Authored by Claude. karel.kubicek.claude | practices:legal_enforcement [2026/09/11 18:00] (current) – Carve-out drift: the domain-to-company ownership material moved from Programming:Crawler:webXray to the new Design:Ownership resolution on 2026-09-11; repoint the link. Authored by Claude karel.kubicek.claude |
|---|
| | 2025–2026* | 1,185 | 121 | 10.2% | | | 2025–2026* | 1,185 | 121 | 10.2% | |
| |
| <wrap todo>* 2025–2026 is provisional: CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and TheWebConf 2026 abstracts are not in OpenAlex, so those venue-years are under-represented by construction. See [[Literature:Corpus]].</wrap> | <WRAP todo>* 2025–2026 is provisional: CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and TheWebConf 2026 abstracts are not in OpenAlex, so those venue-years are under-represented by construction. See [[Literature:Corpus]].</WRAP> |
| |
| It is also very unevenly distributed. **Almost a quarter of PoPETs papers assess a law**; at CCS it is one in thirty. If you are writing a compliance measurement and wondering where the reviewers who have read one before are, this table is the answer. | It is also very unevenly distributed. **Almost a quarter of PoPETs papers assess a law**; at CCS it is one in thirty. If you are writing a compliance measurement and wondering where the reviewers who have read one before are, this table is the answer. |
| |
| - **A named complainant who is a data subject**, with the evidence that they are one. Not "we crawled 100k sites" but "the following was written into //my// terminal at //this// timestamp". | - **A named complainant who is a data subject**, with the evidence that they are one. Not "we crawled 100k sites" but "the following was written into //my// terminal at //this// timestamp". |
| - **The controller, identified.** Reg. 2025/2518 Art. 4(1)(d) asks for //"information which facilitates the identification of the controller or processor"//. For a third-party tracker this is real work: the domain is not the company. See [[Programming:Crawler:webXray]] for the ownership databases and how much they disagree. | - **The controller, identified.** Reg. 2025/2518 Art. 4(1)(d) asks for //"information which facilitates the identification of the controller or processor"//. For a third-party tracker this is real work: the domain is not the company. See [[Design:Ownership resolution]] for the ownership databases, how much they disagree, and how often each is right. |
| - **The provision breached, named as an article of the //national// law.** "Art. 5(3) ePrivacy Directive, as transposed by § 25 TDDDG" is a case; "the site is not GDPR compliant" is not. This is also where the ePrivacy/GDPR split has to be made explicit — and note that the German provision is the same example this page would have written as "§ 25 TTDSG" two years ago: the statute was renamed to TDDDG in 2024, section number unchanged.((Verified 2026-08-18 at [[https://www.gesetze-im-internet.de/ttdsg/__25.html|gesetze-im-internet.de]], whose URL path still reads ''ttdsg'' while the heading reads "§ 25 TDDDG — //Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten//".)) | - **The provision breached, named as an article of the //national// law.** "Art. 5(3) ePrivacy Directive, as transposed by § 25 TDDDG" is a case; "the site is not GDPR compliant" is not. This is also where the ePrivacy/GDPR split has to be made explicit — and note that the German provision is the same example this page would have written as "§ 25 TTDSG" two years ago: the statute was renamed to TDDDG in 2024, section number unchanged.((Verified 2026-08-18 at [[https://www.gesetze-im-internet.de/ttdsg/__25.html|gesetze-im-internet.de]], whose URL path still reads ''ttdsg'' while the heading reads "§ 25 TDDDG — //Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten//".)) |
| - **Reproducible evidence, not a table of percentages.** A HAR or a request log with timestamps, the screenshots of the banner state, the exact user journey, and the crawler configuration. See [[Programming:Traffic files]] and [[Design:Automated measurements]]. | - **Reproducible evidence, not a table of percentages.** A HAR or a request log with timestamps, the screenshots of the banner state, the exact user journey, and the crawler configuration. See [[Programming:Traffic files]] and [[Design:Automated measurements]]. |
| * [[Privacy:Consent]] — what you are measuring when you measure a cookie banner. | * [[Privacy:Consent]] — what you are measuring when you measure a cookie banner. |
| * [[Privacy:Cookies]] and [[Privacy:Requests]] — the classification your legal claim rests on. | * [[Privacy:Cookies]] and [[Privacy:Requests]] — the classification your legal claim rests on. |
| | * [[Privacy:Policies|Measuring Privacy Policies and Terms]] — the //document// side of a compliance claim rather than the behavioural side. Most of that literature assesses a law, at many times the corpus rate; that page carries the counts and the test. |
| * [[Design:Crawling location]] — the vantage point determines which national transposition applies to what you observed. | * [[Design:Crawling location]] — the vantage point determines which national transposition applies to what you observed. |
| * [[Practices:Public relations]] — publication as the other enforcement route, per {[saemann2022_fines]}. | * [[Practices:Public relations]] — publication as the other enforcement route, per {[saemann2022_fines]}. |
