Cookie syncing (also cookie matching, ID syncing, user matching) is the mechanism by which two parties that each hold their own identifier for the same browser learn that the two identifiers belong to the same person. The same-origin policy stops tracker.com from reading advertiser.com's cookie, so instead tracker.com sends the browser to advertiser.com with its own identifier in the URL — a redirect, an image, an iframe — and both sides write the pair into a match table. Everything afterwards happens server to server, invisibly.

This page is about detecting that exchange from a measurement, not about the ad-tech business it serves. It is the mechanism that turns per-domain identifiers into a joinable graph, and it is the reason a per-party site-prevalence figure understates what that party can see. It is also, from the crawler's side, the tracking behaviour most sensitive to how the crawl was set up. Run a Safari- or Firefox-default browser and you measure near-zero third-party syncing by construction, not because it stopped. Run stateless and you see only first-contact syncing and none of the accumulated graph — a real measurement, but of a different thing.

• Online Tracking: A 1-million-site Measurement and Analysis [3Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)], CCS 2016 — the reference implementation. Section 4 states the ID-cookie criteria that most later work either copies or explicitly modifies, Section 5.6 measures syncing, and Section 3 explains why the crawl has to be stateful. Its tool, OpenWPM, is still the default instrument.
• Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask [4Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2019): "Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask", in: Proceedings of the ACM Web Conference. (DOI)], TheWebConf 2019 — the only paper in this corpus whose whole subject is the phenomenon, and one of only three that measure it on real users' traffic rather than on a crawl. Read it for the CONRAD algorithm — its rule-based detector for identifier sharing in passive traffic, plus a machine-learning fallback for encrypted identifiers — and for what syncing does to a user over a year, not for a site-level prevalence figure (it does not produce one).
• Tracing Information Flows Between Ad Exchanges Using Retargeted Ads [2Bashir, Muhammad Ahmad; Arshad, Sajjad; Robertson, William; Wilson, Christo (2016): "Tracing information flows between ad exchanges using retargeted ads", in: 25th USENIX Security Symposium (USENIX Security 16), pp. 481-496. (Link)], USENIX Security 2016 — the one paper that does not look for identifiers in URLs at all, and therefore the only external check on everything that does. It infers sharing from the semantics of which retargeted ad gets served, which works even when the identifiers are encrypted.
• From Syntactic Matching to Taint Tracking and Back [1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)], PoPETs 2026 — the current methodological state of the art on the detection question itself. Read this before you implement anything; it is a systematisation of every identifier heuristic in the literature plus a measurement of what each gets wrong.
• Measuring UID Smuggling in the Wild [5Randall, Audrey; Snyder, Peter; Ukani, Alisha; Snoeren, Alex C.; Voelker, Geoffrey M.; Savage, Stefan; Schulman, Aaron (2022): "Measuring UID smuggling in the wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], IMC 2022 — read for the crawler design (four synchronised crawlers instead of two) and because it measures the phenomenon syncing turns into once third-party cookies are unavailable.

Published syncing figures look wildly inconsistent because they are not measuring the same object. Nothing on this page is comparable across rows of this table; each number is correct for its own unit.

Two consequences. First, “X% of sites do cookie syncing” is meaningless without the crawl's statefulness, consent action, and vantage — the same population moves by 5.6 percentage points across the three consent actions in [7Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2021): "User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users", in: Proceedings of the ACM Web Conference. (DOI)] alone. Second, the directional unit (A sent its ID to B) and the pair unit (A and B are synced) differ by roughly a factor of two, and papers are not consistent about which they report; [3Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] says explicitly that its count “includes both events where it is a referer and where it is a receiver”.

Thirty papers in the corpus measure identifier sharing between parties (see Use in Publications for how that set was built). Twenty-nine of them field their own detector, in six families; the thirtieth reuses another paper's syncing labels rather than detecting anything, and is the last row.

• A fixed length window on the cookie value as the identifier test. 8 ≤ length ≤ 100 [3Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] and length > 10 [4Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2019): "Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask", in: Proceedings of the ACM Web Conference. (DOI)] were reasonable when they were written and are weak now: they admit constant strings such as a publisher's own domain name, which is exactly the false-positive class Calzavara et al. traced by hand — matches on bat.bing.net's p parameter (the publisher domain), tags.creativecdn.com's path constant, analytics.twitter.com's landing-page title. Replace or supplement the length test with an entropy / guessability test: zxcvbn guesses ≥ 10^9 is the criterion used by [24Sanchez-Rola, Iskander; Dell'Amico, Matteo; Kotzias, Platon; Balzarotti, Davide; Bilge, Leyla; Vervier, Pierre-Antoine; Santos, Igor (2019): "Can I Opt Out Yet? GDPR and the Global Illusion of Cookie Control", pp. 340–351. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)], [14Sánchez-Rola, Iskander; Dell'Amico, Matteo; Balzarotti, Davide; Vervier, Pierre-Antoine; Bilge, Leyla (2021): "Journey to the Center of the Cookie Ecosystem: Unraveling Actors' Roles and Relationships", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] and adopted by [1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)].
• A long expiry as a necessary condition. [12Acar, Gunes; Eubank, Christian; Englehardt, Steven; Juarez, Marc; Narayanan, Arvind; Díaz, Claudia (2014): "The Web Never Forgets: Persistent Tracking Mechanisms in the Wild", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] required > 30 days, [25Englehardt, Steven; Reisman, Dillon; Eubank, Christian; Zimmerman, Peter; Mayer, Jonathan R.; Narayanan, Arvind; Felten, Edward W. (2015): "Cookies That Give You Away: The Surveillance Implications of Web Tracking", in: Proceedings of the ACM Web Conference. (DOI)] and [3Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] > 90 days. [5Randall, Audrey; Snyder, Peter; Ukani, Alisha; Snoeren, Alex C.; Voelker, Geoffrey M.; Savage, Stefan; Schulman, Aaron (2022): "Measuring UID smuggling in the wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] drops the lifetime condition entirely and says why: under partitioned storage and capped cookie lifetimes, tracking identifiers are increasingly short-lived, so a lifetime filter now excludes the interesting cases. Do not filter on expiry unless you can justify it for your population.
• Two synchronised profiles as the way to tell an identifier from a constant. The classic design runs two machines and keeps values that differ between them [3Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)]. [5Randall, Audrey; Snyder, Peter; Ukani, Alisha; Snoeren, Alex C.; Voelker, Geoffrey M.; Savage, Stefan; Schulman, Aaron (2022): "Measuring UID smuggling in the wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] shows this discards a large number of genuine identifiers — those that appear on only one crawler, and those that cannot be distinguished from session IDs — and uses four crawlers instead: three different user profiles plus one that repeats the first profile's visit, so a value can be tested for “varies across users” and “stable for the same user” separately. If you can afford four browsers, run four.
• Assuming the identifier travels in plaintext. DoubleClick was already encrypting synced identifiers by 2016 [2Bashir, Muhammad Ahmad; Arshad, Sajjad; Robertson, William; Wilson, Christo (2016): "Tracing information flows between ad exchanges using retargeted ads", in: 25th USENIX Security Symposium (USENIX Security 16), pp. 481-496. (Link)], and [4Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2019): "Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask", in: Proceedings of the ACM Web Conference. (DOI)] added a machine-learning “cookie-less” detector for exactly this reason. Plaintext-only matching is a lower bound and should be labelled as one.
• “Third-party cookies are about to disappear, so this is about to stop mattering.” They are not. Google announced on 2025-04-22 that it would keep third-party-cookie choice in Chrome and not ship the planned prompt,¹⁾ and on 2025-10-17 it announced the retirement of ten Privacy Sandbox technologies, among them Attribution Reporting, Topics and Protected Audience, while stating that “Chrome will maintain our current approach to offering users third-party cookie choice in Chrome”.²⁾ The framing to avoid is “post-cookie”; the framing that holds is “Chrome keeps them, Safari and Firefox do not” — which makes syncing a browser-conditional phenomenon, not a disappearing one. Note that the retirement is a live process rather than a completed one, and that Google's blog posts give no Chrome milestone for it while Chrome's own engineering channel does: as of 2026-08-26 the Privacy Sandbox feature-status page lists Protected Audience, Topics, Attribution Reporting, Private Aggregation, Shared Storage and Related Website Sets as “Intent to deprecate and remove filed”, and the Chrome Platform Status entry for Protected Audience gives a removal milestone of Chrome 153 with status “Proposed”.³⁾

Syncing is measured in venues this site does not index. The AsiaCCS and EuroS&P line of work is entirely absent — Urban et al.'s GDPR-and-data-sharing measurements are cited by corpus papers but are not in the corpus — and so is most of the ad-tech-economics literature. Any count on this page is a count over CCS, IMC, NDSS, PoPETs, USENIX Security, TheWebConf and IEEE S&P, 2010–2026. See Corpus.

Calzavara et al. [1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)] tabulate the identifier-detection heuristics used across the literature. This is the single most useful table for anyone about to write one, so it is reproduced here with the original papers attributed. “RO” is Ratcliff–Obershelp string similarity between the values two independent clients received; “Guesses” is the zxcvbn cracking-cost estimate.

The paper's own summary of that table is the sentence to quote in your related-work section: “there is no consensus on the most effective heuristic due to the absence of a solid ground truth.”

Three practical instructions follow from their evaluation.

1. Match after decoding, not only after encoding. Most prior work generated encoded forms of the identifier (Base64, MD5, SHA-1, SHA-256) and looked for those. That misses the case where the identifier is inside a structure that is then encoded — base64('{“uid”: 1234}') contains no encoding of 1234. Parse and decode the request too, up to a bounded depth (three layers is the convention).
2. Confirm each match with a canary. Their validation technique is cheap and reusable: overwrite the storage value with a distinctive canary, revisit the page, and check whether the matching request now carries the canary. If it does, the flow is real; if the request still carries the original value, the match was spurious. Applying this filter removed 24% of tracking requests and 36% of distinct trackers from their own results, and manual inspection confirmed the removed ones were not tracking.
3. If you can run both matching and taint tracking, do. The two disagree on 60% of the union of 40,605 requests: 17,496 (43% of the union, 52% of syntactic matching's own 33,584) found by syntactic matching alone, 7,021 (17% of the union) by taint tracking alone. Neither is a superset.

Syncing is the tracking behaviour most sensitive to crawler setup. Get any of these wrong and the measurement floor, not the phenomenon, is what you report.

• Stateful, and with a seed profile. [3Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] is explicit: for cookie syncing, statefulness “is essential”, because the sync graph of an accumulated identity is what you are trying to reconstruct. They also solve the parallelism problem in a way worth copying — build one seed profile by visiting the top 10,000 sites serially, then load that profile into every parallel browser instance. Their measured justification: such a profile “will have communicated with 76% of all third-party domains present on more than 5 of the top 100,000 sites”. The residual bias is stated too: third parties absent from the seed hand out a different identifier in each parallel instance and so appear to sync with themselves — and no paper in these venues has measured how large that inflation is, which is the open question on the statefulness page.
• But “stateful sees more” is not a law. Zeber et al. [29Zeber, David; Bird, Sarah; Oliveira, Camila; Rudametkin, Walter; Segall, Ilana; Wolls´en, Fredrik; Lopatka, Martin (2020): "The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing", in: Proceedings of The Web Conference 2020, pp. 167–178. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] give the mechanism for the opposite: “cookie syncing is not necessary for users who have already had their cookies synced, whereas a stateless crawler browser instance with a fresh profile would be a clear target for cookie syncing”. A fresh profile over-triggers first-contact syncing; an aged profile is what you need for the graph. Decide which of the two you are measuring and say so — the full comparison is on the statefulness page. That six of the corpus's 25 crawling papers ran both conditions is the right instinct.
• The browser decides the answer. Safari's ITP “by default blocks all third-party cookies. There are no exceptions to this blocking”,⁷⁾ and Firefox has partitioned cookies by top-level site for all users since Firefox 103.⁸⁾ A default-configured Firefox or Safari crawl measures near-zero third-party syncing by construction. If your instrument is OpenWPM on Firefox, check what protections are on before you interpret a low number; [18Munir, Shaoor; Siby, Sandra; Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair; Troncoso, Carmela (2023): "CookieGraph: Understanding and Detecting First-Party Tracking Cookies", pp. 3490–3504. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] turns Firefox's additional protections off deliberately and says so. Conversely, running with third-party cookies blocked is a legitimate experimental condition — [12Acar, Gunes; Eubank, Christian; Englehardt, Steven; Juarez, Marc; Narayanan, Arvind; Díaz, Claudia (2014): "The Web Never Forgets: Persistent Tracking Mechanisms in the Wild", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] used it and found synced IDs and parties fell “by nearly a factor of two”.
• Consent action changes the number, and not in the direction you expect. [7Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2021): "User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users", in: Proceedings of the ACM Web Conference. (DOI)]: sites carrying third-party ID synchronisation went 24.03% → 26.20% → 29.61% for No Action → Reject All → Accept All, and syncs per third-party ID 3.51 → 3.91 → 4.86. Rejecting produced more syncing than not interacting at all. Record the consent action, and prefer measuring more than one. See Consent and Interaction.
• Interaction depth and timing. Syncing is triggered by the ad stack, which runs after the auction. Prebid.js — the dominant open-source header-bidding wrapper — documents its user-sync defaults as syncDelay 3000 ms after the auction ends, syncsPerBidder 5, image syncs enabled and iframe syncs disabled by default.⁹⁾ A crawler that closes the page 3 seconds after load can miss the syncs entirely, and any per-adapter count is capped at 5 by the publisher's own configuration rather than by the adapter's appetite. In the corpus's measuring set, 11 of the 25 that crawled visited the landing page only.
• Vantage. Which exchanges bid, and therefore which sync, depends on where the browser appears to be, and EU vantage points additionally bring a consent banner into the path. Of the 30 measuring papers, 19 state any vantage location at all; the United States accounts for 13 of those.
• Logging. You need request URLs and referrers and POST bodies, plus Set-Cookie and the resulting cookie jar, plus redirect chains with their initiators. HAR alone is usually not enough — see Traffic files.

Third-party-cookie syncing is a Chrome-and-blocklist-permitting behaviour. Everywhere it is blocked, the same function is served by mechanisms that a syncing detector will not see, and these are where the measurable action is now.

• Link decoration and UID smuggling. The identifier moves into the URL of a top-level navigation, so no third-party cookie is needed. [5Randall, Audrey; Snyder, Peter; Ukani, Alisha; Snoeren, Alex C.; Voelker, Geoffrey M.; Savage, Stefan; Schulman, Aaron (2022): "Measuring UID smuggling in the wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] measures it directly: UID smuggling on 8.11% of the unique URL paths its crawler took (Table 2 puts that population at 10,814), against 2.7% of the navigation paths that were bounce tracking without a UID transfer, and it names 27 “dedicated smugglers” — redirectors with no purpose in the path except carrying an identifier.¹⁰⁾ [19Munir, Shaoor; Lee, Patrick; Iqbal, Umar; Shafiq, Zubair; Siby, Sandra (2024): "PURL: Safe and Effective Sanitization of Link Decoration", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 4103-4120. USENIX Association, Philadelphia, PA. (Link)] finds tracking link decorations on 73.02% of tested sites, averaging 10.75 per site. The 2026 entry in this line is [30Dao, Ha; Shinde, Abhishek; Athar, Sana; Gosain, Devashish (2026): "Clicking into Exposure: Uncovering Privacy Risks of Google Click Identifier in YouTube Ads", Proceedings on Privacy Enhancing Technologies 2026(2):92-107. (DOI)], which follows one specific click identifier: all 568 YouTube ad interactions it observed carried a gclid in a URL path, 64 of 76 advertisers stored it as a first-party cookie (41 of 74 even after the banner was rejected), and 133 distinct third-party domains received gclid values. That last figure is the syncing question in link-decoration clothing: an identifier the advertiser did not set, reaching parties that did not set it either. Detection, tooling and the parameter-list landscape are on Link Decoration and Tracking Parameters — do not re-derive them here.
• Bounce tracking. A redirect through the tracker's own domain so that its cookie becomes first-party for one hop. WebKit classifies it explicitly: ITP “counts the number of unique such redirects” and “will count it as a bounce even if the redirect is delayed by landing on a webpage and triggering a navigation a couple of seconds later”, and it “caps the expiry of cookies created in JavaScript on the landing webpage to 24 hours” when it detects link decoration.¹¹⁾ [8Iqbal, Umar; Wolfe, Charlie; Nguyen, Charles; Englehardt, Steven; Shafiq, Zubair (2022): "Khaleesi: Breaker of Advertising and Tracking Request Chains", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2911-2928. USENIX Association, Boston, MA. (Link)] detects it with a chain heuristic requiring a top-level navigation, third-party cookies and a return navigation. Chrome ships mitigations for it too, and — importantly for anyone reading the Privacy Sandbox retirement as “Chrome gave up” — they are on the keep list: a site that a navigation redirected through, and that the user has not interacted with in 45 days, has its storage deleted, for users who block third-party cookies.¹²⁾
• First-party identifier sharing. The identifier is set as a first-party cookie — often by a third-party script — and then sent onward. [6Fouad, Imane; Bielova, Nataliia; Legout, Arnaud; Sarafijanovic-Djukic, Natasa (2020): "Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels", in: Proceedings on Privacy Enhancing Technologies, pp. 499-518. (DOI)] calls this first-to-third-party syncing and finds it on 67.96% of the domains it visited; [14Sánchez-Rola, Iskander; Dell'Amico, Matteo; Balzarotti, Davide; Vervier, Pierre-Antoine; Bilge, Leyla (2021): "Journey to the Center of the Cookie Ecosystem: Unraveling Actors' Roles and Relationships", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] names the practice cookie ghostwriting, where an entity creates a cookie in another party's name, and measures the resulting graph over 138M cookie-creation events from 6.2M pages on 1M sites. [18Munir, Shaoor; Siby, Sandra; Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair; Troncoso, Carmela (2023): "CookieGraph: Understanding and Detecting First-Party Tracking Cookies", pp. 3490–3504. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] and [28Nikkhah Bahrami, Pouneh; Fass, Aurore; Shafiq, Zubair (2025): "CookieGuard: Characterizing and Isolating the First-Party Cookie Jar", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] are the detection follow-ups. This is the family most likely to be what you actually need to measure in 2026.
• Server-side. If the exchange happens between two servers, no client-side method sees it at all. That is the subject of Server side tracking, and it is the reason the ad-semantics family [2Bashir, Muhammad Ahmad; Arshad, Sajjad; Robertson, William; Wilson, Christo (2016): "Tracing information flows between ad exchanges using retargeted ads", in: 25th USENIX Security Symposium (USENIX Security 16), pp. 481-496. (Link)] remains the only complete check.
• Deterministic, non-cookie identifiers. Hashed-email identity frameworks are the industry's declared replacement. UID2 describes itself as “a framework that enables deterministic identity for advertising opportunities on the open internet”.¹³⁾ These are joined at the identity-provider rather than in the browser, so a syncing crawl sees a token being set, not an exchange. No paper in this corpus measures their deployment, which is a gap, not a finding.

A note on the vendor mechanism, for the related-work paragraph. Google's Authorized Buyers documentation still describes the classic flow in the vendor's own words: Cookie Matching “lets you match your cookie … with a corresponding bidder-specific Google User ID”, implemented as a redirect that hands the bidder a google_gid — “an unpadded web-safe base64-encoded string” — and a google_cver, with the bidder answering with a 1×1 pixel; the match is stored in a match table, optionally Google-hosted.¹⁴⁾ Citing the vendor documentation rather than a secondary description is worth the extra paragraph: it is the ground truth for what parameter names to look for.

All figures below come from the publication corpus — seven venues, 2010–2026, 5,869 papers with readable full text. The full query log, the report script and its unedited output are on cookie_syncing.

The phenomenon has no field in the extraction schema, so reach is measured from the text. Denominator: 5,869 papers with full text.

The gap between 106 and 31 is the point: most mentions are one line of related work. The regex is not the population — see Methodology and limitations of these figures.

Denominator: that venue's own papers with full text.

PoPETs is where this literature lives. Its ≥1-mention rate (5.5%) is about twice IMC's, the next venue, and about seven times CCS's; at the ≥5 threshold it holds 9 of the 31 papers. If you are choosing a venue, that is the signal. No NDSS paper in the corpus mentions syncing five times or more, despite NDSS having the fourth-highest ≥1-mention rate in the table.

Papers mentioning any syncing wording, per year, against that year's corpus size. This measures attention in the literature, not how common syncing was in any year — no row here is a prevalence figure. 2025 is thin at the edges and 2026 is provisional — CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and TheWebConf 2026 are incompletely selected — so the last two rows are not evidence of decline.

2010–2013 produced two mentions in 510 papers and no paper engaging with it. 2022 is the peak year of attention on both columns, which is also when the request-chain and graph families arrive. That is a coincidence worth noticing, not a cause.

Built by hand from the 44 candidates the automated sweep produced: 30 measure identifier sharing between distinct parties, 5 cite it without measuring it, and 9 use the phrase for something else entirely (a rendering side-channel that “synchronises cookies” across browsers, a cookie-match predicate in a formal browser model, opt-out cookie name matching, and a redefinition of “cookie syncing” to mean cross-site syncing enabled by a browser bug). Unlabelled residue: zero — every candidate carries a hand label.

Of the 30, 25 ran an automated crawl (crawlConfig fired). Sentinels are shown but are never counted as answers.

Just under a quarter of the papers measuring the one behaviour that most needs a stateful crawl do not say whether their crawl was stateful, and just under half do not say what they did about consent banners. Those are the two fields this page asks you to report. See Stateful stateless.

Of the 30, 13 (43.3%) state a public artifact and 10 (33.3%) mention none. What is actually released and reusable:

Nine of the thirteen public artifacts are listed; the other four are conference-artifact or project pages whose reuse value is narrower than a tool or a dataset. The full list of links the extraction found is in the report output on cookie_syncing.

Crossing the measuring set with the extraction's classification family: 20 of the 30 carry a tuple whose target is web-request (corpus-wide, 262 of the 4,439 papers that classified anything target web-request). Of those 20, 15 use a blocklist to decide which of the parties involved counts as a tracker: 12 name EasyList and/or EasyPrivacy and 4 name Disconnect. That is a second, independent dependency on filter lists layered on top of the identifier heuristic, and it inherits everything those lists miss. Only 9 of the 20 report any validation of that classification stronger than a sentinel.

If a reviewer is to accept a syncing figure, the paper has to answer all of these. The corpus can only speak to three of them, and on those three the record is poor: 24.0% of the papers do not state statefulness, 48.0% do not state a consent action, and 80.0% do not state whether the browser was headless.

1. The unit and its denominator. Sites? Directional flows? Unordered domain pairs? Users? Requests? Chains? And of what population — see the table in Pick the Unit Before You Pick the Method.
2. The identifier heuristic, in full. Lifetime condition, tokenisation, length bound, randomness test and its threshold, and how many independent profiles you compared. Reproduce the row you would occupy in the table in The identifier heuristic is the measurement.
3. Which request components you searched: query parameters, path segments, Referer, request body, response headers. Papers differ here and rarely say so.
4. Which encodings and decodings you applied, and to what depth.
5. How you decided two domains are different parties, and with which entity list at which version. Without this, amazon.com → amazonaws.com is a sync.
6. Statefulness, seed profile, parallelism. If parallel, say how the seed was built and acknowledge the self-sync artefact [3Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)].
7. Consent action, and ideally more than one.
8. Browser and its tracking protections, explicitly. “Firefox” is not a configuration.
9. Vantage, and whether it is in the EEA.
10. How long you stayed on the page after load, given the 3-second Prebid default.
11. Whether your figure is a lower bound because of encryption, server-side exchange, or a blocked configuration. It almost always is.
12. Any validation. A canary re-visit [1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)] is cheap; a manual sample is the minimum.

The full query log, the report script, its unedited output, the hand labels and the quote checks are on cookie_syncing. Corpus-wide caveats — how the corpus was built, which venue-years are provisional, how stable each extracted field is — are on Corpus.

The limitations specific to this page:

• The population is defined by a regex over full text, then corrected by hand. The regex is a filter for reading effort, not a definition. It under-recalls badly at the low end: [1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)], the most methodologically central paper here, uses the phrase twice and would have been excluded by any threshold. Three papers were added to the set by hand for exactly this reason, and a fourth to correct a boundary inconsistency rather than to expand the set. There is no way to know how many others were missed, and the honest reading of “106 papers mention it” is “at least 106”.
• The 30-paper “measures it” set is one person's judgement, recorded as an explicit label per paper in the report script so that a disagreement can be located. Nine candidates were excluded because the phrase means something else in them; that call is defensible but not unique.
• The boundary of that set is genuinely fuzzy, and it moved during writing. It is “measures an identifier being conveyed to a party that did not set it”, which includes both a two-way sync and a one-way hand-off. Two corpus papers meet that description and are not in the 30, because they were found after the set was fixed and adding papers as one stumbles on them is how a hand-curated set stops being reproducible: [31Bekos, Paschalis; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2023): "The Hitchhiker's Guide to Facebook Web Tracking with Invisible Pixels and Click IDs", in: Proceedings of the ACM Web Conference. (DOI)] measures a median website passing identifiers to 6.2 third parties, and [32Dimova, Yana; Acar, Gunes; Olejnik, Lukasz; Joosen, Wouter; Van Goethem, Tom (2021): "The CNAME of the game: Large-scale analysis of DNS-based tracking evasion", Proceedings on Privacy Enhancing Technologies 2021:394–412. (DOI) (Link)] finds 1,899 cookie leaks in request URLs on 1,295 distinct sites. Both are named here rather than quietly omitted; a reader who counts them gets 32, and the shape of every table above is unchanged by two papers. One paper was added late — the gclid study — but to correct a boundary that had been applied two different ways, not to expand the set; the difference is argued on cookie_syncing. Drawn strictly — only papers measuring a genuine two-way match between two parties' identifiers — the set would be closer to twenty.
• The detection-family assignment is coarse. Papers combine families — [19Munir, Shaoor; Lee, Patrick; Iqbal, Umar; Shafiq, Zubair; Siby, Sandra (2024): "PURL: Safe and Effective Sanitization of Link Decoration", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 4103-4120. USENIX Association, Philadelphia, PA. (Link)] builds a graph and does syntactic value matching — and each was assigned the family that does the identifier-sharing work. Read the family table as a ranking, not as a partition.
• Every prevalence figure quoted from a paper carries that paper's denominator, and they are not comparable. This is stated once in Pick the Unit Before You Pick the Method and is worth repeating: none of the percentages on this page can be averaged, ordered, or plotted against each other.
• crawlConfig is an object with one shared evidence quote, so the crawl-configuration table cannot be quote-checked field by field. Of five quotes read by hand, four do not touch the field the row reports. See the box beside that table, and the detail in the provenance page.
• Corpus-level counts come from the .cols rendering of the PDFs. Column reading order was repaired but not perfectly; a phrase split across a column break can still be missed even after whitespace collapsing and de-hyphenation.
• The extraction fields used here (crawlConfig.statefulness, .consentAction, .interactionDepth) are among the most stable in the schema — 98%, 93% and 97% paper-level agreement between two independent extraction runs — but that stability was measured on the previous corpus and has not been re-measured.

• Classifying Cookies — deciding what a cookie is for; this page is about what happens to its value afterwards.
• Classifying Web Requests — filter lists, ML request classifiers, and the link-decoration tooling this page defers to.
• Measuring Server-Side Tracking — where the exchange goes when it leaves the browser entirely.
• Granting Consent to Websites and Interaction — the consent action that changes every figure here.
• Stateful and stateless crawling — the single configuration choice this measurement depends on most.
• OpenWPM and the crawler comparison.
• Traffic files — what you must log to detect a sync at all.
• Fingerprinting — the stateless counterpart, and the mechanism that re-links identifiers after a cookie clear.

[1]

Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)

[2]

Bashir, Muhammad Ahmad; Arshad, Sajjad; Robertson, William; Wilson, Christo (2016): "Tracing information flows between ad exchanges using retargeted ads", in: 25th USENIX Security Symposium (USENIX Security 16), pp. 481-496. (Link)

[3]

Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[4]

Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2019): "Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask", in: Proceedings of the ACM Web Conference. (DOI)

[5]

Randall, Audrey; Snyder, Peter; Ukani, Alisha; Snoeren, Alex C.; Voelker, Geoffrey M.; Savage, Stefan; Schulman, Aaron (2022): "Measuring UID smuggling in the wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[6]

Fouad, Imane; Bielova, Nataliia; Legout, Arnaud; Sarafijanovic-Djukic, Natasa (2020): "Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels", in: Proceedings on Privacy Enhancing Technologies, pp. 499-518. (DOI)

[7]

Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2021): "User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users", in: Proceedings of the ACM Web Conference. (DOI)

[8]

Iqbal, Umar; Wolfe, Charlie; Nguyen, Charles; Englehardt, Steven; Shafiq, Zubair (2022): "Khaleesi: Breaker of Advertising and Tracking Request Chains", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2911-2928. USENIX Association, Boston, MA. (Link)

[9]

Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[10]

Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)

[11]

Weerasekara, Nipuna; Moreno, José Miguel; Matic, Srdjan; Reardon, Joel; Tapiador, Juan; Vallina-Rodríguez, Narseo (2025): "Tracking Without Borders: Studying the Role of WebViews in Bridging Mobile and Web Tracking", Proceedings on Privacy Enhancing Technologies 2025(4). (DOI)

[12]

Acar, Gunes; Eubank, Christian; Englehardt, Steven; Juarez, Marc; Narayanan, Arvind; Díaz, Claudia (2014): "The Web Never Forgets: Persistent Tracking Mechanisms in the Wild", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[13]

Di Tizio, Giorgio; Massacci, Fabio (2021): "A Calculus of Tracking: Theory and Practice", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[14]

Sánchez-Rola, Iskander; Dell'Amico, Matteo; Balzarotti, Davide; Vervier, Pierre-Antoine; Bilge, Leyla (2021): "Journey to the Center of the Cookie Ecosystem: Unraveling Actors' Roles and Relationships", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[15]

Musa, Maaz Bin; Nithyanand, Rishab (2022): "ATOM: Ad-network Tomography", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[16]

Iqbal, Umar; Bahrami, Pouneh Nikkhah; Trimananda, Rahmadi; Cui, Hao; Gamero-Garrido, Alexander; Dubois, Daniel J.; Choffnes, David R.; Markopoulou, Athina; Roesner, Franziska; Shafiq, Zubair (2023): "Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[17]

Siby, Sandra; Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair; Troncoso, Carmela (2022): "WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2875-2892. USENIX Association, Boston, MA. (Link)

[18]

Munir, Shaoor; Siby, Sandra; Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair; Troncoso, Carmela (2023): "CookieGraph: Understanding and Detecting First-Party Tracking Cookies", pp. 3490–3504. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[19]

Munir, Shaoor; Lee, Patrick; Iqbal, Umar; Shafiq, Zubair; Siby, Sandra (2024): "PURL: Safe and Effective Sanitization of Link Decoration", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 4103-4120. USENIX Association, Philadelphia, PA. (Link)

[20]

Cook, John; Nithyanand, Rishab; Shafiq, Zubair (2020): "Inferring Tracker-Advertiser Relationships in the Online Advertising Ecosystem using Header Bidding", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[21]

Oh, ChangSeok; Kanich, Chris; McCoy, Damon; Pearce, Paul (2022): "Cart-ology: Intercepting Targeted Advertising via Ad Network Identity Entanglement", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[22]

Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2018): "The Cost of Digital Advertisement: Comparing User and Advertiser Views", in: Proceedings of the ACM Web Conference. (DOI)

[23]

Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair (2021): "Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[24]

Sanchez-Rola, Iskander; Dell'Amico, Matteo; Kotzias, Platon; Balzarotti, Davide; Bilge, Leyla; Vervier, Pierre-Antoine; Santos, Igor (2019): "Can I Opt Out Yet? GDPR and the Global Illusion of Cookie Control", pp. 340–351. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[25]

Englehardt, Steven; Reisman, Dillon; Eubank, Christian; Zimmerman, Peter; Mayer, Jonathan R.; Narayanan, Arvind; Felten, Edward W. (2015): "Cookies That Give You Away: The Surveillance Implications of Web Tracking", in: Proceedings of the ACM Web Conference. (DOI)

[26]

Roesner, Franziska; Kohno, Tadayoshi; Wetherall, David (2012): "Detecting and Defending Against Third-Party Tracking on the Web", in: 9th USENIX Symposium on Networked Systems Design and Implementation (NSDI 12), pp. 155-168. USENIX Association, San Jose, CA. (Link)

[27]

Chen, Quan; Ilia, Panagiotis; Polychronakis, Michalis; Kapravelos, Alexandros (2021): "Cookie Swap Party: Abusing First-Party Cookies for Web Tracking", in: Proceedings of the ACM Web Conference. (DOI)

[28]

Nikkhah Bahrami, Pouneh; Fass, Aurore; Shafiq, Zubair (2025): "CookieGuard: Characterizing and Isolating the First-Party Cookie Jar", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[29]

Zeber, David; Bird, Sarah; Oliveira, Camila; Rudametkin, Walter; Segall, Ilana; Wolls´en, Fredrik; Lopatka, Martin (2020): "The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing", in: Proceedings of The Web Conference 2020, pp. 167–178. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[30]

Dao, Ha; Shinde, Abhishek; Athar, Sana; Gosain, Devashish (2026): "Clicking into Exposure: Uncovering Privacy Risks of Google Click Identifier in YouTube Ads", Proceedings on Privacy Enhancing Technologies 2026(2):92-107. (DOI)

[31]

Bekos, Paschalis; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2023): "The Hitchhiker's Guide to Facebook Web Tracking with Invisible Pixels and Click IDs", in: Proceedings of the ACM Web Conference. (DOI)

[32]

Dimova, Yana; Acar, Gunes; Olejnik, Lukasz; Joosen, Wouter; Van Goethem, Tom (2021): "The CNAME of the game: Large-scale analysis of DNS-based tracking evasion", Proceedings on Privacy Enhancing Technologies 2021:394–412. (DOI) (Link)