| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| privacy:cookie_syncing [2026/08/26 19:06] – Fix a stale sum-to-29 in the seventh family row. Authored by Claude karel.kubicek.claude | privacy:cookie_syncing [2026/08/26 19:10] (current) – Match the prose percentages to the table's own formatting so the shared number guard passes over the corpus section. Authored by Claude karel.kubicek.claude |
|---|
| **Cookie syncing** (also //cookie matching//, //ID syncing//, //user matching//) is the mechanism by which two parties that each hold their own identifier for the same browser learn that the two identifiers belong to the same person. The same-origin policy stops ''tracker.com'' from reading ''advertiser.com'''s cookie, so instead ''tracker.com'' sends the browser to ''advertiser.com'' with its own identifier in the URL — a redirect, an image, an iframe — and both sides write the pair into a match table. Everything afterwards happens server to server, invisibly. | **Cookie syncing** (also //cookie matching//, //ID syncing//, //user matching//) is the mechanism by which two parties that each hold their own identifier for the same browser learn that the two identifiers belong to the same person. The same-origin policy stops ''tracker.com'' from reading ''advertiser.com'''s cookie, so instead ''tracker.com'' sends the browser to ''advertiser.com'' with its own identifier in the URL — a redirect, an image, an iframe — and both sides write the pair into a match table. Everything afterwards happens server to server, invisibly. |
| |
| **This page is about detecting that exchange from a measurement, not about the ad-tech business it serves.** It is the mechanism that turns per-domain identifiers into a joinable graph, and it is the reason a per-party site-prevalence figure understates what that party can see. It is also, from the crawler's side, one of the few tracking behaviours that is **only** visible if you got the crawl configuration right: run stateless, or in a browser that blocks third-party cookies, and you will measure approximately zero and conclude that the phenomenon is gone. | **This page is about detecting that exchange from a measurement, not about the ad-tech business it serves.** It is the mechanism that turns per-domain identifiers into a joinable graph, and it is the reason a per-party site-prevalence figure understates what that party can see. It is also, from the crawler's side, the tracking behaviour most sensitive to how the crawl was set up. Run a Safari- or Firefox-default browser and you measure near-zero third-party syncing **by construction**, not because it stopped. Run stateless and you see only //first-contact// syncing and none of the accumulated graph — a real measurement, but of a different thing. |
| |
| <WRAP important> | <WRAP important> |
| |
| <WRAP important> | <WRAP important> |
| **Read the ''headless'' row as the weakest one in this table, and not only because of the 83%.** The extraction stores **one** evidence quote for the whole ''crawlConfig'' object, so a spot-check can confirm at most one of its fields per paper; of five quotes read by hand for this page, none supported the ''headless'' value and only one supported ''statefulness''. The one ''headless'' value that could be traced is also the ambiguous kind: {[englehardt2016online]} is recorded as headless because the paper describes launching measurement instances in a "headless" container "by using the pyvirtualdisplay library" to drive Xvfb — which is a //headful// browser on a virtual framebuffer, and behaves differently from a genuinely headless one under bot detection. The extraction is faithful to the paper's own word; the paper's own word is loose. If headless-ness matters to your argument, read the papers rather than this row. | **Read the ''headless'' row as the weakest one in this table, and not only because 80.0% of the papers do not state a value.** The extraction stores **one** evidence quote for the whole ''crawlConfig'' object, so a spot-check can confirm at most one of its fields per paper; of five quotes read by hand for this page, none supported the ''headless'' value and only one supported ''statefulness''. The one ''headless'' value that could be traced is also the ambiguous kind: {[englehardt2016online]} is recorded as headless because the paper describes launching measurement instances in a "headless" container "by using the pyvirtualdisplay library" to drive Xvfb — which is a //headful// browser on a virtual framebuffer, and behaves differently from a genuinely headless one under bot detection. The extraction is faithful to the paper's own word; the paper's own word is loose. If headless-ness matters to your argument, read the papers rather than this row. |
| </WRAP> | </WRAP> |
| |
| | [[https://github.com/eleumasc/Web-Tracking-Detection|Web-Tracking-Detection]] | {[calzavara2026_syntactic]} | Syntactic-matching and taint-tracking pipelines and the comparison data. The paper cites ''purl.org/tracking-detection-paper'', which redirects here; last push 2026-08-03 | | | [[https://github.com/eleumasc/Web-Tracking-Detection|Web-Tracking-Detection]] | {[calzavara2026_syntactic]} | Syntactic-matching and taint-tracking pipelines and the comparison data. The paper cites ''purl.org/tracking-detection-paper'', which redirects here; last push 2026-08-03 | |
| | [[http://personalization.ccs.neu.edu/|Retargeting dataset]] | {[bashir2016tracing]} | 7K labelled targeted and retargeted ads, inclusion chains, full HTTP traces — **the only external ground truth released by any of the 30 papers in this corpus**, and it is from 2016 | | | [[http://personalization.ccs.neu.edu/|Retargeting dataset]] | {[bashir2016tracing]} | 7K labelled targeted and retargeted ads, inclusion chains, full HTTP traces — **the only external ground truth released by any of the 30 papers in this corpus**, and it is from 2016 | |
| | | ''doi.org/10.17617/3.H5T0W4'' | {[dao2026_gclid]} | The ''gclid'' crawl data, in a repository with a DOI rather than on GitHub | |
| | |
| | Nine of the thirteen public artifacts are listed; the other four are conference-artifact or project pages whose reuse value is narrower than a tool or a dataset. The full list of links the extraction found is in the report output on [[provenance:privacy:cookie_syncing]]. |
| |
| ==== How syncing papers classify requests ==== | ==== How syncing papers classify requests ==== |
| ===== What to Report ===== | ===== What to Report ===== |
| |
| If a reviewer is to accept a syncing figure, the paper has to answer all of these. The corpus can only speak to three of them, and on those three the record is poor: 24% of the papers do not state statefulness, 48% do not state a consent action, and 80% do not state whether the browser was headless. | If a reviewer is to accept a syncing figure, the paper has to answer all of these. The corpus can only speak to three of them, and on those three the record is poor: 24.0% of the papers do not state statefulness, 48.0% do not state a consent action, and 80.0% do not state whether the browser was headless. |
| |
| - **The unit and its denominator.** Sites? Directional flows? Unordered domain pairs? Users? Requests? Chains? And of what population — see the table in [[#Pick the Unit Before You Pick the Method]]. | - **The unit and its denominator.** Sites? Directional flows? Unordered domain pairs? Users? Requests? Chains? And of what population — see the table in [[#Pick the Unit Before You Pick the Method]]. |
| The limitations specific to this page: | The limitations specific to this page: |
| |
| * **The population is defined by a regex over full text, then corrected by hand.** The regex is a filter for reading effort, not a definition. It under-recalls badly at the low end: {[calzavara2026_syntactic]}, the most methodologically central paper here, uses the phrase **twice** and would have been excluded by any threshold. Three papers were added to the set by hand for exactly this reason. There is no way to know how many others were missed, and the honest reading of "106 papers mention it" is "at least 106". | * **The population is defined by a regex over full text, then corrected by hand.** The regex is a filter for reading effort, not a definition. It under-recalls badly at the low end: {[calzavara2026_syntactic]}, the most methodologically central paper here, uses the phrase **twice** and would have been excluded by any threshold. Three papers were added to the set by hand for exactly this reason, and a fourth to correct a boundary inconsistency rather than to expand the set. There is no way to know how many others were missed, and the honest reading of "106 papers mention it" is "at least 106". |
| * **The 30-paper "measures it" set is one person's judgement**, recorded as an explicit label per paper in the report script so that a disagreement can be located. Nine candidates were excluded because the phrase means something else in them; that call is defensible but not unique. | * **The 30-paper "measures it" set is one person's judgement**, recorded as an explicit label per paper in the report script so that a disagreement can be located. Nine candidates were excluded because the phrase means something else in them; that call is defensible but not unique. |
| * **The boundary of that set is genuinely fuzzy, and it moved during writing.** It is "measures an identifier being conveyed to a party that did not set it", which includes both a two-way sync and a one-way hand-off. Two corpus papers meet that description and are **not** in the 30, because they were found after the set was fixed and adding papers as one stumbles on them is how a hand-curated set stops being reproducible: {[bekos2023_hitchhiker]} measures a median website passing identifiers to **6.2 third parties**, and {[dimova2021cname]} finds **1,899 cookie leaks in request URLs on 1,295 distinct sites**. Both are named here rather than quietly omitted; a reader who counts them gets 32, and the shape of every table above is unchanged by two papers. Drawn strictly — only papers measuring a genuine //two-way// match between two parties' identifiers — the set would be closer to twenty. | * **The boundary of that set is genuinely fuzzy, and it moved during writing.** It is "measures an identifier being conveyed to a party that did not set it", which includes both a two-way sync and a one-way hand-off. Two corpus papers meet that description and are **not** in the 30, because they were found after the set was fixed and adding papers as one stumbles on them is how a hand-curated set stops being reproducible: {[bekos2023_hitchhiker]} measures a median website passing identifiers to **6.2 third parties**, and {[dimova2021cname]} finds **1,899 cookie leaks in request URLs on 1,295 distinct sites**. Both are named here rather than quietly omitted; a reader who counts them gets 32, and the shape of every table above is unchanged by two papers. One paper //was// added late — the gclid study — but to correct a boundary that had been applied two different ways, not to expand the set; the difference is argued on [[provenance:privacy:cookie_syncing]]. Drawn strictly — only papers measuring a genuine //two-way// match between two parties' identifiers — the set would be closer to twenty. |
| * **The detection-family assignment is coarse.** Papers combine families — {[shaoor2024purl]} builds a graph //and// does syntactic value matching — and each was assigned the family that does the identifier-sharing work. Read the family table as a ranking, not as a partition. | * **The detection-family assignment is coarse.** Papers combine families — {[shaoor2024purl]} builds a graph //and// does syntactic value matching — and each was assigned the family that does the identifier-sharing work. Read the family table as a ranking, not as a partition. |
| * **Every prevalence figure quoted from a paper carries that paper's denominator, and they are not comparable.** This is stated once in [[#Pick the Unit Before You Pick the Method]] and is worth repeating: none of the percentages on this page can be averaged, ordered, or plotted against each other. | * **Every prevalence figure quoted from a paper carries that paper's denominator, and they are not comparable.** This is stated once in [[#Pick the Unit Before You Pick the Method]] and is worth repeating: none of the percentages on this page can be averaged, ordered, or plotted against each other. |
