Differences

This shows you the differences between two versions of the page.

--- privacy:cookies [2026/09/10 16:34] – Self-audit corrections: Cookiepedia 12->14 papers, Cookie-Script 4->3, custom-prefixed names 31->27, consent-state claim 9->7 of 49, LLM user-generated-text share aligned to report_llm_currency's used/used definition (7.6%->7.2%), retract 'no purpose mode karel.kubicek.claude
+++ privacy:cookies [2026/09/11 02:30] (current) – Point at the new statistics:annotation page from the validation section and Related Pages. Authored by Claude karel.kubicek.claude
@@ Line 1: / Line 1: @@
 ====== Classifying Cookies ======
-Browser cookies are still the most commonly used method for tracking the session state of websites and the identity of visitors. According to prior studies, between 80% in 2012 {[roesner2012_detecting]} and 90% in 2019 {[solomos2019_clash,sanchezrola2019can]} of websites use cookies for user tracking, often without users' knowledge. While other stateless tracking technologies, such as [[Privacy:Fingerprinting]] or [[Privacy:Requests#Link Decoration and Tracking Parameters|Link decorators]], exist, cookies remain the primary choice, with stateless methods typically used in combination with cookies. This trend persists, and third-party cookies were in the end **not** discontinued: on 22 April 2025 Google announced it would "maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies".((Privacy Sandbox, [[https://privacysandbox.com/news/privacy-sandbox-next-steps/|"Next steps for Privacy Sandbox and tracking protections in Chrome"]], 22 April 2025. Checked 2026-09-10.)) They remain allowed by default in Chrome, blocked in its Incognito mode, and partitioned per top-level site by default in Firefox and Safari — so what a measurement observes depends on which browser it drove and in which mode; see [[Programming:Stateful stateless#Since 2022 the engine decides, not you]].
+Browser cookies are still the most commonly used method for tracking the session state of websites and the identity of visitors. Sánchez-Rola et al. {[sanchezrola2019can]} found cookies capable of identifying a user on **more than 90%** of the websites they visited, often without those users' knowledge.((The widely repeated trend line "80% in 2012 {[roesner2012_detecting]} rising to 90% in 2019 {[solomos2019_clash]}" — which this page carried until 2026-09-10 and which comes from the introduction of {[bollinger2022automating]} — could not be confirmed against either primary source: the Roesner NSDI 2012 paper contains no percentage between 70% and 99% anywhere in its text, and the Solomos et al. paper reports on the tracker–publisher graph rather than a share of websites. Checked 2026-09-10. Do not cite the pair without re-reading both.)) While other stateless tracking technologies, such as [[Privacy:Fingerprinting]] or [[Privacy:Requests#Link Decoration and Tracking Parameters|Link decorators]], exist, cookies remain the primary choice, with stateless methods typically used in combination with cookies. This trend persists, and third-party cookies were in the end **not** discontinued: on 22 April 2025 Google announced it would "maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies".((Anthony Chavez, [[https://privacysandbox.google.com/blog/privacy-sandbox-next-steps|"Next steps for Privacy Sandbox and tracking protections in Chrome"]], 22 April 2025. The older ''privacysandbox.com/news/…'' URL now redirects here; the quoted text is unchanged. Checked 2026-09-10.)) They remain allowed by default in Chrome, blocked in its Incognito mode, and partitioned per top-level site by default in Firefox and Safari — so what a measurement observes depends on which browser it drove and in which mode; see [[Programming:Stateful stateless#Since 2022 the engine decides, not you]].
 This page is about deciding **what a cookie you have already recorded is for**. That is a labelling problem with a specific and unusual property: there is no ground truth. Nobody can read a cookie value and know that it carries an advertising identifier; every label on this page comes from someone's declaration, someone's list, or someone's model, and the interesting methodological questions are all about which of those you chose and how much of your data it could label at all.
@@ Line 14: / Line 14: @@
   * **CookieGraph: Understanding and Detecting First-Party Tracking Cookies** {[shaoor2023cookiegraph]}, CCS 2023 — the graph-feature successor, and the paper that made first-party tracking cookies a measurable category. Its released artifact is also the easiest way to see how thin name-based labelling is in practice (see [[#Coverage is the number you have to report]]).
   * **Semantics-Aware Cookie Purpose Compliance** {[chen2025_semantics]}, TheWebConf 2025 — the only peer-reviewed LLM cookie classifier in these seven venues. Read it for the design (segment the //value//, then interpret the segments) rather than for the F1.
-  * **Crumbling Cookie Categories** {[jiwani2024crumbling]}, PoPETs 2024 — the categories you are classifying into are not understood by the people they exist for. **7%** of participants correctly identified the standard definition of a "functional" cookie.
+  * **Crumbling Cookie Categories** {[jiwani2024crumbling]}, PoPETs 2024 — the categories you are classifying into are not understood by the people they exist for. **7%** of participants correctly identified the standard definition of a "functional" cookie, and 24% that of a "performance" cookie.
-  * **Journey to the Center of the Cookie Ecosystem** {[sanchezrola2021_journey]}, IEEE S&P 2022 — the largest identifier-classification run in the corpus (137,997,677 cookies, 48% classed as identifiers) and the paper that moved the field from length-and-expiry thresholds to an entropy test.
+  * **Journey to the Center of the Cookie Ecosystem** {[sanchezrola2021_journey]}, IEEE S&P 2022 — the largest identifier-classification run in the corpus (137,997,677 cookies over 6.2M pages, 48% classed as identifiers) and the paper that moved the field from length-and-expiry thresholds to an entropy test.
   * Then, for the mechanics your classifier sits on top of: [[Privacy:Browser storage]] for what your crawler actually captured, and [[Privacy:Cookie syncing]] for what happens to an identifier after you have found it.
@@ Line 75: / Line 75: @@
     * Advertising/tracking cookies:
       * Used to tailor advertisements to the viewer, help track the user and collect sensitive data of the user's browsing behavior, usually across multiple websites. Said data is then also often sold to third parties. We recommend rejecting these types of cookies to protect your privacy.
-  * [[https://web.archive.org/web/20210520213158/https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/#A_Purposes|12 purposes by IAB]], commonly used in CMPs implementing the TCF — see [[Privacy:TCF consent strings]].
+  * The [[https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/|IAB Europe TCF purposes]], used by CMPs implementing the TCF. **The count has moved and older papers will say 12:** as of 2026-09-10 the live policy defines **11 purposes plus 3 special purposes** (plus 3 features and 2 special features). TCF v2.2 added Purpose 11 and Special Purpose 3 was added later; the [[https://web.archive.org/web/20210520213158/https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/#A_Purposes|2021 snapshot]] a lot of the literature cites has 10 purposes and 2 special purposes. Cite the version, not the number. See [[Privacy:TCF consent strings]].
 The ICC scheme is the field's default and it is not stated as such. Of the **29** corpus papers that name any category scheme on a cookie tuple, **11 (37.9%)** use the ICC four — but only **8** name the ICC or the International Chamber of Commerce; the other three simply write the four categories out. Counted by exact string the largest group is two papers. The fold and every contributing string are on [[provenance:privacy:cookies]].
 <WRAP alert>
-**The categories do not survive contact with a user.** Jiwani et al. {[jiwani2024crumbling]} tested comprehension of the standard category names and found that only **7%** of participants could correctly identify the definition of a "functional" cookie, against **67%** for the candidate replacement term "anonymous analytics". Schöni et al. {[schoeni2024_cookieblock]} found the same downstream: **18 of 40** participants needed a prompt to recover from breakage caused by a cookie misclassification. If your paper's conclusion depends on users acting on a category, that dependency is a finding in itself, not an assumption.
+**The categories do not survive contact with a user.** Jiwani et al. {[jiwani2024crumbling]} tested comprehension of the standard category names and found that only **7%** of participants could correctly identify the definition of a "functional" cookie and **24%** that of a "performance" cookie. Four candidate replacements beat "functional" — "customization" 72%, "personalized experience" 67%, "preferences" 59% — and the paper recommends "extra functionality cookies" and "anonymous analytics cookies" (67%, against performance's 24%) instead. Schöni et al. {[schoeni2024_cookieblock]} found the same downstream: **18 of 40** participants needed a prompt to recover from breakage caused by a cookie misclassification. If your paper's conclusion depends on users acting on a category, that dependency is a finding in itself, not an assumption.
 </WRAP>
@@ Line 120: / Line 120: @@
 | {[bollinger2022automating]}, Table 3 | 277k cookies from 29,398 CMP-using websites | Cookiepedia **79.2%**; their own XGBoost model 100% |
 | {[demir2024_bannertools]} | Cookies from a cookie-banner-tool crawl | Cookiepedia classified **57%** of all cookies and **38%** of distinct cookies |
-| {[lin2024_browsing]}, Table 1 | 17,074 cookies across 255 websites | Cookie-Script left **28.50%** unclassified (14,619 cookies), which the paper calls "the vast majority" of distinct cookies |
+| {[lin2024_browsing]}, Table 1 | 18,074 cookies across 255 websites with cookie notices | Cookie-Script left **14,619 unclassified — 80.9%**((Computed from the paper's Table 1 by this page, not stated as a percentage by the paper: 940 strictly necessary + 905 performance + 103 functionality + 1,507 tracking + 14,619 unclassified = 18,074. Table 1's second column is a **mean per site**, not a share — an earlier version of this page read the 28.50 in the unclassified row as a percentage, which is wrong and contradicts the paper's own caption.)) — "the vast majority of cookies are unclassified" |
 | The Cookiepedia name table released with {[shaoor2023cookiegraph]} | 45,785 distinct cookie names looked up | **39.3%** returned one of Cookiepedia's four categories; 35.1% returned an error and 25.6% returned "Unknown" |
 | Cookiepedia's own front page | Its whole 42,020,489-cookie database | **32% Unknown**, alongside 1% strictly necessary, 5% performance, 3% functionality, 58% targeting(([[https://cookiepedia.co.uk/|cookiepedia.co.uk]] front page, "Website Benchmarks from Cookiepedia". Vendor self-report, read 2026-09-10.)) |
@@ Line 160: / Line 160: @@
   * ''cat_id'': Numeric representation of ICC UK categories: 0 = Strictly-necessary, 1 = Functionality, 2 = Analytics, 3 = Advertising/tracking.
-Note that 80% of cookies are third-party cookies, the majority of these involve multiple entries for a given name and domain. However, these entries might assign contradicting labels, in fact, 7.2% of cookies have labels that do not match the majority label. You should therefore aggregate labels for given cookie and domain pair, and then pick the most popular category.
+Note that 80% of cookies are third-party cookies, the majority of these involve multiple entries for a given name and domain. However, these entries might assign contradicting labels, in fact, the paper puts a lower bound of 7.2% on the share of **third-party** cookie labels that are noise — labels that do not match the majority label for that cookie. You should therefore aggregate labels for given cookie and domain pair, and then pick the most popular category.
 There will be soon a new release based on December 2024 crawl, reach Karel Kubicek if you are reading this text and wanting the data.
@@ Line 174: / Line 174: @@
 It is the field's default label source: **17 of the 53** cookie-classifying papers in the corpus use a purpose database, and Cookiepedia is named in **14** of them, from 2016 {[cahn2016_cookies]} to 2025 {[tang2025_navigating]}.
-To use Cookiepedia directly on the website, you can either select to search by website or cookie name. In the first case, Cookiepedia overviews of all the first- and third-party cookies, and in the latter, it shows the aggregated purpose across all websites with this cookie. This has limitations for first-party cookies, as different websites may use cookies with the same name for different purposes. For instance [[https://cookiepedia.co.uk/cookies/user_id|user_id cookies]] is classified as Strictly Necessary despite that many websites use it to track users.
+To use Cookiepedia directly on the website, you can either select to search by website or cookie name. In the first case, Cookiepedia overviews of all the first- and third-party cookies, and in the latter, it shows the aggregated purpose across all websites with this cookie. This has limitations for first-party cookies, as different websites may use cookies with the same name for different purposes. For instance [[https://cookiepedia.co.uk/cookies/user_id|user_id cookies]] is classified as Strictly Necessary despite that many websites use it to track users.((That specific classification is as last observed by the page's authors and could **not** be re-verified on 2026-09-10: ''cookiepedia.co.uk/cookies/<name>'' sits behind a Cloudflare interstitial that returns 403 to ''curl'' and to a headless Chromium from a datacentre address alike, while the site root returns 200. Check it from a residential vantage before quoting it.))
 You can [[https://github.com/dibollinger/CookieBlock-Consent-Crawler/blob/67434cce8cab56e7097568a4162d86ee0752295f/domain_sources/cookiepedia_domain_scraper.py|scrape Cookiepedia]] or download dataset of almost 1M cookies collected by {[shaoor2023cookiegraph]} as a [[https://github.com/cookiegraph/CookieGraph/blob/main/Feature%20Extraction%20and%20Classifier/code/labelling_scripts/cookiepedia.csv|CSV here]]. Note that the site rejects plain ''curl'' with HTTP 403; a scraper needs a real browser or a browser-like client.((Checked 2026-09-10: ''cookiepedia.co.uk/cookies/user_id'' returns 403 to ''curl'' with a desktop User-Agent, while the site root returns 200.))
-**Accuracy, on the one dataset where anyone measured it.** {[bollinger2022automating]} evaluated Cookiepedia against 277k operator-declared labels and reports macro-recall (balanced accuracy) of **84.7%**, against **84.4%** for its own XGBoost model — the basis for the "competitive with human expertise" claim below. Precision is very uneven across classes: 94.5% for necessary, 84.2% for analytics, **38.1% for functional**. Nobody has re-measured Cookiepedia since.((The paper's §4.4 prose states 83.4% for the same quantity while its Table 3, §4.5 summary and abstract state 84.7%. This page quotes the table. Flagged here rather than silently picking one.))
+**Accuracy, on the one dataset where anyone measured it.** {[bollinger2022automating]} evaluated Cookiepedia against 277k operator-declared labels and reports macro-recall (balanced accuracy) of **84.7%**, against **84.4%** for its own XGBoost model — the basis for the "competitive with human expertise" claim below. Precision is very uneven across classes: 94.5% for necessary, 84.2% for analytics, **38.1% for functional**. Nobody has re-measured Cookiepedia since.((The paper's §4.1 prose states **83.4%** for the same quantity while its Table 3 and §4.5 summary state **84.7%**. Its abstract quotes neither — it gives 84.4%, which is CookieBlock's own balanced accuracy, a different quantity. This page quotes the table. Flagged here rather than silently picking one.))
 ==== Cookie-Script ====
@@ Line 184: / Line 184: @@
 [[https://cookie-script.com/|Cookie-Script]] is a commercial CMP whose cookie scanner exposes a name-keyed category database using the same four ICC UK categories plus an "unclassified" bucket. It is the second-most-used purpose database in the corpus — **3** papers, all 2024–2025 {[lin2024_browsing,chen2025_semantics]} — and it is not mentioned anywhere on this page before 2026, which is a good illustration of how quietly a label source becomes standard.
-Its unclassified rate is the reason to know about it: across 255 websites, {[lin2024_browsing]} found Cookie-Script left **28.50%** of cookies (14,619) unclassified, and observes that "the vast majority of cookies are unclassified" among distinct cookies.
+Its unclassified rate is the reason to know about it: across 255 websites with cookie notices from the Tranco top 350, {[lin2024_browsing]} categorised 18,074 cookies with Cookie-Script and **14,619 of them (80.9%) came back unclassified**. The paper's own Table 1 caption puts it plainly: "the vast majority of cookies are unclassified".
 ==== Cookiedatabase.org ====
@@ Line 508: / Line 508: @@
 ''none-reported'' and ''not-applicable'' are sentinels and are never counted as answers; the rows overlap because a paper with several cookie tuples can appear in several. Manual validation of a sample is the field's realistic minimum and only a quarter of the papers do it.
+The corpus-wide comparison, the four validation kinds and what each is worth on a task like this one are on [[Statistics:Annotation]]; 32.1% is the lowest rate of any target on this wiki that has a page.
 ==== These papers do crawl better than the field ====
@@ Line 542: / Line 544: @@
 | 96.61% of those are ghostwritten by third-party scripts | The first-party tracking cookies above | {[shaoor2023cookiegraph]} |
 | 89.84% of all cookie accesses are by third-party JavaScript | Tranco top 10,000, modified Firefox | {[kancherla2025_least]} |
-| 48% (66.7M) of cookies are identifiers | 137,997,677 cookies collected across 387K websites | {[sanchezrola2021_journey]} |
+| 48% (66.7M) of cookies are identifiers | 137,997,677 cookies observed over 6.2M pages crawled from a 1M-domain seed | {[sanchezrola2021_journey]} |
 | 85.8% of websites have at least one cookie with a missing declaration or purpose | 29,398 CMP-using websites | {[bollinger2022automating]} |
 | 36.4% have at least one incorrectly assigned cookie purpose | Same 29,398 | {[bollinger2022automating]} |
@@ Line 553: / Line 555: @@
 | 39% (100 of 255) of websites keep using tracking cookies after the user opts out | 255 websites with cookie notices | {[lin2024_browsing]} |
 | 1.3% (40 of 3,177) of tracking cookies are partitioned | The paper's tracking-cookie set | {[rasaii2025_crumbs]} |
-| Only 7% of participants correctly identify the standard "functional" cookie definition | Survey participants | {[jiwani2024crumbling]} |
+| Only 7% of participants correctly identify the standard "functional" cookie definition, and 24% the "performance" one | Survey participants | {[jiwani2024crumbling]} |
 The last row is the one to keep in mind while reading the rest. Every percentage above is a percentage of a category system that the people it exists for cannot use.
@@ Line 611: / Line 613: @@
   * [[Programming:Crawler:OpenWPM|OpenWPM]] — the cookie instrumentation the offline route expects.
   * [[Design:Website classification|Classifying Websites]] — the per-target LLM adoption table this page's LLM section shares.
+  * [[Statistics:Annotation|Annotation and Validation]] — how to validate a label set whatever it labels, and why cookie classification is the worst-validated target here.
 ====== References ======