| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| privacy:requests [2026/08/29 12:13] – Move the Block Lists how-to (list inventory, engines, MV3 caps, provenance script, coverage-hole table) to the new Programming:Filter Lists page and leave a summary plus pointer; no duplication, and the moved material was re-verified 2026-08-29. Authored karel.kubicek.claude | privacy:requests [2026/09/16 10:59] (current) – Add one-line disambiguator: this page is HTTP requests, privacy:data_subject_rights is DSARs. Authored by Claude karel.kubicek.claude |
|---|
| ====== Classifying Web Requests ====== | ====== Classifying Web Requests ====== |
| | |
| | //**HTTP** requests — the ones a browser sends to a server. For access, deletion and opt-out requests sent by a person to a company, see [[Privacy:Data subject rights]].// |
| |
| A common task in web privacy measurements is to determine which web requests correspond to the benign loading of required web resources and which are used to track users. There are two main methods for such classification: matching requests against crowd-sourced lists (typically used in ad-blocking or tracking protection extensions) or using machine learning (**ML**) to classify the requests based on their context and request URL. | A common task in web privacy measurements is to determine which web requests correspond to the benign loading of required web resources and which are used to track users. There are two main methods for such classification: matching requests against crowd-sourced lists (typically used in ad-blocking or tracking protection extensions) or using machine learning (**ML**) to classify the requests based on their context and request URL. |
| |
| * **A rule is evaluated against a request //in context//.** ''$third-party'', ''$domain='', the resource-type options and ''@@'' exception rules all need the initiator URL, the resource type and the redirect chain. A crawl that logged only request URLs cannot be post-processed with a list, and it fails silently rather than erroring. | * **A rule is evaluated against a request //in context//.** ''$third-party'', ''$domain='', the resource-type options and ''@@'' exception rules all need the initiator URL, the resource type and the redirect chain. A crawl that logged only request URLs cannot be post-processed with a list, and it fails silently rather than erroring. |
| * **The list is a moving target.** EasyList publishes a ''Version:'' and a ''Commit:'' in its own header and changes several times an hour; of the 178 corpus papers naming a list as a tool, **four** record something that identifies the rules they matched against. | * **The list is a moving target.** EasyList publishes a ''Version:'' and a ''Commit:'' in its own header and changes several times an hour; of the corpus papers naming a list as a tool, **four** record something that identifies the rules they matched against ([[Programming:Filter Lists#Which version|the count and its denominator]]). |
| * **A filter-list hit is a noisy label**, estimated at **16%–19% false positives** {[calzavara2026_syntactic]}, with the false negatives measured repeatedly and separately — 25.22% {[fouad2020_missed]}, 34.5% {[lee2023_track]}, and much worse off the desktop web. | * **A filter-list hit is a noisy label**, estimated at **16%–19% false positives** {[calzavara2026_syntactic]}, with the false negatives measured repeatedly and separately — 25.22% {[fouad2020_missed]}, 34.5% {[lee2023_track]}, and much worse off the desktop web. |
| |
| **The pipeline everyone converges on has three stages, and each has a measured cost.** | **The pipeline everyone converges on has three stages, and each has a measured cost.** |
| |
| - **Find the notice.** Start with the **EasyList Cookie List** CSS selectors (1,668 network and 22,979 cosmetic rules on 2026-08-12) and add DOM/text heuristics: high ''z-index'', ''position: fixed'', a privacy-related keyword pool, a container that overlaps the viewport bottom or centre. | - **Find the notice.** Start with the **EasyList Cookie List** CSS selectors ([[Programming:Filter Lists#The lists|current rule counts here]] — it is overwhelmingly cosmetic, which is what you want for finding a banner) and add DOM/text heuristics: high ''z-index'', ''position: fixed'', a privacy-related keyword pool, a container that overlaps the viewport bottom or centre. |
| - **Label the interactive elements.** Accept / reject / close / save / settings / other. Button text is short, multilingual and adversarially designed, which is why this is the stage that moved from keyword lists to learned models. | - **Label the interactive elements.** Accept / reject / close / save / settings / other. Button text is short, multilingual and adversarially designed, which is why this is the stage that moved from keyword lists to learned models. |
| - **Decide what to click, and verify it happened.** A click that silently fails is worse than no click, because the crawl continues and reports pre-consent behaviour as post-consent. The consent-interaction crawlers the field shares for this — BannerClick, Priv-Accept and the ''autoconsent'' integration built into [[Programming:Crawler:Tracker Radar Collector|Tracker Radar Collector]] — are compared on [[Programming:Crawler#Specialised Measurement Crawlers|the crawler page]]. | - **Decide what to click, and verify it happened.** A click that silently fails is worse than no click, because the crawl continues and reports pre-consent behaviour as post-consent. The consent-interaction crawlers the field shares for this — BannerClick, Priv-Accept and the ''autoconsent'' integration built into [[Programming:Crawler:Tracker Radar Collector|Tracker Radar Collector]] — are compared on [[Programming:Crawler#Specialised Measurement Crawlers|the crawler page]]. |
| | Khandelwal et al. {[khandelwal2023automated]}, USENIX Sec 2023 (CookieEnforcer) | Candidate-element extraction, then **BERT** | **T5-Large** predicting the click sequence | 986 of 2,000 domains, 2 false positives and 16 false negatives; **93.7% end-to-end** on 1,000 sites. At scale: notices on **52.7%** of 85,473 sites, 35.4% of them multi-view, and only **21.5%** offering a one-click opt-out | | | Khandelwal et al. {[khandelwal2023automated]}, USENIX Sec 2023 (CookieEnforcer) | Candidate-element extraction, then **BERT** | **T5-Large** predicting the click sequence | 986 of 2,000 domains, 2 false positives and 16 false negatives; **93.7% end-to-end** on 1,000 sites. At scale: notices on **52.7%** of 85,473 sites, 35.4% of them multi-view, and only **21.5%** offering a one-click opt-out | |
| | Ogut et al. {[ogut2024_dissecting]}, USENIX Sec 2024 | XPath plus privacy-word pools, validated by hand | — | Notices on 37% of loaded sites; the paper to read on **language**, since button text is the classifier's input | | | Ogut et al. {[ogut2024_dissecting]}, USENIX Sec 2024 | XPath plus privacy-word pools, validated by hand | — | Notices on 37% of loaded sites; the paper to read on **language**, since button text is the classifier's input | |
| | Bouhoula et al. {[bouhoula2024automated]}, USENIX Sec 2024 | EasyList Cookie List plus custom heuristics | **BERT** on 2353 hand-annotated interactive-element texts, six labels | **100.0% precision and 86.9% recall** on notice detection; the six-label element classifier reached **95.1% accuracy and F1 90.9%** in 5-fold cross-validation, with double annotation agreeing at **Cohen's κ = 91%** | | | Bouhoula et al. {[bouhoula2024_automated]}, USENIX Sec 2024 | EasyList Cookie List plus custom heuristics | **BERT** on 2353 hand-annotated interactive-element texts, six labels | **100.0% precision and 86.9% recall** on notice detection; the six-label element classifier reached **95.1% accuracy and F1 90.9%** in 5-fold cross-validation, with double annotation agreeing at **Cohen's κ = 91%** | |
| | Demir et al. {[demir2024_bannertools]}, PETS 2024 | Compared existing banner-interaction extensions | — | Each extension interacts with **12 banners on average, 65%** of those shown (SD 21%, min 48%, max 95%) — the number to cite when you justify not using an off-the-shelf extension | | | Demir et al. {[demir2024_bannertools]}, PETS 2024 | Compared existing banner-interaction extensions | — | Each extension interacts with **12 banners on average, 65%** of those shown (SD 21%, min 48%, max 95%) — the number to cite when you justify not using an off-the-shelf extension | |
| | Tang et al. {[tang2025_navigating]}, USENIX Sec 2025 //(a compliance result, listed for its detector)// | Random forest on home pages, 1,000 hand-annotated | — | Global comparison; **96.18% (EU) to 97.72% (US)** of sites had at least one consent violation, and only 3.82% enforced preferences correctly | | | Tang et al. {[tang2025_navigating]}, USENIX Sec 2025 //(a compliance result, listed for its detector)// | Random forest on home pages, 1,000 hand-annotated | — | Global comparison; **96.18% (EU) to 97.72% (US)** of sites had at least one consent violation, and only 3.82% enforced preferences correctly | |
| | held-out test set | 5 | 2.9% | | | held-out test set | 5 | 2.9% | |
| |
| **One paper in three reports no validation of its request classification at all.** The ''not-applicable'' row is mostly papers that applied a list as-is and reasonably consider the list itself the definition — **45 of those 58 papers** carry that ''not-applicable'' verdict on a ''blocklist'' tuple — which is exactly the assumption Calzavara et al. {[calzavara2026_syntactic]} measured at 16%–19% false positives. Manual validation of a sample is an afternoon's work and it is the single cheapest thing you can add. | **One paper in three reports no validation of its request classification at all** — against a 70.1% rate across all 4,439 papers that classify anything ([[Statistics:Annotation]], which owns the corpus-wide figures and what each validation kind is worth). The ''not-applicable'' row is mostly papers that applied a list as-is and reasonably consider the list itself the definition — **45 of those 58 papers** carry that ''not-applicable'' verdict on a ''blocklist'' tuple — which is exactly the assumption Calzavara et al. {[calzavara2026_syntactic]} measured at 16%–19% false positives. Manual validation of a sample is an afternoon's work and it is the single cheapest thing you can add. |
| |
| ==== Almost nobody says which version of the list ==== | ==== Almost nobody says which version of the list ==== |
| ===== What to Report ===== | ===== What to Report ===== |
| |
| - **The list, its version and its commit.** ''EasyList Version 202608121614, commit cff91d2b'' — not "EasyList". Archive the ''.txt'' with your artefact. 70% of papers do not do this. | - **The list, its version and its commit**, and the archived ''.txt'' — not "EasyList". 70% of papers give no version at all and 98% give nothing that identifies the rules. [[Programming:Filter Lists#Recording Which List You Used|How, and a script that does it]]. |
| - **The engine and its version**, separately from the list. ''adblock'' 0.13.2 and ''adblockparser'' 0.7 do not match the same rules, and the second one silently ignores options it does not know. | - **The engine and its version**, separately from the list, because two parsers of the same list do not match the same rules and the older ones silently ignore options they do not know. [[Programming:Filter Lists#Post-processing beats blocking at crawl time|Which engines are maintained]]. |
| - **Which rule kinds you evaluated.** Network only, or cosmetic too? Nearly a third of EasyList is cosmetic and answers a different question. | - **Which rule kinds you evaluated.** Network only, or cosmetic too? Nearly a third of EasyList is cosmetic and answers a different question. |
| - **The unit, and how you decided "party".** Domain, eTLD+1, URL, chain or parameter — and whether party is by public suffix list (name which one) or by **entity map** (name which one). The two give different third-party rates for the same crawl. | - **The unit, and how you decided "party".** Domain, eTLD+1, URL, chain or parameter — and whether party is by public suffix list (name which one) or by **entity map** (name which one). The two give different third-party rates for the same crawl. |
| * **Python has no maintained filter-list engine.** Someone should either revive ''python-adblock'' against ''adblock'' 0.13.x or state loudly that Python pipelines must shell out. | * **Python has no maintained filter-list engine.** Someone should either revive ''python-adblock'' against ''adblock'' 0.13.x or state loudly that Python pipelines must shell out. |
| * **Nothing in this corpus escapes the filter list.** All 8 learned request classifiers train on filter-list labels, Duumviri included. The two directions that come closest — Duumviri's differential features and breakage detector {[shuang2025_duumviri]}, and taint tracking as an independent detector {[calzavara2026_syntactic]} — have each been done once. **A request classifier whose labels come from something other than a list is an open problem, and it is the one this page would most like solved.** | * **Nothing in this corpus escapes the filter list.** All 8 learned request classifiers train on filter-list labels, Duumviri included. The two directions that come closest — Duumviri's differential features and breakage detector {[shuang2025_duumviri]}, and taint tracking as an independent detector {[calzavara2026_syntactic]} — have each been done once. **A request classifier whose labels come from something other than a list is an open problem, and it is the one this page would most like solved.** |
| * **What Manifest V3 did to extension-based measurement.** Lukić and Papadopoulos {[lukic2026_mv3]} found no significant loss of blocking effectiveness under ''declarativeNetRequest'', but the 30,000-rule static cap is well under EasyList's 52,557 network rules and nobody has published which rules the shipped MV3 blockers drop, or what that omits from a measurement. | * **What Manifest V3 did to extension-based measurement.** Lukić and Papadopoulos {[lukic2026_mv3]} found no significant loss of blocking effectiveness under ''declarativeNetRequest'', but the 30,000-rule static cap is well under EasyList's network-rule count ([[Programming:Filter Lists#If your instrument is a browser extension: Manifest V3 caps the rules|current figure here]]) and nobody has published which rules the shipped MV3 blockers drop, or what that omits from a measurement. |
| * **Venue coverage is itself an open problem for this topic.** AdVersa {[lim2026_adversa]} at TheWebConf 2026 and Intumwayase et al. {[intumwayase2025_continents]} at WPES 2025 are both squarely in scope and both invisible to the figures above. A reading list built only from the seven venues in this corpus will be incomplete for exactly the most recent work. | * **Venue coverage is itself an open problem for this topic.** AdVersa {[lim2026_adversa]} at TheWebConf 2026 and Intumwayase et al. {[intumwayase2025_continents]} at WPES 2025 are both squarely in scope and both invisible to the figures above. A reading list built only from the seven venues in this corpus will be incomplete for exactly the most recent work. |
| </WRAP> | </WRAP> |
| |
| * [[Programming:Crawler|Comparison of crawling libraries]] — what records the initiator chain, the call stack and the response headers these methods need. | * [[Programming:Crawler|Comparison of crawling libraries]] — what records the initiator chain, the call stack and the response headers these methods need. |
| | * [[Privacy:Browser protection|Measuring with browser tracking protections on]] — this page assumes the default browser. If your crawl ran Firefox, Brave, Safari or Edge, part of what you were trying to classify was blocked before you saw it, and the protection is a treatment you can vary on purpose. |
| * [[Programming:Crawler:Tracker Radar Collector|Tracker Radar Collector]] — the lowest-effort crawler for this task, and where the Tracker Radar data comes from. | * [[Programming:Crawler:Tracker Radar Collector|Tracker Radar Collector]] — the lowest-effort crawler for this task, and where the Tracker Radar data comes from. |
| * [[Programming:Crawler:PageGraph|Brave PageGraph]] — AdGraph's production successor, and the practical way to get a page-execution graph. | * [[Programming:Crawler:PageGraph|Brave PageGraph]] — AdGraph's production successor, and the practical way to get a page-execution graph. |
| * [[Programming:Crawler:webXray|webXray and domain-to-company ownership]] — once a request is flagged, this is how to answer //whose// it is, and why webXray, Tracker Radar and Disconnect give three different answers. | * [[Design:Ownership resolution]] — once a request is flagged, this is how to answer //whose// it is, and why webXray, Tracker Radar and Disconnect give three different answers. (It was under [[Programming:Crawler:webXray]] until 2026-09-11.) |
| * [[Privacy:JavaScript|Analysing and classifying JavaScript]] — the script-level and function-level end of the granularity ladder. | * [[Privacy:JavaScript|Analysing and classifying JavaScript]] — the script-level and function-level end of the granularity ladder. |
| * [[Privacy:Cookies|Cookies]] and [[Privacy:Fingerprinting|Fingerprinting]] — the other two things a "tracking" label is often about. | * [[Privacy:Cookies|Cookies]] and [[Privacy:Fingerprinting|Fingerprinting]] — the other two things a "tracking" label is often about. |
| * [[Privacy:Consent|Granting consent to websites]] — what the cookie notice means, once you have found it. | * [[Privacy:Consent|Granting consent to websites]] — what the cookie notice means, once you have found it. |
| * [[Design:Website Classification|Website classification]] — and the measured reason **not** to use a categorisation service to find trackers. | * [[Design:Website Classification|Website classification]] — and the measured reason **not** to use a categorisation service to find trackers. |
| | * [[Design:Connected TV]] — where the instruments on this page stop working: no request interception without network-level capture, no page context to attribute a request to, and filter lists with a measured coverage of 22–27%. |
| | * [[Statistics:Annotation|Annotation and Validation]] — validating a label set whatever it labels, and why a held-out set drawn from one crawl is usually not held out. |
| * [[Programming:Stateful Stateless|Stateful vs stateless crawling]] and [[Programming:Interaction|Interaction]]. | * [[Programming:Stateful Stateless|Stateful vs stateless crawling]] and [[Programming:Interaction|Interaction]]. |
| * [[provenance:privacy:requests|Provenance of this page's figures]]. | * [[provenance:privacy:requests|Provenance of this page's figures]]. |
