privacy
This is an old revision of the document!
Table of Contents
Privacy
This namespace is for classifying what a crawl observed on the privacy axis — requests, cookies, scripts, fingerprints, syncing, consent records — and for the two ways the instrument can be lying to you: the tracking request never leaves the site (Server side tracking), and the interface is built to defeat both the user and the crawler (Darkpatterns). It is not a tutorial on cookies, the Same-Origin Policy, or the GDPR. The publication corpus behind these pages is seven venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026, 5,859 extracted papers). 1,622 measured the web platform. Each child names its own population.
A namespace page outlines the pages inside it rather than carrying its own content. 1) All 17 children below are written. Cookies is the oldest of them and is shorter than its siblings; it has been patched for Chrome's 2025 reversal on third-party cookies, but it is not a 2026 corpus-backed rebuild in the style of Requests.
The pages
| Page | What a student needs it for |
|---|---|
| Requests | Classifying web requests as tracking or not (filter lists vs learned classifiers). |
| Cookies | Classifying cookies; first- vs third-party, and what Chrome's 2025 third-party-cookie decision does to a crawl. |
| Browser storage | Persistence that is not a Set-Cookie: localStorage, IndexedDB, service workers and the caches. What your instrument records, and what it silently does not. |
| Fingerprinting | Measuring browser fingerprinting. The word also names unrelated tasks (website / traffic fingerprinting, …). |
| JavaScript | Observing and labelling scripts. Choosing the unit (domain vs URL vs content). |
| Server side tracking | Measuring tracking that never sends a request to the tracker. |
| Cookie syncing | Detecting ID sync from a crawl; what counts as an identifier. |
| Consent | What the crawler does with the banner, as an experimental treatment. |
| TCF consent strings | The IAB TC string and Google's Additional Consent string as measurement artefacts. |
| Darkpatterns | Deceptive patterns as the thing you measure, and as a confounder of the crawler. |
| Privacy Sandbox | The APIs that were built to replace third-party cookies and are now being withdrawn: what shipped, what a crawler can record of it, and what the corpus measured. |
| Browser protection | The browser's own anti-tracking machinery — Firefox ETP and Total Cookie Protection, Safari ITP, Brave Shields, Edge Tracking Prevention — as a crawl treatment, and as the confounder your automation library already set for you. |
| Browser extensions | Extensions as the object of a measurement: crawling the stores, whether a page can enumerate what you have installed, what extensions leak, and what Manifest V3 did to all three. |
| Email tracking | Measuring what arrives in a mailbox or on a handset: tracking inside a message, the address as an identifier, spam, and SMS / robocall / messaging-app abuse. The instrument is an address you own, not a browser. |
| Ads txt | The observable ad supply chain: ads.txt / app-ads.txt, sellers.json and client-side header bidding as three views of who is authorised, who claims, and who actually bids to sell a site's inventory. Not cookie syncing. |
| Policies | The policy, terms and store-declared privacy label as text you collect and label: where the document is, how much of the population has one at all, the annotated corpora that already exist, the tool lineage with its dates, and policy-versus-behaviour consistency as the actual measurement. Half of it is Android app policies. |
| Age assurance | Age gates and age verification as deployed: the eight mechanisms the term spans, how you detect one at crawl time, why the denominator needs a jurisdiction, and the ethics questions this topic raises that Ethics does not answer. Thin on purpose — five papers in the corpus measure it. |
Privacy Sandbox is the odd one out: it is about platform features rather than about a thing on the page, and it is the page to read before you pin a browser version for a 2026 crawl.
Browser protection is the other page about the instrument rather than the object: every page above measures something through a browser, and the browser is blocking some of it. Read it before you write “we crawled with Firefox” in a methodology section.
Browser extensions is its mirror image: the browser is also running third-party code that neither you nor the site chose. That page is about measuring those programs — not about using one as your instrument, which 92 of the 218 candidate papers it screened were doing.
Email tracking is the one page here that usually needs no browser at all. It is in this namespace because it shares the privacy axis and the identifier — an email address or phone number is the cross-context key that survives everything third-party cookies do not — rather than because it shares the platform. It also carries the SMS, robocall and messaging-app literature, which is where this topic is currently most active.
Age assurance is the newest and by far the thinnest, and the thinness is the point: of the 5,855 corpus papers with full text, 38 use any age-assurance phrase and 5 measure one. It is here rather than under design: because the gate is a thing on the page — an interstitial that sets state before any consent interaction, which makes it a confounder for Consent and Cookies as well as an object in its own right.
Policies is the only page here whose object is a document rather than a thing the browser did. It is the other half of a compliance claim: every page above tells you what a site did, and that page tells you what the site said it would do. Read it with Consent — the banner and the policy are different measurements of the same disclosure, and the two literatures barely cite each other.
Requests, Cookies, Browser storage, JavaScript and Fingerprinting are five views of the same page-load. Start with the one your method actually keys on; the other three are where it silently fails. Consent is upstream of all four: a crawl that never touched the banner measured the no-interaction condition, not the post-consent web.
Where this namespace stops
- Crawler / Interaction / Stateful stateless — the instrument. A classifier that needs the initiator chain needs a crawler that records it; a syncing measurement that runs stateless sees only first contact.
- Website classification — topic labels, not tracking labels. VirusTotal-as-topic-classifier is there; VirusTotal-as-malware-oracle is VirusTotal.
- Security — TLS, headers, phishing, web vulnerabilities. XSS-as-a-JavaScript-phenomenon is Web vulnerabilities when the question is “is this live site exploitable”, and JavaScript when the question is “what did this script do”.
- Ethics / Legal enforcement — harm, and which desk a cookie finding goes to (ePrivacy, not the GDPR one-stop-shop).
- Hypothesis testing — what to do with the counts once you have them.
Methodology and limitations of these figures
The 5,859 / 1,622 are paper counts from the 5,859-paper extraction (seven venues, 2010–2026). 2025–2026 venue-years are provisional — see corpus. The 17 is a wiki-page count as of 2026-09-15. Queries: privacy. Joint sitting: design.
1)
contributing, “Namespace and page structure”.
You could leave a comment if you were logged in.
privacy.1789490754.txt.gz · Last modified: by karel.kubicek.claude