| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| programming:stateful_stateless [2026/09/11 11:21] – Link Design:Algorithm audits from the personalisation row and the recommendations: when the profile is the independent variable, statefulness is not the whole design. Authored by Claude karel.kubicek.claude | programming:stateful_stateless [2026/09/17 10:45] (current) – ConsentAction audit propagation and bucket series; Authored by Claude karel.kubicek.claude |
|---|
| - **Almost nobody reports it.** Of the **1,120 papers in our corpus that ran an automated web crawl, 219 (19.6%) say whether the crawl was stateful** — the second-least-reported crawl-configuration field after headless mode, and the **flattest**: its reporting rate moved 2.5 percentage points between the first and last four-year bucket, against +18.2 for naming a browser and +10.1 for headless (see [[#Reporting has not improved in sixteen years]]). | - **Almost nobody reports it.** Of the **1,120 papers in our corpus that ran an automated web crawl, 219 (19.6%) say whether the crawl was stateful** — the second-least-reported crawl-configuration field after headless mode, and the **flattest**: its reporting rate moved 2.5 percentage points between the first and last four-year bucket, against +18.2 for naming a browser and +10.1 for headless (see [[#Reporting has not improved in sixteen years]]). |
| - **"We cleared cookies" is not a reset.** Measured here on Playwright 1.62.1 / Chromium 151: ''context.clearCookies()'' leaves ''localStorage'' intact //and// leaves the HTTP cache warm, so the next visit serves subresources from disk and never touches the origin. See [[#What a reset actually resets]]. | - **"We cleared cookies" is not a reset.** Measured here on Playwright 1.62.1 / Chromium 151: ''context.clearCookies()'' leaves ''localStorage'' intact //and// leaves the HTTP cache warm, so the next visit serves subresources from disk and never touches the origin. See [[#What a reset actually resets]]. |
| - **Since 2022 the browser decides how stateful your stateful crawl is, not you.** Firefox partitions third-party cookies per top-level site by default; Chrome partitions third-party //storage// for every user from Chrome 115 on. Playwright launches Chromium with ''--disable-features=ThirdPartyStoragePartitioning'', Puppeteer does not. Same engine, two different webs. See [[#Since 2022 the engine decides, not you]]. | - **Since 2022 the browser decides how stateful your stateful crawl is, not you.** Firefox partitions third-party cookies per top-level site by default; Chrome partitions third-party //storage// for every user from Chrome 115 on. Playwright launches Chromium with ''%%--disable-features%%=ThirdPartyStoragePartitioning'', Puppeteer does not. Same engine, two different webs. See [[#Since 2022 the engine decides, not you]]. |
| </WRAP> | </WRAP> |
| |
| * **Chrome partitions third-party //storage// for every user.** "The feature has been enabled for all users on Chrome 115 and later."((Google, //Privacy Sandbox: Storage Partitioning//, ''developers.google.com/privacy-sandbox/cookies/storage-partitioning''. Checked 2026-08-19.)) Cookies are the exception, not the rule, here. | * **Chrome partitions third-party //storage// for every user.** "The feature has been enabled for all users on Chrome 115 and later."((Google, //Privacy Sandbox: Storage Partitioning//, ''developers.google.com/privacy-sandbox/cookies/storage-partitioning''. Checked 2026-08-19.)) Cookies are the exception, not the rule, here. |
| * **Third-party cookies were //not// deprecated.** On 22 April 2025 Google announced it would "maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies", and in October 2025 confirmed CHIPS and FedCM continue while other Privacy Sandbox APIs are phased out.((Privacy Sandbox, "Next steps for Privacy Sandbox and tracking protections in Chrome", 22 April 2025, and "Update on Plans for Privacy Sandbox Technologies", 17 October 2025. Checked 2026-08-19.)) A 2023-vintage paper that frames its design around imminent third-party cookie removal is describing a future that did not arrive. Chrome's **Incognito mode** does block third-party cookies by default, which is a separate trap: "we ran in incognito for a clean profile" silently also changes the blocking policy. | * **Third-party cookies were //not// deprecated.** On 22 April 2025 Google announced it would "maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies", and in October 2025 confirmed CHIPS and FedCM continue while other Privacy Sandbox APIs are phased out.((Privacy Sandbox, "Next steps for Privacy Sandbox and tracking protections in Chrome", 22 April 2025, and "Update on Plans for Privacy Sandbox Technologies", 17 October 2025. Checked 2026-08-19.)) A 2023-vintage paper that frames its design around imminent third-party cookie removal is describing a future that did not arrive. Chrome's **Incognito mode** does block third-party cookies by default, which is a separate trap: "we ran in incognito for a clean profile" silently also changes the blocking policy. |
| * **Your crawler probably turns the partitioning off.** Playwright launches Chromium with ''--disable-features=…,ThirdPartyStoragePartitioning,…''; Puppeteer does not. Measured here: | * **Your crawler probably turns the partitioning off.** Playwright launches Chromium with ''%%--disable-features%%=…,ThirdPartyStoragePartitioning,…''; Puppeteer does not. Measured here: |
| |
| ^ Chromium feature ^ Playwright 1.62.1 ^ Puppeteer 25.5.0((The same list in Puppeteer 25.8.0, the latest release as of 2026-08-19, is byte-identical, so the comparison is not an artefact of the pinned version.)) ^ | ^ Chromium feature ^ Playwright 1.62.1 ^ Puppeteer 25.5.0((The same list in Puppeteer 25.8.0, the latest release as of 2026-08-19, is byte-identical, so the comparison is not an artefact of the pinned version.)) ^ |
| | Authentication | 779 | 69.6% | | | Authentication | 779 | 69.6% | |
| | At least one browser named | 529 | 47.2% | | | At least one browser named | 529 | 47.2% | |
| | Consent action | 349 | 31.2% | | | Consent action field populated (schema; not an audited paper claim) | 349 | 31.2% | |
| | **Stateful or stateless** | **219** | **19.6%** | | | **Stateful or stateless** | **219** | **19.6%** | |
| | Headless or headful | 140 | 12.5% | | | Headless or headful | 140 | 12.5% | |
| | ''authentication'' | 59.8% | 70.1% | 69.2% | 72.8% | 69.2% | 12.9 pp | +9.4 pp | | | ''authentication'' | 59.8% | 70.1% | 69.2% | 72.8% | 69.2% | 12.9 pp | +9.4 pp | |
| | ''browsers'' (≥1 named) | 32.4% | 48.5% | 49.7% | 47.0% | 50.5% | 18.2 pp | **+18.2 pp** | | | ''browsers'' (≥1 named) | 32.4% | 48.5% | 49.7% | 47.0% | 50.5% | 18.2 pp | **+18.2 pp** | |
| | ''consentAction'' | 24.5% | 29.9% | 32.1% | 33.6% | 29.8% | 9.1 pp | +5.3 pp | | | ''consentAction'' (schema field populated; not a paper-claim series) | 24.5% | 29.9% | 32.1% | 33.6% | 29.8% | 9.1 pp | +5.3 pp | |
| | **''statefulness''** | 15.7% | 21.0% | 19.8% | 20.6% | 18.2% | **5.3 pp** | **+2.5 pp** | | | **''statefulness''** | 15.7% | 21.0% | 19.8% | 20.6% | 18.2% | **5.3 pp** | **+2.5 pp** | |
| | ''headless'' | 1.0% | 15.6% | 13.3% | 14.5% | 11.1% | 14.6 pp | +10.1 pp | | | ''headless'' | 1.0% | 15.6% | 13.3% | 14.5% | 11.1% | 14.6 pp | +10.1 pp | |
| | |
| | The raw ''consentAction'' row above is a schema-population baseline, not a paper-claim series. The 2026-09-05 audit produces this separate paper-claim series: |
| | |
| | ^ Bucket ^ Crawling papers ^ Audited papers stating a consent action ^ Share ^ Of those, interacted ^ |
| | | 2010–2013 | 102 | 0 | 0.0% | 0 | |
| | | 2014–2017 | 167 | 0 | 0.0% | 0 | |
| | | 2018–2021 | 308 | 11 | 3.6% | 3 | |
| | | 2022–2024 | 345 | 25 | 7.2% | 16 | |
| | | 2025–2026* | 198 | 19 | 9.6% | 13 | |
| | |
| | The old raw-series adjacent tests are all non-significant (p = 0.4008, 0.679, 0.7387 and 0.3911). On the audited series, 2010–2013 versus 2014–2017 is p = 1, 2014–2017 versus 2018–2021 is p = 0.009883, 2018–2021 versus 2022–2024 is p = 0.05751, and 2022–2024 versus provisional 2025–2026 is p = 0.3324. |
| |
| Denominators are the crawling papers in each bucket, from the table above (102 / 167 / 308 / 345 / 198). Naming the browser gained 18 points and headless mode gained 10 from a near-zero base; statefulness gained 2.5 and has the narrowest **range** of the six (5.3 pp). Interaction depth is the only field whose range is nearly as narrow (6.2 pp), and it got that way by //declining// from 78.4% to 72.2% rather than by standing still. It is not that the field decided the axis does not matter — Demir et al. made it a named criterion in 2022, and Zeber et al. and Jueckstock et al. had made it a measured concern in 2020 and 2021. It is that nothing turned the concern into a reporting norm: no venue asks for it on a checklist, and no widely used tool writes it into a config file that ends up in an artifact. | Denominators are the crawling papers in each bucket, from the table above (102 / 167 / 308 / 345 / 198). Naming the browser gained 18 points and headless mode gained 10 from a near-zero base; statefulness gained 2.5 and has the narrowest **range** of the six (5.3 pp). Interaction depth is the only field whose range is nearly as narrow (6.2 pp), and it got that way by //declining// from 78.4% to 72.2% rather than by standing still. It is not that the field decided the axis does not matter — Demir et al. made it a named criterion in 2022, and Zeber et al. and Jueckstock et al. had made it a measured concern in 2020 and 2021. It is that nothing turned the concern into a reporting norm: no venue asks for it on a checklist, and no widely used tool writes it into a config file that ends up in an artifact. |
| |
| ^ Subset of crawling papers ^ N ^ State statefulness ^ Share stating ^ stateless ^ stateful ^ both ^ | ^ Subset of crawling papers ^ N ^ State statefulness ^ Share stating ^ stateless ^ stateful ^ both ^ |
| | Crawls that acted on a consent notice | 36 | 22 | **61.1%** | 11 | 4 | 7 | | | Crawls that an audit found acted on a consent notice | 32 | 20 | **62.5%** | 10 | 4 | 6 | |
| | …the 28 of those whose interaction was verified by hand | 28 | 16 | **57.1%** | 8 | 3 | 5 | | | Crawls with an audited consent action (interaction or explicit no-action) | 55 | 32 | **58.2%** | 18 | 8 | 6 | |
| | Crawls that logged in | 90 | 54 | **60.0%** | 7 | 39 | 8 | | | Crawls that logged in | 90 | 54 | **60.0%** | 7 | 39 | 8 | |
| | Repeat-visit designs (2 or more visits per target) | 199 | 85 | 42.7% | 49 | 21 | 15 | | | Repeat-visit designs (2 or more visits per target) | 199 | 85 | 42.7% | 49 | 21 | 15 | |
| | //all crawling papers// | 1,120 | 219 | 19.6% | 113 | 77 | 29 | | | //all crawling papers// | 1,120 | 219 | 19.6% | 113 | 77 | 29 | |
| |
| The consent row needs a caveat that [[privacy:consent]] supplies: the same 36 papers were hand-audited there and **7 (19.4%) turned out to be extraction false positives** — they never touched a banner. The second row recomputes the rate on the 28 the audit **fully** supported (a 29th is supported but with an overstated enum value), and it barely moves, so the finding is robust to the error. | The consent rows use the 2026-09-05 full-text audit. Of the **313** ''no-interaction'' labels, **279 (89.1%)** were unsupported defaults; on the interacting side, **7 of 36 (19.4%)** labels were false positives. Of the **32** audited-interacting papers, **20** state statefulness (62.5%); of the **55** audited-action papers, **32** state statefulness (58.2%). The old 36/28 rows are not used because they were based on only one side of the audit. |
| |
| The good news first: where the design makes the axis unavoidable, reporting roughly triples. A login is state, and 39 of the 54 login crawls that say anything say stateful. The bad news is the repeat-visit row: **199 papers visit the same target two or more times and 114 of them (57.3%) never say whether state carried between the visits** — which is the one thing that determines whether the repeat visit is a replication or a second step in a sequence. If you take one reporting rule from this page, take that one. | The good news first: where the design makes the axis unavoidable, reporting roughly triples. A login is state, and 39 of the 54 login crawls that say anything say stateful. The bad news is the repeat-visit row: **199 papers visit the same target two or more times and 114 of them (57.3%) never say whether state carried between the visits** — which is the one thing that determines whether the repeat visit is a replication or a second step in a sequence. If you take one reporting rule from this page, take that one. |
