Working log for Legal enforcement. Every query with its population and denominator, the report scripts with their unedited output, the folds with their residue, every quote with its verification verdict, the external sources with how each was checked, and what could not be established. Corpus-wide caveats — the venue scope, the selection funnel, the provisional 2025–2026 slice — are on Corpus and are not repeated here.

Voice here is a working log, not prose. It is read by somebody checking a number.

No ~~DISCUSSION~~ block: comments belong on the content page. (This follows the convention set by the earlier provenance pages.)

Every figure on the page names one of these. None of them is “of 5,859 papers”.

The 646 empirical papers with no ethics object are excluded, not counted as “did not contact a regulator”. Counting them as no would move the corpus-wide regulatorContact = yes rate from 3.3% to 2.9% and would be a lie about what the extraction saw.

node scripts/report_legal_enforcement.mjs — plain text; –wiki emits DokuWiki tables; –list prints the hand-coded map in full. Unedited output:

report_legal_enforcement.txt

# practices:legal_enforcement — every figure with its denominator
corpus: 5859 papers, 7 venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P), 2010–2026
 
populations
population          definition                                                 N
------------------  ---------------------------------------------------------  -----------------
all                 every extraction record                                    5859
empirical           isEmpirical == true                                        5118
empirical ∧ ethics  and the extractor emitted an ethics object                 4472
legal               legal[].length > 0 — assessed compliance with a named law  402 (6.9% of all)
legal ∧ ethics                                                                 385
legal ∧ crawled     and ran an automated web crawl                             131
 
## A. The legal population over time and by venue
 
Window      Papers in window  Assessed a law  Share
----------  ----------------  --------------  -----
2010–2013   511               8               1.6%
2014–2017   769               17              2.2%
2018–2021   1439              83              5.8%
2022–2024   1955              173             8.8%
2025–2026*  1185              121             10.2%
 
Venue    Papers  Assessed a law  Share
-------  ------  --------------  -----
PETS     510     122             23.9%
USENIX   1410    102             7.2%
IEEE-SP  767     52              6.8%
CCS      990     34              3.4%
WWW      843     33              3.9%
NDSS     701     32              4.6%
IMC      638     27              4.2%
 
## B. Which laws, folded (population: 402 papers that assessed a law)
 
Law family                                                       Papers  Share of 402
---------------------------------------------------------------  ------  ------------
EU data protection (GDPR and predecessors)                       289     71.9%
US state privacy law                                             73      18.2%
US children / education / health / finance                       53      13.2%
Sector, national and other rules                                 49      12.2%
ePrivacy / cookie law                                            27      6.7%
Non-EU/US data protection law                                    26      6.5%
Computer-crime, access and copyright                             19      4.7%
US federal consumer protection and sector regulators (FTC, FCC)  18      4.5%
EU platform / digital-market regulation                          17      4.2%
 
families are multi-valued: a paper naming both the GDPR and the ePrivacy Directive
counts once in each, so the column sums to 571 > 402.
 
distinct law strings before folding: 186
UNMAPPED RESIDUE: 7 strings, 7 papers (1.7% of the population)
  1  139-FZ
  1  18 U.S.C. Sec. 2252A(b)(1)
  1  47 CFR Part 17.7
  1  Act against Unfair Competition (UWG)
  1  Air Navigation Order 2016
  1  AML regulations
  1  Brazilian Law Nº 13.488
 
papers naming the ePrivacy Directive itself: 26
papers in the wider 'ePrivacy / cookie law' family: 27 (the extra 1: GPDP guidelines on cookies)
 
"GDPR" appears under 9 spellings: EU GDPR | European GDPR | GDPR | GDPR Art. 20 | GDPR Article 6 | GDPR, Article 32 | General Data Protection Regulation | General Data Protection Regulation (GDPR) | UK GDPR
papers naming the GDPR in any spelling: 284; exact string "GDPR" only: 271; missed by the exact string: 13 — an undercount of 4.6%
 
## C. legal[].foundViolations (population: 402; counted per paper, a paper with any "yes" tuple counts yes)
 
foundViolations  Papers  Share of 402
---------------  ------  ------------
yes              94      23.4%
partial          83      20.6%
no               74      18.4%
not-assessed     151     37.6%
not-stated       0       0.0%
 
## D. ethics.regulatorContact — "a DPA, CERT, or other regulator was contacted"
 
legal ∧ ethics = 385; legal ∧ empirical ∧ ethics = 376 (the 9 difference assess a law without being scored empirical)
 
Population                N     yes         no            not-stated
------------------------  ----  ----------  ------------  ------------
empirical ∧ ethics        4472  147 (3.3%)  1982 (44.3%)  2343 (52.4%)
crawled ∧ ethics          972   37 (3.8%)   418 (43.0%)   517 (53.2%)
legal ∧ ethics            385   27 (7.0%)   228 (59.2%)   130 (33.8%)
legal ∧ crawled ∧ ethics  123   10 (8.1%)   74 (60.2%)    39 (31.7%)
 
Window      legal ∧ ethics N  regulatorContact = yes  Share
----------  ----------------  ----------------------  -----
2010–2013   7                 0                       0.0%
2014–2017   16                2                       12.5%
2018–2021   83                10                      12.0%
2022–2024   162               10                      6.2%
2025–2026*  117               5                       4.3%
 
## E. Hand-coded regulator contact (full-text sweep, then read in context)
 
Role           What it means                                                        Papers
-------------  -------------------------------------------------------------------  ------
filed          took findings to a privacy / consumer-protection / sector regulator  15
authorised     a regulator approved or supervised the authors' own processing       4
planned        stated an intention to, not done at submission                       3
corpus         measures regulators' own output rather than contacting one           3
subject        a regulator acted on the authors                                     1
declined       said explicitly they chose not to involve one                        1
collaboration  the study was designed with, for, or inside a regulator              1
 
candidate sweep: 95 papers read; 67 coded off-topic, 28 kept.
  off-topic, homograph — "regulator" is a hardware component: 3
  off-topic, column-splice artefact — "de-/fined by", "self-reported": 4
  off-topic, regulator as an abstract audience or recommendation, no contact: 25
  off-topic, cites a regulator document, decision or guideline; no contact: 33
  off-topic, the DPA reference is in the study's own consent form or an interview recruitment, not a filing: 2
 
Sweep candidates: 89. Hand verdicts: 95.
In the map but NOT a sweep candidate (6) — added from ethics.regulatorContact == 'yes'
or from the enforcement-corpus sweep; the sentence rule missed them:
  IMC/2023/characterizing-and-modeling-session-level-mobile-traffic-demands-from-large-scal  [authorised]
  PETS/2016/students-and-taxes-a-privacy-preserving-study-using-secure-computation  [authorised]
  PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned  [planned]
  PETS/2020/angel-or-devil-a-privacy-study-of-mobile-parental-control-apps  [filed]
  PETS/2023/usability-and-enforceability-of-global-privacy-control  [filed]
  USENIX/2025/privacy-law-enforcement-under-centralized-governance-a-qualitative-analysis-of-f  [corpus]
 
Of the 15 that filed, by authority type:
  US FTC or California OAG: 7
  an EU data protection authority (EDPS / CNIL / AEPD / unnamed DPA): 6
  other or unnamed: 2  ["IEEE-SP/2010/chip-and-pin-is-broken","USENIX/2025/demystifying-the-in-security-of-qr-code-based-login-in-real-world-deployments"]
 
Of the 15 that filed, ethics.notifiedAffectedParties:
  partial: 7
  yes: 7
  no: 1
 
The 18 filed-or-planned papers by year:
  2010: 1
  2019: 3
  2020: 3
  2023: 4
  2024: 2
  2025: 3
  2026: 2
 
## D2. What the free-text disclosure detail says about regulators
 
Population                                                                   N     Share of 2,870
---------------------------------------------------------------------------  ----  --------------
empirical ∧ ethics with a disclosureDetail string                            2870  100%
  … names a privacy or consumer-protection AUTHORITY (the published figure)  12    0.4%
  … or says "regulator"/"regulatory" without naming one                      15    0.5%
  … names a CERT or CSIRT                                                    54    1.9%
 
All 15 strings, verbatim; [named] marks the 12 that name an authority, [loose] the 3 that only say "regulator":
  [loose] PETS/2016: Data owners and regulators reviewed the MPC design; summary-only outputs and deletion controls were used.
  [loose] PETS/2019: Discussed privacy risks and proposed user, platform, and regulatory mitigations.
  [named] PETS/2019: Notified regulators of some findings and piloted analysis with the FTC.
  [named] USENIX/2019: Findings were responsibly disclosed to Google and the FTC; authors received a bug bounty.
  [named] CCS/2020: Reported certification findings to Amazon and Google; shared results with FTC researchers.
  [named] PETS/2020: Findings communicated to AEPD and INCIBE's IS4K.
  [named] IMC/2023: Amazon learned through the preprint and updated disclosures; findings were also shared at an FTC forum.
  [named] WWW/2023: Reported suspicious advertisements to Facebook, PayPal, and the Federal Trade Commission; redacted organization names.
  [named] NDSS/2024: Shared a report with 10 e-commerce platforms and the Federal Trade Commission.
  [named] USENIX/2024: Participants were debriefed about the study intent and DPA collaboration at the end.
  [named] PETS/2025: Preprint shared with Google and European data protection authorities.
  [named] PETS/2026: Responsible disclosure to developers; results planned for EDPB, regulators, and IAB Europe.
  [loose] IEEE-SP/2010: Informed bank regulators in the UK, Europe, and North America before publication.
  [named] PETS/2025: Reported findings to Android Security Team, EDPS, and CNIL; received a bug bounty.
  [named] USENIX/2026: Disclosed findings to browser, OS, app vendors, and EU/US data protection authorities; publicly disclosed after coordination.
 
## E1. A regulator in the author list
 
Sweep of all 5859 papers' full text for regulator email domains and for authority
names in the first 80 lines, then the affiliation block read by hand. 4 papers:
  PETS/2017/cross-device-tracking-measurement-and-disclosures
    US Federal Trade Commission, Office of Technology Research and Investigation (all four authors, @ftc.gov)
  PETS/2022/my-cookie-is-a-phoenix-detection-measurement-and-lawfulness-of-cookie-respawning
    CNIL, LINC team (one author)
  PETS/2022/on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
    CNIL, LINC team (one author, nbielova@cnil.fr)
  USENIX/2024/the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions
    CNIL (one author); lead author a CNIL Senior Privacy Fellow 2021–2022
 
## E2. Of the papers that found violations, how many went to a regulator
 
Population                             N    Figure
-------------------------------------  ---  ------------
legal, foundViolations yes or partial  177  44.0% of 402
  … with an ethics object              166  —
  … ethics.regulatorContact == yes     19   11.4%
  … hand-coded role == filed           7    4.0%
  … found violations and did NOT file  170  96.0%
 
Note the subtraction that is WRONG: 177 - 15 = 162 treats every filer as a
violation-finder. Only 7 of the 15 are. The count of violation-finding
papers that did not file is 170. (Generic reviewer, 2026-08-18.)
 
And the same cut on the web-crawling subset — the population closest to a reader of this page:
Population                          N   Figure
----------------------------------  --  ------
legal ∧ crawled, found violations   80  —
  … with an ethics object           75  —
  … ethics.regulatorContact == yes  9   12.0%
 
Did regulator contact fall? legal ∧ ethics, 2018–2021 vs 2022–2026:
  10/83 (12.0%) vs 15/279 (5.4%)
  Fisher's exact, two-sided: p = 0.047
 
Is it composition? Venue mix of legal ∧ ethics papers, and the rate within strata:
Venue    2018–2021 share of legal ∧ ethics  2022–2026 share
-------  ---------------------------------  ---------------
CCS      7/83 (8.4%)                        22/279 (7.9%)
IEEE-SP  7/83 (8.4%)                        41/279 (14.7%)
IMC      9/83 (10.8%)                       14/279 (5.0%)
NDSS     10/83 (12.0%)                      17/279 (6.1%)
PETS     18/83 (21.7%)                      90/279 (32.3%)
USENIX   22/83 (26.5%)                      77/279 (27.6%)
WWW      10/83 (12.0%)                      18/279 (6.5%)
  2018–2021: all 10/83 (12.0%) | PoPETs 3/18 (16.7%) | non-PoPETs 7/65 (10.8%)
  2022–2026: all 15/279 (5.4%) | PoPETs 6/90 (6.7%) | non-PoPETs 9/189 (4.8%)
  PoPETs' share of legal ∧ ethics papers ROSE (21.7% -> 32.3%), and the rate fell inside
  both strata. So the decline is not a venue-mix effect and this report offers no explanation.
 
Cross-check of the figure quoted from practices:notifying_websites:
  regulatorContact == yes: 147; of those also notifiedAffectedParties yes/partial: 135 (91.8%)
 
## F. The one-stop-shop mechanism in the corpus
 
Sweep: /\b(main establishment|lead (data protection |supervisory )?authorit|cross-border processing|Article 56|Art\. 56|Article 60|Art\. 60|one-stop|one stop shop|mutual assistance|consistency mechanism)\b/i over all 5859 papers' full text. Every hit read and given a
verdict in enforce_map.mjs (OSS_MAP). There is no default: the report exits 1
both on a hit with no verdict and on a verdict for a paper the sweep no longer returns.
 
Verdict    Papers
---------  ------
homograph  35
mechanism  1
refonly    1
 
sweep hits: 37
  mechanism: USENIX/2024/the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions
  refonly: WWW/2025/50-shades-of-deceptive-patterns-a-unified-taxonomy-multimodal-detection-and-secu
 
The quote the page prints from the one 'mechanism' paper is checked by
scripts/le_quotecheck.mjs and is verbatim in paper.cols.txt.
 
## F2. Papers reporting use of the DSA Article 40 vetted-researcher route
 
The page says no corpus paper uses it. That was asserted, not measured, until
the generic reviewer asked for the sweep (2026-08-18). Regex over all full text:
  /vetted researcher|Article 40 of (the )?(DSA|Regulation \(EU\) 2022\/2065)|Art\. 40 DSA|DSA data access|data-access\.dsa|digital services coordinator/i
  7 hits, all read:
    CCS/2020/the-cookie-hunter-automated-black-box-auditing-for-web-authentication-and-author
    NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media
    IMC/2025/r-e-routing-policy-inference-and-implication
    USENIX/2025/demystifying-the-in-security-of-qr-code-based-login-in-real-world-deployments
    USENIX/2025/watch-out-your-tv-box-reversing-and-blocking-a-p2p-based-illegal-streaming-ecosy
    WWW/2026/does-this-button-work-investigating-youtubes-ineffective-user-controls
    NDSS/2026/tickets-to-hide-an-inside-look-into-the-anti-abuse-ecosystem-through-internal-abuse-data
  None reports obtaining or using Art. 40 access: the hits are Censys' own vetted-access
  programme, artifact-release policies, and advocacy citations. The delegated act
  (Reg. (EU) 2025/2050) entered into force 29 October 2025, so most of the corpus's
  submission cycles predate the portal — but the 2026 venue-years do not, and the
  page must not claim the corpus "ends before the portal opened".

scripts/law_fold.mjs. legal[].law is verbatim free text: 186 distinct strings across 402 papers. Nine ordered families, first match wins, grouped by which authority enforces the law rather than by subject matter — which is why ePrivacy is its own family and not folded into “EU data protection”. Its Art. 5(3) is enforced by nationally designated bodies outside the GDPR one-stop-shop, so a cookie finding and a profiling finding go to different desks; a fold that merged them would have made the page's central point uncountable.

Why folding is not optional here: “GDPR” appears under 9 spellings — GDPR, EU GDPR, European GDPR, UK GDPR, GDPR Art. 20, GDPR Article 6, GDPR, Article 32, General Data Protection Regulation, General Data Protection Regulation (GDPR). 284 papers name it in some spelling; the exact string GDPR catches 271. A 4.6% undercount on the page's largest row.

A note on the ePrivacy row. The family is named for what it groups — terminal-access rules enforced outside the one-stop-shop — and it holds 27 papers, but only 26 name the ePrivacy Directive itself; the 27th is there for the string “GPDP guidelines on cookies” (the Italian authority's cookie guidance). The page's prose says 26 because its claim is about the Directive. The report prints both.

Two explicit exceptions, added on 2026-08-18 after self-review and confirmed by the figures reviewer. Neither is a regex weakening — both are a keyed override that runs before the families, so the mistake is visible in the code rather than buried in an alternation:

Effect on the published table: EU data protection 290 → 289 (that paper also names the German Prostitutes Protection Act, already in Sector, so Sector does not double-count it); Non-EU/US 27 → 26; Sector 48 → 49.

One regex tightened: the US-state-privacy family carried a bare \bcpa\b for “Colorado Privacy Act (CPA)”. Harmless on this corpus — the only string that matched was the explicit one — but it would have swallowed any future “Consumer Protection Act” into a US-state bucket. Replaced with the spelled-out name.

Unmapped residue, printed in full — 7 strings, 7 papers, 1.7% of the population:

In order: a Russian federal law, a US criminal-code section, an FCC tower-marking rule, German unfair-competition law, a UK aviation order, anti-money-laundering rules, and Brazilian election law. Every one would belong in Sector, national and other rules. They were deliberately not absorbed by adding regexes: a residue of one-off national statutes is honest information about the corpus's long tail, and a fold that matches everything tells you nothing. The residue is 1.7% of papers; it does not move any published figure.

ethics.regulatorContact is a three-value enum whose schema description is “Whether a DPA, CERT, or other regulator was contacted.” It cannot answer this page's question, because it merges:

• a national CERT (which belongs to Notifying websites),
• a sector regulator (bank supervisors, the FCC, a telecoms authority),
• a data protection or consumer-protection authority (this page),
• and, in at least one case, the authors' own institutional Data Protection Officer.

So the schema signal (147 papers yes) is an upper bound, and the page reports it as such. The hand map narrows it.

scripts/dpa_sweep.mjs reads the rendering the extractor read (paper.cols.txt, or paper.norm.txt for the 7 papers with textSource: “mistral”) for all 5,859 papers — 0 missing text files — and fires six pattern families.

scripts/dpa_candidates.mjs narrows to sentences (≤600 chars) that contain an authority name, a first-person marker (we / our / the authors) and a contact or approval verb, deliberately excluding CERT/CSIRT and “Data Protection Officer” (an in-house role, not a regulator). 89 candidate papers.

All 89, plus 6 more found by other routes, were read in context and given exactly one role. scripts/enforce_map.mjs holds the verdicts with a deciding quote; report_legal_enforcement.mjs exits 1 if a sweep candidate has no verdict, so the map cannot silently fall behind the sweep.

The 6 the sentence rule missed — this is the sweep's measured recall failure, and it is why the page says “expect the true count to be a little higher than fifteen”:

The first four came from dumping every ethics.regulatorContact == “yes” paper's evidence quote and disclosure detail; the last two from a separate sweep for enforcement-outcome language. That sweep's regex was paraphrased in an earlier draft of this page, and the figures reviewer correctly reported that the paraphrase reproduces 211 papers rather than the 108 quoted. The regex actually run was:

/\b(GDPR fine|fined (by|the)|enforcement action|regulatory (action|enforcement|intervention)
  |sanction(ed|s) (by|imposed)|decision of the (CNIL|ICO|Garante|DPC)
  |CNIL (fined|imposed|issued)|enforcement (decision|notice|sweep))\b/i

which returns 108 papers. It was an orientation sweep, not a published population: nothing on the content page is a count from it. Two of its hits ([1Saemann, Marlene; Theis, Daniel; Urban, Tobias; Degeling, Martin (2022): "Investigating GDPR Fines in the Light of Data Flows", Proceedings on Privacy Enhancing Technologies 2022(4). (DOI)] was already in hand; [2Sun, Chen; Jacobs, Evan; Lehmann, Daniel; Crouse, Andrew; Shastri, Supreeth (2023): "GDPRxiv: Establishing the State of the Art in GDPR Enforcement", Proceedings on Privacy Enhancing Technologies 2023(4). (DOI)] and [3Jing, Tao; Li, Yao; Ye, Jingzhou; Wang, Jie; Wang, Xueqiang (2025): "Privacy Law Enforcement Under Centralized Governance: A Qualitative Analysis of Four Years' Special Privacy Rectification Campaigns", in: Proceedings of the USENIX Security Symposium. (Link)] came from it) entered the hand map as corpus.

The full list of all 67 keys, grouped by reason, is in the –list output at the foot of this page. Three worth naming because a reader might expect them on the content page:

• IEEE-SP/2026/consumer-beware-exploring-data-brokers-ccpa-compliance — recommends that consumers “file official grievances using the CPPA complaint form”. The authors did not file. It is the corpus's only pointer to the CPPA form and is cited on the page for the form, not as a filing.
• USENIX/2025/websites-global-privacy-control-compliance-at-scale-and-over-time — regulatorContact = yes in the schema, but every regulator sentence in the paper is a recommendation to regulators. A clean example of the schema over-firing.
• PETS/2024/the-devil-is-in-the-details-… — “we consulted case decisions of the Court of Justice of the EU, guidelines of both the European Data Protection Board … and Data Protection Authorities”. Consulting guidance is not contacting an authority.

The task asked the page to cover the one-stop-shop. The corpus almost cannot.

This section was originally three hardcoded console.log lines in the report — a stale count sitting inside the block whose whole purpose is auditability, and the figures reviewer caught it: the number printed there (35) was not produced by any code in the repository, and could not be reproduced. Section F now runs the sweep at report time, classifies each hit against a hand map in enforce_map.mjs (OSS_MAP), and exits 1 if the map holds a verdict for a paper the sweep no longer returns. The regex the report prints is the regex the report ran.

Sweep, over all 5,859 papers' full text: /\b(main establishment|lead (data protection |supervisory )?authorit|cross-border processing|Article 56|Art\. 56|Article 60|Art\. 60|one-stop|one stop shop|mutual assistance|consistency mechanism)\b/i

37 papers hit. Every hit was read.

mechanism: USENIX/2024/the-effect-of-design-patterns-… [4Bielova, Nataliia; Litvine, Laura; Nguyen, Anysia; Chammat, Mariam; Toubiana, Vincent; Hary, Estelle (2024): "The Effect of Design Patterns on (Present and Future) Cookie Consent Decisions", in: Proceedings of the USENIX Security Symposium. (Link)], whose author list includes CNIL. Its sentence is quoted in the page's opening box and verified verbatim below. refonly: WWW/2025/50-shades-of-deceptive-patterns-…

Note the sensitivity: an earlier hand-run of a narrower regex (one[- ]stop[- ]shop spelled out in full, no consistency mechanism) returns 23, and the figures reviewer reproduced that number from the regex this page used to quote. Both are correct for their own regex; only one of them was in code. The broader one is now in code and is the number this page reports.

This is the page's most consequential judgement call. The corpus cannot support a section on the one-stop-shop, so the page sources that section from primary law (GDPR Arts. 4(23)/56/60/65, EDPB Opinion 5/2019, Conseil d'État, and — for what is proposed — COM(2025) 837) and says so in its methodology section. The alternative, omitting the mechanism because the corpus is silent, would have left the page unable to answer the question a reader arrives with.

scripts/le_quotecheck.mjs. Every quote the page prints, checked against the rendering the extractor read and, on failure, against paper.pdf re-extracted with pypdf. 34 quotes: 34 exact, 0 partial, 0 below threshold.

Three things this check had to get right, each found by a failure:

1. Ligatures. pypdf emits findings and effort where .cols emits findings. Without normalising ff–ffl, the angel-or-devil quote scored 42%.
2. Hyphens at a line break. Data Pro- tection (pypdf) and Data Pro-tection (.cols) are one word in the PDF and neither is what the paper says. De-hyphenating fixed 2 of the 3 initial below-threshold results.
3. .cols and pypdf defeat different sentences. 4-years-of-eu-cookie-law fails in both renderings on its own, and is verbatim in the PDF once de-hyphenated. A checker that reads only one rendering scores a faithful extraction as a fabrication.

Two extraction quotes were reconstructions, not verbatim, and were replaced on the page with the paper's own sentence:

Unedited output:

le_quotecheck.txt

exact    100%  [cols] PETS/2019/maps-scaling-privacy-compliance-analysis-to-a-million-apps
exact    100%  [cols] USENIX/2019/50-ways-to-leak-your-data-an-exploration-of-apps-circumvention-of-the-android-pe
exact    100%  [cols] CCS/2020/dangerous-skills-got-certified-measuring-the-trustworthiness-of-skill-certificat
exact    100%  [cols] IEEE-SP/2020/an-analysis-of-pre-installed-android-software
exact    100%  [pdf] PETS/2020/angel-or-devil-a-privacy-study-of-mobile-parental-control-apps
exact    100%  [cols] IMC/2023/tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
exact    100%  [pdf] WWW/2023/online-advertising-in-ukraine-and-russia-during-the-2022-russian-invasion
exact    100%  [cols] NDSS/2024/the-dark-side-of-e-commerce-dropshipping-abuse-as-a-business-model
exact    100%  [cols] IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites
exact    100%  [cols] PETS/2025/your-signal-their-data-an-empirical-privacy-analysis-of-wireless-scanning-sdks-i
exact    100%  [cols] PETS/2025/tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we
exact    100%  [cols] USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
exact    100%  [cols] IEEE-SP/2010/chip-and-pin-is-broken
exact    100%  [cols] USENIX/2025/demystifying-the-in-security-of-qr-code-based-login-in-real-world-deployments
exact    100%  [cols] PETS/2023/usability-and-enforceability-of-global-privacy-control
exact    100%  [pdf] PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
exact    100%  [cols] IMC/2023/in-the-room-where-it-happens-characterizing-local-communication-and-threats-in-s
exact    100%  [pdf] PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
exact    100%  [cols] PETS/2016/students-and-taxes-a-privacy-preserving-study-using-secure-computation
exact    100%  [pdf] WWW/2019/urban-vibes-and-rural-charms-analysis-of-geographic-diversity-in-mobile-service
exact    100%  [pdf] IMC/2023/characterizing-and-modeling-session-level-mobile-traffic-demands-from-large-scal
exact    100%  [cols] IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s
exact    100%  [cols] PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part
exact    100%  [cols] USENIX/2021/share-first-ask-later-or-never-studying-violations-of-gdprs-explicit-consent-in
exact    100%  [cols] USENIX/2024/the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions
exact    100%  [cols] USENIX/2024/the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions
exact    100%  [cols] PETS/2023/gdprxiv-establishing-the-state-of-the-art-in-gdpr-enforcement
exact    100%  [cols] PETS/2023/gdprxiv-establishing-the-state-of-the-art-in-gdpr-enforcement
exact    100%  [pdf] PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows
exact    100%  [cols] PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows
exact    100%  [pdf] USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
exact    100%  [cols] USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
exact    100%  [cols] PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part
exact    100%  [cols] USENIX/2025/privacy-law-enforcement-under-centralized-governance-a-qualitative-analysis-of-f
 
34 quotes: 34 exact, 0 partial (>=60% of 5-word windows), 0 below threshold.
textSource: cols

scripts/verify_legal_figures.mjs checks every literal figure the page takes from a cited paper against that paper's own text (not against evidence.quote, because these are read out of results sections). 14 figures, 14 found, 0 missing. It also carries the EXTERNAL FIGURES block — statute numbers, dates and case identifiers — so check_page_numbers.mjs can be run whole-page:

node scripts/report_legal_enforcement.mjs > out/report_legal_enforcement.txt
node scripts/verify_legal_figures.mjs    > out/verify_legal_figures.txt
cat out/report_legal_enforcement.txt out/verify_legal_figures.txt > out/le_allnumbers.txt
node scripts/check_page_numbers.mjs pages/practices_legal_enforcement.txt out/le_allnumbers.txt
# OK — every figure in the page traces to out/le_allnumbers.txt
node scripts/check_tables.mjs pages/practices_legal_enforcement.txt
# OK — every table has one width

Unedited output:

verify_legal_figures.txt

ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "856"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "295 out of the 856"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "34%"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "45 fines (18%)"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "61 fines (25%)"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "9 of them (15%)"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "52 (85%)"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "111 cases (45%)"
ok     PETS/2023/gdprxiv-establishing-the-state-of-the-art-in-gdpr-enforcement  "2 enforcement decisions are issued every day"
ok     PETS/2023/gdprxiv-establishing-the-state-of-the-art-in-gdpr-enforcement  "54% of all GDPR enforcements"
ok     USENIX/2024/the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions  "3,947"
ok     PETS/2023/usability-and-enforceability-of-global-privacy-control  "47"
ok     PETS/2023/usability-and-enforceability-of-global-privacy-control  "30-day cure period"
ok     USENIX/2019/50-ways-to-leak-your-data-an-exploration-of-apps-circumvention-of-the-android-pe  "bug bounty"
 
14 literal per-paper figures: 14 found, 0 missing.
 
EXTERNAL FIGURES (primary source, all fetched 2026-08-18)
  Regulation (EU) 2016/679 — Articles 4(23), 56(1), 56(2), 56(3), 56(6), 57(1)(f),
    60(7), 60(8), 77(1), 78(2), 78(3), 80(1), 80(2)
    publications.europa.eu/resource/celex/32016R0679 (CELLAR, XHTML)
  EDPB Opinion 5/2019, adopted 12 March 2019, paragraphs 64, 80, 90 and 91
    edpb.europa.eu/.../201905_edpb_opinion_eprivacydir_gdpr_interplay_en_0.pdf
  Conseil d'Etat n° 449209 of 28 January 2022; interim ruling n° 449212 of 4 March 2021
    CJEU C-673/17 (Planet49), C-645/19 (Facebook Ireland); ePrivacy Dir. Art. 15a
    conseil-etat.fr/fr/arianeweb/CE/decision/2022-01-28/449209
  Directive 2002/58/EC, Article 5(3); Directive 2009/136/EC
  Regulation (EU) 2022/2065 (DSA) — Articles 34(1), 40, 49, 53
  Commission Delegated Regulation (EU) 2025/2050 of 1 July 2025, OJ L, 2025/2050,
    9.10.2025, in force 29 October 2025 (DSA Art. 40 data access)
    publications.europa.eu/resource/celex/32025R2050 (CELLAR, XHTML)
  COM(2025) 837 final, 19.11.2025, procedure 2025/0360(COD) — Digital Omnibus:
    new GDPR Art. 88a and Art. 88b; ePrivacy Art. 5(3) carve-out for natural
    persons' personal data. Status "Awaiting committee decision"; committee
    referral 19/01/2026; ITRE rapporteur appointed 25/02/2026
    publications.europa.eu/resource/comnat/COM_2025_0837_FIN (CELLAR)
    oeil.secure.europarl.europa.eu procedure-file 2025/0360(COD)
  German transposition of ePrivacy Art. 5(3) is § 25 TDDDG (renamed from TTDSG in
    2024, section number unchanged) — gesetze-im-internet.de/ttdsg/__25.html
  FTC Office of Technology established February 2023, ftc.gov/office-technology
    (supersedes the Office of Technology Research and Investigation named on the
    stale PrivacyCon call page)
  Regulation (EU) 2025/2518 — OJ L, 2025/2518, 12.12.2025; Art. 4, Art. 37(2)
    (adopted 26 November 2025; applies from 2 April 2027; two-week inadmissibility
    deadline) publications.europa.eu/resource/celex/32025R2518 (CELLAR, XHTML)
  COM(2025) 45 final, 11.2.2025, Annex IV Withdrawals item 29 = COM(2017)10 final
    (ePrivacy Regulation proposal withdrawn)
  Cal. Civ. Code §§ 1798.150, 1798.155, 1798.199.90 — both amended by
    Stats. 2025, Ch. 20 (AB 137), effective 30 June 2025; no cure language
    leginfo.legislature.ca.gov printCodeSectionWindow.xhtml
  CPRA (Prop 24, 3 November 2020) deleted the 30-day cure period from 1 January 2023
  90 Fed. Reg. 16918 (22 April 2025) — amended COPPA Rule; effective 23 June 2025;
    general compliance date 22 April 2026; § 312.11(d)(1), (d)(4), (g) carve-outs
    govinfo.gov/content/pkg/FR-2025-04-22/html/2025-05904.htm
  CNIL fine of EUR 100m against Google (deliberation SAN-2020-012, 7 December 2020)
  noyb: "more than 500 GDPR complaints" cookie-banner campaign, noyb.eu
  FTC PrivacyCon: last live event page 6 March 2024; /2025/03/privacycon-2025 -> 404
  EDPB member directory: /about-edpb/about-edpb/members_en -> 301 -> /about-edpb/our-members_en
  data-access.dsa.ec.europa.eu -> HTTP 200; DSA data-access delegated act 2 July 2025
 
AUTHOR-NETWORK CLAIM (computed by scripts/le_authors.mjs, not asserted)
  Connected components over the 15 'filed' papers' author surnames, diacritics
  folded, author lists read from the BibTeX that ships with the page:
    7 components; 11 papers in three multi-paper components, 4 singletons.
    [7] linked by vallina-rodriguez (6), reardon (3), tapiador (3), feal (2),
        zuiderveen borgesius (2), acar (2), girish (2), matic (2), weerasekara (2)
    [2] zimmeck (2), wang (2)
    [2] iqbal (2), roesner (2)
    [1] x 4
  An earlier draft asserted "two groups, and the other seven share no author with
  each other". That was wrong twice over: moti2024_targeted joins the large
  component through Acar, and iqbal2023_tracking / yeung2023_online share two
  authors. Full output in out/le_authors.txt.
 
ARITHMETIC THE PAGE DOES (checked here so it cannot go stale silently)
  Saemann et al. report 45 (18%), 61 (25%) and 111 (45%) against an
  identifiable-cause set they state as 295 of 856. 45/295 = 15.3%, 61/295 = 20.7%,
  111/295 = 37.6% — none matches. The three reported percentages are consistent
  with a base of about 245 (45/245 = 18.4%, 61/245 = 24.9%, 111/245 = 45.3%), and
  29 + 45 + 9 + 52 + 111 = 246 from their own cause table. The paper does not
  reconcile 245/246 with 295, so the page reports the shape and flags the base.
 
NOT FIGURES (URL fragments, statute and case identifiers, section marks)
  8,000  — a hypothetical in the page's opening sentence, mirroring the opening of
           practices:notifying_websites. Not a measurement.
  302    — HTTP status: the EDPB Opinion 5/2019 PDF's old path redirects. Checked 2026-08-18.
  403    — HTTP status: ftc.gov and edps.europa.eu refuse a bare curl and serve 200 to a
           browser User-Agent. Checked 2026-08-18.
  03  05904  12  13  16918  137  200  202  2002  2065  2518  26  30  301  40  65
  449209  449212  645  673  679  77  78  85  88  90  91  1798.150  1798.155
  1798.199.90  12.12.2025  2050  837  2025/0360  88a  88b  0360  19  2023  9.10.2025
  25   — section number of the German TDDDG

[1Saemann, Marlene; Theis, Daniel; Urban, Tobias; Degeling, Martin (2022): "Investigating GDPR Fines in the Light of Data Flows", Proceedings on Privacy Enhancing Technologies 2022(4). (DOI)] states that it identified the cause of investigation for 295 of 856 fines (34%), and then reports 45 (18%), 61 (25%) and 111 (45%) for the three largest causes. Those percentages do not come from 295: 45/295 = 15.3%, 61/295 = 20.7%, 111/295 = 37.6%. They are consistent with a base of about 245 (18.4% / 24.9% / 45.3%), and the paper's own cause table sums to 29 + 45 + 9 + 52 + 111 = 246. The paper does not reconcile the two.

Both numbers are verbatim in the paper. The page therefore quotes the paper's own labels and percentages, states 295/856 separately as the identifiable-cause figure, and puts this note in a footnote. It does not compute a percentage of its own from these numbers, which is the failure mode this pattern usually produces.

Every external claim on the page was checked on 2026-08-18; the How verified column below says for each one whether that was a live fetch of the primary source, and by whom. Two rows were read from Wayback mirrors rather than live — see Response to G12 above. Three origins refuse automated fetchers and each needs a different workaround: eur-lex.europa.eu answers with an HTTP 202 AWS-WAF challenge (use CELLAR, below); ftc.gov and edps.europa.eu return 403 to a bare curl and 200 to the same request with a browser User-Agent; leginfo.legislature.ca.gov gates its normal pages behind JavaScript but serves printCodeSectionWindow.xhtml in the clear. A sonnet sub-agent ran the first pass; the load-bearing items were then re-fetched independently by the main agent, because the sub-agent had used Wayback mirrors for EUR-Lex (whose live HTML front end answers automated fetchers with an HTTP 202 AWS-WAF challenge). Independent re-fetch used the EU Publications Office CELLAR service, which serves the same authenticated XHTML with no challenge:

curl -sSL -H "Accept: application/xhtml+xml" -H "Accept-Language: eng" \
  http://publications.europa.eu/resource/celex/32016R0679   # GDPR
curl -sSL -H "Accept: application/xhtml+xml" -H "Accept-Language: eng" \
  http://publications.europa.eu/resource/celex/32025R2518   # GDPR procedural reg
curl -sSL http://publications.europa.eu/resource/cellar/149fe240-e92c-11ef-b5e9-01aa75ed71a1.0001.03/DOC_2
  # COM(2025) 45 final, annexes — Annex IV Withdrawals

• Every law-firm and vendor summary of the CCPA cure period. The sub-agent's first pass had the repealed §1798.155(b) text only from IAPP / BCLP / TrueVault. That text is quoted on this provenance page as secondary and is not on the content page; what the content page asserts is the current statute, read in full, containing no cure language. A repeal is provable by the absence, which is checkable; the wording of the repealed text is not load-bearing.
• Secondary reporting of the ePrivacy Regulation withdrawal (TechCrunch, Hunton, RPC). Replaced by the Commission's own Annex IV.
• Secondary reporting of DSA portal response latency (“roughly 80 working days”). Not on the page: no primary source found, and a latency figure that cannot be sourced is exactly the kind of number a reader would repeat.
• gdpr-info.eu and similar unofficial GDPR mirrors, considered as a workaround for the EUR-Lex WAF. Rejected in favour of CELLAR, which is the Publications Office's own service.
• EDPB Guidelines 2/2023 (technical scope of Art. 5(3)) and Opinion 08/2024 (consent-or-pay). The currency reviewer flagged both as later EDPB guidance in the same space. Neither disturbs the §80/§91 holding on the cooperation mechanism, which is the only thing the page cites Opinion 5/2019 for. Adding them would have diluted the box with material the page does not rely on. Rejected, on the record.
• A named FTC contact person. The PrivacyCon call page names an “Acting Chief” and carries 2016 dates. Naming a specific individual from a stale page would be wrong within a year and possibly already; the page points at the office and flags the staleness.

• Whether any of the fifteen filings produced an enforcement action. Only one paper reports a regulator output ([5Gamba, Julien; Rashed, Mohammed; Razaghpanah, Abbas; Tapiador, Juan; Vallina-Rodriguez, Narseo (2020): "An Analysis of Pre-installed Android Software", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)], the AEPD report). The rest are silent, and the corpus has no way to follow up. Closing this would need a survey of the authors, which is a different piece of work.
• Which Member States have enacted GDPR Art. 80(2) (mandate-free representative complaints). The page states that it is a Member State option and does not list countries. Closing this needs 27 national statutes read; the sub-agent flagged it and it was not attempted.
• The Amazon cookie decision (Conseil d'État, 27 June 2022, n° 451423) was found only in secondary sources and is not cited on the page; the Google decision, verified directly, carries the same reasoning and is sufficient.
• Whether the corpus's 5,859 papers include filings not written down. A paper that filed and did not say so is invisible here, and the reporting rates on Notifying websites suggest under-reporting is the norm in this literature. Every count on the page is a count of what papers say.
• Whether the Digital Omnibus will be adopted, in what form, or when. The page states the proposal, quotes it, and states its procedural status. It does not predict. The Council's own negotiating position on the cookie provisions was not fetched — only the Commission proposal and the Parliament's procedure file — so this page cannot say how the text has moved in Council.
• e-Evidence (Reg. (EU) 2023/1543): flagged by the sub-agent as unchecked and judged out of scope — it is a cross-border criminal-evidence framework, not a route for a compliance finding.

1. A new page rather than broadening practices:notifying_websites. See The run above.
2. ePrivacy / cookie law as its own fold family, not merged into EU data protection. The whole page turns on the two being enforced differently.
3. Reporting regulatorContact figures at all, given that the enum conflates DPAs with CERTs. Kept, because the trend and the population comparisons are meaningful even on a conflated signal, and because dropping it would leave only a 15-paper hand count with no denominator to sit against. Every table that uses it says what it conflates.
4. Publishing the 12.0% → 5.4% decline with a Fisher test. The split is post-hoc, chosen after seeing the five-window table, on small counts. It is reported with the p-value, labelled post-hoc in the footnote, and given a compositional explanation rather than a cultural one. A defensible alternative was to report the five windows and no test; that was rejected because a reader will do the comparison mentally anyway and deserves to know how weak it is. It is the page's only test, so no multiplicity correction applies — see Pvalue corrections for why that matters.
5. Counting planned separately from filed. Three papers say they will contact a regulator. Merging them would have made 18 filings out of 15; keeping them apart costs a row and is the difference between an act and an intention.
6. Calling PETS/2023/usability-and-enforceability-of-global-privacy-control a filing. It notified operators and told them the notice might trigger the CCPA cure period “to prepare potential enforcement actions by the OAG”. It never wrote to the OAG. Coded filed with an explicit qualifier in the authority field, because the mechanism it used is a real route to enforcement and is the most instructive single design on the page — but a reasonable person would code it offtopic.
7. The collaboration role, invented for one paper. USENIX/2024/the-effect-of-design-patterns-… was first coded off-topic (“cites a regulator guideline”). Re-reading it for the one-stop-shop query showed a CNIL co-author and a study commissioned to answer a CNIL question. One paper is a thin basis for a role; it was kept because the route it represents — a fellowship inside the authority — is real, has four corpus instances counted separately as author affiliations, and is advice a reader can act on.
8. Telling readers not to copy [6Zimmeck, Sebastian; Wang, Oliver; Alicki, Kuba; Wang, Jocelyn; Eng, Sophie (2023): "Usability and Enforceability of Global Privacy Control", Proceedings on Privacy Enhancing Technologies 2023(2). (DOI)]'s cure-period design. The page contradicts a published, peer-reviewed method on the strength of a statutory reading. That is a strong claim; it rests on the current text of two code sections read in full, and the page shows its work.

Three focused reviewers ran in parallel against a frozen snapshot (out/freeze/), then the fixes below were applied, then a generic pass ran against the corrected page. Which snapshot each pass saw matters: reviewers 1–3 read the original freeze; reviewer 4 read the page after their fixes were applied but before S5 and S6 (the two framing-sentence corrections, found by the main agent while reviewer 4 was running), so anything reviewer 4 reports about those two sentences is a report on an already-corrected page. Rejections are listed as well as fixes: they are the only record of whether a reviewer is worth its slot.

S5 and S6 are the same failure as F2 in a different costume: a framing sentence that reads as scene-setting, is never measured, and is false. Three of the four self-findings and one of the reviewer's four WRONGs were of this kind. On this page the rule “re-derive your own framing sentences, not only your tables” cost four corrections.

The figures reviewer independently found S2 and S4. It did not find S1 (a one-paper move in a row it was not asked to audit). S3 it did not raise.

Re-ran all five scripts, re-implemented Fisher's exact independently (p ≈ 0.04716, matching), dumped all 186 law strings by family, reproduced two regex sweeps from scratch, and diffed all four embedded <file> blocks. Checked “well over 250 individual figures”.

F1 and F2 are the two that mattered: both are claims that were individually plausible, survived the numeric guard, and were false. F2 in particular is the exact failure mode check_page_numbers.mjs is meant to catch and structurally cannot — a percentage whose digits happen to appear elsewhere in the report as something else.

Verified all 25 new BibTeX entries against Crossref or the venue landing page, re-checked ~15 of the 34 quotes independently, read the affiliation blocks of the four regulator-affiliated papers, and re-derived the Saemann arithmetic.

It confirmed, against the sources: that [4Bielova, Nataliia; Litvine, Laura; Nguyen, Anysia; Chammat, Mariam; Toubiana, Vincent; Hary, Estelle (2024): "The Effect of Design Patterns on (Present and Future) Cookie Consent Decisions", in: Proceedings of the USENIX Security Symposium. (Link)] is the only one-stop-shop paper and has a CNIL co-author with the lead author a CNIL fellow; the AEPD-report sentence in [5Gamba, Julien; Rashed, Mohammed; Razaghpanah, Abbas; Tapiador, Juan; Vallina-Rodriguez, Narseo (2020): "An Analysis of Pre-installed Android Software", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]; that [8Vlummens, Tim; Girish, Aniketh; Weerasekara, Nipuna; Zuiderveen Borgesius, Frederik; Acar, Gunes; Vallina-Rodriguez, Narseo (2026): "Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost", in: Proceedings of the USENIX Security Symposium. (Link)] really does not attribute its outcomes to the DPA filings specifically, so the page's careful phrasing is fair; the [9Utz, Christine; Amft, Sabrina; Degeling, Martin; Holz, Thorsten; Fahl, Sascha; Schaub, Florian (2023): "Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites", Proceedings on Privacy Enhancing Technologies 2023(1):5-28. (DOI)] research-privilege sentence; every Saemann and Sun figure; and all four regulator affiliations. No fabricated quote, no colliding key, no wrong venue or year, no “et al.” mismatch.

It did not re-fetch GDPR Arts. 56(2)/56(3)/57(1)(f)/60(7)/60(8), the CNIL deliberation number, or the two CJEU case numbers, and said so.

Fetched every external URL and every statute afresh.

Everything else it checked came back confirmed: GDPR unamended for every cited article, ePrivacy Directive still in force, Reg. 2025/2518 verbatim, COM(2025) 45 Annex IV item 29, Conseil d'État still standing with no later CJEU judgment disturbing it, the California code sections with no cure language and AB 137 as the latest amendment, COPPA in force, no PrivacyCon since 2024, and every remaining URL live. It supplied a full URL/status table.

E1 is the case for running a currency pass that fetches rather than recalls. The other two reviewers read the same box and neither asked whether the law it states was about to change; nothing in a figures check or a citation check would surface a pending proposal.

Read the page after reviewers 1–3's fixes were applied but before S5–S8. It re-ran the report scripts, independently re-derived the two framing claims, and compared against the live sibling page.

Nothing was rejected. That is unusual and worth saying plainly: the generic pass found more real defects than any of the three focused passes, including two — G5 and G9 — that no focused pass could have found, because one is a lie a script tells about itself and the other is an absence. The repo's standing advice (“run the generic review pass, do not argue yourself out of it”) held again.

• The blanket sentence “Every external claim on the page was fetched from a primary source on 2026-08-18” is withdrawn. It was false in two places its own table already disclosed. The EDPS Private organisation page and the DSA articles were read from Wayback mirrors by the sub-agent; edps.europa.eu in fact serves 200 to a browser User-Agent, so that one had no excuse. The section now says what is true per row and nothing more.
• Reviewer 1 re-ran five scripts: report_legal_enforcement.mjs (with and without –list), verify_legal_figures.mjs, le_quotecheck.mjs and check_tables.mjs. le_authors.mjs did not exist when it ran; dpa_sweep.mjs, dpa_candidates.mjs, dpa_context.mjs, law_fold.mjs and enforce_map.mjs are modules it read and re-implemented rather than executed as commands.
• The placeholder was unreplaced in the frozen snapshot the reviewer read, by construction — the log cannot be written before the review. It is replaced here.

scripts/le_authors.mjs. The page's clustering claim, computed rather than asserted: connected components over the fifteen filed papers, edge wherever two share an author surname (diacritics folded, because Vallina-Rodriguez appears both with and without the accent across venues). Author lists are read from the BibTeX that ships with the page, so a reader can check the input.

le_authors.txt

15 'filed' papers -> 7 connected author components
 
[7] linked by: vallina-rodriguez (6), reardon (3), tapiador (3), feal (2), zuiderveen borgesius (2), acar (2), girish (2), matic (2), weerasekara (2)
    gamba2020_installed
    moti2024_targeted
    feal2020_angel
    weerasekara2025_webviews
    girish2025_signal
    reardon2019_50ways
    vlummens2026_bridges
[2] linked by: zimmeck (2), wang (2)
    zimmeck2019_maps
    zimmeck2023_gpc
[2] linked by: iqbal (2), roesner (2)
    iqbal2023_tracking
    yeung2023_online
[1] singleton
    cheng2020_dangerous
[1] singleton
    arunasalam2024_dark
[1] singleton
    murdoch2010_chip
[1] singleton
    zhang2025_qrcode
 
in a multi-paper component: 11; singletons: 4

enforce_map_listing.txt

## G. The hand-coded map in full
 
 
--- filed ---
CCS/2020/dangerous-skills-got-certified-measuring-the-trustworthiness-of-skill-certificat
  authority: US Federal Trade Commission
  quote: We also shared our results to Federal Trade Commission (FTC) researchers and received recognition from them.
IEEE-SP/2010/chip-and-pin-is-broken
  authority: bank regulators, UK / Europe / North America
  quote: We have therefore decided on a policy of responsible disclosure, of publishing this paper some time after informing bank regulators in the UK, Europe and North America of the vulnerability.
IEEE-SP/2020/an-analysis-of-pre-installed-android-software
  authority: Agencia Española de Protección de Datos (AEPD)
  quote: Our work was also the basis of a report produced by the Spanish Data Protection Agency (AEPD) [3].
IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites
  authority: an unnamed European DPA and a consumer protection agency
  quote: In addition, we shared our preliminary results with a European data protection agency (DPA), and a consumer protection agency.
IMC/2023/tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
  authority: US Federal Trade Commission (public forum)
  quote: We have also shared our findings in a public forum at the Federal Trade Commission (FTC) [44].
NDSS/2024/the-dark-side-of-e-commerce-dropshipping-abuse-as-a-business-model
  authority: US Federal Trade Commission
  quote: We shared the report with 10 e-commerce platforms2 and the Federal Trade Commission (FTC) via relevant channels.
PETS/2019/maps-scaling-privacy-compliance-analysis-to-a-million-apps
  authority: FTC (unnamed "regulators")
  quote: We notified regulators of some of our findings (§ 6), and performed a pilot study with a large European electronic device manufacturer (§ 7).
PETS/2020/angel-or-devil-a-privacy-study-of-mobile-parental-control-apps
  authority: AEPD and INCIBE (IS4K), Spain
  quote: We communicated our findings to the Spanish National Data Protection Agency (AEPD) and other government agencies promoting Internet safety, namely INCIBE's IS4K [1].
PETS/2023/usability-and-enforceability-of-global-privacy-control
  authority: California OAG, invoked rather than contacted
  quote: We made clear that our email may serve as a notice for triggering the 30-day cure period per the CCPA to prepare potential enforcement actions by the OAG.
PETS/2025/tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we
  authority: EDPS, CNIL
  quote: We reported our results to the European Data Protection Supervisor (EDPS) and CNIL.
PETS/2025/your-signal-their-data-an-empirical-privacy-analysis-of-wireless-scanning-sdks-i
  authority: EDPS, AEPD, CNIL
  quote: We shared a preprint of this paper with Google as operator of the Android platform, and with the European Data Protection Supervisor (EDPS), the Spanish Data Protection Agency (AEPD), and the French National Commission on Informatics and Liberty (CNIL).
USENIX/2019/50-ways-to-leak-your-data-an-exploration-of-apps-circumvention-of-the-android-pe
  authority: US Federal Trade Commission
  quote: We found a number of side and covert channels in active use, responsibly disclosed our findings to Google and the U.S. Federal Trade Commission (FTC), and received a bug bounty for our efforts.
USENIX/2025/demystifying-the-in-security-of-qr-code-based-login-in-real-world-deployments
  authority: unnamed ("regulators")
  quote: We responsibly report these vulnerabilities to the developers and regulators.
USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
  authority: EU- and US-based data protection authorities
  quote: After confirming the behavior across other browsers, we extended disclosure to Mozilla, Brave, DuckDuckGo, Microsoft Edge, WebKit, and to EU- and US-based data protection authorities.
WWW/2023/online-advertising-in-ukraine-and-russia-during-the-2022-russian-invasion
  authority: US Federal Trade Commission
  quote: We have reported suspicious humanitarian donation ads to the social media platforms that host their public facing pages, i.e., Facebook and Paypal, and regulatory authorities, i.e., Federal Trade Commission, for further investigation and validation.
 
--- planned ---
IMC/2023/in-the-room-where-it-happens-characterizing-local-communication-and-threats-in-s
  authority: regulators in relevant jurisdictions
  quote: In addition, we are in the process of disclosing the potential privacy violations found in this study to regulators in relevant jurisdictions.
PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
  authority: local Data Protection Authority (Italy)
  quote: Finally, we are improving CookieCheck to include further checks, and we are contacting local Data Protection Authority to present our findings, hoping this will lead to a first step to find a remedy
PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
  authority: EDPB, data protection regulators, IAB Europe
  quote: We also plan to share our results with the European Data Protection Board, data protection regulators, as well as with IAB Europe.
 
--- authorised ---
IMC/2023/characterizing-and-modeling-session-level-mobile-traffic-demands-from-large-scal
  authority: CNIL
  quote: The data collection and processing was approved by the Data Protection Officer (DPO) of the operator, and authorized by the French National Commission on Informatics and Liberty (CNIL)
IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s
  authority: partner's regulatory authority (unnamed)
  quote: our research has been authorized and supervised by the network management department and regulatory authority of our partner.
PETS/2016/students-and-taxes-a-privacy-preserving-study-using-secure-computation
  authority: Estonian Data Protection Inspectorate
  quote: After reviewing our application to process personal data during the study in encrypted form the Data Protection Inspectorate indicated that we did not require a permission to process personal data.
WWW/2019/urban-vibes-and-rural-charms-analysis-of-geographic-diversity-in-mobile-service
  authority: CNIL
  quote: data collection occurred in compliance with regulations in force, and was approved by the French national authority for data privacy (CNIL).
 
--- subject ---
PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part
  authority: the authors' state data protection authority (Germany)
  quote: Despite these efforts, one recipient filed a complaint with our state's data protection authority, upon which we immediately stopped recruitment via GitHub, rather than waiting for the outcome.
 
--- declined ---
USENIX/2021/share-first-ask-later-or-never-studying-violations-of-gdprs-explicit-consent-in
  authority: regulators, Google
  quote: Since disclosing the findings to authorities (e.g., regulators, Google) might cause financial harm to developers, we consciously decided not to involve authorities but rather notify developers directly to remedy compliance issues.
 
--- corpus ---
PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows
  authority: EU DPAs (fine decisions)
PETS/2023/gdprxiv-establishing-the-state-of-the-art-in-gdpr-enforcement
  authority: DPAs, EDPB, courts, EU Parliament
USENIX/2025/privacy-law-enforcement-under-centralized-governance-a-qualitative-analysis-of-f
  authority: Chinese central authorities (SPRCs)
 
--- off-topic ---
 
[homograph — "regulator" is a hardware component]
  CCS/2019/voltjockey-breaching-trustzone-by-software-controlled-voltage-manipulation-over
  IEEE-SP/2022/surakav-generating-realistic-traces-for-a-strong-website-fingerprinting-defense
  NDSS/2025/powerradio-manipulate-sensor-measurement-via-power-gnd-radiation
 
[column-splice artefact — "de-/fined by", "self-reported"]
  CCS/2022/characterizing-and-detecting-non-consensual-photo-sharing-on-social-networks
  USENIX/2013/on-the-security-of-picture-gesture-authentication
  WWW/2019/before-and-after-gdpr-the-changes-in-third-party-presence-at-public-and-private
  WWW/2021/privacy-policies-over-time-curation-and-analysis-of-a-million-document-dataset
 
[regulator as an abstract audience or recommendation, no contact]
  CCS/2019/watching-you-watch-the-tracking-ecosystem-of-over-the-top-tv-streaming-devices
  CCS/2025/automatically-detecting-online-deceptive-patterns
  CCS/2025/is-this-a-scam-the-nature-and-quality-of-reddit-discussion-about-scams
  IEEE-SP/2022/desperate-times-call-for-desperate-measures-user-concerns-with-mobile-loan-apps
  IEEE-SP/2026/banshee-target-switch-attacks-on-gimbal-stabilized-visual-tracking-systems-via-a
  IEEE-SP/2026/consumer-beware-exploring-data-brokers-ccpa-compliance
  IMC/2024/diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc
  IMC/2024/the-age-of-ddoscovery-an-empirical-comparison-of-industry-and-academic-ddos-asse
  IMC/2025/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
  NDSS/2024/leaking-the-privacy-of-groups-and-more-understanding-privacy-risks-of-cross-app-content-sharing-in-mobile-ecosystem
  NDSS/2025/where-are-we-on-cyber-a-qualitative-study-on-boards-cybersecurity-risk-decision-making
  PETS/2019/monte-carlo-and-reconstruction-membership-inference-attacks-against-generative-m
  PETS/2021/data-portability-between-online-services-an-empirical-analysis-on-the-effectiven
  PETS/2022/disparate-vulnerability-to-membership-inference-attacks
  PETS/2022/setting-the-bar-low-are-websites-complying-with-the-minimum-requirements-of-the
  PETS/2023/trust-tee-exploring-the-impact-of-trusted-execution-environments-on-smart-home-p
  PETS/2024/the-devil-is-in-the-details-detection-measurement-and-lawfulness-of-server-side
  PETS/2025/johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
  USENIX/2019/evaluating-the-contextual-integrity-of-privacy-regulation-parents-iot-toy-privac
  USENIX/2023/bug-hunters-perspectives-on-the-challenges-and-benefits-of-the-bug-bounty-ecosys
  USENIX/2023/diving-into-robocall-content-with-snorcall
  USENIX/2024/unpacking-privacy-labels-a-measurement-and-developer-perspective-on-googles-data
  USENIX/2025/websites-global-privacy-control-compliance-at-scale-and-over-time
  WWW/2021/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
  WWW/2024/a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework
 
[cites a regulator document, decision or guideline; no contact]
  CCS/2016/over-the-top-bypass-study-of-a-recent-telephony-fraud
  CCS/2019/network-hygiene-incentives-and-regulation-deployment-of-source-address-validatio
  CCS/2020/deploying-android-security-updates-an-extensive-study-involving-manufacturers-ca
  CCS/2023/marketing-to-children-through-online-targeted-advertising-targeting-mechanisms-a
  CCS/2025/the-challenges-and-opportunities-with-cybersecurity-regulations-a-case-study-of
  IEEE-SP/2014/cloak-and-swagger-understanding-data-sensitivity-through-the-lens-of-user-anonym
  IEEE-SP/2020/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
  IEEE-SP/2022/investigating-influencer-vpn-ads-on-youtube
  IEEE-SP/2025/blind-users-really-do-heed-aural-telephone-scam-warnings
  IEEE-SP/2025/characterizing-robocalls-with-multiple-vantage-points
  IEEE-SP/2025/gdpr-in-the-small-a-field-study-of-privacy-and-security-challenges-in-schools
  IEEE-SP/2025/why-would-money-protect-me-from-cyber-bullying-a-mixed-methods-study-of-personal
  IEEE-SP/2026/setting-the-course-but-forgetting-to-steer-analyzing-compliance-with-gdprs-right
  NDSS/2015/phoneypot-data-driven-understanding-of-telephony-threats
  NDSS/2017/automated-analysis-of-privacy-requirements-for-mobile-apps
  NDSS/2025/policypulse-precision-semantic-role-extraction-for-enhanced-privacy-policy-comprehension
  PETS/2018/privacy-preserving-wi-fi-analytics
  PETS/2020/an-analysis-of-the-current-state-of-the-consumer-credit-reporting-system-in-chin
  PETS/2020/multiple-purposes-multiple-problems-a-user-study-of-consent-dialogs-after-gdpr
  PETS/2022/on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
  PETS/2023/senrev-measurement-of-personal-information-disclosure-in-online-health-communiti
  PETS/2025/empirically-measuring-data-localization-in-the-eu
  PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
  PETS/2026/overcoming-language-barriers-multilingual-analysis-of-the-2023-swiss-privacy-law
  PETS/2026/the-role-of-online-forums-in-developer-understanding-of-privacy-law-a-reddit-cas
  USENIX/2016/protecting-privacy-of-ble-device-users
  USENIX/2019/users-really-do-answer-telephone-scams
  USENIX/2020/actions-speak-louder-than-words-entity-sensitive-privacy-policy-and-data-flow-an
  USENIX/2022/caring-about-sharing-user-perceptions-of-multiparty-data-sharing
  USENIX/2023/the-writing-on-the-wall-and-3d-digital-twins-personal-information-in-not-so-priv
  USENIX/2024/automated-large-scale-analysis-of-cookie-notice-compliance
  WWW/2022/fairness-audit-of-machine-learning-models-with-confidential-computing
  WWW/2026/does-ad-free-mean-less-data-collection-an-empirical-study-of-platform-data-pract
 
[the DPA reference is in the study's own consent form or an interview recruitment, not a filing]
  USENIX/2023/anatomy-of-a-high-profile-data-breach-dissecting-the-aftermath-of-a-crypto-walle
  USENIX/2023/examining-power-dynamics-and-user-privacy-in-smart-technology-use-among-jordania

• Legal enforcement — the page this log is for.
• Corpus — corpus-wide provenance: venues, funnel, the provisional 2025–2026 slice, the duplicate records and the posters.
• notifying_websites — the sibling log; the 91.8% cross-reference is recomputed independently in both.

[1]

Saemann, Marlene; Theis, Daniel; Urban, Tobias; Degeling, Martin (2022): "Investigating GDPR Fines in the Light of Data Flows", Proceedings on Privacy Enhancing Technologies 2022(4). (DOI)

[2]

Sun, Chen; Jacobs, Evan; Lehmann, Daniel; Crouse, Andrew; Shastri, Supreeth (2023): "GDPRxiv: Establishing the State of the Art in GDPR Enforcement", Proceedings on Privacy Enhancing Technologies 2023(4). (DOI)

[3]

Jing, Tao; Li, Yao; Ye, Jingzhou; Wang, Jie; Wang, Xueqiang (2025): "Privacy Law Enforcement Under Centralized Governance: A Qualitative Analysis of Four Years' Special Privacy Rectification Campaigns", in: Proceedings of the USENIX Security Symposium. (Link)

[4]

Bielova, Nataliia; Litvine, Laura; Nguyen, Anysia; Chammat, Mariam; Toubiana, Vincent; Hary, Estelle (2024): "The Effect of Design Patterns on (Present and Future) Cookie Consent Decisions", in: Proceedings of the USENIX Security Symposium. (Link)

[5]

Gamba, Julien; Rashed, Mohammed; Razaghpanah, Abbas; Tapiador, Juan; Vallina-Rodriguez, Narseo (2020): "An Analysis of Pre-installed Android Software", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[6]

Zimmeck, Sebastian; Wang, Oliver; Alicki, Kuba; Wang, Jocelyn; Eng, Sophie (2023): "Usability and Enforceability of Global Privacy Control", Proceedings on Privacy Enhancing Technologies 2023(2). (DOI)

[7]

Feal, Álvaro; Calciati, Paolo; Vallina-Rodriguez, Narseo; Troncoso, Carmela; Gorla, Alessandra (2020): "Angel or Devil? A Privacy Study of Mobile Parental Control Apps", Proceedings on Privacy Enhancing Technologies 2020(2). (DOI)

[8]

Vlummens, Tim; Girish, Aniketh; Weerasekara, Nipuna; Zuiderveen Borgesius, Frederik; Acar, Gunes; Vallina-Rodriguez, Narseo (2026): "Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost", in: Proceedings of the USENIX Security Symposium. (Link)

[9]

Utz, Christine; Amft, Sabrina; Degeling, Martin; Holz, Thorsten; Fahl, Sascha; Schaub, Florian (2023): "Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites", Proceedings on Privacy Enhancing Technologies 2023(1):5-28. (DOI)