Measure The Web

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Provenance: Practices — Legal Enforcement ======

Working log for **[[Practices:Legal enforcement]]**. Every query with its population and denominator, the report scripts with their unedited output, the folds with their residue, every quote with its verification verdict, the external sources with how each was checked, and what could not be established. Corpus-wide caveats — the venue scope, the selection funnel, the provisional 2025–2026 slice — are on [[Literature:Corpus]] and are not repeated here.

Voice here is a working log, not prose. It is read by somebody checking a number.

No ''~~DISCUSSION~~'' block: comments belong on the content page. (This follows the convention set by the earlier provenance pages.)

===== The run =====

^ Item ^ Value ^
| Date | 2026-08-18 |
| Corpus | ''data/extract/run1/extractions.jsonl'', 5,859 papers, 7 venues, 2010–2026 |
| Page status | **new page**. ''practices:legal_enforcement'' was a red link promised by ''start'', ''practices:notifying_websites'' and ''privacy:fingerprinting''. Nothing existed to extend. |
| Scope call | The nearest neighbour is [[Practices:Notifying websites]] (59 KB, operator-facing). It already covers CERTs and the regulator-or-CERT figure. This page was written as a **sibling, not a broadening**: the competence question (which authority, one-stop-shop, ePrivacy carve-out) is a different subject with a different literature, and folding it into a page about contact discovery and response rates would have buried it. The two cross-link, and the overlap is deliberately confined to one figure (91.8%), which is recomputed here rather than copied. |
| Models | Main authoring and all corpus work: Claude Opus 5. One ''sonnet'' sub-agent for the external legal fact-check (its findings were re-verified by hand for the load-bearing claims — see //External sources// below). Review layer per the task spec. |
| Scripts added | ''scripts/law_fold.mjs'', ''scripts/enforce_map.mjs'', ''scripts/dpa_sweep.mjs'', ''scripts/dpa_candidates.mjs'', ''scripts/dpa_context.mjs'', ''scripts/report_legal_enforcement.mjs'', ''scripts/le_quotecheck.mjs'', ''scripts/verify_legal_figures.mjs'', ''scripts/le_authors.mjs'' (nine in all) |
| Bibliography | 25 entries appended to [[Literature:Bibliography]]; 6 keys reused (''trevisan2019_cookielaw'', ''nguyen2021_sharefirst'', ''utz2023_rarely'', ''fouad2022_cookie'', ''moti2024_targeted'', ''vlummens2026_bridges''). Checked for collisions against the live bibliography before appending: none. |

===== Populations and denominators =====

Every figure on the page names one of these. None of them is "of 5,859 papers".

^ Name ^ Definition in code ^ N ^
| ''all'' | every extraction record | 5,859 |
| ''empirical'' | ''isEmpirical === true'' | 5,118 |
| ''empirical ∧ ethics'' | and ''ethics !== null'' (the extractor emits the object only when the paper says something about ethics) | 4,472 |
| ''legal'' | ''legal.length > 0'' — at least one tuple naming a statute and a compliance question | 402 |
| ''legal ∧ ethics'' | | 385 |
| ''legal ∧ crawled'' | and ''POPULATIONS.crawled'': a non-null ''crawlConfig'' //or// ''studyTypes'' containing ''automated-web-crawl'' | 131 |
| ''legal ∧ crawled ∧ ethics'' | | 123 |
| ''found violations'' | ''legal[].foundViolations'' is ''yes'' or ''partial'' for at least one tuple | 177 |

The 646 empirical papers with no ethics object are **excluded**, not counted as "did not contact a regulator". Counting them as ''no'' would move the corpus-wide ''regulatorContact = yes'' rate from 3.3% to 2.9% and would be a lie about what the extraction saw.

===== Report script =====

''node scripts/report_legal_enforcement.mjs'' — plain text; ''%%--wiki%%'' emits DokuWiki tables; ''%%--list%%'' prints the hand-coded map in full. Unedited output:

<file text report_legal_enforcement.txt>
# practices:legal_enforcement — every figure with its denominator
corpus: 5859 papers, 7 venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P), 2010–2026

populations
population          definition                                                 N
------------------  ---------------------------------------------------------  -----------------
all                 every extraction record                                    5859
empirical           isEmpirical == true                                        5118
empirical ∧ ethics  and the extractor emitted an ethics object                 4472
legal               legal[].length > 0 — assessed compliance with a named law  402 (6.9% of all)
legal ∧ ethics                                                                 385
legal ∧ crawled     and ran an automated web crawl                             131

## A. The legal population over time and by venue

Window      Papers in window  Assessed a law  Share
----------  ----------------  --------------  -----
2010–2013   511               8               1.6%
2014–2017   769               17              2.2%
2018–2021   1439              83              5.8%
2022–2024   1955              173             8.8%
2025–2026*  1185              121             10.2%

Venue    Papers  Assessed a law  Share
-------  ------  --------------  -----
PETS     510     122             23.9%
USENIX   1410    102             7.2%
IEEE-SP  767     52              6.8%
CCS      990     34              3.4%
WWW      843     33              3.9%
NDSS     701     32              4.6%
IMC      638     27              4.2%

## B. Which laws, folded (population: 402 papers that assessed a law)

Law family                                                       Papers  Share of 402
---------------------------------------------------------------  ------  ------------
EU data protection (GDPR and predecessors)                       289     71.9%
US state privacy law                                             73      18.2%
US children / education / health / finance                       53      13.2%
Sector, national and other rules                                 49      12.2%
ePrivacy / cookie law                                            27      6.7%
Non-EU/US data protection law                                    26      6.5%
Computer-crime, access and copyright                             19      4.7%
US federal consumer protection and sector regulators (FTC, FCC)  18      4.5%
EU platform / digital-market regulation                          17      4.2%

families are multi-valued: a paper naming both the GDPR and the ePrivacy Directive
counts once in each, so the column sums to 571 > 402.

distinct law strings before folding: 186
UNMAPPED RESIDUE: 7 strings, 7 papers (1.7% of the population)
  1  139-FZ
  1  18 U.S.C. Sec. 2252A(b)(1)
  1  47 CFR Part 17.7
  1  Act against Unfair Competition (UWG)
  1  Air Navigation Order 2016
  1  AML regulations
  1  Brazilian Law Nº 13.488

papers naming the ePrivacy Directive itself: 26
papers in the wider 'ePrivacy / cookie law' family: 27 (the extra 1: GPDP guidelines on cookies)

"GDPR" appears under 9 spellings: EU GDPR | European GDPR | GDPR | GDPR Art. 20 | GDPR Article 6 | GDPR, Article 32 | General Data Protection Regulation | General Data Protection Regulation (GDPR) | UK GDPR
papers naming the GDPR in any spelling: 284; exact string "GDPR" only: 271; missed by the exact string: 13 — an undercount of 4.6%

## C. legal[].foundViolations (population: 402; counted per paper, a paper with any "yes" tuple counts yes)

foundViolations  Papers  Share of 402
---------------  ------  ------------
yes              94      23.4%
partial          83      20.6%
no               74      18.4%
not-assessed     151     37.6%
not-stated       0       0.0%

## D. ethics.regulatorContact — "a DPA, CERT, or other regulator was contacted"

legal ∧ ethics = 385; legal ∧ empirical ∧ ethics = 376 (the 9 difference assess a law without being scored empirical)

Population                N     yes         no            not-stated
------------------------  ----  ----------  ------------  ------------
empirical ∧ ethics        4472  147 (3.3%)  1982 (44.3%)  2343 (52.4%)
crawled ∧ ethics          972   37 (3.8%)   418 (43.0%)   517 (53.2%)
legal ∧ ethics            385   27 (7.0%)   228 (59.2%)   130 (33.8%)
legal ∧ crawled ∧ ethics  123   10 (8.1%)   74 (60.2%)    39 (31.7%)

Window      legal ∧ ethics N  regulatorContact = yes  Share
----------  ----------------  ----------------------  -----
2010–2013   7                 0                       0.0%
2014–2017   16                2                       12.5%
2018–2021   83                10                      12.0%
2022–2024   162               10                      6.2%
2025–2026*  117               5                       4.3%

## E. Hand-coded regulator contact (full-text sweep, then read in context)

Role           What it means                                                        Papers
-------------  -------------------------------------------------------------------  ------
filed          took findings to a privacy / consumer-protection / sector regulator  15
authorised     a regulator approved or supervised the authors' own processing       4
planned        stated an intention to, not done at submission                       3
corpus         measures regulators' own output rather than contacting one           3
subject        a regulator acted on the authors                                     1
declined       said explicitly they chose not to involve one                        1
collaboration  the study was designed with, for, or inside a regulator              1

candidate sweep: 95 papers read; 67 coded off-topic, 28 kept.
  off-topic, homograph — "regulator" is a hardware component: 3
  off-topic, column-splice artefact — "de-/fined by", "self-reported": 4
  off-topic, regulator as an abstract audience or recommendation, no contact: 25
  off-topic, cites a regulator document, decision or guideline; no contact: 33
  off-topic, the DPA reference is in the study's own consent form or an interview recruitment, not a filing: 2

Sweep candidates: 89. Hand verdicts: 95.
In the map but NOT a sweep candidate (6) — added from ethics.regulatorContact == 'yes'
or from the enforcement-corpus sweep; the sentence rule missed them:
  IMC/2023/characterizing-and-modeling-session-level-mobile-traffic-demands-from-large-scal  [authorised]
  PETS/2016/students-and-taxes-a-privacy-preserving-study-using-secure-computation  [authorised]
  PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned  [planned]
  PETS/2020/angel-or-devil-a-privacy-study-of-mobile-parental-control-apps  [filed]
  PETS/2023/usability-and-enforceability-of-global-privacy-control  [filed]
  USENIX/2025/privacy-law-enforcement-under-centralized-governance-a-qualitative-analysis-of-f  [corpus]

Of the 15 that filed, by authority type:
  US FTC or California OAG: 7
  an EU data protection authority (EDPS / CNIL / AEPD / unnamed DPA): 6
  other or unnamed: 2  ["IEEE-SP/2010/chip-and-pin-is-broken","USENIX/2025/demystifying-the-in-security-of-qr-code-based-login-in-real-world-deployments"]

Of the 15 that filed, ethics.notifiedAffectedParties:
  partial: 7
  yes: 7
  no: 1

The 18 filed-or-planned papers by year:
  2010: 1
  2019: 3
  2020: 3
  2023: 4
  2024: 2
  2025: 3
  2026: 2

## D2. What the free-text disclosure detail says about regulators

Population                                                                   N     Share of 2,870
---------------------------------------------------------------------------  ----  --------------
empirical ∧ ethics with a disclosureDetail string                            2870  100%
  … names a privacy or consumer-protection AUTHORITY (the published figure)  12    0.4%
  … or says "regulator"/"regulatory" without naming one                      15    0.5%
  … names a CERT or CSIRT                                                    54    1.9%

All 15 strings, verbatim; [named] marks the 12 that name an authority, [loose] the 3 that only say "regulator":
  [loose] PETS/2016: Data owners and regulators reviewed the MPC design; summary-only outputs and deletion controls were used.
  [loose] PETS/2019: Discussed privacy risks and proposed user, platform, and regulatory mitigations.
  [named] PETS/2019: Notified regulators of some findings and piloted analysis with the FTC.
  [named] USENIX/2019: Findings were responsibly disclosed to Google and the FTC; authors received a bug bounty.
  [named] CCS/2020: Reported certification findings to Amazon and Google; shared results with FTC researchers.
  [named] PETS/2020: Findings communicated to AEPD and INCIBE's IS4K.
  [named] IMC/2023: Amazon learned through the preprint and updated disclosures; findings were also shared at an FTC forum.
  [named] WWW/2023: Reported suspicious advertisements to Facebook, PayPal, and the Federal Trade Commission; redacted organization names.
  [named] NDSS/2024: Shared a report with 10 e-commerce platforms and the Federal Trade Commission.
  [named] USENIX/2024: Participants were debriefed about the study intent and DPA collaboration at the end.
  [named] PETS/2025: Preprint shared with Google and European data protection authorities.
  [named] PETS/2026: Responsible disclosure to developers; results planned for EDPB, regulators, and IAB Europe.
  [loose] IEEE-SP/2010: Informed bank regulators in the UK, Europe, and North America before publication.
  [named] PETS/2025: Reported findings to Android Security Team, EDPS, and CNIL; received a bug bounty.
  [named] USENIX/2026: Disclosed findings to browser, OS, app vendors, and EU/US data protection authorities; publicly disclosed after coordination.

## E1. A regulator in the author list

Sweep of all 5859 papers' full text for regulator email domains and for authority
names in the first 80 lines, then the affiliation block read by hand. 4 papers:
  PETS/2017/cross-device-tracking-measurement-and-disclosures
    US Federal Trade Commission, Office of Technology Research and Investigation (all four authors, @ftc.gov)
  PETS/2022/my-cookie-is-a-phoenix-detection-measurement-and-lawfulness-of-cookie-respawning
    CNIL, LINC team (one author)
  PETS/2022/on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
    CNIL, LINC team (one author, nbielova@cnil.fr)
  USENIX/2024/the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions
    CNIL (one author); lead author a CNIL Senior Privacy Fellow 2021–2022

## E2. Of the papers that found violations, how many went to a regulator

Population                             N    Figure
-------------------------------------  ---  ------------
legal, foundViolations yes or partial  177  44.0% of 402
  … with an ethics object              166  —
  … ethics.regulatorContact == yes     19   11.4%
  … hand-coded role == filed           7    4.0%
  … found violations and did NOT file  170  96.0%

Note the subtraction that is WRONG: 177 - 15 = 162 treats every filer as a
violation-finder. Only 7 of the 15 are. The count of violation-finding
papers that did not file is 170. (Generic reviewer, 2026-08-18.)

And the same cut on the web-crawling subset — the population closest to a reader of this page:
Population                          N   Figure
----------------------------------  --  ------
legal ∧ crawled, found violations   80  —
  … with an ethics object           75  —
  … ethics.regulatorContact == yes  9   12.0%

Did regulator contact fall? legal ∧ ethics, 2018–2021 vs 2022–2026:
  10/83 (12.0%) vs 15/279 (5.4%)
  Fisher's exact, two-sided: p = 0.047

Is it composition? Venue mix of legal ∧ ethics papers, and the rate within strata:
Venue    2018–2021 share of legal ∧ ethics  2022–2026 share
-------  ---------------------------------  ---------------
CCS      7/83 (8.4%)                        22/279 (7.9%)
IEEE-SP  7/83 (8.4%)                        41/279 (14.7%)
IMC      9/83 (10.8%)                       14/279 (5.0%)
NDSS     10/83 (12.0%)                      17/279 (6.1%)
PETS     18/83 (21.7%)                      90/279 (32.3%)
USENIX   22/83 (26.5%)                      77/279 (27.6%)
WWW      10/83 (12.0%)                      18/279 (6.5%)
  2018–2021: all 10/83 (12.0%) | PoPETs 3/18 (16.7%) | non-PoPETs 7/65 (10.8%)
  2022–2026: all 15/279 (5.4%) | PoPETs 6/90 (6.7%) | non-PoPETs 9/189 (4.8%)
  PoPETs' share of legal ∧ ethics papers ROSE (21.7% -> 32.3%), and the rate fell inside
  both strata. So the decline is not a venue-mix effect and this report offers no explanation.

Cross-check of the figure quoted from practices:notifying_websites:
  regulatorContact == yes: 147; of those also notifiedAffectedParties yes/partial: 135 (91.8%)

## F. The one-stop-shop mechanism in the corpus

Sweep: /\b(main establishment|lead (data protection |supervisory )?authorit|cross-border processing|Article 56|Art\. 56|Article 60|Art\. 60|one-stop|one stop shop|mutual assistance|consistency mechanism)\b/i over all 5859 papers' full text. Every hit read and given a
verdict in enforce_map.mjs (OSS_MAP). There is no default: the report exits 1
both on a hit with no verdict and on a verdict for a paper the sweep no longer returns.

Verdict    Papers
---------  ------
homograph  35
mechanism  1
refonly    1

sweep hits: 37
  mechanism: USENIX/2024/the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions
  refonly: WWW/2025/50-shades-of-deceptive-patterns-a-unified-taxonomy-multimodal-detection-and-secu

The quote the page prints from the one 'mechanism' paper is checked by
scripts/le_quotecheck.mjs and is verbatim in paper.cols.txt.

## F2. Papers reporting use of the DSA Article 40 vetted-researcher route

The page says no corpus paper uses it. That was asserted, not measured, until
the generic reviewer asked for the sweep (2026-08-18). Regex over all full text:
  /vetted researcher|Article 40 of (the )?(DSA|Regulation \(EU\) 2022\/2065)|Art\. 40 DSA|DSA data access|data-access\.dsa|digital services coordinator/i
  7 hits, all read:
    CCS/2020/the-cookie-hunter-automated-black-box-auditing-for-web-authentication-and-author
    NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media
    IMC/2025/r-e-routing-policy-inference-and-implication
    USENIX/2025/demystifying-the-in-security-of-qr-code-based-login-in-real-world-deployments
    USENIX/2025/watch-out-your-tv-box-reversing-and-blocking-a-p2p-based-illegal-streaming-ecosy
    WWW/2026/does-this-button-work-investigating-youtubes-ineffective-user-controls
    NDSS/2026/tickets-to-hide-an-inside-look-into-the-anti-abuse-ecosystem-through-internal-abuse-data
  None reports obtaining or using Art. 40 access: the hits are Censys' own vetted-access
  programme, artifact-release policies, and advocacy citations. The delegated act
  (Reg. (EU) 2025/2050) entered into force 29 October 2025, so most of the corpus's
  submission cycles predate the portal — but the 2026 venue-years do not, and the
  page must not claim the corpus "ends before the portal opened".
</file>

===== The law fold =====

''scripts/law_fold.mjs''. ''legal[].law'' is verbatim free text: **186 distinct strings across 402 papers**. Nine ordered families, first match wins, grouped by **which authority enforces the law** rather than by subject matter — which is why ePrivacy is its own family and not folded into "EU data protection". Its Art. 5(3) is enforced by nationally designated bodies outside the GDPR one-stop-shop, so a cookie finding and a profiling finding go to different desks; a fold that merged them would have made the page's central point uncountable.

Why folding is not optional here: **"GDPR" appears under 9 spellings** — ''GDPR'', ''EU GDPR'', ''European GDPR'', ''UK GDPR'', ''GDPR Art. 20'', ''GDPR Article 6'', ''GDPR, Article 32'', ''General Data Protection Regulation'', ''General Data Protection Regulation (GDPR)''. 284 papers name it in some spelling; the exact string ''GDPR'' catches 271. A 4.6% undercount on the page's largest row.

**A note on the ePrivacy row.** The family is named for what it groups — terminal-access rules enforced outside the one-stop-shop — and it holds 27 papers, but only **26** name the ePrivacy Directive itself; the 27th is there for the string "GPDP guidelines on cookies" (the Italian authority's cookie guidance). The page's prose says 26 because its claim is about the Directive. The report prints both.

**Two explicit exceptions**, added on 2026-08-18 after self-review and confirmed by the figures reviewer. Neither is a regex weakening — both are a keyed override that runs before the families, so the mistake is visible in the code rather than buried in an alternation:

^ String ^ Was ^ Now ^ Why ^
| ''Privacy Act of 1974'' | Non-EU/US data protection law | Sector, national and other rules | a US **federal-agency records** statute. It matched the ''privacy act'' alternative written for the Australian Privacy Act 1988 — wrong on both the jurisdiction and the subject. |
| ''Impressumspflicht'' | EU data protection (GDPR and predecessors) | Sector, national and other rules | the German **imprint/disclosure** duty (TMG §5 / DDG). Not data protection, and not enforced by a DPA — which is the axis this fold is built on. |

Effect on the published table: EU data protection 290 → **289** (that paper also names the German Prostitutes Protection Act, already in Sector, so Sector does not double-count it); Non-EU/US 27 → **26**; Sector 48 → **49**.

**One regex tightened**: the US-state-privacy family carried a bare ''\bcpa\b'' for "Colorado Privacy Act (CPA)". Harmless on this corpus — the only string that matched was the explicit one — but it would have swallowed any future "Consumer Protection Act" into a US-state bucket. Replaced with the spelled-out name.

**Unmapped residue, printed in full — 7 strings, 7 papers, 1.7% of the population:**

^ String ^ Papers ^
| ''139-FZ'' | 1 |
| ''18 U.S.C. Sec. 2252A(b)(1)'' | 1 |
| ''47 CFR Part 17.7'' | 1 |
| ''Act against Unfair Competition (UWG)'' | 1 |
| ''Air Navigation Order 2016'' | 1 |
| ''AML regulations'' | 1 |
| ''Brazilian Law Nº 13.488'' | 1 |

In order: a Russian federal law, a US criminal-code section, an FCC tower-marking rule, German unfair-competition law, a UK aviation order, anti-money-laundering rules, and Brazilian election law. Every one would belong in //Sector, national and other rules//. They were deliberately **not** absorbed by adding regexes: a residue of one-off national statutes is honest information about the corpus's long tail, and a fold that matches everything tells you nothing. The residue is 1.7% of papers; it does not move any published figure.

===== The regulator-contact sweep, and why a hand map was needed =====

''ethics.regulatorContact'' is a three-value enum whose schema description is //"Whether a DPA, CERT, or other regulator was contacted."// It cannot answer this page's question, because it merges:

  * a national CERT (which belongs to [[Practices:Notifying websites]]),
  * a sector regulator (bank supervisors, the FCC, a telecoms authority),
  * a data protection or consumer-protection authority (this page),
  * and, in at least one case, the authors' own institutional Data Protection Officer.

So the schema signal (147 papers ''yes'') is an **upper bound**, and the page reports it as such. The hand map narrows it.

==== Step 1 — full-text sweep ====

''scripts/dpa_sweep.mjs'' reads the rendering the extractor read (''paper.cols.txt'', or ''paper.norm.txt'' for the 7 papers with ''textSource: "mistral"'') for all 5,859 papers — 0 missing text files — and fires six pattern families.

^ Family ^ Papers ^
| ''us-regulator'' | 284 |
| ''dpa-named'' | 139 |
| ''generic-dpa'' | 86 |
| ''complaint'' | 21 |
| ''ngo'' (noyb) | 19 |
| ''one-stop-shop'' | 11 |
| **union** | **419** |

==== Step 2 — sentence rule ====

''scripts/dpa_candidates.mjs'' narrows to sentences (≤600 chars) that contain an **authority name**, a **first-person marker** (''we'' / ''our'' / ''the authors'') and a **contact or approval verb**, deliberately excluding CERT/CSIRT and "Data Protection Officer" (an in-house role, not a regulator). **89 candidate papers.**

==== Step 3 — read every one ====

All 89, plus 6 more found by other routes, were read in context and given exactly one role. ''scripts/enforce_map.mjs'' holds the verdicts with a deciding quote; ''report_legal_enforcement.mjs'' **exits 1** if a sweep candidate has no verdict, so the map cannot silently fall behind the sweep.

The 6 the sentence rule missed — this is the sweep's measured recall failure, and it is why the page says "expect the true count to be a little higher than fifteen":

^ Paper ^ Role ^ Why the sentence rule missed it ^
| ''PETS/2016/students-and-taxes-…'' | authorised | the deciding sentence has no first-person pronoun ("After reviewing our application … the Data Protection Inspectorate indicated…" — ''our'' is present but the verb ''indicated'' has the authority as subject and is not in the verb list) |
| ''PETS/2019/4-years-of-eu-cookie-law-…'' | planned | the sentence is spliced across the two-column repair between "Data Pro-" and "tection Authority" |
| ''PETS/2020/angel-or-devil-…'' | filed | same splice, plus an em-dash clause between the verb and the authority |
| ''IMC/2023/characterizing-and-modeling-session-level-…'' | authorised | passive, and the authority name is French-expanded across a line break |
| ''PETS/2023/usability-and-enforceability-of-global-privacy-control'' | filed | the OAG appears as the beneficiary of a third party's future action, not as the object of the authors' verb |
| ''USENIX/2025/privacy-law-enforcement-under-centralized-governance-…'' | corpus | studies enforcement; never contacts anyone |

The first four came from dumping every ''ethics.regulatorContact == "yes"'' paper's evidence quote and disclosure detail; the last two from a separate sweep for enforcement-outcome language. That sweep's regex was **paraphrased** in an earlier draft of this page, and the figures reviewer correctly reported that the paraphrase reproduces 211 papers rather than the 108 quoted. The regex actually run was:

<code>
/\b(GDPR fine|fined (by|the)|enforcement action|regulatory (action|enforcement|intervention)
  |sanction(ed|s) (by|imposed)|decision of the (CNIL|ICO|Garante|DPC)
  |CNIL (fined|imposed|issued)|enforcement (decision|notice|sweep))\b/i
</code>

which returns **108** papers. It was an orientation sweep, not a published population: nothing on the content page is a count from it. Two of its hits ({[saemann2022_fines]} was already in hand; {[sun2023_gdprxiv]} and {[jing2025_enforcement]} came from it) entered the hand map as ''corpus''.

==== The 67 off-topic papers, with the reason each was excluded ====

^ Reason ^ Papers ^
| cites a regulator document, decision or guideline; no contact | 33 |
| regulator as an abstract audience or recommendation, no contact ("we hope regulators will…") | 25 |
| column-splice artefact — ''de-/fined by'', ''self-reported'' | 4 |
| homograph — "regulator" is a hardware component (voltage regulator, traffic-shaping regulator ''R'') | 3 |
| the DPA reference is in the study's own consent form or an interview recruitment, not a filing | 2 |

The full list of all 67 keys, grouped by reason, is in the ''%%--list%%'' output at the foot of this page. Three worth naming because a reader might expect them on the content page:

  * ''IEEE-SP/2026/consumer-beware-exploring-data-brokers-ccpa-compliance'' — **recommends** that consumers //"file official grievances using the CPPA complaint form"//. The authors did not file. It is the corpus's only pointer to the CPPA form and is cited on the page for the form, not as a filing.
  * ''USENIX/2025/websites-global-privacy-control-compliance-at-scale-and-over-time'' — ''regulatorContact = yes'' in the schema, but every regulator sentence in the paper is a **recommendation to** regulators. A clean example of the schema over-firing.
  * ''PETS/2024/the-devil-is-in-the-details-…'' — //"we consulted case decisions of the Court of Justice of the EU, guidelines of both the European Data Protection Board … and Data Protection Authorities"//. Consulting guidance is not contacting an authority.

===== The one-stop-shop query =====

The task asked the page to cover the one-stop-shop. The corpus almost cannot.

**This section was originally three hardcoded ''console.log'' lines in the report** — a stale count sitting inside the block whose whole purpose is auditability, and the figures reviewer caught it: the number printed there (35) was not produced by any code in the repository, and could not be reproduced. Section F now runs the sweep at report time, classifies each hit against a hand map in ''enforce_map.mjs'' (''OSS_MAP''), and **exits 1** if the map holds a verdict for a paper the sweep no longer returns. The regex the report prints is the regex the report ran.

Sweep, over all 5,859 papers' full text: ''/\b(main establishment|lead (data protection |supervisory )?authorit|cross-border processing|Article 56|Art\. 56|Article 60|Art\. 60|one-stop|one stop shop|mutual assistance|consistency mechanism)\b/i''

**37 papers hit. Every hit was read.**

^ Verdict ^ Papers ^
| ''homograph'' — the colloquial "one-stop shop/solution/service", an "Article 56" page number in a citation, a data-store "consistency mechanism", or a caching "Mutual Assistance Group" | 35 |
| ''mechanism'' — discusses the GDPR one-stop-shop as a mechanism | **1** |
| ''refonly'' — cites an EDPB Article 60 document in the reference list only | 1 |

''mechanism'': ''USENIX/2024/the-effect-of-design-patterns-…'' {[bielova2024_designpatterns]}, whose author list includes CNIL. Its sentence is quoted in the page's opening box and verified verbatim below.
''refonly'': ''WWW/2025/50-shades-of-deceptive-patterns-…''

Note the sensitivity: an earlier hand-run of a **narrower** regex (''one[- ]stop[- ]shop'' spelled out in full, no ''consistency mechanism'') returns 23, and the figures reviewer reproduced that number from the regex this page used to quote. Both are correct for their own regex; only one of them was in code. The broader one is now in code and is the number this page reports.

**This is the page's most consequential judgement call.** The corpus cannot support a section on the one-stop-shop, so the page sources that section from primary law (GDPR Arts. 4(23)/56/60/65, EDPB Opinion 5/2019, Conseil d'État, and — for what is proposed — COM(2025) 837) and says so in its methodology section. The alternative, omitting the mechanism because the corpus is silent, would have left the page unable to answer the question a reader arrives with.

===== Quote verification =====

''scripts/le_quotecheck.mjs''. Every quote the page prints, checked against the rendering the extractor read and, on failure, against ''paper.pdf'' re-extracted with ''pypdf''. **34 quotes: 34 exact, 0 partial, 0 below threshold.**

Three things this check had to get right, each found by a failure:

  - **Ligatures.** ''pypdf'' emits ''ﬁndings'' and ''eﬀort'' where ''.cols'' emits ''findings''. Without normalising ''ﬀ''–''ﬄ'', the ''angel-or-devil'' quote scored 42%.
  - **Hyphens at a line break.** ''Data Pro- tection'' (pypdf) and ''Data Pro-tection'' (''.cols'') are one word in the PDF and neither is what the paper says. De-hyphenating fixed 2 of the 3 initial below-threshold results.
  - **''.cols'' and ''pypdf'' defeat //different// sentences.** ''4-years-of-eu-cookie-law'' fails in both renderings on its own, and is verbatim in the PDF once de-hyphenated. A checker that reads only one rendering scores a faithful extraction as a fabrication.

Two extraction quotes were **reconstructions, not verbatim**, and were replaced on the page with the paper's own sentence:

^ Paper ^ Extraction's ''evidence.quote'' ^ What the paper says ^
| USENIX/2019 50 Ways | "We have responsibly disclosed our findings to Google and the U.S. Federal Trade Commission (FTC), and received a bug bounty for our efforts." | "We found a number of side and covert channels in active use, responsibly disclosed our findings to Google and the U.S. Federal Trade Commission (FTC), and received a bug bounty for our efforts." |
| WWW/2023 Online Advertising | (truncated mid-clause by a column splice) | "…and regulatory authorities, i.e., Federal Trade Commission, for further investigation and validation." |

Unedited output:

<file text le_quotecheck.txt>
exact    100%  [cols] PETS/2019/maps-scaling-privacy-compliance-analysis-to-a-million-apps
exact    100%  [cols] USENIX/2019/50-ways-to-leak-your-data-an-exploration-of-apps-circumvention-of-the-android-pe
exact    100%  [cols] CCS/2020/dangerous-skills-got-certified-measuring-the-trustworthiness-of-skill-certificat
exact    100%  [cols] IEEE-SP/2020/an-analysis-of-pre-installed-android-software
exact    100%  [pdf] PETS/2020/angel-or-devil-a-privacy-study-of-mobile-parental-control-apps
exact    100%  [cols] IMC/2023/tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
exact    100%  [pdf] WWW/2023/online-advertising-in-ukraine-and-russia-during-the-2022-russian-invasion
exact    100%  [cols] NDSS/2024/the-dark-side-of-e-commerce-dropshipping-abuse-as-a-business-model
exact    100%  [cols] IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites
exact    100%  [cols] PETS/2025/your-signal-their-data-an-empirical-privacy-analysis-of-wireless-scanning-sdks-i
exact    100%  [cols] PETS/2025/tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we
exact    100%  [cols] USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
exact    100%  [cols] IEEE-SP/2010/chip-and-pin-is-broken
exact    100%  [cols] USENIX/2025/demystifying-the-in-security-of-qr-code-based-login-in-real-world-deployments
exact    100%  [cols] PETS/2023/usability-and-enforceability-of-global-privacy-control
exact    100%  [pdf] PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
exact    100%  [cols] IMC/2023/in-the-room-where-it-happens-characterizing-local-communication-and-threats-in-s
exact    100%  [pdf] PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
exact    100%  [cols] PETS/2016/students-and-taxes-a-privacy-preserving-study-using-secure-computation
exact    100%  [pdf] WWW/2019/urban-vibes-and-rural-charms-analysis-of-geographic-diversity-in-mobile-service
exact    100%  [pdf] IMC/2023/characterizing-and-modeling-session-level-mobile-traffic-demands-from-large-scal
exact    100%  [cols] IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s
exact    100%  [cols] PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part
exact    100%  [cols] USENIX/2021/share-first-ask-later-or-never-studying-violations-of-gdprs-explicit-consent-in
exact    100%  [cols] USENIX/2024/the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions
exact    100%  [cols] USENIX/2024/the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions
exact    100%  [cols] PETS/2023/gdprxiv-establishing-the-state-of-the-art-in-gdpr-enforcement
exact    100%  [cols] PETS/2023/gdprxiv-establishing-the-state-of-the-art-in-gdpr-enforcement
exact    100%  [pdf] PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows
exact    100%  [cols] PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows
exact    100%  [pdf] USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
exact    100%  [cols] USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
exact    100%  [cols] PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part
exact    100%  [cols] USENIX/2025/privacy-law-enforcement-under-centralized-governance-a-qualitative-analysis-of-f

34 quotes: 34 exact, 0 partial (>=60% of 5-word windows), 0 below threshold.
textSource: cols
</file>

===== Per-paper figures and external identifiers =====

''scripts/verify_legal_figures.mjs'' checks every literal figure the page takes from a cited paper against that paper's own text (not against ''evidence.quote'', because these are read out of results sections). **14 figures, 14 found, 0 missing.** It also carries the ''EXTERNAL FIGURES'' block — statute numbers, dates and case identifiers — so ''check_page_numbers.mjs'' can be run whole-page:

<code>
node scripts/report_legal_enforcement.mjs > out/report_legal_enforcement.txt
node scripts/verify_legal_figures.mjs    > out/verify_legal_figures.txt
cat out/report_legal_enforcement.txt out/verify_legal_figures.txt > out/le_allnumbers.txt
node scripts/check_page_numbers.mjs pages/practices_legal_enforcement.txt out/le_allnumbers.txt
# OK — every figure in the page traces to out/le_allnumbers.txt
node scripts/check_tables.mjs pages/practices_legal_enforcement.txt
# OK — every table has one width
</code>

Unedited output:

<file text verify_legal_figures.txt>
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "856"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "295 out of the 856"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "34%"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "45 fines (18%)"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "61 fines (25%)"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "9 of them (15%)"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "52 (85%)"
ok     PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows  "111 cases (45%)"
ok     PETS/2023/gdprxiv-establishing-the-state-of-the-art-in-gdpr-enforcement  "2 enforcement decisions are issued every day"
ok     PETS/2023/gdprxiv-establishing-the-state-of-the-art-in-gdpr-enforcement  "54% of all GDPR enforcements"
ok     USENIX/2024/the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions  "3,947"
ok     PETS/2023/usability-and-enforceability-of-global-privacy-control  "47"
ok     PETS/2023/usability-and-enforceability-of-global-privacy-control  "30-day cure period"
ok     USENIX/2019/50-ways-to-leak-your-data-an-exploration-of-apps-circumvention-of-the-android-pe  "bug bounty"

14 literal per-paper figures: 14 found, 0 missing.

EXTERNAL FIGURES (primary source, all fetched 2026-08-18)
  Regulation (EU) 2016/679 — Articles 4(23), 56(1), 56(2), 56(3), 56(6), 57(1)(f),
    60(7), 60(8), 77(1), 78(2), 78(3), 80(1), 80(2)
    publications.europa.eu/resource/celex/32016R0679 (CELLAR, XHTML)
  EDPB Opinion 5/2019, adopted 12 March 2019, paragraphs 64, 80, 90 and 91
    edpb.europa.eu/.../201905_edpb_opinion_eprivacydir_gdpr_interplay_en_0.pdf
  Conseil d'Etat n° 449209 of 28 January 2022; interim ruling n° 449212 of 4 March 2021
    CJEU C-673/17 (Planet49), C-645/19 (Facebook Ireland); ePrivacy Dir. Art. 15a
    conseil-etat.fr/fr/arianeweb/CE/decision/2022-01-28/449209
  Directive 2002/58/EC, Article 5(3); Directive 2009/136/EC
  Regulation (EU) 2022/2065 (DSA) — Articles 34(1), 40, 49, 53
  Commission Delegated Regulation (EU) 2025/2050 of 1 July 2025, OJ L, 2025/2050,
    9.10.2025, in force 29 October 2025 (DSA Art. 40 data access)
    publications.europa.eu/resource/celex/32025R2050 (CELLAR, XHTML)
  COM(2025) 837 final, 19.11.2025, procedure 2025/0360(COD) — Digital Omnibus:
    new GDPR Art. 88a and Art. 88b; ePrivacy Art. 5(3) carve-out for natural
    persons' personal data. Status "Awaiting committee decision"; committee
    referral 19/01/2026; ITRE rapporteur appointed 25/02/2026
    publications.europa.eu/resource/comnat/COM_2025_0837_FIN (CELLAR)
    oeil.secure.europarl.europa.eu procedure-file 2025/0360(COD)
  German transposition of ePrivacy Art. 5(3) is § 25 TDDDG (renamed from TTDSG in
    2024, section number unchanged) — gesetze-im-internet.de/ttdsg/__25.html
  FTC Office of Technology established February 2023, ftc.gov/office-technology
    (supersedes the Office of Technology Research and Investigation named on the
    stale PrivacyCon call page)
  Regulation (EU) 2025/2518 — OJ L, 2025/2518, 12.12.2025; Art. 4, Art. 37(2)
    (adopted 26 November 2025; applies from 2 April 2027; two-week inadmissibility
    deadline) publications.europa.eu/resource/celex/32025R2518 (CELLAR, XHTML)
  COM(2025) 45 final, 11.2.2025, Annex IV Withdrawals item 29 = COM(2017)10 final
    (ePrivacy Regulation proposal withdrawn)
  Cal. Civ. Code §§ 1798.150, 1798.155, 1798.199.90 — both amended by
    Stats. 2025, Ch. 20 (AB 137), effective 30 June 2025; no cure language
    leginfo.legislature.ca.gov printCodeSectionWindow.xhtml
  CPRA (Prop 24, 3 November 2020) deleted the 30-day cure period from 1 January 2023
  90 Fed. Reg. 16918 (22 April 2025) — amended COPPA Rule; effective 23 June 2025;
    general compliance date 22 April 2026; § 312.11(d)(1), (d)(4), (g) carve-outs
    govinfo.gov/content/pkg/FR-2025-04-22/html/2025-05904.htm
  CNIL fine of EUR 100m against Google (deliberation SAN-2020-012, 7 December 2020)
  noyb: "more than 500 GDPR complaints" cookie-banner campaign, noyb.eu
  FTC PrivacyCon: last live event page 6 March 2024; /2025/03/privacycon-2025 -> 404
  EDPB member directory: /about-edpb/about-edpb/members_en -> 301 -> /about-edpb/our-members_en
  data-access.dsa.ec.europa.eu -> HTTP 200; DSA data-access delegated act 2 July 2025

AUTHOR-NETWORK CLAIM (computed by scripts/le_authors.mjs, not asserted)
  Connected components over the 15 'filed' papers' author surnames, diacritics
  folded, author lists read from the BibTeX that ships with the page:
    7 components; 11 papers in three multi-paper components, 4 singletons.
    [7] linked by vallina-rodriguez (6), reardon (3), tapiador (3), feal (2),
        zuiderveen borgesius (2), acar (2), girish (2), matic (2), weerasekara (2)
    [2] zimmeck (2), wang (2)
    [2] iqbal (2), roesner (2)
    [1] x 4
  An earlier draft asserted "two groups, and the other seven share no author with
  each other". That was wrong twice over: moti2024_targeted joins the large
  component through Acar, and iqbal2023_tracking / yeung2023_online share two
  authors. Full output in out/le_authors.txt.

ARITHMETIC THE PAGE DOES (checked here so it cannot go stale silently)
  Saemann et al. report 45 (18%), 61 (25%) and 111 (45%) against an
  identifiable-cause set they state as 295 of 856. 45/295 = 15.3%, 61/295 = 20.7%,
  111/295 = 37.6% — none matches. The three reported percentages are consistent
  with a base of about 245 (45/245 = 18.4%, 61/245 = 24.9%, 111/245 = 45.3%), and
  29 + 45 + 9 + 52 + 111 = 246 from their own cause table. The paper does not
  reconcile 245/246 with 295, so the page reports the shape and flags the base.

NOT FIGURES (URL fragments, statute and case identifiers, section marks)
  8,000  — a hypothetical in the page's opening sentence, mirroring the opening of
           practices:notifying_websites. Not a measurement.
  302    — HTTP status: the EDPB Opinion 5/2019 PDF's old path redirects. Checked 2026-08-18.
  403    — HTTP status: ftc.gov and edps.europa.eu refuse a bare curl and serve 200 to a
           browser User-Agent. Checked 2026-08-18.
  03  05904  12  13  16918  137  200  202  2002  2065  2518  26  30  301  40  65
  449209  449212  645  673  679  77  78  85  88  90  91  1798.150  1798.155
  1798.199.90  12.12.2025  2050  837  2025/0360  88a  88b  0360  19  2023  9.10.2025
  25   — section number of the German TDDDG
</file>

==== One arithmetic problem the page flags rather than hides ====

{[saemann2022_fines]} states that it identified the cause of investigation for **295 of 856** fines (34%), and then reports **45 (18%)**, **61 (25%)** and **111 (45%)** for the three largest causes. Those percentages do not come from 295: 45/295 = 15.3%, 61/295 = 20.7%, 111/295 = 37.6%. They are consistent with a base of about **245** (18.4% / 24.9% / 45.3%), and the paper's own cause table sums to 29 + 45 + 9 + 52 + 111 = **246**. The paper does not reconcile the two.

Both numbers are verbatim in the paper. The page therefore quotes the paper's own labels and percentages, states 295/856 separately as the identifiable-cause figure, and puts this note in a footnote. It does **not** compute a percentage of its own from these numbers, which is the failure mode this pattern usually produces.

===== External sources =====

Every external claim on the page was checked on **2026-08-18**; the //How verified// column below says for each one whether that was a live fetch of the primary source, and by whom. Two rows were read from Wayback mirrors rather than live — see //Response to G12// above. Three origins refuse automated fetchers and each needs a different workaround: ''eur-lex.europa.eu'' answers with an HTTP 202 AWS-WAF challenge (use CELLAR, below); ''ftc.gov'' and ''edps.europa.eu'' return **403** to a bare ''curl'' and **200** to the same request with a browser User-Agent; ''leginfo.legislature.ca.gov'' gates its normal pages behind JavaScript but serves ''printCodeSectionWindow.xhtml'' in the clear. A ''sonnet'' sub-agent ran the first pass; the load-bearing items were then re-fetched independently by the main agent, because the sub-agent had used Wayback mirrors for EUR-Lex (whose live HTML front end answers automated fetchers with an HTTP 202 AWS-WAF challenge). Independent re-fetch used the EU Publications Office **CELLAR** service, which serves the same authenticated XHTML with no challenge:

<code>
curl -sSL -H "Accept: application/xhtml+xml" -H "Accept-Language: eng" \
  http://publications.europa.eu/resource/celex/32016R0679   # GDPR
curl -sSL -H "Accept: application/xhtml+xml" -H "Accept-Language: eng" \
  http://publications.europa.eu/resource/celex/32025R2518   # GDPR procedural reg
curl -sSL http://publications.europa.eu/resource/cellar/149fe240-e92c-11ef-b5e9-01aa75ed71a1.0001.03/DOC_2
  # COM(2025) 45 final, annexes — Annex IV Withdrawals
</code>

^ Claim ^ Primary source ^ How verified ^ Verdict ^
| GDPR Art. 77(1): only a **data subject** may lodge; forum = residence / work / place of infringement | Reg. (EU) 2016/679 | CELLAR XHTML, re-fetched by main agent | confirmed, verbatim |
| Art. 78(2): judicial remedy if no handling or no information within **three months**; Art. 78(3) venue | same | same | confirmed, verbatim |
| Art. 80(1) mandate; **80(2) is a Member State option** | same | same | confirmed, verbatim |
| Art. 57(1)(f): duty to handle complaints | same | same | confirmed, verbatim |
| Art. 4(23), 56(1)–(6), 60(7)–(8): one-stop-shop mechanics, three-week decision, sole interlocutor, who notifies a dismissal | same | same | confirmed, verbatim |
| **One-stop-shop does not cover ePrivacy Art. 5(3)** | EDPB Opinion 5/2019 §§80, 90, 91 | PDF fetched directly and parsed with ''pypdf'' by the main agent | confirmed, verbatim |
| CNIL competent over Google despite Irish main establishment | Conseil d'État n° 449209 (28 Jan 2022); interim n° 449212 (4 Mar 2021) | fetched from ''conseil-etat.fr'' by the sub-agent; French text quoted verbatim on the page | confirmed |
| Reg. (EU) 2025/2518 adopted 26 Nov 2025, OJ 12.12.2025, **applies from 2 April 2027**; Art. 4 admissibility list; Art. 4(3) no prior-contact requirement; two-week inadmissibility deadline | Reg. (EU) 2025/2518 | CELLAR XHTML, re-fetched and re-read by main agent | confirmed, verbatim |
| ePrivacy Regulation proposal **withdrawn** | COM(2025) 45 final, 11.2.2025, Annex IV //Withdrawals//, item 29 (= COM(2017)10 final) | CELLAR, re-fetched by main agent — the sub-agent had this only from secondary reporting | confirmed, verbatim, upgraded from secondary |
| EDPS not competent for private companies | edps.europa.eu ''/private-organisation_en'' | sub-agent (Wayback; live origin 403s to curl) | confirmed |
| EDPB DPA directory URL | ''edpb.europa.eu/about-edpb/our-members_en'' | main agent: the old ''/about-edpb/about-edpb/members_en'' path returns **301** to this one | confirmed, URL corrected |
| DSA Arts. 40, 49, 53 | Reg. (EU) 2022/2065 | sub-agent (Wayback of EUR-Lex) | confirmed |
| DSA data-access delegated act adopted 2 July 2025; portal live | Commission digital-strategy news page; ''data-access.dsa.ec.europa.eu'' | sub-agent direct fetch; main agent re-checked the portal returns HTTP 200 | confirmed |
| CCPA 30-day cure period **removed** and still absent today | Cal. Civ. Code §§ 1798.155, 1798.199.90, both //Amended by Stats. 2025, Ch. 20 (AB 137), Effective June 30, 2025// | sub-agent via ''leginfo'' ''printCodeSectionWindow.xhtml'' (not behind the site's JS gate); full current text contains no cure language | confirmed |
| Amended COPPA Rule effective 23 June 2025, general compliance 22 April 2026 | 90 Fed. Reg. 16918 (22 Apr 2025) | sub-agent via GPO ''govinfo.gov'' (federalregister.gov blocked the fetch) | confirmed, verbatim |
| FTC intake ''reportfraud.ftc.gov''; OTech standing invitation on the PrivacyCon call page | ftc.gov | sub-agent direct fetch | confirmed |
| PrivacyCon still running in 2026? | ftc.gov | main agent: ''/2025/03/privacycon-2025'' → **404**; ''/2024/03/privacycon-2024'' → 200; the events index still calls PrivacyCon annual | **could not verify** — the page says so and tells the reader to check |
| CPPA and California OAG complaint forms; OAG "does not represent individual consumers" | cppa.ca.gov, oag.ca.gov | sub-agent direct fetch | confirmed, verbatim |
| noyb credits RUB and Utrecht/Inria research in its cookie-banner campaign | noyb.eu campaign page | sub-agent direct fetch | confirmed, verbatim |
| noyb accepts researcher submissions generally? | noyb.eu "About us", FAQ | sub-agent direct fetch: no submission channel documented | **could not verify** — the page says the route is a direct approach, not a form |
| DSA Art. 40 delegated act is **Commission Delegated Regulation (EU) 2025/2050** of 1 July 2025, OJ 9.10.2025, in force 29 Oct 2025 | Reg. (EU) 2025/2050 | CELLAR XHTML, fetched by main agent after the currency reviewer pointed out the page cited the act by date and not by number | confirmed, verbatim |
| **Digital Omnibus**: COM(2025) 837 final, 19.11.2025 — new GDPR Art. 88a moves terminal-equipment consent for personal data into the GDPR; ePrivacy Art. 5(3) gains a carve-out for natural persons' personal data | COM(2025) 837 final | CELLAR (''comnat/COM_2025_0837_FIN'' → DOC_1), fetched and read by main agent; both the explanatory memorandum and the enacting text quoted verbatim on the page | confirmed, verbatim |
| Digital Omnibus is a **proposal, not law**, as of 2026-08-18 | EP Legislative Observatory, procedure 2025/0360(COD) | fetched by main agent: status //"Awaiting committee decision"//; proposal published 19/11/2025; committee referral 19/01/2026; ITRE rapporteur appointed 25/02/2026 | confirmed |
| FTC **Office of Technology** (Feb 2023) supersedes the Office of Technology Research and Investigation named on the PrivacyCon call page | ftc.gov/office-technology | currency reviewer; main agent confirmed the URL returns 200 to a browser User-Agent | confirmed |
| EDPB Opinion 5/2019 PDF path moved | edpb.europa.eu | main agent: the ''/sites/default/files/...'' path 302-redirects to ''/system/files/documents/files/file1/...'' | confirmed, URL corrected |

==== Rejected, and why ====

  * **Every law-firm and vendor summary of the CCPA cure period.** The sub-agent's first pass had the repealed §1798.155(b) text only from IAPP / BCLP / TrueVault. That text is quoted on this provenance page as secondary and is **not** on the content page; what the content page asserts is the //current// statute, read in full, containing no cure language. A repeal is provable by the absence, which is checkable; the wording of the repealed text is not load-bearing.
  * **Secondary reporting of the ePrivacy Regulation withdrawal** (TechCrunch, Hunton, RPC). Replaced by the Commission's own Annex IV.
  * **Secondary reporting of DSA portal response latency** ("roughly 80 working days"). Not on the page: no primary source found, and a latency figure that cannot be sourced is exactly the kind of number a reader would repeat.
  * **''gdpr-info.eu''** and similar unofficial GDPR mirrors, considered as a workaround for the EUR-Lex WAF. Rejected in favour of CELLAR, which is the Publications Office's own service.
  * **EDPB Guidelines 2/2023 (technical scope of Art. 5(3)) and Opinion 08/2024 (consent-or-pay).** The currency reviewer flagged both as later EDPB guidance in the same space. Neither disturbs the §80/§91 holding on the cooperation mechanism, which is the only thing the page cites Opinion 5/2019 for. Adding them would have diluted the box with material the page does not rely on. Rejected, on the record.
  * **A named FTC contact person.** The PrivacyCon call page names an "Acting Chief" and carries 2016 dates. Naming a specific individual from a stale page would be wrong within a year and possibly already; the page points at the office and flags the staleness.

==== Not established ====

  * **Whether any of the fifteen filings produced an enforcement action.** Only one paper reports a regulator output ({[gamba2020_installed]}, the AEPD report). The rest are silent, and the corpus has no way to follow up. Closing this would need a survey of the authors, which is a different piece of work.
  * **Which Member States have enacted GDPR Art. 80(2)** (mandate-free representative complaints). The page states that it is a Member State option and does not list countries. Closing this needs 27 national statutes read; the sub-agent flagged it and it was not attempted.
  * **The Amazon cookie decision** (Conseil d'État, 27 June 2022, n° 451423) was found only in secondary sources and is not cited on the page; the Google decision, verified directly, carries the same reasoning and is sufficient.
  * **Whether the corpus's 5,859 papers include filings not written down.** A paper that filed and did not say so is invisible here, and the reporting rates on [[Practices:Notifying websites]] suggest under-reporting is the norm in this literature. Every count on the page is a count of //what papers say//.
  * **Whether the Digital Omnibus will be adopted, in what form, or when.** The page states the proposal, quotes it, and states its procedural status. It does not predict. The Council's own negotiating position on the cookie provisions was not fetched — only the Commission proposal and the Parliament's procedure file — so this page cannot say how the text has moved in Council.
  * **e-Evidence** (Reg. (EU) 2023/1543): flagged by the sub-agent as unchecked and judged out of scope — it is a cross-border criminal-evidence framework, not a route for a compliance finding.

===== Judgement calls =====

  - **A new page rather than broadening ''practices:notifying_websites''.** See //The run// above.
  - **''ePrivacy / cookie law'' as its own fold family**, not merged into EU data protection. The whole page turns on the two being enforced differently.
  - **Reporting ''regulatorContact'' figures at all**, given that the enum conflates DPAs with CERTs. Kept, because the trend and the population comparisons are meaningful even on a conflated signal, and because dropping it would leave only a 15-paper hand count with no denominator to sit against. Every table that uses it says what it conflates.
  - **Publishing the 12.0% → 5.4% decline with a Fisher test.** The split is post-hoc, chosen after seeing the five-window table, on small counts. It is reported with the //p//-value, labelled post-hoc in the footnote, and given a compositional explanation rather than a cultural one. A defensible alternative was to report the five windows and no test; that was rejected because a reader will do the comparison mentally anyway and deserves to know how weak it is. It is the page's only test, so no multiplicity correction applies — see [[Statistics:Pvalue corrections]] for why that matters.
  - **Counting ''planned'' separately from ''filed''.** Three papers say they will contact a regulator. Merging them would have made 18 filings out of 15; keeping them apart costs a row and is the difference between an act and an intention.
  - **Calling ''PETS/2023/usability-and-enforceability-of-global-privacy-control'' a filing.** It notified operators and told them the notice might trigger the CCPA cure period "to prepare potential enforcement actions by the OAG". It never wrote to the OAG. Coded ''filed'' with an explicit qualifier in the authority field, because the mechanism it used is a real route to enforcement and is the most instructive single design on the page — but a reasonable person would code it ''offtopic''.
  - **The ''collaboration'' role, invented for one paper.** ''USENIX/2024/the-effect-of-design-patterns-…'' was first coded off-topic ("cites a regulator guideline"). Re-reading it for the one-stop-shop query showed a CNIL co-author and a study commissioned to answer a CNIL question. One paper is a thin basis for a role; it was kept because the //route// it represents — a fellowship inside the authority — is real, has four corpus instances counted separately as author affiliations, and is advice a reader can act on.
  - **Telling readers not to copy {[zimmeck2023_gpc]}'s cure-period design.** The page contradicts a published, peer-reviewed method on the strength of a statutory reading. That is a strong claim; it rests on the current text of two code sections read in full, and the page shows its work.

===== Reviewer findings =====

Three focused reviewers ran in parallel against a frozen snapshot (''out/freeze/''), then the fixes below were applied, then a generic pass ran against the corrected page. **Which snapshot each pass saw matters**: reviewers 1–3 read the original freeze; reviewer 4 read the page after their fixes were applied but **before** S5 and S6 (the two framing-sentence corrections, found by the main agent while reviewer 4 was running), so anything reviewer 4 reports about those two sentences is a report on an already-corrected page. Rejections are listed as well as fixes: they are the only record of whether a reviewer is worth its slot.

==== Self-review, before the reviewers reported ====

^ # ^ Finding ^ Action ^
| S1 | ''Privacy Act of 1974'' folded into //Non-EU/US data protection law// | fixed, exception added (see //The law fold//) |
| S2 | ''Impressumspflicht'' folded into //EU data protection// | fixed, exception added |
| S3 | ''Internet Security Law'' sits in //Computer-crime// rather than //Non-EU/US DP// | left, and recorded: the string is ambiguous between China's Cybersecurity Law and a generic phrase |
| S4 | Section F of the report was hardcoded prose, not computed | fixed: it now runs the sweep and exits 1 if the hand map falls behind it |
| S5 | The page explained the falling regulator-contact rate as a **venue-mix effect**, unmeasured. Measuring it kills it: PoPETs' share of these papers //rose// 21.7% → 32.3%, and the rate fell inside both strata (PoPETs 16.7% → 6.7%, elsewhere 10.8% → 4.8%). | fixed: the explanation is removed, the stratified figures are on the page, and the page now says it has no explanation. The check is in the report so it cannot be re-asserted silently. |
| S6 | The page asserted the filings "cluster in two research groups" and that "the other seven share no author with each other". **Both wrong.** ''moti2024_targeted'' joins the large component through Acar, and ''iqbal2023_tracking'' / ''yeung2023_online'' share two authors. | fixed: ''scripts/le_authors.mjs'' computes connected components from the shipped BibTeX — 7 components, 11 papers in three multi-paper components, 4 singletons — and the page states that instead |

| S7 | The //Elsewhere// section still said "27 corpus papers assess a non-EU, non-US data protection law" after the fold fix moved it to 26. ''check_page_numbers.mjs'' passed it because 27 appears elsewhere in the report as the ePrivacy row. | fixed — and it is the **second** number on this page to survive the numeric guard by colliding with an unrelated value (see F2). Two in one page is a measured limit of that guard, not bad luck: it matches on presence of the digits anywhere in the report, so any figure whose value also occurs as something else is unprotected |
| S8 | The example national transposition was written as "§ 25 TTDSG". The German statute was renamed **TDDDG** in 2024; the section number is unchanged. | fixed, and turned into an example of the page's own advice to date a legal analysis |

S5 and S6 are the same failure as F2 in a different costume: a framing sentence that reads as scene-setting, is never measured, and is false. Three of the four self-findings and one of the reviewer's four WRONGs were of this kind. On this page the rule "re-derive your own framing sentences, not only your tables" cost four corrections.

The figures reviewer independently found S2 and S4. It did not find S1 (a one-paper move in a row it was not asked to audit). S3 it did not raise.

==== Reviewer 1 — figures against the script (sonnet) ====

Re-ran all five scripts, re-implemented Fisher's exact independently (p ≈ 0.04716, matching), dumped all 186 law strings by family, reproduced two regex sweeps from scratch, and diffed all four embedded ''%%<file>%%'' blocks. Checked "well over 250 individual figures".

^ # ^ Finding ^ Severity ^ Verdict ^
| F1 | //"Every one of the fifteen also notified the affected party directly"// — the report says ''partial'' 7, ''yes'' 7, **''no'' 1**. {[feal2020_angel]} took its findings to the AEPD and INCIBE and to nobody else. | WRONG | **accepted** — the sentence now says fourteen of fifteen and names the exception |
| F2 | //"75% of the corpus stops there"// in the reporting checklist appears nowhere in the report. It was carried over from a **different population** on [[Practices:Notifying websites]] (75.6% of the 2,160 papers that said they notified give no channel). ''check_page_numbers.mjs'' passed it because the digits "75" appear in the report as an unrelated raw count. | WRONG | **accepted** — replaced with a figure this page's own report computes (15 of 2,870, 0.5%) |
| F3 | The one-stop-shop sweep count (35) was not produced by any code; the regex as quoted reproduces 23. | WRONG | **accepted** — see S4. Section F is computed, the regex printed is the regex run, and the count is 37 |
| F4 | The enforcement-outcome sweep regex was **paraphrased**; the paraphrase returns 211, not the quoted 108. | WRONG | **accepted** — the real regex is now printed in full |
| F5 | ''Impressumspflicht'' misclassified; moves the headline row 290 → 289 | MISLEADING | **accepted** (= S2) |
| F6 | The residue table had a malformed 8th row: ''Air Navigation Order 2016'' listed twice, the second time carrying a gloss for all seven strings | MISLEADING | **accepted** — gloss moved to prose |
| F7 | Bare ''\bcpa\b'' in the US-state family would swallow a future "Consumer Protection Act" | NIT | **accepted** — spelled out |
| F8 | ''REVIEW_LOG_PLACEHOLDER'' unreplaced | NIT | **accepted** — you are reading its replacement |
| F9 | //US federal consumer-protection / FTC// also matches ''\bfcc\b'' and the Anti-Cybersquatting Consumer Protection Act | NIT | **accepted** — family renamed //US federal consumer protection and sector regulators (FTC, FCC)// |

F1 and F2 are the two that mattered: both are claims that were individually plausible, survived the numeric guard, and were false. F2 in particular is the exact failure mode ''check_page_numbers.mjs'' is meant to catch and structurally cannot — a percentage whose digits happen to appear elsewhere in the report as something else.

==== Reviewer 2 — citations and quotes (sonnet) ====

Verified all 25 new BibTeX entries against Crossref or the venue landing page, re-checked ~15 of the 34 quotes independently, read the affiliation blocks of the four regulator-affiliated papers, and re-derived the Saemann arithmetic.

^ # ^ Finding ^ Severity ^ Verdict ^
| C1 | ''zanella2023_characterizing'': author mis-split as ''Nogueras, Antonio Bazco''. The byline and Crossref both give **Bazco-Nogueras, Antonio** — a hyphenated surname. | WRONG | **accepted** — fixed |
| C2 | ''murdoch2010_chip'' printed "Anderson, Ross J."; the paper's byline says "Ross Anderson" | NIT | **accepted** — matched to the paper |
| C3 | Two quotes silently truncated mid-sentence (California OAG; the {[vlummens2026_bridges]} outcomes sentence) | NIT | **accepted** — both extended to the full sentence |
| C4 | The noyb source itself reads "Utrech University"; the page silently corrected it | NIT | **accepted** — now quoted as ''Utrech[t]'' with a footnote |

It confirmed, against the sources: that {[bielova2024_designpatterns]} is the only one-stop-shop paper and has a CNIL co-author with the lead author a CNIL fellow; the AEPD-report sentence in {[gamba2020_installed]}; that {[vlummens2026_bridges]} really does **not** attribute its outcomes to the DPA filings specifically, so the page's careful phrasing is fair; the {[utz2023_rarely]} research-privilege sentence; every Saemann and Sun figure; and all four regulator affiliations. No fabricated quote, no colliding key, no wrong venue or year, no "et al." mismatch.

It did **not** re-fetch GDPR Arts. 56(2)/56(3)/57(1)(f)/60(7)/60(8), the CNIL deliberation number, or the two CJEU case numbers, and said so.

==== Reviewer 3 — external currency (sonnet) ====

Fetched every external URL and every statute afresh.

^ # ^ Finding ^ Severity ^ Verdict ^
| E1 | The page omits the **Digital Omnibus**, a live legislative proposal that would move terminal-equipment consent into the GDPR and therefore into the one-stop-shop — reversing the page's central claim — while devoting a box to a less urgent development | MISLEADING | **accepted, and it is the most valuable finding of the whole review.** Re-verified from primary sources by the main agent (COM(2025) 837 final via CELLAR, procedure status via the EP Legislative Observatory) and given its own box |
| E2 | The FTC's Office of Technology Research and Investigation was superseded by the **Office of Technology** in February 2023; the page hedged only the stale dates, not the stale organisation | MISLEADING | **accepted** — footnote rewritten |
| E3 | The DSA Art. 40 delegated act was cited by date, never by number | NIT | **accepted** — Commission Delegated Regulation (EU) 2025/2050 added, verified via CELLAR |
| E4 | EDPB Opinion 5/2019 PDF 302-redirects; EDPB has since issued Guidelines 2/2023 and Opinion 08/2024 in the same space | NIT | **accepted in part** — URL corrected; the later guidance **rejected**, see //Rejected, and why// |
| E5 | ''edps.europa.eu'' and ''ftc.gov'' 403 a bare curl and 200 a browser User-Agent | NIT | **accepted** as a provenance note |

Everything else it checked came back confirmed: GDPR unamended for every cited article, ePrivacy Directive still in force, Reg. 2025/2518 verbatim, COM(2025) 45 Annex IV item 29, Conseil d'État still standing with no later CJEU judgment disturbing it, the California code sections with no cure language and AB 137 as the latest amendment, COPPA in force, no PrivacyCon since 2024, and every remaining URL live. It supplied a full URL/status table.

**E1 is the case for running a currency pass that fetches rather than recalls.** The other two reviewers read the same box and neither asked whether the law it states was about to change; nothing in a figures check or a citation check would surface a pending proposal.

==== Reviewer 4 — generic (fable) ====

Read the page **after** reviewers 1–3's fixes were applied but **before** S5–S8. It re-ran the report scripts, independently re-derived the two framing claims, and compared against the live sibling page.

^ # ^ Finding ^ Severity ^ Verdict ^
| G1 | //"what the other 162 violation-finding papers omit"// — 177 − 15 treats every filer as a violation-finder. Only **7** of the 15 are; the page says so three screens earlier. The count is **170**. | WRONG | **accepted** — corrected, and the report now prints 170 with a note naming the wrong subtraction |
| G2 | The venue-mix explanation is wrong | WRONG | already fixed as S5; the reviewer re-derived it independently and went further: standardising 2018–21 within-venue rates to the 2022–26 venue mix predicts **13.5%**, //above// the 12.0% baseline, because composition shifted //toward// the highest-rate venue. The fix was verified correct. |
| G3 | The two-groups clustering claim is wrong | WRONG | already fixed as S6; verified correct against the shipped BibTeX |
| G4 | Internal contradiction: the methodology says //"higher than fifteen, not lower"//, but the page's own table and this log both concede {[zimmeck2023_gpc]} could be coded off-topic — and "the remaining ten say only that they filed" includes a paper that did not file | WRONG | **accepted** — the methodology now says recall and coding generosity cut in opposite directions and reads the number as "about fifteen, of which fourteen are unambiguous"; the outcomes list separates {[zimmeck2023_gpc]} out |
| G5 | **Section F's guard did not exist.** the lookup fell back to ''OSS_DEFAULT'' with a logical-or, so it silently defaulted an unread sweep hit to ''homograph'' while the report printed //"the report fails if a hit has no verdict"//. The reverse direction was guarded; this one was not. A logical-or fallback is also exactly what this repo's fail-loud rules forbid. | WRONG | **accepted, and it is the worst finding of the four passes** — a repair (S4) that was itself broken, inside the audit trail, described in code comments as doing the thing it did not do. All 37 verdicts are now enumerated in ''OSS_MAP'', there is no default, and the report exits 1 in both directions. |
| G6 | //"15 (0.5%) name a privacy or consumer-protection regulator"// — the regex ended in a bare ''\bregulator'', so it caught a //bank// regulator and a paper that says "regulatory mitigations" and names nobody | MISLEADING | **accepted** — split into ''NAMED_AUTH'' (12, the published figure) and the looser count (15), both printed, each string tagged |
| G7 | //"Only 27 papers name the ePrivacy Directive"// — 26 do; the 27th is in the family via "GPDP guidelines on cookies" | WRONG | **accepted** — the report now prints both counts and names the extra string |
| G8 | //"the corpus ends before the portal opened"// is false (the corpus runs to 2026; the portal opened October 2025), and no sweep backed //"no paper uses it"// | WRONG (justification) | **accepted** — the reviewer ran the sweep and found the claim true anyway; it is now section F2 of the report, with the seven hits and why each is a false positive, and the page's justification is corrected |
| G9 | The page's headline says a cookie finding goes outside the one-stop-shop, then never explains **how an ePrivacy filing works** — that the competent body is designated nationally and is not always the DPA, that Art. 77 standing is GDPR-only, and that Reg. 2025/2518's admissibility list does not reach ePrivacy | MISLEADING (gap) | **accepted, and it is the most useful finding for the reader** — a new subsection //EU: the ePrivacy complaint, which is a different thing// was added, sourced to EDPB Opinion 5/2019 §§64 and 90, plus a caveat on the checklist |
| G10 | 385 here vs 376 on the sibling page, same numerator, unflagged | NIT | **accepted** — footnoted, and both denominators are now computed in the report |
| G11 | //"found thousands of violations"// is measured nowhere; //"only a data subject can lodge"// is contradicted by the page's own Art. 80(2) paragraph | NIT | **accepted** — both softened |
| G12 | Provenance overstatements: the blanket //"every external claim … fetched from a primary source"// against a table that says two were read from Wayback; //"re-ran all five scripts"// when nine are listed; the unreplaced ''GENERIC_REVIEW_PLACEHOLDER'' | NIT | **accepted** — see below |
| G13 | "sixteen years" for 2010–2026; E2 mixes denominators at one indent level; ''partial'' counted as direct notification without saying so; //"exactly one paper in the corpus"// is sweep-bounded but stated as a census | NIT | **all accepted** — "seventeen publication years"; the E2 rows now name their own denominators; ''partial'' is spelled out; the claim is now //"a corpus-wide sweep surfaces exactly one paper"// |

Nothing was rejected. That is unusual and worth saying plainly: the generic pass found more real defects than any of the three focused passes, including two — G5 and G9 — that no focused pass could have found, because one is a lie a script tells about itself and the other is an absence. The repo's standing advice ("run the generic review pass, do not argue yourself out of it") held again.

===== Response to G12: what this page overstated about itself =====

  * The blanket sentence //"Every external claim on the page was fetched from a primary source on 2026-08-18"// is **withdrawn**. It was false in two places its own table already disclosed. The EDPS //Private organisation// page and the DSA articles were read from Wayback mirrors by the sub-agent; ''edps.europa.eu'' in fact serves 200 to a browser User-Agent, so that one had no excuse. The section now says what is true per row and nothing more.
  * Reviewer 1 re-ran **five** scripts: ''report_legal_enforcement.mjs'' (with and without ''%%--list%%''), ''verify_legal_figures.mjs'', ''le_quotecheck.mjs'' and ''check_tables.mjs''. ''le_authors.mjs'' did not exist when it ran; ''dpa_sweep.mjs'', ''dpa_candidates.mjs'', ''dpa_context.mjs'', ''law_fold.mjs'' and ''enforce_map.mjs'' are modules it read and re-implemented rather than executed as commands.
  * The placeholder was unreplaced in the frozen snapshot the reviewer read, by construction — the log cannot be written before the review. It is replaced here.

===== Who filed, as a graph =====

''scripts/le_authors.mjs''. The page's clustering claim, computed rather than asserted: connected components over the fifteen ''filed'' papers, edge wherever two share an author surname (diacritics folded, because Vallina-Rodriguez appears both with and without the accent across venues). Author lists are read from the BibTeX that ships with the page, so a reader can check the input.

<file text le_authors.txt>
15 'filed' papers -> 7 connected author components

[7] linked by: vallina-rodriguez (6), reardon (3), tapiador (3), feal (2), zuiderveen borgesius (2), acar (2), girish (2), matic (2), weerasekara (2)
    gamba2020_installed
    moti2024_targeted
    feal2020_angel
    weerasekara2025_webviews
    girish2025_signal
    reardon2019_50ways
    vlummens2026_bridges
[2] linked by: zimmeck (2), wang (2)
    zimmeck2019_maps
    zimmeck2023_gpc
[2] linked by: iqbal (2), roesner (2)
    iqbal2023_tracking
    yeung2023_online
[1] singleton
    cheng2020_dangerous
[1] singleton
    arunasalam2024_dark
[1] singleton
    murdoch2010_chip
[1] singleton
    zhang2025_qrcode

in a multi-paper component: 11; singletons: 4
</file>

===== The hand-coded map in full =====

<file text enforce_map_listing.txt>
## G. The hand-coded map in full


--- filed ---
CCS/2020/dangerous-skills-got-certified-measuring-the-trustworthiness-of-skill-certificat
  authority: US Federal Trade Commission
  quote: We also shared our results to Federal Trade Commission (FTC) researchers and received recognition from them.
IEEE-SP/2010/chip-and-pin-is-broken
  authority: bank regulators, UK / Europe / North America
  quote: We have therefore decided on a policy of responsible disclosure, of publishing this paper some time after informing bank regulators in the UK, Europe and North America of the vulnerability.
IEEE-SP/2020/an-analysis-of-pre-installed-android-software
  authority: Agencia Española de Protección de Datos (AEPD)
  quote: Our work was also the basis of a report produced by the Spanish Data Protection Agency (AEPD) [3].
IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites
  authority: an unnamed European DPA and a consumer protection agency
  quote: In addition, we shared our preliminary results with a European data protection agency (DPA), and a consumer protection agency.
IMC/2023/tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
  authority: US Federal Trade Commission (public forum)
  quote: We have also shared our findings in a public forum at the Federal Trade Commission (FTC) [44].
NDSS/2024/the-dark-side-of-e-commerce-dropshipping-abuse-as-a-business-model
  authority: US Federal Trade Commission
  quote: We shared the report with 10 e-commerce platforms2 and the Federal Trade Commission (FTC) via relevant channels.
PETS/2019/maps-scaling-privacy-compliance-analysis-to-a-million-apps
  authority: FTC (unnamed "regulators")
  quote: We notified regulators of some of our findings (§ 6), and performed a pilot study with a large European electronic device manufacturer (§ 7).
PETS/2020/angel-or-devil-a-privacy-study-of-mobile-parental-control-apps
  authority: AEPD and INCIBE (IS4K), Spain
  quote: We communicated our findings to the Spanish National Data Protection Agency (AEPD) and other government agencies promoting Internet safety, namely INCIBE's IS4K [1].
PETS/2023/usability-and-enforceability-of-global-privacy-control
  authority: California OAG, invoked rather than contacted
  quote: We made clear that our email may serve as a notice for triggering the 30-day cure period per the CCPA to prepare potential enforcement actions by the OAG.
PETS/2025/tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we
  authority: EDPS, CNIL
  quote: We reported our results to the European Data Protection Supervisor (EDPS) and CNIL.
PETS/2025/your-signal-their-data-an-empirical-privacy-analysis-of-wireless-scanning-sdks-i
  authority: EDPS, AEPD, CNIL
  quote: We shared a preprint of this paper with Google as operator of the Android platform, and with the European Data Protection Supervisor (EDPS), the Spanish Data Protection Agency (AEPD), and the French National Commission on Informatics and Liberty (CNIL).
USENIX/2019/50-ways-to-leak-your-data-an-exploration-of-apps-circumvention-of-the-android-pe
  authority: US Federal Trade Commission
  quote: We found a number of side and covert channels in active use, responsibly disclosed our findings to Google and the U.S. Federal Trade Commission (FTC), and received a bug bounty for our efforts.
USENIX/2025/demystifying-the-in-security-of-qr-code-based-login-in-real-world-deployments
  authority: unnamed ("regulators")
  quote: We responsibly report these vulnerabilities to the developers and regulators.
USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
  authority: EU- and US-based data protection authorities
  quote: After confirming the behavior across other browsers, we extended disclosure to Mozilla, Brave, DuckDuckGo, Microsoft Edge, WebKit, and to EU- and US-based data protection authorities.
WWW/2023/online-advertising-in-ukraine-and-russia-during-the-2022-russian-invasion
  authority: US Federal Trade Commission
  quote: We have reported suspicious humanitarian donation ads to the social media platforms that host their public facing pages, i.e., Facebook and Paypal, and regulatory authorities, i.e., Federal Trade Commission, for further investigation and validation.

--- planned ---
IMC/2023/in-the-room-where-it-happens-characterizing-local-communication-and-threats-in-s
  authority: regulators in relevant jurisdictions
  quote: In addition, we are in the process of disclosing the potential privacy violations found in this study to regulators in relevant jurisdictions.
PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
  authority: local Data Protection Authority (Italy)
  quote: Finally, we are improving CookieCheck to include further checks, and we are contacting local Data Protection Authority to present our findings, hoping this will lead to a first step to find a remedy
PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
  authority: EDPB, data protection regulators, IAB Europe
  quote: We also plan to share our results with the European Data Protection Board, data protection regulators, as well as with IAB Europe.

--- authorised ---
IMC/2023/characterizing-and-modeling-session-level-mobile-traffic-demands-from-large-scal
  authority: CNIL
  quote: The data collection and processing was approved by the Data Protection Officer (DPO) of the operator, and authorized by the French National Commission on Informatics and Liberty (CNIL)
IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s
  authority: partner's regulatory authority (unnamed)
  quote: our research has been authorized and supervised by the network management department and regulatory authority of our partner.
PETS/2016/students-and-taxes-a-privacy-preserving-study-using-secure-computation
  authority: Estonian Data Protection Inspectorate
  quote: After reviewing our application to process personal data during the study in encrypted form the Data Protection Inspectorate indicated that we did not require a permission to process personal data.
WWW/2019/urban-vibes-and-rural-charms-analysis-of-geographic-diversity-in-mobile-service
  authority: CNIL
  quote: data collection occurred in compliance with regulations in force, and was approved by the French national authority for data privacy (CNIL).

--- subject ---
PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part
  authority: the authors' state data protection authority (Germany)
  quote: Despite these efforts, one recipient filed a complaint with our state's data protection authority, upon which we immediately stopped recruitment via GitHub, rather than waiting for the outcome.

--- declined ---
USENIX/2021/share-first-ask-later-or-never-studying-violations-of-gdprs-explicit-consent-in
  authority: regulators, Google
  quote: Since disclosing the findings to authorities (e.g., regulators, Google) might cause financial harm to developers, we consciously decided not to involve authorities but rather notify developers directly to remedy compliance issues.

--- corpus ---
PETS/2022/investigating-gdpr-fines-in-the-light-of-data-flows
  authority: EU DPAs (fine decisions)
PETS/2023/gdprxiv-establishing-the-state-of-the-art-in-gdpr-enforcement
  authority: DPAs, EDPB, courts, EU Parliament
USENIX/2025/privacy-law-enforcement-under-centralized-governance-a-qualitative-analysis-of-f
  authority: Chinese central authorities (SPRCs)

--- off-topic ---

[homograph — "regulator" is a hardware component]
  CCS/2019/voltjockey-breaching-trustzone-by-software-controlled-voltage-manipulation-over
  IEEE-SP/2022/surakav-generating-realistic-traces-for-a-strong-website-fingerprinting-defense
  NDSS/2025/powerradio-manipulate-sensor-measurement-via-power-gnd-radiation

[column-splice artefact — "de-/fined by", "self-reported"]
  CCS/2022/characterizing-and-detecting-non-consensual-photo-sharing-on-social-networks
  USENIX/2013/on-the-security-of-picture-gesture-authentication
  WWW/2019/before-and-after-gdpr-the-changes-in-third-party-presence-at-public-and-private
  WWW/2021/privacy-policies-over-time-curation-and-analysis-of-a-million-document-dataset

[regulator as an abstract audience or recommendation, no contact]
  CCS/2019/watching-you-watch-the-tracking-ecosystem-of-over-the-top-tv-streaming-devices
  CCS/2025/automatically-detecting-online-deceptive-patterns
  CCS/2025/is-this-a-scam-the-nature-and-quality-of-reddit-discussion-about-scams
  IEEE-SP/2022/desperate-times-call-for-desperate-measures-user-concerns-with-mobile-loan-apps
  IEEE-SP/2026/banshee-target-switch-attacks-on-gimbal-stabilized-visual-tracking-systems-via-a
  IEEE-SP/2026/consumer-beware-exploring-data-brokers-ccpa-compliance
  IMC/2024/diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc
  IMC/2024/the-age-of-ddoscovery-an-empirical-comparison-of-industry-and-academic-ddos-asse
  IMC/2025/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
  NDSS/2024/leaking-the-privacy-of-groups-and-more-understanding-privacy-risks-of-cross-app-content-sharing-in-mobile-ecosystem
  NDSS/2025/where-are-we-on-cyber-a-qualitative-study-on-boards-cybersecurity-risk-decision-making
  PETS/2019/monte-carlo-and-reconstruction-membership-inference-attacks-against-generative-m
  PETS/2021/data-portability-between-online-services-an-empirical-analysis-on-the-effectiven
  PETS/2022/disparate-vulnerability-to-membership-inference-attacks
  PETS/2022/setting-the-bar-low-are-websites-complying-with-the-minimum-requirements-of-the
  PETS/2023/trust-tee-exploring-the-impact-of-trusted-execution-environments-on-smart-home-p
  PETS/2024/the-devil-is-in-the-details-detection-measurement-and-lawfulness-of-server-side
  PETS/2025/johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
  USENIX/2019/evaluating-the-contextual-integrity-of-privacy-regulation-parents-iot-toy-privac
  USENIX/2023/bug-hunters-perspectives-on-the-challenges-and-benefits-of-the-bug-bounty-ecosys
  USENIX/2023/diving-into-robocall-content-with-snorcall
  USENIX/2024/unpacking-privacy-labels-a-measurement-and-developer-perspective-on-googles-data
  USENIX/2025/websites-global-privacy-control-compliance-at-scale-and-over-time
  WWW/2021/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
  WWW/2024/a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework

[cites a regulator document, decision or guideline; no contact]
  CCS/2016/over-the-top-bypass-study-of-a-recent-telephony-fraud
  CCS/2019/network-hygiene-incentives-and-regulation-deployment-of-source-address-validatio
  CCS/2020/deploying-android-security-updates-an-extensive-study-involving-manufacturers-ca
  CCS/2023/marketing-to-children-through-online-targeted-advertising-targeting-mechanisms-a
  CCS/2025/the-challenges-and-opportunities-with-cybersecurity-regulations-a-case-study-of
  IEEE-SP/2014/cloak-and-swagger-understanding-data-sensitivity-through-the-lens-of-user-anonym
  IEEE-SP/2020/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
  IEEE-SP/2022/investigating-influencer-vpn-ads-on-youtube
  IEEE-SP/2025/blind-users-really-do-heed-aural-telephone-scam-warnings
  IEEE-SP/2025/characterizing-robocalls-with-multiple-vantage-points
  IEEE-SP/2025/gdpr-in-the-small-a-field-study-of-privacy-and-security-challenges-in-schools
  IEEE-SP/2025/why-would-money-protect-me-from-cyber-bullying-a-mixed-methods-study-of-personal
  IEEE-SP/2026/setting-the-course-but-forgetting-to-steer-analyzing-compliance-with-gdprs-right
  NDSS/2015/phoneypot-data-driven-understanding-of-telephony-threats
  NDSS/2017/automated-analysis-of-privacy-requirements-for-mobile-apps
  NDSS/2025/policypulse-precision-semantic-role-extraction-for-enhanced-privacy-policy-comprehension
  PETS/2018/privacy-preserving-wi-fi-analytics
  PETS/2020/an-analysis-of-the-current-state-of-the-consumer-credit-reporting-system-in-chin
  PETS/2020/multiple-purposes-multiple-problems-a-user-study-of-consent-dialogs-after-gdpr
  PETS/2022/on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
  PETS/2023/senrev-measurement-of-personal-information-disclosure-in-online-health-communiti
  PETS/2025/empirically-measuring-data-localization-in-the-eu
  PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
  PETS/2026/overcoming-language-barriers-multilingual-analysis-of-the-2023-swiss-privacy-law
  PETS/2026/the-role-of-online-forums-in-developer-understanding-of-privacy-law-a-reddit-cas
  USENIX/2016/protecting-privacy-of-ble-device-users
  USENIX/2019/users-really-do-answer-telephone-scams
  USENIX/2020/actions-speak-louder-than-words-entity-sensitive-privacy-policy-and-data-flow-an
  USENIX/2022/caring-about-sharing-user-perceptions-of-multiparty-data-sharing
  USENIX/2023/the-writing-on-the-wall-and-3d-digital-twins-personal-information-in-not-so-priv
  USENIX/2024/automated-large-scale-analysis-of-cookie-notice-compliance
  WWW/2022/fairness-audit-of-machine-learning-models-with-confidential-computing
  WWW/2026/does-ad-free-mean-less-data-collection-an-empirical-study-of-platform-data-pract

[the DPA reference is in the study's own consent form or an interview recruitment, not a filing]
  USENIX/2023/anatomy-of-a-high-profile-data-breach-dissecting-the-aftermath-of-a-crypto-walle
  USENIX/2023/examining-power-dynamics-and-user-privacy-in-smart-technology-use-among-jordania
</file>

===== Related =====

  * **[[Practices:Legal enforcement]]** — the page this log is for.
  * [[Literature:Corpus]] — corpus-wide provenance: venues, funnel, the provisional 2025–2026 slice, the duplicate records and the posters.
  * [[provenance:practices:notifying_websites]] — the sibling log; the 91.8% cross-reference is recomputed independently in both.

====== References ======
<bibtex bibliography></bibtex>

===== Markup sweep, 2026-09-17 =====

Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.