Working notes behind consent — every query with its population and its denominator, the scripts and their unedited output, the folds and their residue, the figures checked against the source papers, the external sources and how each was verified, and what could not be established. Corpus-level caveats that apply to every page on this site are on corpus and are not restated here.

Create, extend or overlap? This is a rewrite. privacy:consent existed at 2,748 bytes and was explicitly labelled brainstorm notes: a <wrap todo> box and two bullet lists of topics to cover. Every topic it listed is now covered somewhere — notice detection and the Consent-O-Matic/autoconsent/IDCAC family, ML classification of consent choices, GPC, DNT, opt-out links. Nothing was deleted that carried information; the two citations the stub used ([1Khandelwal, Rishabh; Nayak, Asmit; Harkous, Hamza; Fawaz, Kassem (2023): "Automated Cookie Notice Analysis and Enforcement", in: 32nd USENIX Security Symposium (USENIX Security 23), pp. 1109-1126. USENIX Association, Anaheim, CA. (Link)] and [2Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: Proceedings of the USENIX Security Symposium, pp. 1723-1739. (Link)]) are both still cited.

The overlap that mattered, and how it was resolved. requests already carries a section called Cookie Notices and Their Interactive Elements which covers detecting the notice and labelling its buttons, with a comparison table of detectors, and which explicitly says “What the notice means legally, and what to do about consent, is on consent”. That division was kept rather than re-litigated. This page therefore does not repeat the detector comparison; it starts one step later, at “you have found the banner, now what do you do with it”. The judgement call and the alternative are in §10.

Two handles, because they answer different questions and only partly overlap.

S1 is an enum and is published as percentages. crawlConfig.consentAction is in the schema's most stable band: an independent extraction run over the same 100 papers agreed with it on 93%. That figure was measured on the earlier 4,322-paper corpus and has not been re-measured on this one; it is quoted on the content page with that caveat attached.

S2 is a judgement and is published as counts and rankings, never as a share of the corpus. No field in the extraction means “is about consent”. The construction is below in full.

A paper enters the raw candidate set if any of these fields contains a match for the CORE regex in report_consent.mjs:

• classification[].resourceName
• classification[].targetDetail
• detection[].phenomenon
• legal[].whatWasAssessed
• tools[].name and otherToolsMentioned[].name

or if any classification[] tuple has target == “consent-notice”.

The regex deliberately does not match a bare consent. In this corpus a bare “consent” is overwhelmingly research-ethics informed consent — “Consent, data handling, storage, and publication of interview data”, “Consent and anonymous research-data collection” — which is a different page's subject. It matches compound terms only: cookie bann*, consent notice, consent dialog, before consent, without consent, consent revocation, named CMPs, named tools, \btcf\b, \bcmp\b, \bgpc\b, \bdnt\b, opt-out and so on. The full alternation list is the CORE constant in the script.

classification.target == “consent-notice” fires on 39 papers. The hand audit keeps 24 of them. The 15 it drops are not marginal calls — they are the enum firing on things that are not consent artefacts at all: cryptomining opt-in notices (two 2018 papers and OUTGUARD), Twitter misinformation labels, GPTzero output, taint-style vulnerability detection, ad-disclosure keywords, login/registration form heuristics, LlamaGuard safety labels, and privacy-policy rule checking. Using the enum as the population would have made a 38% error rate invisible.

In the other direction the enum misses most of the field: of the 72 papers in S2, only 24 carry the enum at all. Papers that measure GPC compliance, opt-out links, TCF string contents or pre-consent tracking classify something, but not “a consent notice”.

28 of the 100 raw candidates were excluded, each with a recorded reason. This list is the part of the population definition most worth disagreeing with, which is why it is printed here rather than left in a script.

One key in that list (IMC/2025/cookieguard-…) no longer matches the sweep at all: an earlier draft of consent_fold.mjs had cookieguard in the candidate vocabulary, which was wrong — CookieGuard is a first-party-cookie-jar isolation defence, not a consent tool. The key is kept in the exclusion map and the script marks it ? rather than x so the record of the decision survives.

Borderline calls that were kept, and would be reasonable to drop:

• NDSS/2021/your-phone-is-my-proxy — measures user understanding of proxy-SDK consent dialogs. A consent dialog, but not a tracking-consent one.
• IMC/2024/watching-tv-with-the-second-party and NDSS/2023/i-still-know-what-you-watched-last-sunday — smart-TV opt-out and pre-consent tracking. Not the web, but the same measurement.
• PETS/2022/atom-ad-network-tomography — kept because its consent decision was to exclude sites with banners from the sample, which is itself a consent-handling choice worth having in the population.
• IMC/2025/an-in-depth-investigation-of-data-collection-in-llm-app-ecosystems — measures availability of opt-out controls in LLM app ecosystems.

Borderline calls that were dropped, and would be reasonable to keep:

• CCS/2023/policychecker and the COPPA/parental-consent papers — they assess whether consent was obtained, but measure no consent mechanism.
• IEEE-SP/2025/analyzing-the-ios-local-network-permission — an OS permission rationale is arguably the mobile analogue of a consent notice.

Moving every borderline paper the other way changes S2 by about ±6 papers, i.e. under 10%. No figure on the content page turns on it, because S2 is only ever reported as counts and rankings.

cd /workspace/artifacts/wiki
node scripts/report_consent.mjs                # the numbers, with denominators
node scripts/report_consent.mjs --wiki         # the same, as DokuWiki tables
node scripts/consent_quotecheck.mjs            # every published literal vs the source PDFs

node scripts/consent_action_audit.mjs                    # the 36 interacting papers
node scripts/consent_action_noninteraction_audit.mjs     # the 313 no-interaction papers
node scripts/consent_action_noninteraction_audit.mjs --evidence  # per-paper consent sentences
node scripts/consent_action_noninteraction_audit.mjs --probes    # the two recall probes
node scripts/consent_ni_quotecheck.mjs --mutate          # verdict quotes + mutation self-test
python3 scripts/consent_ni_significance.py               # Fisher's exact on the year buckets

Both scripts resolve the dataset through scripts/lib.mjs → dataRoot(), so they work whether the mount root is /workspace/publications_dataset or /workspace/publications_dataset/data.

corpus: 5859 papers, 7 venues, 2010-2026
2025 and 2026 are provisional venue-years (see literature:corpus).

── S1. Consent action, of every paper that ran an automated web crawl ──
population 'crawled' (crawlConfig present OR studyTypes includes automated-web-crawl): 1120
of those, a crawlConfig object was extracted for: 1080
Value                  Papers  Share of 1120  Sentinel?
---------------------  ------  -------------  -------------------
no-interaction         313     27.9%
accept-all             15      1.3%
accept-and-reject      14      1.3%
reject-all             2       0.2%
dismiss-or-remove      3       0.3%
cmp-specific-choices   2       0.2%
not-stated             495     44.2%          YES — not an answer
not-applicable         236     21.1%          YES — not an answer
no-crawlConfig-object  40      3.6%           YES — not an answer

STATED a consent action: 349 of 1120 (31.2%)
Of the 349 that state one, 36 (10.3%) actually touched the notice;
the other 313 (89.7%) state that they did not.
Papers in the whole corpus that state a consent action other than no-interaction: 36

── S1b. Is the reporting gap closing? consent action stated, by year bucket ──
Bucket      Crawling papers  State an action  Share  Actually interacted  Share
----------  ---------------  ---------------  -----  -------------------  -----
2010–2013   102              25               24.5%  0                    0.0%
2014–2017   167              50               29.9%  0                    0.0%
2018–2021   308              99               32.1%  6                    1.9%
2022–2024   345              116              33.6%  17                   4.9%
2025–2026*  198              59               29.8%  13                   6.6%
* 2025-2026 is provisional: CCS/IMC 2026 not held, IEEE S&P/WWW 2026 incompletely selected.

── S1c. Consent action x statefulness (of crawling papers stating BOTH) ──
population: 115 papers state a consent action AND a statefulness
Consent action        stateful  stateless  both  Total
--------------------  --------  ---------  ----  -----
accept-all            2         4          1     7
accept-and-reject     1         4          5     10
cmp-specific-choices  1         1          0     2
dismiss-or-remove     0         1          1     2
no-interaction        21        62         10    93
reject-all            0         1          0     1

── S1d. Consent action x vantage point: did the crawl run where the law applies? ──
population: 349 crawling papers that state a consent action
Vantage                             Papers  Share
----------------------------------  ------  -----
vantage tuple, location not-stated  206     59.0%
stated a non-EU/EEA vantage only    71      20.3%
EU/EEA vantage                      68      19.5%
no vantage tuple at all             3       0.9%
location named but unmappable       1       0.3%

Of the 36 papers that actually interacted with a notice, 21 (58.3%) did so from an EU/EEA vantage.
Locations folded with scripts/geo.mjs; EEA membership list is in that file.
geo.mjs residue over this population: 5 unmapped strings: "not-stated", "all operating systems and geographic regions", "vantage country", "different continents", "various geographic regions"

── S2. Papers that measure or manipulate a consent mechanism ──
raw vocabulary + enum sweep: 100 candidates
hand-audited exclusions:      28
S2 population:                72 papers
(exclusion keys in EXCLUDED that no longer match the sweep: 1)

── S2b. S2 by venue and by year ──
Venue    Papers in S2  Papers in corpus  Share of venue
-------  ------------  ----------------  --------------
PETS     30            510               5.9%
USENIX   14            1410              1.0%
WWW      8             843               0.9%
CCS      7             990               0.7%
IMC      7             638               1.1%
NDSS     3             701               0.4%
IEEE-SP  3             767               0.4%

Year   Papers in S2
-----  ------------
2018   1
2019   4
2020   3
2021   5
2022   9
2023   9
2024   20
2025*  15
2026*  6
* provisional venue-year.

── S2c. Object of study vs instrument ──
Role of consent in the paper                                                         Papers  Share of S2
-----------------------------------------------------------------------------------  ------  -----------
consent mechanism is measured (fires on a detection / classification / legal field)  60      83.3%
consent handling is only an instrument (fires on a tool name only)                   12      16.7%

── S2d. Platform measured, of S2 papers ──
population: 72 S2 papers; platforms is multi-valued so shares do not sum to 100%
Platform              Papers  Share of S2
--------------------  ------  -----------
web                   57      79.2%
mobile                15      20.8%
other-online-service  7       9.7%
iot                   2       2.8%
offline               1       1.4%

── T1. Consent-handling tools, whole corpus, used or produced only ──
denominator: all 5859 papers; tuples filtered to usedOrMentioned in {used, produced}
Tool                             Papers  Role
-------------------------------  ------  -------------
Consent-O-Matic                  9       used
BannerClick                      4       produced+used
CookieBlock                      4       used
custom GPC extension or crawler  4       produced+used
autoconsent                      3       used
EasyList Cookie List             2       used
Priv-Accept                      2       used
TC-string decoder                2       used
ConsentChk                       1       produced
CookieCheck                      1       produced
CookieEnforcer                   1       produced
GDPR-Consent                     1       produced
I don't care about cookies       1       used
Ninja Cookie                     1       used
Opt-Out Easy                     1       produced
OptOutCheck                      1       produced
Super Agent                      1       used

UNMAPPED RESIDUE of the consent-tool fold: 5 distinct names over 5 papers
    1  IAB anti-ad-block script
    1  Interactive Advertising Bureau (IAB) taxonomy
    1  IAB Europe's CMP Compliance Programme
    1  IAB Europe Transparency and Consent Framework
    1  IAB ads.txt crawler

── T2. CMP vendors named as a tool used, whole corpus ──
denominator: all 5859 papers
CMP            Papers
-------------  ------
OneTrust       6
Quantcast      3
Cookiebot      3
Cookie Script  3
Didomi         1
This counts papers that name the CMP as a tool, not CMP market share.

── C1. Method used to classify a consent notice (audited subset of the enum) ──
population: 24 S2 papers carrying a classification tuple with target=consent-notice
(the enum fires on 39 papers before the audit)
Method               Papers  Share of subset
-------------------  ------  ---------------
heuristic-rules      11      45.8%
manual-labelling     9       37.5%
supervised-ml        3       12.5%
regex-or-signature   2       8.3%
blocklist            2       8.3%
third-party-service  1       4.2%
curated-database     1       4.2%
llm                  1       4.2%

── C2. Ground truth and validation, same subset ──
population: 24 papers
Validation         Papers  Share
-----------------  ------  -----
manual-validation  19      79.2%
none-reported      4       16.7%
cross-validation   2       8.3%
held-out-test-set  1       4.2%
not-applicable     1       4.2%

Names a ground-truth source: 19 of 24 (79.2%)

── L1. Laws assessed by S2 papers, folded with scripts/law_fold.mjs ──
population: 53 of 72 S2 papers carry a legal tuple (corpus-wide, 402 papers do)
Law family                                  Papers  Share of the 53
------------------------------------------  ------  ---------------
EU data protection (GDPR and predecessors)  42      79.2%
ePrivacy / cookie law                       20      37.7%
US state privacy law                        20      37.7%
US children / education / health / finance  7       13.2%
EU platform / digital-market regulation     2       3.8%
Sector, national and other rules            1       1.9%
UNMAPPED                                    1       1.9%
Non-EU/US data protection law               1       1.9%

Strings that fell into the catch-all family or matched nothing: 2
    1  Act against Unfair Competition (UWG)
    1  Digital Economy Act 2017

── X. Cross-check: S2 papers that ran a crawl and what they did with the notice ──
population: 51 of 72 S2 papers ran an automated web crawl
Consent action        Papers  Share
--------------------  ------  -----
no-interaction        18      35.3%
accept-and-reject     14      27.5%
accept-all            8       15.7%
not-stated            6       11.8%
cmp-specific-choices  2       3.9%
reject-all            2       3.9%
not-applicable        1       2.0%

── E. The exclusion list, in full ──
  x CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
      cryptomining opt-in notice, not a tracking-consent mechanism
  x CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense
      cryptomining opt-in notice, not a tracking-consent mechanism
  x CCS/2021/android-on-pc-on-the-security-of-end-user-android-emulators
      screenshot capture by emulators; "without consent" used colloquially
  x CCS/2023/cookiegraph-understanding-and-detecting-first-party-tracking-cookies
      cookie classification; CookieBlock appears only as a compared baseline
  x CCS/2024/octopustaint-advanced-data-flow-analysis-for-detecting-taint-based-vulnerabiliti
      consent-notice enum misfire on a taint-analysis paper
  x IEEE-SP/2021/trouble-over-the-air-an-analysis-of-fota-apps-in-the-android-ecosystem
      app installation without consent; no consent mechanism measured
  x IEEE-SP/2024/to-auth-or-not-to-auth-a-comparative-analysis-of-the-pre-and-post-login-security
      consent-notice enum misfire on login/registration form heuristics
  x IEEE-SP/2025/analyzing-the-ios-local-network-permission-from-a-technical-and-user-perspective
      OS permission rationale, not a tracking-consent mechanism
  x IEEE-SP/2025/detecting-taint-style-vulnerabilities-in-microservice-structured-web-application
      consent-notice enum misfire
  x IMC/2013/understanding-the-effectiveness-of-video-ads-a-measurement-study
      IAB ad-format definition, not IAB Europe TCF
  x IMC/2024/analyzing-the-in-accessibility-of-online-advertisements
      consent-notice enum misfire on ad-disclosure keywords
  ? IMC/2025/cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
      cookie-jar isolation defence; name collides with the tool vocabulary
  x NDSS/2019/measuring-the-facebook-advertising-ecosystem
      IAB content taxonomy, not IAB Europe TCF
  x NDSS/2025/attributing-open-source-contributions-is-critical-but-difficult-a-systematic-analysis-of-github-practices-and-their-impact-on-software-supply-chain-security
      consent-notice enum misfire (GPTzero)
  x NDSS/2026/dom-xss-detection-via-webpage-interaction-fuzzing-and-url-component-synthesis
      IAB content taxonomy, not IAB Europe TCF
  x PETS/2017/detecting-anti-ad-blockers-in-the-wild
      IAB anti-ad-block script, not IAB Europe TCF
  x PETS/2020/angel-or-devil-a-privacy-study-of-mobile-parental-control-apps
      no consent mechanism measured; consent inferred from data flows
  x PETS/2025/your-signal-their-data-an-empirical-privacy-analysis-of-wireless-scanning-sdks-i
      consent-notice enum misfire on SDK rationale detection
  x PETS/2026/ai-in-the-loop-privacy-preserving-real-time-scam-detection-and-conversational-sc
      consent-notice enum misfire (LlamaGuard safety labels)
  x PETS/2026/audagent-automated-auditing-of-privacy-policy-compliance-in-ai-agents
      consent-notice enum misfire on privacy-policy rules
  x PETS/2026/no-privacy-for-privates-how-military-communities-experience-and-perceive-the-pri
      consent-notice enum misfire on data-safety label comparison
  x USENIX/2018/unveiling-and-quantifying-facebook-exploitation-of-sensitive-personal-data-for-a
      no consent mechanism measured
  x USENIX/2022/electronic-monitoring-smartphone-apps-an-analysis-of-risks-from-technical-human
      pre-login transmissions; no consent mechanism measured
  x USENIX/2025/exploring-user-security-and-privacy-attitudes-and-concerns-toward-the-use-of-gen
      attitudes study; opt-out appears only in a legal framing sentence
  x WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild
      cryptomining opt-in notice, not a tracking-consent mechanism
  x WWW/2019/think-outside-the-dataset-finding-fraudulent-reviews-using-cross-dataset-analysi
      consent-notice enum misfire on review-fraud labels
  x WWW/2022/the-impact-of-twitter-labels-on-misinformation-spread-and-user-engagement-lesson
      consent-notice enum misfire on misinformation labels
  x WWW/2023/not-seen-not-heard-in-the-digital-world-measuring-privacy-practices-in-childrens
      COPPA parental consent inferred from data flows; no mechanism measured
  x WWW/2025/welcome-to-the-dark-side-analyzing-the-revenue-flows-of-fraud-in-the-online-ad-e
      IAB ads.txt, not IAB Europe TCF

  x = excluded from a live sweep hit; ? = key no longer matches the sweep

This is the block the content page's What the papers found table was built from — 109 tuples across 50 papers, each with its metric, its prevalence as the authors stated it, and the verbatim evidence quote with its section. It is long. It is here because the alternative is that nobody can check which of these the page chose to publish and which it passed over.

── D1. Every consent-related detection tuple in S2 that carries a prevalence ──
109 tuples across 50 papers
metric names the unit, not always the population — check the paper before quoting.

WWW 2018 an-automated-approach-to-auditing-disclosure-of-third-party-data-collection-in-w
  phenomenon: Do Not Track policy support
  metric:     policy share mentioning or respecting DNT
  prevalence: 7% contained “do not track”; 64.80% explicitly did not honor DNT; 19.46% clearly committed to honor it.
  quote [results]: Across the population of website policies analyzed, 7% contain the string "do not track". A manual analysis of a sample of policies determines if the string is in reference to DNT

WWW 2018 an-automated-approach-to-auditing-disclosure-of-third-party-data-collection-in-w
  phenomenon: third-party Do Not Track support
  metric:     number of policies mentioning or supporting DNT
  prevalence: Nine of 25 mentioned DNT; two offered qualified support; none offered unqualified support.
  quote [results]: Despite this awareness, only nine of 25 data collectors mention the DNT standard in their privacy policies. As with first-party disclosures, the majority of these mentions are to specify that DNT is ignored.

CCS 2019 un-informed-consent-studying-gdpr-consent-notices-in-the-field
  phenomenon: Consent-notice GUI properties
  metric:     share of consent notices
  prevalence: 57.4% used nudging; 92.3% contained an additional-information link
  quote [methodology]: Nudging & Dark Patterns. Consent notices often (57.4 %) use interface design to steer website visitors towards accepting privacy-unfriendly options.

CCS 2019 un-informed-consent-studying-gdpr-consent-notices-in-the-field
  phenomenon: Visitor consent behavior
  metric:     number of unique visitors
  prevalence: 82,890 cleaned visitor logs
  quote [results]: Our cleaned dataset contained event logs of 82,890 unique website visitors: 14,135 in Experiment 1, 36,530 in Experiment 2, and 32,225 in Experiment 3.

IMC 2019 tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
  phenomenon: cookie consent banners
  metric:     share of pornographic websites
  prevalence: 4.41% in the EU and 3.76% in the USA
  quote [results]: The proportion of pornographic webpages with cookie banners is very small, being only 4% of the total.

NDSS 2019 we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy
  phenomenon: cookie-consent notices
  metric:     share of websites displaying notices
  prevalence: 62.1% in May 2018, up from 46.1% in January
  quote [results]: The GDPR's most notable (and visible for users) effect we observed is the increase of cookie consent notifications, which rose from 46.1 % in January to 62.1 % in May.

PETS 2019 4-years-of-eu-cookie-law-results-and-lessons-learned
  phenomenon: Consent-related cookie installation
  metric:     share of websites
  prevalence: 80.5% install profiling cookies before consent
  quote [results]: All other websites, i.e., 80.5% install profiling cookies before consent, and possibly install more after that.

PETS 2020 multiple-purposes-multiple-problems-a-user-study-of-consent-dialogs-after-gdpr
  phenomenon: Consent-dialog interaction effort
  metric:     response time
  prevalence: Reduced-choice participants spent approximately five seconds less responding on average than participants shown three purposes.
  quote [results]: The measurement starts when the cookie dialog appears and ends when the participant clicks a button.

WWW 2020 finding-a-choice-in-a-haystack-automatic-extraction-of-opt-out-statements-from-p
  phenomenon: opt-out hyperlinks
  metric:     precision, recall, and F1
  prevalence: precision 0.93, recall 0.90, F1 0.91
  quote [results]: When crafting simple rules to automatically detect these opt-outs and combining these rules with our classifiers, we are actually able to achieve an overall recall of 0.90 and a precision of 0.93 and an F1 score of 0.91.

WWW 2020 finding-a-choice-in-a-haystack-automatic-extraction-of-opt-out-statements-from-p
  phenomenon: opt-out hyperlinks
  metric:     share of hyperlinks
  prevalence: 441 of 3,251 hyperlinks (14%) were easily identifiable third-party opt-outs
  quote [results]: In our annotated corpus, the 11 easily-identifiable third party opt-out services accounted for 441 of 3,251 hyperlinks, which represents 14% of the hyperlinks.

WWW 2020 finding-a-choice-in-a-haystack-automatic-extraction-of-opt-out-statements-from-p
  phenomenon: opt-out categories
  metric:     percentage of detected opt-outs
  prevalence: 60% advertising, 17% cookies, 10% communication, 7% third-party sharing, and 6% analytics
  quote [results]: advertising opt-outs (AD) account overall for 60% of all detected opt-outs, following by 17% of cookie opt-outs (CK), 10% communication opt-outs (CM)

WWW 2020 finding-a-choice-in-a-haystack-automatic-extraction-of-opt-out-statements-from-p
  phenomenon: opt-outs by website popularity
  metric:     mean opt-outs per site
  prevalence: U.S. Alexa ranks 1–200: 3.43; 200–1000: 2.49; above 1000: 1.22
  quote [results]: The average number of opt-outs varies with the website's Alexa rank. This is true both when looking solely at U.S. websites

IEEE-SP 2020 do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
  phenomenon: TCF cookie banners
  metric:     share of reachable and authorized websites
  prevalence: 1,426 of 22,949 websites (6.2%)
  quote [results]: Among reachable and authorized websites, 1 426 (6.2%) had a TCF banner

IEEE-SP 2020 do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
  phenomenon: No way to opt out
  metric:     share of semi-automatically crawled websites
  prevalence: 38 of 560 websites (6.8%)
  quote [results]: We find that 38 (6.8%) websites do no provide any way to refuse consent.

IEEE-SP 2020 do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
  phenomenon: Shared-cookie consent reuse
  metric:     share of semi-automatically crawled websites
  prevalence: 62 of 1,426 websites (4.3%) returned the same consent string
  quote [results]: Using this protocol, 62 (4.3%) websites return the same consent strings.

PETS 2021 privacy-preference-signals-past-present-and-future
  phenomenon: TCF implementation and version
  metric:     share of crawled websites
  prevalence: 7,582 TCF implementations in the top 100k
  quote [methodology]: As each CMP must implement a __cmp() function for TCF 1.x and __tcfapi() function for TCF 2.x, we check for the presence of these functions

PETS 2021 privacy-preference-signals-past-present-and-future
  phenomenon: TCF 2.0 migration
  metric:     longitudinal adoption and transition counts
  prevalence: 5.7 million Quantcast and 1.4 million OneTrust captures
  quote [methodology]: we identified distinct HTTP requests that indicate the use of specific TCF versions.

PETS 2021 privacy-preference-signals-past-present-and-future
  phenomenon: TCF vendor adoption
  metric:     vendor joins, departures, switches, and legal-basis declarations
  prevalence: More than 600 vendors had adopted TCF by October 2020
  quote [methodology]: We then inspected these previous versions for longitudinal changes and measured every instance when an AdTech vendor joins, leaves, or switches to TCF 2.0.

PETS 2021 privacy-preference-signals-past-present-and-future
  phenomenon: Cookie notices and consent prompts
  metric:     estimated share of websites with cookie prompts
  prevalence: 5% overall error rate in manual checking
  quote [methodology]: In a manual inspection of 50 randomly picked domains with and 50 domains without "cookie" in their DOM tree, we found five domains

NDSS 2021 your-phone-is-my-proxy-detecting-and-understanding-mobile-proxy-networks
  phenomenon: user understanding of consent dialogs
  metric:     percentage of participants
  prevalence: 72% considered dialogs not at all clear after explanation
  quote [results]: After knowing the concepts of web proxy and relaying network traffic, 72% of the participants think the dialogs are "Not at all clear"

PETS 2021 managing-potentially-intrusive-practices-in-the-browser-a-user-centered-perspect
  phenomenon: Users’ opt-out preferences
  metric:     percentage of instances
  prevalence: Participants preferred to opt out in 81% of instances on average.
  quote [results]: Overall, participants preferred to opt out in 81% of instances on average.

USENIX 2021 share-first-ask-later-or-never-studying-violations-of-gdprs-explicit-consent-in
  phenomenon: Personal-data transmission without consent
  metric:     share of successfully analyzed apps
  prevalence: 24,838 apps (34.4%) sent personal data to third-party data controllers
  quote [results]: this means that 34.4% of them sent out PD to third-party data controllers, thereby violating GDPR's mandated consent

USENIX 2021 share-first-ask-later-or-never-studying-violations-of-gdprs-explicit-consent-in
  phenomenon: Consent notices in violating apps
  metric:     share of 100 sampled apps
  prevalence: 25 apps showed consent notices; 11 offered rejection
  quote [results]: Among these 100 apps, we found only 25 apps present any type of consent notices to users. Of these, only 11 apps provide an option to reject

CCS 2022 do-opt-outs-really-opt-me-out
  phenomenon: opt-out buttons
  metric:     precision and recall
  prevalence: OptOutCheck identified opt-out cookies from 165 trackers
  quote [results]: After excluding 30 trackers with non-English opt-out pages, OptOutCheck identified 265 opt-out cookies from 165 trackers.

CCS 2022 do-opt-outs-really-opt-me-out
  phenomenon: opt-out policy statements
  metric:     precision and recall
  prevalence: 55 No-data-collection and No-tracking policies from 54 sentences of 42 trackers
  quote [results]: OptOutCheck extracted 55 No-data-collection and No-tracking policies from 54 sentences of 42 trackers.

CCS 2022 do-opt-outs-really-opt-me-out
  phenomenon: opt-out cookies
  metric:     F1 score, precision, and recall
  prevalence: 84% F1, 97% precision, and 74% recall on the test set
  quote [evaluation]: the classifier achieves a high F1 score of 84% (97% precision and 74% recall) on the test set.

CCS 2022 do-opt-outs-really-opt-me-out
  phenomenon: opt-out inconsistencies
  metric:     number of inconsistent trackers
  prevalence: 11 trackers continued tracking or data collection inconsistently with policies
  quote [results]: OptOutCheck detected 11 trackers that had conducted tracking and data collection inconsistently with their opt-out policies after activating the opt-out choices.

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: consent notices
  metric:     share of analyzed apps
  prevalence: 13,082 consent notices among 239,381 successfully analyzed apps
  quote [results]: As a result, we identified 13,082 privacy-related user interfaces that are any form of consent notices.

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: consent interaction mechanisms
  metric:     share of consent notices
  prevalence: confirmation-only 43.87%; opt-out personalized ads 30.19%; binary choices 21.95%; complex choices 4%
  quote [results]: we identified the four mechanisms for user interaction that are currently widely implemented by Android apps

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: lack of consent notices
  metric:     share of apps sending personal data to ad domains
  prevalence: 30,160 of 32,341 apps (93.26%)
  quote [results]: we identified a significant number of 30,160 (93.26% of 32,341) apps have no implemented any form of consent notices.

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: sharing data before consent
  metric:     share of consent-notice apps
  prevalence: 2,181 apps (16.67%) sent personal data before explicit consent
  quote [results]: we identified 3,007 (23%) apps that sent users' personal data to the Internet before any given consent ... 2,181 (16,67% of 13,082) apps sent personal data to third-party data controllers

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: no way to opt out
  metric:     share of consent-notice apps
  prevalence: 1,084 apps (8.28%) sent data to advertising controllers without refusal options
  quote [results]: 1,084 (8.28% of 13,082) apps sent to third-party data controllers in which their consent notices do not offer a way to refuse consent.

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: non-respect of opt-out
  metric:     number of apps
  prevalence: 134 apps sent personal data after explicit opt-out
  quote [results]: We found 134 apps that still sent users' personal data to third-party advertising data controller after explicitly opting-out the data sharing

PETS 2022 are-iphones-really-better-for-privacy-a-comparative-study-of-ios-and-android-app
  phenomenon: tracking before consent
  metric:     share of apps contacting tracking domains at startup
  prevalence: 81.44% of Android apps and 68.46% of iOS apps potentially shared data before consent.
  quote [results]: This suggests potentially widespread violations of applicable data protection law (in 81.44% of Android apps, and 68.46% of iOS apps).

PETS 2022 checking-websites-gdpr-consent-compliance-for-marketing-emails
  phenomenon: GDPR consent violations
  metric:     share of websites
  prevalence: 17.3% of websites sending marketing emails had at least one potential violation.
  quote [results]: 17.3% of websites have at least one potential violation.

PETS 2022 how-can-and-would-people-protect-from-online-tracking
  phenomenon: Opt-out difficulty
  metric:     mean number of clicks
  prevalence: Opting out averaged 3 clicks initially and 6 clicks after previously accepting consent.
  quote [results]: For the remaining websites, it would take the user to opt-out from the cookie notice by 3 clicks on average... changes mind later, it would take them 6 clicks on average to opt-out.

PETS 2022 on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
  phenomenon: unbalanced consent choices
  metric:     share of studied consent pop-ups
  prevalence: six out of ten studied consent pop-ups showed a difference between the “Accept” and “Reject” button by default
  quote [results]: We found out that six out of ten studied consent pop-ups - Quantcast, Cookiebot free, Cookiebot paid, and Cookie Script Free, Lite, and Plus - showed a difference between the “Accept” and “Reject” button by default

PETS 2022 on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
  phenomenon: CMP tracker-scanner manipulation
  metric:     number of CMPs offering tracker scanners
  prevalence: four CMPs proposed tracker scanners
  quote [results]: We found out that four CMPs - CookiePro, Cookiebot, Crownpeak, and Cookie Script - propose tracker scanners.

PETS 2022 on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
  phenomenon: pre-consent Quantcast tracking
  metric:     third-party requests and tracking cookies
  prevalence: Quantcast initially set a user-specific one-year mc cookie before consent
  quote [results]: This tracking pixel was integrated by default in all Quantcast Choice banners even before the user makes a decision regarding acceptance or refusal of consent

PETS 2022 on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
  phenomenon: third-party tracking in Cookie Script report
  metric:     requests and cookies observed
  prevalence: 41 third-party requests and 6 cookies were deposited without prior consent
  quote [results]: The tracker scan page includes a Google Analytics service, as well as social sharing buttons, all which generating a total of 41 third-party requests and the deposit of 6 cookies without the user's prior consent

USENIX 2022 automating-cookie-consent-and-gdpr-violation-detection
  phenomenon: Cookies before consent
  metric:     share of websites setting non-necessary cookies
  prevalence: 69.7% of examined websites
  quote [results]: By crawling the website without interacting with the cookie banner, we inspect if websites set any cookies with a purpose that is not declared as necessary. We find that 69.7%

USENIX 2022 automating-cookie-consent-and-gdpr-violation-detection
  phenomenon: Cookies despite negative consent
  metric:     share of websites
  prevalence: 21.3% of 29,398 websites
  quote [results]: We then verify that the recorded consent status of the CMP is indeed negative, and identify which of these websites still set non-necessary cookies.

CCS 2023 policychecker-analyzing-the-gdpr-completeness-of-mobile-apps-privacy-policies
  phenomenon: Consent-withdrawal omissions
  metric:     share of consent-based policies
  prevalence: 66.1% of 77,522 consent-based policies
  quote [introduction]: among 77,522 privacy policies that indicated consent-based data processing, 66.1% of them failed to further indicate whether users have the right to withdraw their consents

NDSS 2023 i-still-know-what-you-watched-last-sunday-privacy-of-the-hbbtv-protocol-in-the-european-smart-tv-landscape
  phenomenon: Tracking before consent
  metric:     share of TV channels
  prevalence: 26 of 36 channels communicated with trackers before consent
  quote [discussion]: All the 36 TV channels we analyzed contact at least one tracking domain; further, 26 communicate with trackers before the user has expressed their consent.

IMC 2023 thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web
  phenomenon: cookiewall prevalence
  metric:     share of queried websites
  prevalence: 280 of 45,222 websites (0.6%)
  quote [results]: In total, we find cookiewalls on 280 unique websites, resulting in an overall cookiewall rate of 0.6%

IMC 2023 thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web
  phenomenon: cookiewall detection
  metric:     precision and recall
  prevalence: 98.2% precision; 100% precision and recall on 1,000 sampled websites
  quote [methodology]: We find that 280 websites have indeed a cookiewall, whereas 5 detections are classified as false positives. This results in a detection precision of 98.2%.

USENIX 2023 automated-cookie-notice-analysis-and-enforcement
  phenomenon: cookie notice detection
  metric:     accuracy
  prevalence: 986 of 2000 domains identified as having cookie notices; 16 false negatives and 2 false positives
  quote [results]: The module identified 986 domains as having cookie notices, with 2 false positives and 16 false negatives.

USENIX 2023 automated-cookie-notice-analysis-and-enforcement
  phenomenon: cookie notices at scale
  metric:     share of websites with notices
  prevalence: 52.7% of 85,473 analyzed websites
  quote [results]: First, we find that CookieEnforcer detects a cookie notice on 52.7% of the websites.

USENIX 2023 automated-cookie-notice-analysis-and-enforcement
  phenomenon: multiple-view cookie notices
  metric:     share of websites with notices
  prevalence: 35.4% had multiple views; 64.6% had a single-view notice
  quote [results]: 35.4% of the websites with notices had cookie notices with multiple views while 64.6% had a single-view cookie notice.

USENIX 2023 automated-cookie-notice-analysis-and-enforcement
  phenomenon: one-click opt-out
  metric:     share of websites with cookie notices
  prevalence: 21.5% provided a one-click opt-out mechanism
  quote [results]: We find that in total, only 21.5% of the websites with cookie notices provide a One-click opt-out mechanism

USENIX 2023 the-ok-is-not-enough-a-large-scale-study-of-consent-dialogs-in-smartphone-applic
  phenomenon: privacy consent dialogs
  metric:     share of successfully analyzed apps
  prevalence: 814 (22.3%) apps displayed a privacy consent dialog on start; 434 (11.9%) displayed a proper dialog.
  quote [results]: Overall, we detected 814 (22.3%) apps displaying a privacy consent dialog on start. 232 (6.3%) displayed a link, 165 (4.5%) displayed a notice, and 434 (11.9%) displayed a proper dialog.

USENIX 2023 the-ok-is-not-enough-a-large-scale-study-of-consent-dialogs-in-smartphone-applic
  phenomenon: pre-consent tracker traffic
  metric:     apps contacting monitored tracking endpoints before interaction
  prevalence: 3013 (82.5%) analyzed apps contacted a covered tracking endpoint before interaction.
  quote [results]: Mapping the requests back to apps, leads to 3013 (82.5%) of apps contacted one of our covered tracking endpoints before any interaction took place.

USENIX 2023 the-ok-is-not-enough-a-large-scale-study-of-consent-dialogs-in-smartphone-applic
  phenomenon: TCF usage
  metric:     apps setting TCF-related strings
  prevalence: 146 (4.0%) apps set TCF-related settings during execution.
  quote [results]: We detected only TCF-related settings in 146 (4.0%) apps. This highly limits any analysis approach based on frameworks.

PETS 2023 comparing-large-scale-privacy-and-security-notifications
  phenomenon: third-party cookies without consent
  metric:     share of candidate sites
  prevalence: 7.34% of sites with at least one privacy issue
  quote [methodology]: followed by Before Consent (7.57 %) and No Consent (7.34 %).

PETS 2023 comparing-large-scale-privacy-and-security-notifications
  phenomenon: third-party cookies before consent
  metric:     share of candidate sites
  prevalence: 7.57% of sites with at least one privacy issue
  quote [methodology]: followed by Before Consent (7.57 %) and No Consent (7.34 %).

PETS 2023 everybodys-looking-for-ssomething-a-large-scale-evaluation-on-the-privacy-of-oau
  phenomenon: Preselected marketing consent
  metric:     share of sites with marketing consent preselected
  prevalence: 31.82% of minimal-scope and 54.55% of non-minimal-scope sites.
  quote [results]: 14 out of these 44 (31.82%) websites include a preselected choice. On websites that use OAuth with non-minimal scopes ... 30 (54.55%)

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: Willingness to enable GPC
  metric:     share of participants
  prevalence: 46/49 (94%) opted to enable GPC
  quote [results]: 46/49 (94%) of the participants in our Browser Setup Survey opted to enable GPC

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: Understanding of GPC
  metric:     share answering correctly
  prevalence: 81% correctly answered that advertisers would not receive their data
  quote [results]: Based on the explanation, 81% of the participants in our GPC Survey correctly answered that advertisers would not receive their data if they turned on GPC.

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: GPC compliance detection accuracy
  metric:     accuracy
  prevalence: 89/100 sites
  quote [results]: Our extension ran successfully and correctly on 89/100 sites of the Test Set

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: US Privacy String detection
  metric:     F-1 score
  prevalence: 0.98 on the test-set subset
  quote [results]: With one false positive and an F-1 score of 0.98 our extension reliably identified the US Privacy String

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: GPC compliance among combined-set sites
  metric:     compliant sites with US Privacy Strings
  prevalence: 27/64 sites as of August 2022
  quote [results]: As of August 2022, a total of 27/64 sites that implement the US Privacy String were compliant and respected GPC.

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: GPC compliance at scale
  metric:     sites respecting GPC
  prevalence: 54/464 (12%) sites with a US Privacy String
  quote [results]: with only 54/464 (12%) of the sites with US Privacy String opting us out ... GPC non-compliance appears widespread

IMC 2024 diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc
  phenomenon: Pre-consent data processing
  metric:     share of audited services
  prevalence: All services collected data before consent and age disclosure; all but one shared identifiers and personal information with third-party ATS.
  quote [results]: All of the services engaged in data collection and/or sharing prior to consent and age disclosure.

PETS 2024 block-cookies-not-websites-analysing-mental-models-and-usability-of-the-privacy
  phenomenon: CookieBlock mental-model accuracy
  metric:     accuracy category counts
  prevalence: Before: 15 inaccurate, 11 partially accurate, 14 accurate; After: 14, 12, and 12
  quote [results]: The results are shown in Table 1 and illustrated in the following:

PETS 2024 crumbling-cookie-categories-deconstructing-common-cookie-categories-to-create-ca
  phenomenon: Consent-interface comprehension
  metric:     recall and focused comprehension accuracy
  prevalence: Focused comprehension for performance cookies was 79.0% with old terms versus 95.2% with new terms.
  quote [results]: Performance cookies 79.0% 95.2%*

PETS 2024 crumbling-cookie-categories-deconstructing-common-cookie-categories-to-create-ca
  phenomenon: Consent behavior
  metric:     consent-decision proportion
  prevalence: 63.1% accepted only necessary cookies; 33.8% accepted all cookies.
  quote [results]: The most common consent decision was to accept only necessary cookies with 63.1% of participants selecting this option. 33.8% of participants accepted all cookies

PETS 2024 generalizable-active-privacy-choice-designing-a-graphical-user-interface-for-glo
  phenomenon: GPC interface usability
  metric:     agreement with usability statements
  prevalence: 87% disagreed or strongly disagreed that opting out took a lot of effort.
  quote [results]: Across schemes, 87% disagreed or strongly disagreed that it took them a lot of effort to opt out

PETS 2024 generalizable-active-privacy-choice-designing-a-graphical-user-interface-for-glo
  phenomenon: GPC comprehension
  metric:     correct-response rate
  prevalence: 83% correctly explained GPC in free-form responses.
  quote [results]: The correct responses to the multiple choice question were confirmed by an 83% rate of participants' correct free-form responses to the question

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: USP String cookie storage
  metric:     share of publishers
  prevalence: 358 of 10,000 publishers (3.6%) stored a USP String in a cookie
  quote [results]: In our data from Crawl 1 we detect the USP String value being stored in a cookie on 358 (3.6%) publishers out of 10 K

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: USP String HTTP propagation
  metric:     share of requests containing injected opt-out value
  prevalence: 354,416 of 421,497 requests (84.1%) contained 1YYN
  quote [results]: 421,497 HTTP requests contained a URL with a USP parameter, of which 354,416 (84.1%) contained our chosen USP String value of 1YYN.

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: USP String propagation in inclusion chains
  metric:     share of A&A chains rooted at USP-API publishers
  prevalence: 218,541 of 1,214,540 chains (17.9%) contained at least one USP String transmission
  quote [results]: There are 1,214,540 A&A inclusion chains rooted in the 821 publishers that implement the USP API, of which 218,541 (17.9%) contained at least one HTTP request transmitting the USP String.

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: USP String pairwise sharing
  metric:     share of A&A pairs sharing in every chain
  prevalence: 47.1% of A&A pairs shared the USP String in all observed chains
  quote [results]: only 47.1% of A&A pairs share the USP String in all chains in which they appear.

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: GPC-to-USP opt-out conversion
  metric:     share of USP-API publishers setting opt-out
  prevalence: 380 of 825 publishers (46.1%) set the USP String to opt-out
  quote [results]: In Crawl 3, when GPC was enabled, 380 out of 825 (46.1%) publishers with the USP API set the USP String to opt-out.

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: Tracking-pixel response to opt-out
  metric:     tracking pixels per publisher
  prevalence: No statistically significant reduction for most crawl comparisons
  quote [results]: GPC and a USP String set to opt-out do not significantly reduce the number of tracking pixels embedded in publishers

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: opt-out-of-sale links
  metric:     share of top-25,000 websites
  prevalence: 2,429 websites (9.9%) provided manual opt-out links in November 2022.
  quote [results]: 2,429 websites (9.9%) provided manual opt-out of sale links on their homepage

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: GPC signal honoring
  metric:     number of websites honoring GPC
  prevalence: 814 websites honored GPC in November 2023.
  quote [results]: Our final crawl, conducted in November 2023, 2,987 websites provided some form of opt-out mechanism and 814 honored GPC signals.

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: GPC-only opt-out mechanisms
  metric:     number of websites
  prevalence: 340 websites supported GPC as the only opt-out mechanism in November 2023.
  quote [results]: there were 340 websites for which GPC signals were the only supported mechanism for opting-out of sale.

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: loss of opt-out mechanisms
  metric:     share of previously compliant websites
  prevalence: Approximately 24% subsequently provided no opt-out mechanism.
  quote [results]: Most of the websites that provided opt-out of sale links in November 2022 and subsequently removed them provided no opt-out of sale mechanism after CPRA went into effect.

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: GPC-related privacy-policy language
  metric:     number of websites
  prevalence: 1,350 policies included GPC-related expressions by November 2023.
  quote [results]: By November 2023, 1,350 websites in our dataset privacy policies that included one or more GPC-related expressions.

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: gpc.json files
  metric:     number of websites
  prevalence: 56 websites had such files when CPRA enforcement began.
  quote [results]: at which point 56 websites had such files

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: GPC awareness
  metric:     share of participants understanding GPC
  prevalence: Only 5.9% of responses indicated an understanding of GPC.
  quote [results]: Only 5.9% of responses indicated an understanding of what GPC is.

IMC 2024 watching-tv-with-the-second-party-a-first-look-at-automatic-content-recognition
  phenomenon: ACR traffic after opt-out
  metric:     presence or absence of communication with ACR domains
  prevalence: Opting out produced a complete absence of communication with previously identified ACR domains.
  quote [results]: once opt-out is exercised (Table 1), there is a complete absence of communication with any previously identified ACR domains

USENIX 2024 automated-large-scale-analysis-of-cookie-notice-compliance
  phenomenon: Cookie notice detection
  metric:     precision and recall
  prevalence: 100.0% precision and 86.9% recall
  quote [appendix]: We achieve 100.0% precision and 86.9% recall.

USENIX 2024 automated-large-scale-analysis-of-cookie-notice-compliance
  phenomenon: Cookie consent violations
  metric:     share of crawled websites with violations
  prevalence: 72.2% of successfully crawled websites contained at least one privacy violation
  quote [results]: We found that 72.2% of these websites contained at least one privacy violation.

USENIX 2024 dissecting-privacy-perspectives-of-websites-around-the-world-aceptar-todo-alle-a
  phenomenon: cookie consent banner presence
  metric:     share of successfully loaded websites
  prevalence: 37% (1511) of the total dataset included a cookie consent notice
  quote [methodology]: 37% (1511) included a cookie consent notice as a banner as part of the website's privacy policy.

USENIX 2024 abandon-all-hope-ye-who-enter-here-a-dynamic-longitudinal-investigation-of-andro
  phenomenon: Consent-choice violations
  metric:     share of apps with discrepancies among consent-dialog apps
  prevalence: 78.61% across the three reject scenarios
  quote [results]: Overall, for the three "Reject" scenarios (scenario-iii, scenario-iv, scenario-v), we found that 78.61% (σ = 0.54) of the apps that present a consent dialogue have discrepancies

PETS 2024 opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
  phenomenon: Advertiser data usage after opt-out
  metric:     advertiser bid CPM distributions
  prevalence: Most personas received higher bids than control after opting out under GDPR and CCPA.
  quote [discussion]: Overall we note that under CMPs most personas receive higher bids compared to control when users opt-out of data processing and selling under GDPR and CCPA.

PETS 2024 opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
  phenomenon: Pre-opt-out tracking
  metric:     bids and cookie syncing events
  prevalence: Advertisers continued using data and syncing cookies after pre-opt-out.
  quote [appendix]: we conduct additional experiments where we opt-out prior to simulating personas.

PETS 2024 opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
  phenomenon: CMP and prebid deployment
  metric:     number of websites
  prevalence: 352 websites supported selected CMPs and client-side header bidding.
  quote [methodology]: scanning top-100K websites allows us to filter a meaningful number (i.e., 352) of websites that deploy CMPs and prebid.js under both GDPR and CCPA.

USENIX 2024 the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions
  phenomenon: User satisfaction with consent choices
  metric:     satisfaction percentage
  prevalence: 78% of those declining were satisfied, compared with 48% of those accepting.
  quote [results]: Our analyses reveal that people who declined tended to be more satisfied by their choice: 78% of those who declined were satisfied, while only 48% of those who had accepted were satisfied.

WWW 2024 a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework
  phenomenon: TCF consent-recording noncompliance
  metric:     percentage of domains and crawls with violations
  prevalence: TCF violations occurred in 2.2% of domains and 1.3% of crawls.
  quote [results]: In total there are 117 crawls to 48 distinct domains where TCF policies are violated, which is 1.3% of all crawls and 2.2% of all domains, respectively.

WWW 2024 a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework
  phenomenon: Tracking cookies after consent rejection
  metric:     average tracking cookies and percentage of domains setting them
  prevalence: Compliant, non-empty-TC domains averaged 1.28 tracking cookies; all domains averaged 1.11.
  quote [results]: The average number of tracking cookies set when no violation occurs is the average number of cookies set in domains belonging to the first two rows of Table 3 (1.09 tracking cookies).

PETS 2025 johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
  phenomenon: difficult consent revocation
  metric:     share of reachable websites
  prevalence: 19.87% (32/158) offered revocation via a substantially different interface
  quote [results]: Overall, 32 (19.87%) websites out of 158 offered the option to revoke consent via an interface that is substantially different

PETS 2025 johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
  phenomenon: consent-storage inconsistency
  metric:     websites with mismatches
  prevalence: 5 TCF cookie/API, 3 TCF localStorage/API, and 4 OneTrust mismatches
  quote [results]: Five websites implementing the TCF returned different TCStrings from __tcfapi and the TCString stored in the cookie after revocation.

PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
  phenomenon: GPC effect
  metric:     average reduction in intractable cookies
  prevalence: approximately 30%, with an additional 32% after subsequent rejection
  quote [results]: enabling GPC reduces intractable cookies by approximately 30% on average ... further rejection of the banner can lead to an additional 32% reduction

USENIX 2025 evaluating-privacy-policies-under-modern-privacy-laws-at-scale-an-llm-based-auto
  phenomenon: frictionless opt-out signals
  metric:     share of domains mentioning GPC
  prevalence: 506 of 639 E8 domains (79%) mentioned Global Privacy Control
  quote [results]: The vast majority of these domains (506, or 79%) mentioned Global Privacy Control, or GPC [3], as a frictionless opt-out signal.

USENIX 2025 websites-global-privacy-control-compliance-at-scale-and-over-time
  phenomenon: GPC compliance
  metric:     share of sites opting out through all implemented privacy strings
  prevalence: 44% (1,411/3,226) in December 2023; 43% (1,473/3,402) in February 2024; 45% (1,620/3,566) in April 2024
  quote [abstract]: In December 2023, 44% (1,411/3,226) of such sites opted users out via all implemented privacy strings.

USENIX 2025 navigating-cookie-consent-violations-across-the-globe
  phenomenon: cookie consent violations
  metric:     share of websites with at least one violation
  prevalence: 96.18% in the EU to 97.72% in the US
  quote [introduction]: ConsentChk detected that 96.18% (EU) - 97.72% (US) of websites across all regions contain at least one cookie consent violation.

USENIX 2025 navigating-cookie-consent-violations-across-the-globe
  phenomenon: consent enforcement
  metric:     share of websites correctly enforcing consent
  prevalence: 3.82% of websites
  quote [results]: Specifically, only 3.82% of websites correctly enforced the consent preferences of users.

CCS 2025 whispertest-a-voice-control-based-library-for-ios-ui-automation
  phenomenon: tracker domains by consent mode
  metric:     total distinct tracker domains
  prevalence: 512–943 accept; 409–805 reject
  quote [results]: Total distinct tracker domains 512 - 943 409 - 805

CCS 2025 layered-overlapping-and-inconsistent-a-large-scale-analysis-of-the-multiple-priv
  phenomenon: CCPA opt-out implementation
  metric:     share of disclosing banks lacking required opt-outs
  prevalence: 22 of 45 banks (48.9%) acknowledging CCPA sale/sharing failed to implement required opt-outs
  quote [results]: Of the 45 banks that did acknowledge to sell/share data under CCPA, 22 (48.9%) failed to implement required opt-outs.

CCS 2025 layered-overlapping-and-inconsistent-a-large-scale-analysis-of-the-multiple-priv
  phenomenon: GPC compliance
  metric:     number of websites respecting GPC
  prevalence: 64 websites respected GPC signals
  quote [methodology]: In total, 64 were found to respect GPC signals.

PETS 2026 exercising-the-ccpa-opt-out-right-on-android-legally-mandated-but-practically-ch
  phenomenon: app-level CCPA opt-out settings
  metric:     share of apps
  prevalence: 48 of 100 apps implemented a legally mandated CCPA opt-out setting
  quote [results]: Only 48 of the 100 apps we evaluated implement the legally mandated CCPA opt-out setting

PETS 2026 exercising-the-ccpa-opt-out-right-on-android-legally-mandated-but-practically-ch
  phenomenon: GPC opt-out compliance
  metric:     privacy-flag opt-out rate
  prevalence: 338 apps remained opted_in for Vungle while 26 were opted_out under No AdID + GPC
  quote [results]: when sending GPC signals and disabling apps' access to the AdID, 338 apps still had the ccpa status of the ad network Vungle set to opted_in while only 26 had set it to opted_out.

PETS 2026 the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
  phenomenon: TCF implementation prevalence
  metric:     share of downloaded apps
  prevalence: 576 of 4482 apps (12.85%)
  quote [results]: 576 apps were identified as implementing the TCF ... representing 12.85% of the downloaded apps.

PETS 2026 the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
  phenomenon: Incorrect consent-choice storage
  metric:     share of TCF-based apps
  prevalence: 15 apps stored choices only after consent to all processing
  quote [results]: 15 apps only stored our choices if provided with consent to all data processing

PETS 2026 the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
  phenomenon: AAID transmission without consent
  metric:     share of analyzed apps
  prevalence: 66.2% transmitted AAID in the passive-stage Ø-approach; 55.3% transmitted it during active interaction
  quote [results]: In the passive-stage of traffic analysis, 66.2% of analyzed apps share personal data when using the Ø-approach.

PETS 2026 the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
  phenomenon: AAID transmission before consent
  metric:     share of active-stage apps
  prevalence: 284 of 513 apps (55.3%) transmitted AAID before consent
  quote [results]: During this stage, we found 284 apps that transmitted AAID before or during banner interaction, prior to obtaining consent.

USENIX 2026 bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
  phenomenon: consent-bypass localhost tracking
  metric:     share of sites triggering communications without consent
  prevalence: Meta: 75.8% EU and 78.2% USA; Yandex: 84.4% EU and 83.5% USA
  quote [results]: localhost communications were triggered without user consent by Meta Pixel. Yandex Metrica triggered localhost communications on 84.4% (EU), 83.5% (USA) of websites without user consent.

Two ordered rule lists, first match wins:

• CONSENT_TOOLS — what a researcher drives a banner with, or decodes a signal with. Merges Consent-O-Matic/Consent-O-matic and autoconsent/DuckDuckGo autoconsent; maps a family of GPC … extension/GPC … crawler/GPC … compliance strings to one entry; maps IAB consent-string decoding script and IAB TC String Decoder to TC-string decoder.
• CMPS — the vendor being measured. Merges OneTrust, OneTrust CMP and CookiePro (OneTrust acquired CookiePro); Cookie-Script and Cookie Script; Quantcast and Quantcast Choice.

A separate CANDIDATE regex decides what the fold was ever meant to see, so a name that never matched it is not reported as residue. Residue of the fold, printed in full by the script: 5 distinct names over 5 papers, and all five are IAB artefacts that are not banner-interaction tools:

The last two are the honest judgement call: they could be folded into a third family. They were left as residue because the table they would join is headed tools you can install and run.

Reused unchanged from legal_enforcement, including its ordering (specific families before general) and its two hard-coded exceptions. Over the 53 S2 papers with a legal tuple it leaves 2 strings in the catch-all family: Digital Economy Act 2017 and Act against Unfair Competition (UWG). Both are correctly placed — neither is a data-protection instrument — and both are single papers.

The fold matters here. Unfolded, the raw strings split the CCPA across CCPA (16 papers) and California Consumer Privacy Act (CCPA) (4), and ePrivacy across ePrivacy Directive (15), ePrivacy directive (2) and ePrivacy Directive (2002/58/EC) (1). Publishing the raw counts would have understated US state privacy law by a fifth and ePrivacy by a sixth.

Reused unchanged from crawling_location, including its EEA_COUNTRIES set and isEeaVantage(). Note that the UK is deliberately not in that set (post-Brexit), which makes the page's EU/EEA figures slightly conservative — a UK-only vantage counts as non-EEA.

Residue over the 349 papers of S1: 5 strings, all of which name no resolvable place — not-stated, all operating systems and geographic regions, vantage country, different continents, various geographic regions. Of these only not-stated is common, and the script counts it in its own row rather than folding it away.

Every literal figure the content page attributes to a corpus paper was searched for in that paper's own full text, in both renderings — paper.cols.txt (column reading order repaired; the one the extraction read) and paper.norm.txt. They fail on different sentences, so a figure found in either counts as verified and the report says which. Whitespace, thin and non-breaking spaces, curly quotes and unicode dashes are normalised first, because a PDF text layer produces all of them for what the author typed as a plain space or hyphen.

Result: 61 literals, 60 found in both renderings, 1 in cols only, 0 not found. The cols-only case is 62 (4.3%) in Matte et al.

The check is a superset of what the page publishes, not a mirror of it. Ten of the 61 literals were checked and then not used on the page — Bouhoula's 2353 and 95.1%, Rasaii's 6.91, Utz's 39.2, Khandelwal's 986, Rasaii's 98.2%, Bollinger's 87.2% and Koch's 22.3%, 82.5% and 4.0%. They are figures the page considered and cut, kept in the check because a checked-and-cut figure is cheap to keep and expensive to re-derive if a later edit wants it back. The direction that matters is the other one: no literal on the page is absent from the check. A reviewer flagged the “checked against the page” framing as overstated on 2026-08-19; it is corrected here rather than quietly narrowed.

both        2024 USENIX  "100.0% precision and 86.9% recall"
both        2024 USENIX  "72.2%"
both        2024 USENIX  "2353"
both        2024 USENIX  "95.1%"
both        2020 IEEE-SP  "6.2%"
both        2020 IEEE-SP  "28 257"
both        2020 IEEE-SP  "141 out of 1 426 (10%)"
both        2020 IEEE-SP  "9.9% (141/1426)"
both        2020 IEEE-SP  "6.8% (38/560)"
both        2020 IEEE-SP  "46.5% (236/508)"
both        2020 IEEE-SP  "5.3% (27/508)"
both        2020 IEEE-SP  "54.29%"
cols only   2020 IEEE-SP  "62 (4.3%)"
both        2023 USENIX  "52.7%"
both        2023 USENIX  "21.5%"
both        2023 USENIX  "35.4%"
both        2023 USENIX  "986"
both        2024 PETS  "12 (65%)"
both        2024 PETS  "SD: 21%"
both        2023 IMC  "280"
both        2023 IMC  "0.6%"
both        2023 IMC  "98.2%"
both        2025 PETS  "30%"
both        2025 PETS  "32%"
both        2025 PETS  "6.91"
both        2025 USENIX  "96.18%"
both        2025 USENIX  "97.72%"
both        2025 USENIX  "3.82%"
both        2024 USENIX  "37%"
both        2024 USENIX  "1511"
both        2019 NDSS  "62.1"
both        2019 NDSS  "46.1"
both        2022 USENIX  "69.7%"
both        2022 USENIX  "87.2%"
both        2019 CCS  "57.4"
both        2019 CCS  "39.2"
both        2021 PETS  "__tcfapi"
both        2021 PETS  "__cmp"
both        2023 PETS  "54/464"
both        2023 PETS  "12%"
both        2025 USENIX  "1,411/3,226"
both        2025 USENIX  "44%"
both        2024 PETS  "2,429"
both        2024 PETS  "9.9%"
both        2024 PETS  "814"
both        2024 PETS  "46.1%"
both        2024 PETS  "825"
both        2022 PETS  "six out of ten"
both        2026 PETS  "12.85%"
both        2026 PETS  "55.3%"
both        2026 PETS  "576"
both        2024 WWW  "2.2%"
both        2024 WWW  "1.3%"
both        2025 PETS  "19.87%"
both        2025 PETS  "158"
both        2022 CCS  "13,082"
both        2022 CCS  "93.26%"
both        2023 USENIX  "22.3%"
both        2023 USENIX  "82.5%"
both        2023 USENIX  "4.0%"
both        2019 IMC  "4.41"

both: 60   cols only: 1   norm only: 0   NOT FOUND: 0

Three literals failed on the first run, and all three were errors in this page's draft, not in the extraction:

The Matte case is the one worth keeping: a percentage that looks like it came from a paper, computed by the writer from a count and a denominator taken from two different tables. Reading the source turned up four more figures the draft did not have — 46.5% pre-selected, 5.3% non-respect of choice, 54.29% any violation, and the 4.3% shared-cookie consent reuse. The first three went into the results table immediately; the fourth was accidentally dropped between drafts and was restored, as a box in the TCF section, only after a reviewer noticed on 2026-08-19 that this very paragraph claimed it was on the page when it was not.

The page's central figure is “how many papers interacted with a consent notice”. The extraction says 36. Reading all 36 against their own text says 29. That is a 19.4% false-positive rate on the interacting values of crawlConfig.consentAction, and it is the single most important thing on this provenance page.

Why the site's usual check is blind here. The dataset's guidance is to read a handful of evidence.quote values behind any figure before publishing it. That check cannot work for this field. crawlConfig is an object, not an array, and it carries one evidence quote for the whole object — statefulness, browsers, headless, consent action, interaction depth, authentication, languages and repeat visits all share it. So the quote behind a consentAction value usually evidences something else entirely. Read literally, the quotes for the 36 papers include “we create a separate docker container for each URL we visit”, “each crawl within a run is performed once without repetition” and “we visit each website afresh with storage cleared” — none of which says anything about a banner. One of them, for Trevisan et al., says the opposite of its label: “No user action is performed on the page” sits under a accept-and-reject value.

Doing the check properly meant a different method: extract every sentence in each paper containing a consent/banner term and a first-person marker, read them, and record a verdict. consent_action_audit.mjs –sentences reproduces the sentences; the verdicts are hard-coded in that file with a one-line reason each, and the script fails loudly if a paper claims an interaction and has no verdict, or if a verdict refers to a paper that no longer claims one. That guard caught three truncated slugs in the first version of the verdict table.

The seven false positives, and what the extraction mistook:

The one overstatement. Trevisan et al., 4 Years of EU Cookie Law (PoPETs 2019), is labelled accept-and-reject. Its main crawl states “No user action is performed on the page… We do not scroll the page, nor click on any link”, but the paper also reports a separate experiment “when consent to the usage of cookies is given”. An accept arm exists; a reject arm is not described. It is counted as verified, with the caveat recorded here.

The pattern is not random, and it is useful. All three dismiss-or-remove values are wrong and four of fifteen accept-all values are wrong, while accept-and-reject is 14 for 14, reject-all 2 for 2 and cmp-specific-choices 2 for 2. The reading: the field is reliable exactly where a paper had to describe two arms explicitly, and unreliable where a single ambiguous word — consent, banner, dismiss — appears somewhere in a paper about something else. Anyone reusing this field should treat accept-all and dismiss-or-remove as needing verification and the two-armed values as sound.

no-interaction was audited on 2026-09-05. When this section was written it had not been, and the guess recorded here — that its error rate would resemble the interacting values' — was wrong by an order of magnitude. See §7.3.

claimed an interaction: 36
adjudicated:            36

── Verdicts ──
Verdict                                     Papers  Share of the 36
------------------------------------------  ------  ---------------
supported by the paper text                 28      77.8%
supported but the enum value overstates it  1       2.8%
NOT supported — extraction false positive   7       19.4%

FALSE-POSITIVE RATE of crawlConfig.consentAction on the interacting values: 7/36 = 19.4%

── Figures recomputed on the AUDITED set ──
papers that ran a crawl:                       1120
state a consent action (incl. no-interaction): 349 (31.2%)
  ... of which no-interaction:                 313
  ... claim an interaction (extraction):       36 (3.2% of crawled)
  ... interaction VERIFIED in the paper:       29 (2.6% of crawled, 8.3% of those stating)

── Audited interaction by enum value ──
Value                 Claimed  Verified  False positives
--------------------  -------  --------  ---------------
accept-all            15       11        4
accept-and-reject     14       14        0
cmp-specific-choices  2        2         0
dismiss-or-remove     3        0         3
reject-all            2        2         0

── Audited interaction by year bucket ──
Bucket      Crawling papers  Claimed  Verified  Share of bucket
----------  ---------------  -------  --------  ---------------
2010–2013   102              0        0         0.0%
2014–2017   167              0        0         0.0%
2018–2021   308              6        3         1.0%
2022–2024   345              17       14        4.1%
2025–2026*  198              13       12        6.1%

── Vantage point of the VERIFIED interacting papers ──
Vantage                             Papers  Share of 29
----------------------------------  ------  -----------
EU/EEA vantage                      21      72.4%
vantage tuple, location not-stated  5       17.2%
stated a non-EU/EEA vantage only    3       10.3%

── Every verdict, in full ──
[WRONG  ] CCS/2018/pride-and-prejudice-in-progressive-web-apps-abusing-native-app-like-features-in
           claimed: accept-all
           the only consent in the paper is the PUSH NOTIFICATION permission prompt
[WRONG  ] WWW/2018/hiding-in-the-crowd-an-analysis-of-the-effectiveness-of-browser-fingerprinting-a
           claimed: accept-all
           no sentence in the paper mentions a consent notice or banner at all
[PARTIAL] PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
           claimed: accept-and-reject
           main crawl states "No user action is performed on the page"; a separate experiment gives consent, so an ACCEPT arm exists but no reject arm is described
[WRONG  ] IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising
           claimed: accept-all
           "banner" in this paper means BANNER ADS; no consent interaction described
[OK     ] IEEE-SP/2020/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
           claimed: accept-and-reject
           semi-automatic crawl clicking through banners on 560 sites
[OK     ] WWW/2021/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
           claimed: accept-and-reject
           "we leverage the Consent-O-matic tool"; three crawls, one per consent action
[OK     ] PETS/2022/how-can-and-would-people-protect-from-online-tracking
           claimed: accept-and-reject
           "On the second visit, we accept the cookies... on the next visit, we try to opt-out"
[OK     ] USENIX/2022/automating-cookie-consent-and-gdpr-violation-detection
           claimed: accept-and-reject
           crawler consents to all purposes and separately denies consent
[OK     ] USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission
           claimed: accept-and-reject
           "three consent modes... accept all, reject all, and no action"
[OK     ] IMC/2023/the-prevalence-of-single-sign-on-on-the-web-towards-the-next-generation-of-web-c
           claimed: accept-all
           "We use a plugin to auto-accept cookie banners"
[WRONG  ] IMC/2023/understanding-the-privacy-risks-of-popular-search-engine-advertising-systems
           claimed: accept-all
           no first-person sentence mentions consent or a banner
[WRONG  ] PETS/2023/a-utility-preserving-obfuscation-approach-for-youtube-recommendations
           claimed: dismiss-or-remove
           the only "consent" is IRB participant consent for the user dataset
[OK     ] IEEE-SP/2023/the-leaky-web-automated-discovery-of-cross-site-information-leaks-in-browsers-an
           claimed: accept-all
           "the cookie banners accepted by our module"
[WRONG  ] IMC/2024/analyzing-the-in-accessibility-of-online-advertisements
           claimed: dismiss-or-remove
           the only "consent" is IRB informed consent; "banner" means banner ads
[OK     ] USENIX/2024/automated-large-scale-analysis-of-cookie-notice-compliance
           claimed: accept-and-reject
           five crawling steps: accepting, rejecting, closing, saving defaults, not interacting
[OK     ] NDSS/2024/fp-fed-privacy-preserving-federated-detection-of-browser-fingerprinting
           claimed: accept-all
           "...solving CAPTCHAs, and consenting to all cookie notices" (a manual sub-crawl)
[OK     ] USENIX/2024/dissecting-privacy-perspectives-of-websites-around-the-world-aceptar-todo-alle-a
           claimed: cmp-specific-choices
           measures "depth to reach the reject option", i.e. navigates the notice's own layers
[OK     ] PETS/2024/a-large-scale-study-of-cookie-banner-interaction-tools-and-their-impact-on-users
           claimed: accept-and-reject
           the paper IS a comparison of banner-interaction extensions
[OK     ] PETS/2024/fp-tracer-fine-grained-browser-fingerprinting-detection-via-taint-tracking-and-e
           claimed: accept-and-reject
           "we measure whether fingerprinters respect user consent banners using the Consent-O-Matic plugin"
[OK     ] PETS/2024/opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
           claimed: accept-and-reject
           audits four CMPs with consent conveyed and not conveyed
[OK     ] WWW/2024/a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework
           claimed: reject-all
           "accepted the automatic decline of user consent by our data collection system"
[OK     ] WWW/2024/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting
           claimed: accept-all
           "To automatically interact with cookie consent banners, we integrated code derived from Priv-Accept"
[OK     ] IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites
           claimed: accept-all
           "provide affirmative consent to all data processing request options (accept all)" via autoconsent
[OK     ] CCS/2025/piixel-leaks-passive-identification-of-personally-identifiable-information-leaka
           claimed: accept-all
           "we simulate a real user's choice of 'Accept All' using the Consent-O-Matic extension"
[OK     ] IMC/2025/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th
           claimed: accept-all
           "uses the autoconsent library to opt-in to common consent banners"
[OK     ] PETS/2025/johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
           claimed: accept-and-reject
           the paper accepts and then revokes consent on 200 sites
[OK     ] PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
           claimed: accept-and-reject
           "using BannerClick... accepting cookie banners in the first half and... rejected domains in the second"
[OK     ] PETS/2025/referrer-policy-implementation-and-circumvention
           claimed: accept-and-reject
           "we employed DuckDuckGo's autoconsent library... comparison of RP implementations in different consent modes"
[OK     ] WWW/2025/before-after-the-effect-of-eus-2022-code-of-practice-on-disinformation
           claimed: accept-all
           "we make use of Consent-O-Matic ... to automatically accept all cookies in consent banners"
[OK     ] USENIX/2025/navigating-cookie-consent-violations-across-the-globe
           claimed: reject-all
           ConsentChk drives the banner across eight regions
[OK     ] WWW/2025/semantics-aware-cookie-purpose-compliance
           claimed: accept-all
           "We use two browser extensions, namely Consent-O-Matic and Cookie-Editor"
[OK     ] WWW/2025/the-first-early-evidence-of-the-use-of-browser-fingerprinting-for-online-trackin
           claimed: cmp-specific-choices
           "executing window.OneTrust.RejectAll to opt out"; per-CMP reject clicking
[WRONG  ] PETS/2026/the-masks-we-think-we-wear-privacy-threats-of-browser-extension-wallets-in-the-w
           claimed: dismiss-or-remove
           "explicit consent" is a RECOMMENDATION about wallet permissions, not a crawl action
[OK     ] PETS/2026/clicking-into-exposure-uncovering-privacy-risks-of-google-click-identifier-in-yo
           claimed: accept-and-reject
           "(i) a baseline run that accepts cookie banners... (ii) a rejection run that declines them"
[OK     ] PETS/2026/privacy-vs-profit-the-impact-of-googles-manifest-version-3-mv3-update-on-ad-bloc
           claimed: accept-all
           "Accept consent notice via Super Agent-Automatic Cookie Consent extension"
[OK     ] USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
           claimed: accept-all
           "We modify the crawler to automatically accept cookies using Priv-Accept"

Run 2026-09-05. §7.2 audited the 36 papers claiming an interaction and left the complementary 313 unread, which meant the page's central denominator rested on an unaudited field. All 313 have now been read.

What no-interaction asserts. It is not a sentinel. The same field carries not-stated (495 crawling papers) and not-applicable (236), so no-interaction is a positive claim: the paper says its crawl left the notice alone. A paper that never discusses consent should have been not-stated, and counting it as a stated value inflates precisely the quantity the page is about.

Five verdicts, each anchored in the paper's own words rather than in a judgement about how completely the crawl is described. That boundary was chosen deliberately: “the paper describes its procedure fully enough that non-interaction follows” is not reproducible across 313 papers, and would have made the audit a matter of taste.

1. The 313 were partitioned mechanically first. A deliberately wide vocabulary pattern (consent, cookie banner/notice/bar/wall/dialog/prompt, banner, CMP, GDPR, ePrivacy, opt-in, opt-out, accept all, reject all, the named banner tools, the named CMP vendors, pop-up, overlay, interstitial, modal) was run over both renderings of every full text — paper.cols.txt and paper.txt. 72 papers contain no hit in either. Those are unstated without further reading. Positive control: the pattern fires on 36 of 36 papers on the interacting side, including all 29 verified ones.
2. A third, independent extraction was run over a sample of the 72. paper.cols.txt and paper.txt are both pypdf-derived, so agreeing that a paper has no consent vocabulary is weaker evidence than it looks. 12 of the 72 were drawn at random (seed 20260905) and re-extracted directly from paper.pdf with pypdf 6.16.2: 12 of 12 confirmed zero hits, with 50k–97k characters extracted each, so the files are not truncated.
3. The remaining 241 were read. For each, every sentence carrying a consent term was extracted, ranked (named tool > non-interaction phrase with a first-person marker > consent term with a first-person marker > consent term alone) and adjudicated by hand, in batches of 20, in publication order. Where the excerpt was ambiguous the paper's full text was queried directly with a targeted pattern; 21 papers needed that, and 7 changed verdict as a result — my-cookie-is-a-phoenix, everybodys-looking-for-ssomething, comparing-large-scale-privacy-and-security-notifications and digital-disparities from unstated to ok, reproducibility-and-replicability from unstated to implied, CookieEnforcer from unstated to wrong, and WhisperTest from ok to partial.
4. Two recall probes were then run over all 313 as a check on the hand pass, one for statements of interaction and one for statements of non-interaction (§7.3.5). Neither found a paper the hand pass had missed. Neither alone finds every ok either, which is why they are a safety net and not the method.

The two sides of the field fail in different ways, and the no-interaction failure is both far more common and far more consequential.

On the interacting side the extractor misreads a word — a push-notification prompt, a banner ad, an IRB consent form. On the no-interaction side it supplies a default where the paper is silent. The second is the error that matters, because it is what manufactures a reporting rate: 349 papers “stating a consent action” becomes 55.

What the consent vocabulary in the 279 unsupported papers actually was. This is the residue of the classification, printed so the part that could not be a consent claim stays visible:

The fieldstudy pair is worth naming because both are landmark consent papers and both are unstated here: Utz et al., (Un)informed Consent [3Utz, Christine; Degeling, Martin; Fahl, Sascha; Schaub, Florian; Holz, Thorsten (2019): "(Un)informed Consent: Studying GDPR Consent Notices in the Field", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)], whose “no action” figures describe the field experiment's real visitors while its Selenium crawl is described only as visiting home pages and taking screenshots; and Degeling et al., We Value Your Privacy… Now Take Some Cookies [4Degeling, Martin; Utz, Christine; Lentzsch, Christopher; Hosseini, Henry; Schaub, Florian; Holz, Thorsten (2019): "We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)], which categorises notices and their interaction options but never states what its own crawler did. Neither paper is careless. The extraction simply has no value for “measured consent on humans”.

Why the headline count is 32 and not 31 or 33. 29 verified on the interacting side plus the 3 false negatives is 32. Of those 32, 31 interact with a web consent notice; the TCF paper's interaction is entirely inside Android apps. Counting the partial as well gives 33. The content page publishes 32, and the platform split is in this table rather than in a footnote because a reader building a web-only comparison needs 31.

A pattern worth carrying. Two of the three were found because a named tool appears in the text (BannerClick, CookieEnforcer). A paper that rolled its own clicking and described it in one unremarkable sentence would still be missed by both the extractor and this audit. That is why the content page calls 32 a floor.

Probe A looks for statements of interaction; probe B for statements of non-interaction. Both are reported here, because a probe that is only reported when it agrees with you is not a check.

• Probe A's positive control fires on 26 of 28 papers the interacting-side audit verified — not 28 of 28. It would have missed two real interactions. It does contain all 3 false negatives and the 1 partial.
• Probe B misses 8 of the 22 ok papers, listed in the output below. Several state non-interaction in wording no compact pattern catches: “we chose not to interact…”, “as instrumenting opt-in/out was out of the scope of this work”, “a lack of interaction with these banners”.
• Probe A fires on 21 papers the hand pass ruled unstated and probe B on 12. Each was re-read; none describes the paper's own crawl acting on a notice.

A bug found by mutating the probe rather than reading it. Probe B's first version ended its pattern with a word boundary after the noun, so a pattern for “cookie banner” did not match “cookie banners”. It silently reported zero hits for Beyond the Front Page [7Urban, Tobias; Degeling, Martin; Holz, Thorsten; Pohlmann, Norbert (2020): "Beyond the Front Page:Measuring Third Party Dynamics in the Field", in: Proceedings of The Web Conference 2020, pp. 1275–1286. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)], whose methods section says in as many words that its OpenWPM instance “does not interact with any cookie banners”. The plural was the whole bug. It was caught by testing the pattern against a sentence already known to be positive, not by reading the regex.

The verdict reasons are this audit's only human-readable evidence, so a half-remembered quote there would be indistinguishable from a real one. consent_ni_quotecheck.mjs checks every double-quoted phrase against both renderings of the cited paper. It has to tolerate the two-column splice: both renderings are pypdf-derived, so a sentence crossing a column break is interleaved with its neighbour —

...appear on 767 websites our crawls, we did not interact with cookie
banners on the visited (10.41% of the visited websites). websites, that
is we never accepted nor rejected cookies during our visit.

— and a verbatim quote of that sentence is therefore not a contiguous substring of anything. The checker runs contiguous first and falls back to “the quote's words appear in order within a span no more than three times the quote's own length”, which a splice satisfies and a fabrication does not.

quotes verbatim and contiguous in the source:        112
quotes in order across a two-column splice:          17
quotes NOT found in the cited paper:                 0
verdicts carrying no verbatim quote (paraphrase):    200
multi-word single-quoted mentions checked:           0
  ... of those, NOT found in the cited paper:        0

mutation self-test: 82 corrupted quotes rejected, 0 wrongly accepted

What it caught on its first run. 18 failures, of three kinds, all in the verdict file and none in the papers:

1. Two misattributions. Two unstated reasons carried the evidence of a different paper — the “popup window / postMessage” sentence had been filed against WWW/2017/tracking-phishing-attacks-over-time and the “bimodal NTP distribution” sentence against PETS/2019/donttweetthis. Both came from a patch that de-duplicated reasons by position in a list instead of by key. Neither changed a verdict, and neither would have been found by re-reading the file.
2. Paraphrases presented as quotes, e.g. “adopting CAPTCHA as a cloaking technique” where the paper says “webpages adopting client-side cloaking can use a CAPTCHA”. Rewritten to the papers' words.
3. Quotation-mark artefacts from a mechanical conversion that promoted apostrophes inside words to quote delimiters, producing fragments such as “s subject is the browser”.

A mutation self-test (–mutate) corrupts the middle word of every quote of four words or more and requires a FAIL: 82 corrupted quotes, 82 rejected, 0 wrongly accepted.

Then it missed a third misattribution, and a reviewer found it. NDSS/2013/the-postman-always-rings-twice… carried the reason “one hit, Tor described as an 'overlay' network”, which is the evidence of PETS/2022/from-onion-not-found-to-guard-discovery — the postMessage paper never mentions Tor. Its only overlay is inside the URL fragment overlay-analytics, and the apparent “tor.js” is paper.txt line-wrapping selector.js into selec- and tor.js. The verdict (unstated) was right; the evidence was another paper's. It escaped because the checker's own convention exempted single-quoted text as “a word being mentioned” — and this single-quoted run was a substantive claim, not a mention. The checker now verifies every single-quoted run of three words or more as well, excluding word-internal apostrophes and spans that contain a double quote. That check currently finds zero mentions to verify, which is a vacuous pass, so it was mutation-tested directly: injecting a fabricated 'Tor is an overlay network of volunteer-run relays' into that same verdict produces MENTION NOT IN PAPER.

And a structural check was added ahead of both. The mechanical single-to-double conversion had also turned doesn't into doesn“t in 7 reasons, leaving an unbalanced delimiter. The verify step passed them, because the mangled fragment it extracted (“By default, it doesn”) really does appear in the paper. Balanced quotes, and no quote mark inside a word, are now checked before any text is looked up. One of the 7 was WWW/2025/digital-disparities; repairing it turned up the sentence after the one quoted — “While solutions exist, their reliability is untested” — which upgraded that verdict from a hedged weak to a plain explicit.

The audited “states a consent action” series is 55 papers across five buckets, not 349, so every adjacent movement was tested before the content page described any of it.

audited 'states a consent action', adjacent buckets
  2010-2013 (0/102 = 0.0%) vs 2014-2017 (0/167 = 0.0%): p = 1  NOT significant at 0.05
  2014-2017 (0/167 = 0.0%) vs 2018-2021 (11/308 = 3.6%): p = 0.009883  significant at 0.05
  2018-2021 (11/308 = 3.6%) vs 2022-2024 (25/345 = 7.2%): p = 0.05751  NOT significant at 0.05
  2022-2024 (25/345 = 7.2%) vs 2025-2026* (19/198 = 9.6%): p = 0.3324  NOT significant at 0.05

pre-GDPR 2010-2017 (0/269) vs 2018-2026 (55/851): p = 3.023e-07

unaudited extraction series, adjacent buckets (what the page said before)
  2010-2013 (24.5%) vs 2014-2017 (29.9%): p = 0.4008  NOT significant
  2014-2017 (29.9%) vs 2018-2021 (32.1%): p = 0.679  NOT significant
  2018-2021 (32.1%) vs 2022-2024 (33.6%): p = 0.7387  NOT significant
  2022-2024 (33.6%) vs 2025-2026* (29.8%): p = 0.3911  NOT significant

Two things follow. The GDPR step is real, and everything after it is not established at conventional levels. And none of the four adjacent movements in the unaudited series is significant either — the “peak at 33.6%, back to 29.8%” narrative on the previous revision of the content page was describing noise, in a population that was both stale and underpowered. That narrative is gone.

no-interaction papers: 313
adjudicated:           313

── Verdicts on the 313 ──
Verdict                                                               Papers  Share of 313
--------------------------------------------------------------------  ------  ------------
the paper says it did not act on a consent notice                     22      7.0%
the paper says it does not interact at all (consent never mentioned)  8       2.6%
NOT supported by the paper — should have been not-stated              279     89.1%
an interacting arm is described elsewhere in the paper                1       0.3%
the paper DOES act on a consent notice — false negative               3       1.0%

UNSUPPORTED RATE of no-interaction: 279/313 = 89.1%
FALSE-NEGATIVE RATE of no-interaction: 3/313 = 1.0%
  (for comparison, the interacting values' false-positive rate is 7/36 = 19.4%)

── What the consent vocabulary in the unsupported papers actually was ──
Tag          Papers  Share of 279
-----------  ------  ------------
noise        74      26.5%
none         72      25.8%
phenomenon   48      17.2%
irb          24      8.6%
background   22      7.9%
adbanner     19      6.8%
optout       9       3.2%
protobanner  6       2.2%
copyright    3       1.1%
fieldstudy   2       0.7%

── The false negatives, in full ──
[WRONG   ] USENIX/2023/automated-cookie-notice-analysis-and-enforcement
           platforms: web
           CookieEnforcer "addresses these challenges by mimicking the actions of real users: it interacts with the cookie notices", and the backend was run over 85,473 of the top 100k Tranco sites to disable non-essential cookies — a cmp-specific-choices interaction
[WRONG   ] IMC/2024/browsing-without-third-party-cookies-what-do-you-see
           platforms: web
           "we adopted BannerClick" "to automatically click the accept and reject buttons in cookie notices", counting cookies "after BannerClick interaction" — an accept-and-reject design
[PARTIAL ] CCS/2025/whispertest-a-voice-control-based-library-for-ios-ui-automation
           platforms: mobile, web
           the Safari web crawler "does not interact with consent dialogs", but the same paper drives 200 iOS apps "while accepting and rejecting consent dialogs" - an accept-and-reject arm exists on the app side
[WRONG   ] PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
           platforms: mobile, web
           "We design a methodology to semi-automatically interact with consent banners deployed by major CMPs in TCF-based Android apps, combining three approaches ... disagree to all, legitimate interest purposes only, and consent to all"

── Every paper that states a consent action, after auditing BOTH sides ──
papers that ran a crawl:                                  1120
  extraction says they state a consent action:            349 (31.2%)
  ... AUDITED as stating one:                             55 (4.9%)
  ... plus papers stating no interaction of any kind:     63 (5.6%)

verifiably INTERACTED with a consent notice:              32 (2.9% of crawled)
  ... of which on the web rather than in a mobile app:    31
  ... plus the partial (an app-side accept/reject arm):   33
verifiably did NOT act on a consent notice:               22 (2.0% of crawled)
no consent action can be established from the paper:      1057 (94.4% of crawled)

── The six-value table, extraction versus audit ──
Value                 Extraction  Supported by the paper  Not supported
--------------------  ----------  ----------------------  -------------
accept-all            15          11                      4
accept-and-reject     14          14                      0
cmp-specific-choices  2           2                       0
dismiss-or-remove     3           0                       3
reject-all            2           2                       0
no-interaction        313         22                      283
(for no-interaction, "not supported" = 279 unstated + 3 false negatives + 1 partial;
 the 8 "implied" papers are counted in neither column)

── By year bucket, on the AUDITED set ──
Bucket      Crawling papers  Audited: states an action  Share  Of those, interacted
----------  ---------------  -------------------------  -----  --------------------
2010–2013   102              0                          0.0%   0
2014–2017   167              0                          0.0%   0
2018–2021   308              11                         3.6%   3
2022–2024   345              25                         7.2%   16
2025–2026*  198              19                         9.6%   13

── Vantage point ──

  papers AUDITED as stating a consent action (n=55):
Vantage                             Papers  Share of 55
----------------------------------  ------  -----------
EU/EEA vantage                      37      67.3%
vantage tuple, location not-stated  11      20.0%
stated a non-EU/EEA vantage only    7       12.7%

  papers whose INTERACTION is verified (n=32):
Vantage                             Papers  Share of 32
----------------------------------  ------  -----------
EU/EEA vantage                      22      68.8%
vantage tuple, location not-stated  6       18.8%
stated a non-EU/EEA vantage only    4       12.5%

  papers that verifiably did NOT act (n=22):
Vantage                             Papers  Share of 22
----------------------------------  ------  -----------
EU/EEA vantage                      14      63.6%
vantage tuple, location not-stated  5       22.7%
stated a non-EU/EEA vantage only    3       13.6%

── Two-armed designs (an accept arm AND a reject arm), audited ──
papers with a verified two-armed design: 16 (was 14 before this audit; 17 counting the partial)
       PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
       IEEE-SP/2020/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
       WWW/2021/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
       PETS/2022/how-can-and-would-people-protect-from-online-tracking
       USENIX/2022/automating-cookie-consent-and-gdpr-violation-detection
       USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission
       USENIX/2024/automated-large-scale-analysis-of-cookie-notice-compliance
       PETS/2024/a-large-scale-study-of-cookie-banner-interaction-tools-and-their-impact-on-users
       PETS/2024/fp-tracer-fine-grained-browser-fingerprinting-detection-via-taint-tracking-and-e
       PETS/2024/opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
   NEW IMC/2024/browsing-without-third-party-cookies-what-do-you-see
       PETS/2025/johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
       PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
       PETS/2025/referrer-policy-implementation-and-circumvention
       PETS/2026/clicking-into-exposure-uncovering-privacy-risks-of-google-click-identifier-in-yo
   NEW PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of

── Statefulness crossed with an AUDITED consent action ──
papers stating both an audited consent action and a statefulness: 32
Statefulness / action    Papers
-----------------------  ------
stateless / interacted   10
stateless / did not act  8
both / interacted        6
stateful / interacted    4
stateful / did not act   4

The two recall probes:

            no consent vocabulary anywhere in either rendering of the full text
── Probe A (statements of INTERACTION) ──
positive control: fires on 26/28 papers the interacting-side audit verified
   MISSED: NDSS/2024/fp-fed-privacy-preserving-federated-detection-of-browser-fingerprinting
   MISSED: IEEE-SP/2023/the-leaky-web-automated-discovery-of-cross-site-information-leaks-in-browsers-an
fires on 42 of the 313 no-interaction papers
of those, hand verdict: wrong=3, partial=1, ok=17, implied=0, unstated=21
every "wrong"/"partial" paper is in probe A's hits: true

probe-A hits the hand pass ruled "unstated" (each re-read; none describes the paper's own crawl acting on a notice): 21
   CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections  [phenomenon]
   IEEE-SP/2013/cookieless-monster-exploring-the-ecosystem-of-web-based-device-fingerprinting  [phenomenon]
   USENIX/2016/investigating-commercial-pay-per-install-and-the-distribution-of-unwanted-softwa  [phenomenon]
   PETS/2017/why-can-t-users-choose-their-identity-providers-on-the-web  [phenomenon]
   USENIX/2018/o-single-sign-off-where-art-thou-an-empirical-analysis-of-single-sign-on-account  [phenomenon]
   CCS/2019/un-informed-consent-studying-gdpr-consent-notices-in-the-field  [fieldstudy]
   IMC/2019/measuring-ewhoring  [irb]
   NDSS/2019/we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy  [fieldstudy]
   NDSS/2021/tales-of-favicons-and-caches-persistent-tracking-in-modern-browsers  [phenomenon]
   PETS/2021/privacy-preference-signals-past-present-and-future  [phenomenon]
   CCS/2022/do-opt-outs-really-opt-me-out  [phenomenon]
   PETS/2022/checking-websites-gdpr-consent-compliance-for-marketing-emails  [phenomenon]
   PETS/2022/setting-the-bar-low-are-websites-complying-with-the-minimum-requirements-of-the  [phenomenon]
   CCS/2023/policychecker-analyzing-the-gdpr-completeness-of-mobile-apps-privacy-policies  [phenomenon]
   USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks  [adbanner]
   PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part  [irb]
   PETS/2024/privacy-policies-on-the-fediverse-a-case-study-of-mastodon-instances  [irb]
   WWW/2024/experimental-security-analysis-of-sensitive-data-access-by-browser-extensions  [irb]
   PETS/2025/understanding-privacy-norms-through-web-forms  [phenomenon]
   USENIX/2025/analyzing-the-ai-nudification-application-ecosystem  [phenomenon]
   USENIX/2025/evaluating-privacy-policies-under-modern-privacy-laws-at-scale-an-llm-based-auto  [phenomenon]

── Probe B (statements of NON-interaction) ──
fires on 29 of the 313 no-interaction papers
of those, hand verdict: wrong=2, partial=1, ok=14, implied=0, unstated=12
"ok" papers probe B does NOT find (why the hand pass, not the probe, is the method): 8
   USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
   CCS/2020/fill-in-the-blanks-empirical-analysis-of-the-privacy-threats-of-browser-form-aut
   PETS/2020/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
   NDSS/2021/reining-in-the-webs-inconsistencies-with-site-policy
   PETS/2022/atom-ad-network-tomography
   IMC/2025/a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
   WWW/2025/digital-disparities-a-comparative-web-measurement-study-across-economic-boundari
   PETS/2025/unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie

probe-B hits the hand pass ruled "unstated" (each re-read; all are consent as a phenomenon, ethics or background): 12
   IMC/2017/tripwire-inferring-internet-site-compromise  [irb]
   CCS/2019/un-informed-consent-studying-gdpr-consent-notices-in-the-field  [fieldstudy]
   IEEE-SP/2019/resident-evil-understanding-residential-ip-proxy-as-a-dark-service  [protobanner]
   NDSS/2019/we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy  [fieldstudy]
   CCS/2021/consistency-analysis-of-data-usage-purposes-in-mobile-apps  [phenomenon]
   NDSS/2021/tales-of-favicons-and-caches-persistent-tracking-in-modern-browsers  [phenomenon]
   PETS/2021/privacy-preference-signals-past-present-and-future  [phenomenon]
   PETS/2022/checking-websites-gdpr-consent-compliance-for-marketing-emails  [phenomenon]
   CCS/2023/cookiegraph-understanding-and-detecting-first-party-tracking-cookies  [noise]
   CCS/2023/policychecker-analyzing-the-gdpr-completeness-of-mobile-apps-privacy-policies  [phenomenon]
   PETS/2024/privacy-policies-on-the-fediverse-a-case-study-of-mastodon-instances  [irb]
   USENIX/2024/dancer-in-the-dark-synthesizing-and-evaluating-polyglots-for-blind-cross-site-sc  [irb]

All 313 verdicts, one line per paper:

consent_action_noninteraction_verdicts.txt

── Every verdict, in full ──
[UNSTATED|phenomenon] CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections
            the paper's subject is the browser's own download-consent dialog: it looks for a click whose coordinates fall "in the areas of download consent dialogs"; no web consent notice appears
[UNSTATED|adbanner  ] IEEE-SP/2010/on-the-incoherencies-in-web-browser-access-control-policies
            the only 'banner' is an ad banner in an access-control discussion
[UNSTATED|adbanner  ] IMC/2010/challenges-in-measuring-online-advertising-systems
            'banner ads' as an ad format
[UNSTATED|none      ] WWW/2010/analyzing-content-level-properties-of-the-web-adversphere
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] CCS/2011/surf-detecting-and-measuring-search-poisoning
            the WIDE hits are 'adopting'/'overlay' prose; no consent term
[UNSTATED|none      ] IEEE-SP/2011/click-trajectories-end-to-end-analysis-of-the-spam-value-chain
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|irb       ] IMC/2011/analyzing-facebook-privacy-settings-user-expectations-vs-reality
            the survey's participant consent form
[UNSTATED|noise     ] IMC/2011/measuring-the-state-of-ecn-readiness-in-servers-clients-and-routers
            ICMP 'quotation' and 'adopting' prose; no consent term
[UNSTATED|noise     ] USENIX/2011/dirty-jobs-the-role-of-freelance-labor-in-web-service-abuse
            one hit, the word 'overlay' in a normalisation sentence
[UNSTATED|none      ] USENIX/2011/measuring-and-analyzing-search-redirection-attacks-in-the-illicit-online-prescri
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads
            the phrase "without the user" and its consent clause describe the drive-by download attack, not a crawl
[UNSTATED|noise     ] WWW/2011/heat-seeking-honeypots-design-and-experience
            one hit, 'crawling' adjacency; no consent term
[UNSTATED|none      ] WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|protobanner] CCS/2012/manufacturing-compromise-the-emergence-of-exploit-as-a-service
            SMTP server banners, plus affiliate ad banners
[UNSTATED|noise     ] IEEE-SP/2012/lastor-a-low-latency-as-aware-tor-client
            'Quantcast' is the top-list provider, not the CMP
[UNSTATED|phenomenon] IEEE-SP/2012/memento-learning-secrets-from-process-footprints
            "This requires neither the phone owner" nor any permission — an Android side-channel discussion, not a web notice
[UNSTATED|none      ] WWW/2012/branded-with-a-scarlet-c-cheaters-in-a-gaming-social-network
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] WWW/2012/counting-beyond-a-yottabyte-or-how-sparql-1-1-property-paths-will-prevent-adopti
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] WWW/2012/serf-and-turf-crowdturfing-for-fun-and-profit
            one hit, 'pop-up' describing QQ desktop messages
[UNSTATED|protobanner] CCS/2013/protocol-misidentification-made-easy-with-format-transforming-encryption
            SSH/SMB protocol banner messages in an FTE discussion
[UNSTATED|phenomenon] IEEE-SP/2013/cookieless-monster-exploring-the-ecosystem-of-web-based-device-fingerprinting
            'opting-out' of fingerprinting in general; no crawl treatment
[UNSTATED|noise     ] NDSS/2013/the-postman-always-rings-twice-attacking-and-defending-postmessage-in-html5-webs
            the sole hit is the word overlay inside the URL fragment "overlay-analytics"; the apparent Tor reference is paper.txt line-wrapping "selector.js" into "selec-" and "tor.js"
[UNSTATED|none      ] WWW/2013/i-know-the-shortened-urls-you-clicked-on-twitter-inference-attack-using-public-c
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] WWW/2013/the-role-of-web-hosting-providers-in-detecting-compromised-websites
            "take no action" describes hosting providers' abuse response, not the crawler
[UNSTATED|none      ] CCS/2014/a-critical-evaluation-of-website-fingerprinting-attacks
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|optout    ] CCS/2014/the-web-never-forgets-persistent-tracking-mechanisms-in-the-wild
            opts out via the NAI and EDAA industry opt-out pages (2014, pre-GDPR); no consent notice
[UNSTATED|optout    ] CCS/2014/your-online-interests-pwned-a-pollution-attack-against-targeted-advertising
            a Microsoft ad opt-out URL; "top banner display ad"
[UNSTATED|none      ] IMC/2014/censorship-in-the-wild-analyzing-internet-filtering-in-syria
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] IMC/2014/search-seizure-the-effectiveness-of-interventions-on-seo-campaigns
            the only hits are Google Safe Browsing "interstitial" pages in search results
[UNSTATED|copyright ] NDSS/2014/dspin-detecting-automatically-spun-content-on-the-web
            the ACM "copies bear this notice" boilerplate
[UNSTATED|adbanner  ] USENIX/2014/hulk-eliciting-malicious-behavior-in-browser-extensions
            banner replacement by malicious extensions; Chrome install consent
[UNSTATED|none      ] USENIX/2014/optimizing-seed-selection-for-fuzzing
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] USENIX/2014/ssoscan-automated-testing-of-web-applications-for-single-sign-on-vulnerabilities
            OAuth user consent to issue a token; 'quantcast' is the top list
[UNSTATED|none      ] USENIX/2014/the-long-taile-of-typosquatting-domain-names
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] USENIX/2014/understanding-the-dark-side-of-domain-parking
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] CCS/2015/caronte-detecting-location-leaks-for-deanonymizing-tor-hidden-services
            one hit, Tor described as "an overlay of the Internet"
[UNSTATED|phenomenon] IEEE-SP/2015/ad-injection-at-scale-assessing-deceptive-advertisement-modifications
            ad injection "irrespective of user consent"; fly-in ad banners
[IMPLIED |noclick   ] IMC/2015/affiliate-crookies-characterizing-affiliate-marketing-abuse
            "While crawling we do not click on any links" - an explicit no-interaction statement, but the paper never mentions consent notices (2015)
[UNSTATED|optout    ] IMC/2015/from-academy-to-zone-an-analysis-of-the-new-tld-land-rush
            a registrar's opt-out domain offering
[UNSTATED|adbanner  ] NDSS/2015/parking-sensors-analyzing-and-detecting-parked-domains
            parked-domain advertising banners; ISOC copyright consent
[UNSTATED|copyright ] NDSS/2015/upgrading-https-in-mid-air-an-empirical-study-of-strict-transport-security-and-k
            the ISOC "prior written consent" boilerplate is the only consent sentence
[UNSTATED|none      ] USENIX/2015/circuit-fingerprinting-attacks-passive-deanonymization-of-tor-hidden-services
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] USENIX/2015/measuring-the-longitudinal-evolution-of-the-online-anonymous-marketplace-ecosyst
            one hit, a reference title, "Privacy-enhancing overlays in bitcoin"
[UNSTATED|phenomenon] WWW/2015/understanding-malvertising-through-ad-injecting-browser-extensions
            extensions inserting ads "without user consents"
[UNSTATED|none      ] CCS/2016/online-tracking-a-1-million-site-measurement-and-analysis
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] CCS/2016/protecting-insecure-communications-with-topology-aware-network-tunnels
            ICMP prose; no consent term
[UNSTATED|noise     ] IEEE-SP/2016/cloak-of-visibility-detecting-when-machines-browse-a-different-web
            "opting to measure" is the verb, not an opt-out
[UNSTATED|none      ] IEEE-SP/2016/seeking-nonsense-looking-for-trouble-efficient-promotional-infection-detection-t
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|adbanner  ] IEEE-SP/2016/sending-out-an-sms-characterizing-the-security-of-the-sms-ecosystem-with-public
            an anti-adblock banner; SMS gateway 'opt-in'
[UNSTATED|noise     ] IMC/2016/browser-feature-usage-on-the-modern-web
            one hit, "pop-up windows" in a postMessage discussion
[UNSTATED|phenomenon] PETS/2016/are-you-sure-you-want-to-contact-us-quantifying-the-leakage-of-pii-via-website-c
            PII reaching third parties "without the user" knowing or consenting; Quantcast appears as a top-list provider
[UNSTATED|noise     ] USENIX/2016/internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-study-of-w
            third-party popups as a tracking mechanism; no consent term
[UNSTATED|phenomenon] USENIX/2016/investigating-commercial-pay-per-install-and-the-distribution-of-unwanted-softwa
            software-install consent dialogues in the pay-per-install ecosystem
[UNSTATED|none      ] USENIX/2016/the-ever-changing-labyrinth-a-large-scale-analysis-of-wildcard-dns-powered-black
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] WWW/2016/an-empirical-study-of-web-cookies
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] WWW/2016/characterizing-long-tail-seo-spam-on-cloud-web-hosting-services
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] CCS/2017/how-unique-is-your-onion-an-analysis-of-the-fingerprintability-of-tor-onion-serv
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] IEEE-SP/2017/how-to-learn-klingon-without-a-dictionary-detection-and-measurement-of-black-key
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] IEEE-SP/2017/stack-overflow-considered-harmful-the-impact-of-copy-paste-on-android-applicatio
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|background] IEEE-SP/2017/xhound-quantifying-the-fingerprintability-of-browser-extensions
            no consent bearing on the crawl
[UNSTATED|adbanner  ] IMC/2017/the-ad-wars-retrospective-measurement-and-analysis-of-anti-adblock-filter-lists
            "examplebanner" is a filter-rule example
[UNSTATED|irb       ] IMC/2017/tripwire-inferring-internet-site-compromise
            research ethics: consent of the monitored websites; Quantcast as a top list
[UNSTATED|irb       ] NDSS/2017/dial-one-for-scam-a-large-scale-analysis-of-technical-support-scams
            an IRB waiver of consent for deceiving scammers; ISOC copyright
[UNSTATED|copyright ] NDSS/2017/thou-shalt-not-depend-on-me-analysing-the-use-of-outdated-javascript-libraries-o
            the ISOC "prior written consent" notice is the sole consent sentence in the paper
[UNSTATED|optout    ] PETS/2017/cross-device-tracking-measurement-and-disclosures
            DAA and NAI industry opt-out programmes are the object of study; the crawl exercises none
[UNSTATED|noise     ] PETS/2017/detecting-anti-ad-blockers-in-the-wild
            anti-adblock pop-up notifications; no consent term
[UNSTATED|adbanner  ] PETS/2017/topics-of-controversy-an-empirical-analysis-of-web-censorship-lists
            the only hit is a censorship-list page using "banners and links" as advertising
[UNSTATED|noise     ] PETS/2017/towards-seamless-tracking-free-web-improved-detection-of-trackers-via-one-class
            a Privacy Badger "cookieblocklist" URL matched the tool pattern
[UNSTATED|phenomenon] PETS/2017/why-can-t-users-choose-their-identity-providers-on-the-web
            the GitHub/OAuth identity-provider consent screen is the subject
[UNSTATED|noise     ] USENIX/2017/a-privacy-analysis-of-cross-device-tracking
            'Quantcast' is the top-list provider
[UNSTATED|noise     ] USENIX/2017/ccsp-controlled-relaxation-of-content-security-policies-by-runtime-policy-compos
            'banner.jpg' inside a CSP code sample
[UNSTATED|noise     ] USENIX/2017/how-the-web-tangled-itself-uncovering-the-history-of-client-side-web-in-security
            one hit, "popup window" in a postMessage discussion
[UNSTATED|none      ] WWW/2017/extended-tracking-powers-measuring-the-privacy-diffusion-enabled-by-browser-exte
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] WWW/2017/tracking-phishing-attacks-over-time
            one hit, "we have a bimodal distribution" of phishing-cluster lifetimes
[OK      |mining    ] CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense
            "That is, the crawler did not give any consent for cryptomining" - explicit, though the prompt is a cryptomining consent button, not a cookie notice
[UNSTATED|adbanner  ] IEEE-SP/2018/surveylance-automatically-detecting-online-survey-scams
            overlay ads and pop-ups in survey-scam pages
[UNSTATED|phenomenon] IEEE-SP/2018/the-spyware-used-in-intimate-partner-violence
            "without interaction with the current user" describes stalkerware apps
[UNSTATED|phenomenon] IMC/2018/digging-into-browser-based-crypto-mining
            AuthedMine's mining-consent prompt is the object of study
[UNSTATED|none      ] IMC/2018/impact-of-device-performance-on-mobile-internet-qoe
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] PETS/2018/i-never-signed-up-for-this-privacy-implications-of-email-tracking
            "pop-up windows" and the literal strings 'modal'/'dialog' in an email-tracking discussion
[UNSTATED|none      ] USENIX/2018/analysis-of-privacy-protections-in-fitness-tracking-social-networks-or-you-can-r
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] USENIX/2018/freezing-the-web-a-study-of-redos-vulnerabilities-in-javascript-based-web-server
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] USENIX/2018/o-single-sign-off-where-art-thou-an-empirical-analysis-of-single-sign-on-account
            the OpenID Connect end-user consent step
[UNSTATED|adbanner  ] WWW/2018/adbudgetkiller-online-advertising-budget-draining-attack
            responsive ad banners and a banner image
[UNSTATED|irb       ] WWW/2018/auditing-the-personalization-and-composition-of-politically-related-search-engin
            participants provided informed consent for the audit study
[UNSTATED|noise     ] WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics
            'Quantcast' as an analytics provider in a phishing table
[UNSTATED|irb       ] WWW/2018/crimebb-enabling-cybercrime-research-on-underground-forums-at-scale
            informed consent for underground-forum research
[UNSTATED|noise     ] WWW/2018/exposing-search-and-advertisement-abuse-tactics-and-infrastructure-of-technical
            tech-support-scam pop-ups; no consent term
[UNSTATED|none      ] WWW/2018/uncovering-http-header-inconsistencies-and-the-impact-on-desktop-mobile-websites
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] CCS/2019/poster-video-fingerprinting-in-tor
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|fieldstudy] CCS/2019/un-informed-consent-studying-gdpr-consent-notices-in-the-field
            the "no action" figures describe the field experiment's real visitors; the Selenium crawl is described only as visiting home pages and taking screenshots
[UNSTATED|background] IEEE-SP/2019/characterizing-pixel-tracking-through-the-lens-of-disposable-email-services
            GDPR consent as background to email tracking
[UNSTATED|none      ] IEEE-SP/2019/dangerous-skills-understanding-and-mitigating-security-risks-of-voice-controlled
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni
            "consents" is a de-columning artefact where two columns interleave mid-word
[UNSTATED|protobanner] IEEE-SP/2019/resident-evil-understanding-residential-ip-proxy-as-a-dark-service
            Nmap service banners grabbed from proxy IPs; ToS consent of the proxy users
[UNSTATED|noise     ] IMC/2019/ddos-hide-seek-on-the-effectiveness-of-a-booter-services-takedown
            'bimodal' matched the pattern; no consent term
[UNSTATED|irb       ] IMC/2019/measuring-ewhoring
            a REB waiver of informed consent
[UNSTATED|adbanner  ] IMC/2019/no-more-chasing-waterfalls-a-measurement-study-of-the-header-bidding-ad-ecosyste
            ad-slot sizes named 'top banner' and 'side banner'
[UNSTATED|optout    ] IMC/2019/rpki-is-coming-of-age-a-longitudinal-study-of-rpki-deployment-and-invalid-route
            "incremental opt-in adoption" of ASPA objects in RPKI
[UNSTATED|none      ] IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs
            no consent vocabulary anywhere in either rendering of the full text
[OK      |explicit  ] IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
            "Furthermore, we do not interact with the consent notices displayed by the websites" and "we never gave actual consent to the use of cookies"
[UNSTATED|none      ] IMC/2019/visiblev8-in-browser-monitoring-of-javascript-in-the-wild
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|adbanner  ] IMC/2019/what-you-see-is-not-what-you-get-discovering-and-tracking-social-engineering-att
            overlay and banner ads in social-engineering campaigns
[UNSTATED|irb       ] NDSS/2019/quantity-vs-quality-evaluating-user-interest-profiles-using-ad-preference-managers
            participants installed an extension after informed consent
[UNSTATED|none      ] NDSS/2019/the-use-of-tls-in-censorship-circumvention
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] NDSS/2019/time-does-not-heal-all-wounds-a-longitudinal-analysis-of-security-mechanism-support-in-mobile-browsers
            "script sniffing opt-out" is the X-Content-Type-Options header
[UNSTATED|fieldstudy] NDSS/2019/we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy
            the paper categorises consent notices and their interaction options but never states a crawler consent action; its automated arm searches for privacy policies
[UNSTATED|noise     ] PETS/2019/donttweetthis-scoring-private-information-in-social-networks
            one hit, false alarms that "may prevent users from adopting it"
[UNSTATED|background] PETS/2019/maps-scaling-privacy-compliance-analysis-to-a-million-apps
            GDPR compliance of mobile apps' code and policies
[UNSTATED|adbanner  ] USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web
            "trick banners" and banner-ad click-through rates
[OK      |mining    ] USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
            "We have instructed the crawler to never explicitly consent to any mining operation" - explicit, though the prompt is a cryptomining opt-in, not a cookie notice
[UNSTATED|none      ] WWW/2019/anything-to-hide-studying-minified-and-obfuscated-code-in-the-web
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] WWW/2019/auditing-the-partisanship-of-google-search-snippets
            'bimodal' snippet-score distributions
[UNSTATED|background] WWW/2019/before-and-after-gdpr-the-changes-in-third-party-presence-at-public-and-private
            the GDPR is the subject of the before/after comparison; no crawler consent action
[UNSTATED|none      ] WWW/2019/doppelgangers-on-the-dark-web-a-large-scale-assessment-on-phishing-hidden-web-se
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild
            cryptomining consent; the manual check asks whether the site's opt-in system was enabled, not what the crawler did
[UNSTATED|noise     ] WWW/2019/unnecessarily-identifiable-quantifying-the-fingerprintability-of-browser-extensi
            the extension manifest's "exclude_matches" opt-out
[UNSTATED|none      ] WWW/2019/who-watches-the-watchmen-exploring-complaints-on-the-web
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] CCS/2020/deploying-android-security-updates-an-extensive-study-involving-manufacturers-ca
            "adopting security updates" by end users
[OK      |explicit  ] CCS/2020/fill-in-the-blanks-empirical-analysis-of-the-privacy-threats-of-browser-form-aut
            "While our initial plan was to programmatically interact with the consent overlays and accept the use of cookies, we found that ... complications ... prevent us"
[UNSTATED|adbanner  ] IEEE-SP/2020/adgraph-a-graph-based-approach-to-ad-and-tracker-blocking
            'banner' as an ad keyword in the AdGraph feature set
[UNSTATED|phenomenon] IEEE-SP/2020/an-analysis-of-pre-installed-android-software
            Android vendors' consent forms are the object of study
[UNSTATED|noise     ] IEEE-SP/2020/high-precision-open-world-website-fingerprinting
            "opting to use the word distance"; "consenting Tor clients" is a hypothetical
[UNSTATED|noise     ] NDSS/2020/carnus-exploring-the-privacy-threats-of-browser-extension-fingerprinting
            one hit, the reference title "Why johnny can" not opt out, a usability evaluation of behavioural-advertising controls
[UNSTATED|noise     ] NDSS/2020/complex-security-policy-a-longitudinal-analysis-of-deployed-content-security-policies
            CSP and HSTS opt-in/opt-out security mechanisms
[UNSTATED|none      ] NDSS/2020/deceptive-previews-a-study-of-the-link-preview-trustworthiness-in-social-platforms
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] NDSS/2020/melting-pot-of-origins-compromising-the-intermediary-web-services-that-rehost-websites
            "adopting HTTP" by rehosting services
[UNSTATED|phenomenon] NDSS/2020/uiscope-accurate-instrumentation-free-and-visible-attack-investigation-for-gui-applications
            a vulnerability opening "a pop-up window to explicitly ask for" the user's consent, inside the NDSS 2020 attack-investigation example
[OK      |explicit  ] PETS/2020/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
            "we did not emit any user behavior", written in explanation of cookies set before a user clicks the consent button
[UNSTATED|background] PETS/2020/the-price-is-not-right-comparing-privacy-in-free-and-paid-apps
            GDPR/COPPA parental consent in app privacy policies
[UNSTATED|noise     ] USENIX/2020/phishtime-continuous-longitudinal-measurement-of-the-effectiveness-of-anti-phish
            CAPTCHA and popup cloaking; "users who opt in" to Safe Browsing
[UNSTATED|noise     ] WWW/2020/a-first-look-at-commercial-5g-performance-on-smartphones
            ICMP RTT tables and "adopting mmWave"
[OK      |explicit  ] WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field
            "Our measurement platform, a customized OpenWPM instance, does not interact with any cookie banners" and "we never interacted with any cookie banners"
[UNSTATED|noise     ] WWW/2020/de-kodi-understanding-the-kodi-ecosystem
            "always opting to re-crawl an already crawled addon"
[UNSTATED|adbanner  ] WWW/2020/filter-list-generation-for-underserved-regions
            banner ads used as a table of contents on a forum
[UNSTATED|noise     ] WWW/2020/open-knowledge-enrichment-for-long-tail-entities
            "adopting effective estimators"
[UNSTATED|none      ] WWW/2020/towards-ip-based-geolocation-via-fine-grained-and-stable-webcam-landmarks
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] CCS/2021/all-your-credentials-are-belong-to-us-on-insecure-wpa2-enterprise-configurations
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] CCS/2021/consistency-analysis-of-data-usage-purposes-in-mobile-apps
            privacy-policy sentences about consent are the classifier's input
[UNSTATED|none      ] CCS/2021/encodermi-membership-inference-against-pre-trained-encoders-in-contrastive-learn
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] CCS/2021/t-reqs-http-request-smuggling-with-differential-fuzzing
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] IMC/2021/knock-and-talk-investigating-local-network-communications-on-websites
            a proposed opt-in model for local-network access
[UNSTATED|noise     ] IMC/2021/polls-clickbait-and-commemorative-2-bills-problematic-political-advertising-on-n
            modal newsletter dialogs occluding political ads; no consent term
[UNSTATED|noise     ] IMC/2021/who-you-gonna-call-an-empirical-evaluation-of-website-security-txt-deployment
            "adopting security.txt"; GDPR gutting WHOIS
[UNSTATED|optout    ] NDSS/2021/cv-inspector-towards-automating-detection-of-adblock-circumvention
            the Acceptable Ads whitelist opt-out; 'sourcepoint' appears only in a reference
[UNSTATED|background] NDSS/2021/from-whois-to-whowas-a-large-scale-measurement-study-of-domain-registration-privacy-under-the-gdpr
            the GDPR's effect on WHOIS records, not on a web crawl
[UNSTATED|phenomenon] NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system
            cryptojacking "without taking consent of visitors" is the threat model
[OK      |weak      ] NDSS/2021/reining-in-the-webs-inconsistencies-with-site-policy
            "1,995 (18%) sites did not set any first-party cookie ... can be attributed to the presence of GDPR banners which require users to click through" - the crawl's non-clicking is stated in explanation of a result, not in the methods
[UNSTATED|phenomenon] NDSS/2021/tales-of-favicons-and-caches-persistent-tracking-in-modern-browsers
            a GDPR pop-up cited as a user-distraction technique
[UNSTATED|phenomenon] NDSS/2021/uiscope-accurate-instrumentation-free-and-visible-attack-investigation-for-gui-applications
            the same attack-investigation example, in the paper's NDSS 2021 reprint
[UNSTATED|noise     ] PETS/2021/domain-name-encryption-is-not-enough-privacy-leakage-via-ip-based-website-finger
            "refrain from" applies to "other traffic features", not to a notice; Quantcast appears as a top list
[UNSTATED|background] PETS/2021/ml-cb-machine-learning-canvas-block
            "notice and choice has a long history of well-documented failures" as motivation
[UNSTATED|noise     ] PETS/2021/oblivious-dns-over-https-odoh-a-practical-privacy-enhancement-to-dns
            "clients adopting DoH"; GDPR in reference titles
[UNSTATED|phenomenon] PETS/2021/privacy-preference-signals-past-present-and-future
            TCF/CMP adoption is measured by probing for __tcfapi, never by acting on a notice
[UNSTATED|noise     ] USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web
            postMessage popups; "opt out from future scans" by notified websites
[UNSTATED|none      ] USENIX/2021/catching-phishers-by-their-bait-investigating-the-dutch-phishing-landscape-throu
            no consent vocabulary anywhere in either rendering of the full text
[OK      |explicit  ] USENIX/2021/effective-notification-campaigns-on-the-web-a-matter-of-trust-framing-and-suppor
            "We do not check sites for the presence of consent banners; technically, a consent banner could hide the existence of a non-compliant GA instance"
[UNSTATED|noise     ] USENIX/2021/fingerprinting-in-style-detecting-browser-extensions-via-injected-style-sheets
            a CSS-isolation popup in the detection script
[UNSTATED|irb       ] USENIX/2021/phishprint-evading-phishing-detection-crawlers-by-prior-profiling
            prior user consent for the fingerprinting experiment's participants
[UNSTATED|phenomenon] USENIX/2021/prisec-a-privacy-settings-enforcement-controller
            PriSEC's crawler clicks every interactable element on privacy-settings pages; no consent-notice treatment is stated
[UNSTATED|none      ] USENIX/2021/u-cant-debug-this-detecting-javascript-anti-debugging-techniques-in-the-wild
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] WWW/2021/an-empirical-study-of-real-world-webassembly-binaries-security-languages-use-cas
            WebAssembly used to "match cryptocurrencies" mined without users' consent
[UNSTATED|phenomenon] WWW/2021/have-you-been-properly-notified-automatic-compliance-analysis-of-privacy-policy
            GDPR Article 13 compliance of privacy-policy text
[UNSTATED|none      ] WWW/2021/its-not-just-the-site-its-the-contents-intra-domain-fingerprinting-social-media
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|background] WWW/2021/privacy-policies-over-time-curation-and-analysis-of-a-million-document-dataset
            the GDPR's historic impact on privacy policies
[UNSTATED|noise     ] WWW/2021/towards-realistic-and-reproducibleweb-crawl-measurements
            "adopting an access control system"; GDPR as an IP-blocking motive
[UNSTATED|none      ] CCS/2022/a-run-a-day-wont-keep-the-hacker-away-inference-attacks-on-endpoint-privacy-zone
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] CCS/2022/cart-ology-intercepting-targeted-advertising-via-ad-network-identity-entanglemen
            a reference title about bypassing GDPR consent
[UNSTATED|phenomenon] CCS/2022/do-opt-outs-really-opt-me-out
            trackers' opt-out policy statements are classified from privacy-policy text; the crawl exercises no opt-out
[UNSTATED|protobanner] CCS/2022/exposing-the-rat-in-the-tunnel-using-traffic-analysis-for-tor-based-malware-dete
            SMTP server banners relayed to malware; ICMP logs
[UNSTATED|phenomenon] CCS/2022/im-spartacus-no-im-spartacus-proactively-protecting-users-from-phishing-by-inten
            the tool's own privacy consent notice shown to its users
[UNSTATED|none      ] IEEE-SP/2022/meshup-stateless-cache-side-channel-attack-on-cpu-mesh
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] IEEE-SP/2022/timing-based-browsing-privacy-vulnerabilities-via-site-isolation
            a site-isolation attack working "without requiring the consent from the user"
[UNSTATED|none      ] IMC/2022/characterizing-permanently-dead-links-on-wikipedia
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|adbanner  ] IMC/2022/muzeel-assessing-the-impact-of-javascript-dead-code-elimination-on-mobile-web-pe
            a cookie banner appears in a screenshot illustrating dead-code-elimination breakage; no crawler consent action
[UNSTATED|background] NDSS/2022/auto-draft-209
            GDPR/CCPA data-deletion requests as a fallback assumption
[UNSTATED|noise     ] NDSS/2022/auto-draft-211
            "adopting attack mitigations" in embedded firmware
[OK      |explicit  ] PETS/2022/atom-ad-network-tomography
            banner sites are excluded rather than acted on: "as instrumenting opt-in/out was out of the scope of this work"
[UNSTATED|phenomenon] PETS/2022/checking-websites-gdpr-consent-compliance-for-marketing-emails
            consent checkboxes in website registration forms for marketing email, not a cookie notice
[UNSTATED|noise     ] PETS/2022/from-onion-not-found-to-guard-discovery
            Tor described as an 'overlay' network
[OK      |explicit  ] PETS/2022/my-cookie-is-a-phoenix-detection-measurement-and-lawfulness-of-cookie-respawning
            "we crawled websites and even if a website provided a consent banner, we did not give consent thereto"
[UNSTATED|phenomenon] PETS/2022/setting-the-bar-low-are-websites-complying-with-the-minimum-requirements-of-the
            CCPA "Do Not Sell My Personal Information" links are located, not clicked
[UNSTATED|none      ] PETS/2022/toward-uncensorable-anonymous-and-private-access-over-satoshi-blockchains
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] PETS/2022/who-knows-i-like-jelly-beans-an-investigation-into-search-privacy
            CMPs appear in a list of contacted entities; Quantcast as an entity
[UNSTATED|background] USENIX/2022/a-large-scale-investigation-into-geodifferences-in-mobile-apps
            GDPR/CCPA in app privacy policies; collaborators' informed consent
[UNSTATED|none      ] USENIX/2022/behind-the-tube-exploitative-monetization-of-content-on-youtube
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] USENIX/2022/measurement-by-proxy-on-the-accuracy-of-online-marketplace-measurements
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
            'adopting" prior solutions; "do not sell individual plugins'
[UNSTATED|phenomenon] USENIX/2022/ovrseen-auditing-network-traffic-and-privacy-policies-in-oculus-vr
            notice and consent in Oculus app privacy policies
[UNSTATED|irb       ] USENIX/2022/phish-in-sheeps-clothing-exploring-the-authentication-pitfalls-of-browser-finger
            "We did not interact with or affect other Bank-A users" is an ethics statement about people
[UNSTATED|noise     ] USENIX/2022/the-security-lottery-measuring-client-side-web-security-inconsistencies
            one hit, a reference title ending "notifications after gdpr"
[UNSTATED|irb       ] USENIX/2022/watching-the-watchers-bias-and-vulnerability-in-remote-proctoring-software
            informed consent to proctoring software is the object of study
[UNSTATED|noise     ] WWW/2022/am-i-a-real-or-fake-celebrity-evaluating-face-recognition-and-verification-apis
            "adopting face as a primary authentication"
[OK      |explicit  ] WWW/2022/et-tu-brute-privacy-analysis-of-government-websites-and-mobile-apps
            "Note that our crawler does not click on the cookie consent prompts, if present" and "our automation does not accept cookie banners on sites crawled"
[UNSTATED|none      ] WWW/2022/i-have-no-text-in-my-post-using-visual-hints-to-model-user-emotions-in-social-me
            no consent vocabulary anywhere in either rendering of the full text
[IMPLIED |noclick   ] WWW/2022/leveraging-googles-publisher-specific-ids-to-detect-website-administration
            "We do not interact with any component in the visited website, and only passively observe network traffic" - explicit, but consent notices are never mentioned
[UNSTATED|noise     ] WWW/2022/measuring-the-privacy-vs-compatibility-trade-off-in-preventing-third-party-state
            Firefox's Total Cookie Protection opt-in mode
[IMPLIED |noclick   ] WWW/2022/reproducibility-and-replicability-of-web-measurement-studies
            one arm is "no interaction" - "we do not interact with the website at all"; the other arm is generic "artificial user interaction", never described as banner interaction
[UNSTATED|noise     ] CCS/2023/cookiegraph-understanding-and-detecting-first-party-tracking-cookies
            CookieBlock is a cookie classifier compared against, not a consent tool
[UNSTATED|none      ] CCS/2023/jack-in-the-box-an-empirical-study-of-javascript-bundling-on-the-web-and-its-sec
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|background] CCS/2023/marketing-to-children-through-online-targeted-advertising-targeting-mechanisms-a
            COPPA verifiable parental consent; floating banner ads
[UNSTATED|phenomenon] CCS/2023/policychecker-analyzing-the-gdpr-completeness-of-mobile-apps-privacy-policies
            GDPR completeness of mobile-app privacy policies
[UNSTATED|none      ] CCS/2023/read-between-the-lines-detecting-tracking-javascript-with-bytecode-classificatio
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] CCS/2023/realistic-website-fingerprinting-by-augmenting-network-traces
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] CCS/2023/transformer-based-model-for-multi-tab-website-fingerprinting-attack
            "adopting a more randomized methodology"
[UNSTATED|noise     ] CCS/2023/txphishscope-towards-detecting-and-understanding-transaction-based-phishing-on-e
            popup windows showing transaction parameters
[UNSTATED|none      ] CCS/2023/under-the-dark-a-systematical-study-of-stealthy-mining-pools-ab-use-in-the-wild
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] IEEE-SP/2023/detection-of-inconsistencies-in-privacy-practices-of-browser-extensions
            "without clicking the extension icon" describes the extension's behaviour, not a notice
[UNSTATED|background] IEEE-SP/2023/fashion-faux-pas-implicit-stylistic-fingerprints-for-bypassing-browsers-anti-fin
            GDPR/CCPA as legislative background; opt-in browser defaults
[UNSTATED|none      ] IEEE-SP/2023/investigating-package-related-security-threats-in-software-registries
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] IEEE-SP/2023/robust-multi-tab-website-fingerprinting-attacks-in-the-wild
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|adbanner  ] IMC/2023/a-longitudinal-study-of-vulnerable-client-side-resources-and-web-developers-upda
            a Flash banner as dynamic page content
[UNSTATED|protobanner] IMC/2023/does-it-spin-on-the-adoption-and-use-of-quics-spin-bit
            zgrab2 is "a golang-based banner grabber"
[UNSTATED|protobanner] IMC/2023/ecn-with-quic-challenges-in-the-wild
            zgrab2 banner grabber and ICMP quotations
[IMPLIED |noclick   ] IMC/2023/not-only-e-t-phones-home-analysing-the-native-user-tracking-of-mobile-browsers
            "We do not interact with any component inside a website, and only passively observe network traffic" - the mobile-browser study's wording of a sentence three papers from this group share; consent notices are never mentioned
[OK      |explicit  ] IMC/2023/on-the-similarity-of-web-measurements-under-different-experimental-setups
            "our crawler ... does not interact with content notices" — the extracted text reads 'content' where the paper plainly means consent, and the same setup section describes a profile run "without user interaction"
[UNSTATED|none      ] NDSS/2023/double-and-nothing-understanding-and-detecting-cryptocurrency-giveaway-scams
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] NDSS/2023/navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
            "adopting methods like redirection chains"
[OK      |explicit  ] PETS/2023/comparing-large-scale-privacy-and-security-notifications
            the violation definition is "Use of Third-Party Cookies Without Consent Notice or Before Interaction With Consent Notice", so the measured state is explicitly pre-interaction
[OK      |explicit  ] PETS/2023/everybodys-looking-for-ssomething-a-large-scale-evaluation-on-the-privacy-of-oau
            "We excluded elements which contain keywords related to cookie banners" when clicking OAuth buttons, and third-party cookies are measured "before the user has interacted with the cookie banner"
[UNSTATED|irb       ] PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part
            participants' consent form for the GitHub recruitment study
[UNSTATED|noise     ] PETS/2023/raven-stateless-rapid-ip-address-variation-for-enterprise-networks
            opt-in versus opt-out RAVEN client control groups
[UNSTATED|phenomenon] PETS/2023/senrev-measurement-of-personal-information-disclosure-in-online-health-communiti
            consent between healthcare professionals and patients is the object of study
[UNSTATED|phenomenon] USENIX/2023/abuse-vectors-a-framework-for-conceptualizing-iot-enabled-interpersonal-abuse
            IoT devices operated "without the consent" of household members
[UNSTATED|noise     ] USENIX/2023/access-denied-assessing-physical-risks-to-internet-access-networks
            ICMP traceroutes; no consent term
[UNSTATED|noise     ] USENIX/2023/autofr-automated-filter-rule-generation-for-adblocking
            filter rules that block consent-form domains are an observation about lists, not a crawl action
[WRONG   |interacts ] USENIX/2023/automated-cookie-notice-analysis-and-enforcement
            CookieEnforcer "addresses these challenges by mimicking the actions of real users: it interacts with the cookie notices", and the backend was run over 85,473 of the top 100k Tranco sites to disable non-essential cookies — a cmp-specific-choices interaction
[UNSTATED|noise     ] USENIX/2023/knowledge-expansion-and-counterfactual-interaction-for-reference-based-phishing
            "webpages adopting client-side cloaking"
[UNSTATED|adbanner  ] USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks
            the crawler clicks social-engineering ads, not consent notices
[UNSTATED|none      ] WWW/2023/a-passage-level-reading-behavior-model-for-mobile-search
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|irb       ] WWW/2023/an-empirical-study-of-the-usage-of-checksums-for-web-downloads
            respondents' consent for the checksum survey; QuantCast as a top list
[UNSTATED|none      ] WWW/2023/do-nfts-owners-really-possess-their-assets-a-first-look-at-the-nft-to-asset-conn
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|none      ] WWW/2023/efficient-and-low-overhead-website-fingerprinting-attacks-and-defenses-based-on
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|background] WWW/2023/the-hitchhikers-guide-to-facebook-web-tracking-with-invisible-pixels-and-click-i
            GDPR sensitive categories; "adopting FB Pixel"
[UNSTATED|irb       ] WWW/2023/visual-aware-testing-and-debugging-for-web-performance-optimization
            IRB-approved recruitment of 18 users; "rotating banners" as dynamic content
[IMPLIED |noclick   ] WWW/2023/who-funds-misinformation-a-systematic-analysis-of-the-ad-related-profit-routines
            "We do not interact with any component inside a website" — the fake-news-funding study's wording of a sentence three papers from this group share; consent notices are never mentioned
[UNSTATED|none      ] CCS/2024/a-comprehensive-analysis-of-security-vulnerabilities-and-attacks-in-satellite-mo
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] CCS/2024/vpvet-vetting-privacy-policies-of-virtual-reality-apps
            consent clauses in VR app privacy policies
[UNSTATED|irb       ] IEEE-SP/2024/false-negative-that-one-is-going-to-kill-you-understanding-industry-perspectives
            interview and survey informed-consent forms
[UNSTATED|background] IEEE-SP/2024/to-auth-or-not-to-auth-a-comparative-analysis-of-the-pre-and-post-login-security
            the cookie-banner XSS result is cited from related work; no consent action of their own is stated
[WRONG   |interacts ] IMC/2024/browsing-without-third-party-cookies-what-do-you-see
            "we adopted BannerClick" "to automatically click the accept and reject buttons in cookie notices", counting cookies "after BannerClick interaction" — an accept-and-reject design
[UNSTATED|none      ] IMC/2024/collecting-self-reported-semantics-of-bgp-communities-and-investigating-their-co
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|background] IMC/2024/of-choices-and-control-a-comparative-analysis-of-government-hosting
            GDPR-aligned hosting jurisdictions; "governments opting for third-party providers"
[UNSTATED|phenomenon] IMC/2024/whatcha-lookin-at-investigating-third-party-web-content-in-popular-android-apps
            in-app web content shown "without explicit consent from the users"
[UNSTATED|none      ] NDSS/2024/experimental-analyses-of-the-physical-surveillance-risks-in-client-side-content-scanning
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|irb       ] PETS/2024/a-black-box-privacy-analysis-of-messaging-service-providers-chat-message-process
            "we did not interact with other users at all" is about the messaging experiment's counterparties
[UNSTATED|none      ] PETS/2024/automatic-generation-of-web-censorship-probe-lists
            no consent vocabulary anywhere in either rendering of the full text
[OK      |explicit  ] PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
            "Our crawler did not click on or otherwise interact with advertisements or consent banners"; opt-out is instead conveyed through GPC and an injected USP String, never through the notice
[UNSTATED|phenomenon] PETS/2024/on-the-quality-of-privacy-policy-documents-of-virtual-personal-assistant-applica
            GDPR quality of virtual-personal-assistant privacy policies
[UNSTATED|irb       ] PETS/2024/privacy-policies-on-the-fediverse-a-case-study-of-mastodon-instances
            instance administrators' consent to be studied
[OK      |explicit  ] PETS/2024/the-devil-is-in-the-details-detection-measurement-and-lawfulness-of-server-side
            "we did not interact with cookie banners on the visited" websites, "that is we never accepted nor rejected cookies during our visit"
[UNSTATED|background] PETS/2024/website-data-transparency-in-the-browser
            notice and choice as motivation for a transparency dashboard
[IMPLIED |noclick   ] USENIX/2024/arcanum-detecting-and-evaluating-the-privacy-risks-of-browser-extensions-on-web
            "we do not interact with the pages or extensions (e.g., we do not click buttons on the page)" - explicit, but consent notices are never mentioned
[UNSTATED|irb       ] USENIX/2024/dancer-in-the-dark-synthesizing-and-evaluating-polyglots-for-blind-cross-site-sc
            site operators' consent for the large-scale XSS study
[UNSTATED|background] USENIX/2024/fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
            Google's EU User Consent Policy is cited as advertiser obligation; no crawl treatment
[UNSTATED|irb       ] USENIX/2024/into-the-dark-unveiling-internal-site-search-abused-for-black-hat-seo
            "we did not interactively analyze their content" is an ethics statement about illegal sites
[UNSTATED|noise     ] USENIX/2024/iot-market-dynamics-an-analysis-of-device-sales-security-and-privacy-signals-and
            one hit, a GDPR reference title
[UNSTATED|noise     ] USENIX/2024/phishdecloaker-detecting-captcha-cloaked-phishing-websites-via-hybrid-vision-bas
            "adopting CAPTCHA as a cloaking technique"
[OK      |explicit  ] USENIX/2024/purl-safe-and-effective-sanitization-of-link-decoration
            "We conduct our crawls entirely from the vantage point of an academic institution in the US, hence, we do not interact with consent banners"
[UNSTATED|none      ] USENIX/2024/smudged-fingerprints-characterizing-and-improving-the-performance-of-web-applica
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|phenomenon] WWW/2024/detecting-and-understanding-self-deleting-javascript-code
            scripts "tracking user activities without user consent"
[UNSTATED|irb       ] WWW/2024/experimental-security-analysis-of-sensitive-data-access-by-browser-extensions
            "We did not interact with human subjects"; CookieEnforcer appears only in a reference title
[UNSTATED|noise     ] WWW/2024/panoptichrome-a-modern-in-browser-taint-analysis-framework
            "reasons for adopting a static+dynamic taint analysis"
[UNSTATED|none      ] WWW/2024/quic-is-not-quick-enough-over-fast-internet
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|irb       ] WWW/2024/tiktok-and-the-art-of-personalization-investigating-exploration-and-exploitation
            explicit consent from the TikTok data-donation participants
[UNSTATED|phenomenon] CCS/2025/automatically-detecting-online-deceptive-patterns
            AutoBot classifies deceptive patterns from screenshots of cookie banners; nothing is clicked
[UNSTATED|background] CCS/2025/exploiting-the-shared-storage-api
            GDPR consent requirements applied to Shared Storage
[UNSTATED|optout    ] CCS/2025/the-odyssey-of-robots-txt-governance-measuring-convention-implications-of-web-bo
            robots.txt as an LLM-training opt-out mechanism
[PARTIAL |twoarm    ] CCS/2025/whispertest-a-voice-control-based-library-for-ios-ui-automation
            the Safari web crawler "does not interact with consent dialogs", but the same paper drives 200 iOS apps "while accepting and rejecting consent dialogs" - an accept-and-reject arm exists on the app side
[UNSTATED|background] IEEE-SP/2025/gptracker-a-large-scale-measurement-of-misused-gpts
            GDPR compliance of the study's own data management
[OK      |explicit  ] IMC/2025/a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
            "the crawler pauses for 20 seconds without any interaction", and the limitation is named as permissions used "only after specific interactions (e.g., clicking a button, accepting cookie banner)"
[UNSTATED|phenomenon] IMC/2025/an-in-depth-investigation-of-data-collection-in-llm-app-ecosystems
            opt-out controls in LLM app ecosystems
[UNSTATED|none      ] IMC/2025/exploration-of-the-dynamics-of-buy-and-sale-of-social-media-accounts
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] IMC/2025/fishing-for-smishing-understanding-sms-phishing-infrastructure-and-strategies-by
            "scammers adopting that norm"; "direct consent is not possible in internet measurement research"
[IMPLIED |noclick   ] IMC/2025/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
            "records trackers on the homepage of websites with no interaction (e.g., no scrolling)" - explicit, but consent notices are never mentioned
[UNSTATED|phenomenon] NDSS/2025/cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange
            the victim cannot revoke a certificate "without the attacker" agreeing — an SXG attack property, not a crawl treatment
[UNSTATED|noise     ] NDSS/2025/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector
            an over-general filter rule blocks the script that loads a consent dialog - an observation about rules, not a crawl action
[UNSTATED|none      ] NDSS/2025/misdirection-of-trust-demystifying-the-abuse-of-dedicated-url-shortening-service
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|noise     ] NDSS/2025/secret-spilling-drive-leaking-user-behavior-through-ssd-contention
            "overlay in red" in a signal plot
[UNSTATED|noise     ] NDSS/2025/the-discriminative-power-of-cross-layer-rtts-in-fingerprinting-proxy-traffic
            "advise caution in adopting multiplexing as the only mitigation strategy"
[UNSTATED|adbanner  ] PETS/2025/buy-it-now-track-me-later-attacking-user-privacy-via-wi-fi-ap-online-auctions
            the "This listing sold" banner on auction pages
[UNSTATED|optout    ] PETS/2025/measuring-the-accuracy-and-effectiveness-of-pii-removal-services
            data-broker opt-out requests submitted by PII removal services
[UNSTATED|noise     ] PETS/2025/onion-location-measurements-and-fingerprinting
            the 'opt-in' circuit-labelling method of prior work
[OK      |explicit  ] PETS/2025/tracker-installations-are-not-created-equal-understanding-tracker-configuration
            "We chose not to interact with cookie consent banners present on the page to avoid bias", with the resulting blind spot quantified
[UNSTATED|phenomenon] PETS/2025/understanding-privacy-norms-through-web-forms
            cookie consent dialogs are one of the form types the classifier must exclude
[OK      |explicit  ] PETS/2025/unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie
            "our manual examination of IMSS sites found three sites displaying cookie banners. This finding significantly reduces the likelihood that a lack of interaction with these banners has substantially affected our analysis"
[UNSTATED|phenomenon] PETS/2025/who-s-watching-you-zoom-investigating-privacy-of-third-party-zoom-apps
            informed consent in the Zoom marketplace's power asymmetry
[UNSTATED|phenomenon] USENIX/2025/analyzing-the-ai-nudification-application-ecosystem
            consent of the image subject in nudification apps
[UNSTATED|irb       ] USENIX/2025/assessing-the-aftermath-the-effects-of-a-global-takedown-against-ddos-for-hire-s
            consent of individuals on the monitored forums
[UNSTATED|phenomenon] USENIX/2025/dns-flare-a-flush-reload-attack-on-dns-forwarders
            an attack working "without requiring explicit consent or interaction"
[IMPLIED |noclick   ] USENIX/2025/double-edged-shield-on-the-fingerprintability-of-customized-ad-blockers
            "Our crawlers do not interact with the web server in any other way" - explicit, but consent notices are never mentioned
[UNSTATED|phenomenon] USENIX/2025/evaluating-privacy-policies-under-modern-privacy-laws-at-scale-an-llm-based-auto
            GDPR and US state-law clauses in privacy-policy text
[UNSTATED|noise     ] USENIX/2025/evaluating-the-effectiveness-and-robustness-of-visual-similarity-based-phishing
            'CookiePopup' is a screenshot-artefact label in a phishing dataset
[UNSTATED|none      ] USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|background] USENIX/2025/no-way-to-sign-out-unpacking-non-compliance-with-google-plays-app-account-deleti
            GDPR right to erasure in app account deletion
[UNSTATED|noise     ] USENIX/2025/web-execution-bundles-reproducible-accurate-and-archivable-web-measurements
            two consent-related reference titles; no consent statement of its own
[UNSTATED|optout    ] USENIX/2025/websites-global-privacy-control-compliance-at-scale-and-over-time
            compliance is measured by reading privacy strings and sending the GPC signal; no notice interaction is stated either way
[UNSTATED|irb       ] USENIX/2025/when-llms-go-online-the-emerging-threat-of-web-enabled-llms
            participants' informed consent in the phishing survey
[UNSTATED|adbanner  ] WWW/2025/assessing-compliance-in-digital-advertising-a-deep-dive-into-acceptable-ads-stan
            display ads "such as banners and pop-ups"; ACM copyright notice
[OK      |explicit  ] WWW/2025/beyond-the-crawl-unmasking-browser-fingerprinting-in-real-user-interactions
            "As we aim to study what type of user interactions trigger fingerprinting scripts, our automated crawler does not accept cookie consent banners" (the paper's separate human arm did instruct participants to accept)
[OK      |explicit  ] WWW/2025/digital-disparities-a-comparative-web-measurement-study-across-economic-boundari
            of its Lighthouse crawl: "handle cookie banners, which may prevent full webpage rendering. While solutions exist" their "reliability is untested" — the second sentence rules out having used one
[UNSTATED|none      ] WWW/2025/whats-in-phishers-a-longitudinal-study-of-security-configurations-in-phishing-we
            no consent vocabulary anywhere in either rendering of the full text
[UNSTATED|background] IEEE-SP/2026/setting-the-course-but-forgetting-to-steer-analyzing-compliance-with-gdprs-right
            GDPR right of access; the study downloads data packages rather than crawling
[UNSTATED|noise     ] NDSS/2026/on-borrowed-time-measurement-informed-understanding-of-the-ntp-pools-robustness-to-monopoly-attacks
            "adopting prior recommendations" for NTP monitors
[UNSTATED|noise     ] NDSS/2026/time-and-time-again-leveraging-tcp-timestamps-to-improve-remote-timing-attacks
            microsecond TCP timestamps as "an opt-in feature"
[UNSTATED|background] PETS/2026/chatbot-confessions-large-scale-analysis-of-private-data-disclosure-in-shared-ai
            GDPR Article 9 categories in chatbot transcripts
[UNSTATED|noise     ] PETS/2026/more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr
            "multi-modal structure" matched the pattern
[WRONG   |interacts ] PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
            "We design a methodology to semi-automatically interact with consent banners deployed by major CMPs in TCF-based Android apps, combining three approaches ... disagree to all, legitimate interest purposes only, and consent to all"
[UNSTATED|irb       ] USENIX/2026/a-large-scale-study-of-personalized-phishing-using-large-language-models
            mandatory phishing-awareness training without informed consent
[UNSTATED|irb       ] USENIX/2026/from-mirai-to-gorilla-deep-dive-into-a-long-lasting-ddos-for-hire-botnet
            the ISP's consent for self-attacks; Gorilla advertisement banners
[UNSTATED|none      ] WWW/2026/webgeoinfer-structure-free-multi-stage-framework-for-geolocation-inference-from

13 entries appended to bibliography before the closing </bibtex>. Authors, titles and DOIs come from scripts/bibgen.mjs, which reads the publisher metadata in data/corpus2/.meta rather than anything a model recalled. Four needed hand-work, recorded here because the failure mode is silent:

libert2018_automated and liu2024_opted were generated and then dropped from the additions because both already existed in the live bibliography. The assembled file was checked for duplicate keys before saving: 390 entries, 0 duplicates.

Everything on the content page that is not from the corpus was fetched on 2026-08-19 from a primary source — the project's own repository, the vendor's own page, the standards body's own document, or the regulator's own press release. Where the site is behind Cloudflare (w3.org, iabeurope.eu, dataprotectionauthority.be, edpb.europa.eu) the fetch used Playwright's own Chromium build rather than curl, which gets an interstitial.

• This page rather than broadening requests. privacy:requests already covers notice detection and button labelling well, and explicitly delegates the rest here. The alternative — move the whole consent topic onto privacy:requests — was rejected because that page's subject is classifying requests, and consent is a crawl-design decision that affects cookies, requests, fingerprinting and legal analysis alike. The cost of the split is that a reader looking for “how do I find the banner” lands on the wrong page first; the page mitigates it with a pointer in the second paragraph.
• Mobile apps were kept in S2. 15 of 72 S2 papers measure apps rather than the web, and the page is titled Granting Consent to Websites. They were kept because the measurement problem is the same one and the field treats them together, and the page states the split rather than hiding it. Dropping them would take S2 to 57.
• The tool table dates every tool and says which are dead. This is the “currency” requirement taken literally: a corpus that runs to 2026 will still recommend Ninja Cookie and Priv-Accept if you only read what papers used, because papers used them. Every row carries a check date and a verdict.
• no-interaction is treated as a stated value, not a sentinel. A paper that says “we did not interact with cookie notices” has answered the question. Counting it as silence would have made the reporting rate 3.2% instead of 31.2% and would have been wrong. The content page keeps the two numbers visibly separate for exactly this reason.
• The measured-results table publishes 21 of the 109 available prevalence tuples. Selection was by: is the denominator recoverable, is the phenomenon a consent mechanism rather than a downstream effect, and does it add something the other rows do not. The full 109 are in §5.3 so the selection is auditable.
• No ~~DISCUSSION~~ on this provenance page. Following the convention set by the earlier provenance: pages: comments belong on the content page.
• The page publishes JavaScript, and it was executed. tcf_probe.js was run against four live European news sites on 2026-08-19 and its real output is on the content page (§9). The first published revision of this page said the opposite, because the run happened afterwards and these bullets were not revised — a reviewer caught the contradiction on the same day. The limitation that remains is coverage, not fabrication: four sites and three distinct cmpId values are a smoke test, not a compatibility matrix across CMP implementations.

• tcf_probe.js has now been executed against four live European news sites (§9), which was not true of the first published revision. Three CMPs answered and one timed out; the output is on the content page. What is still not established is how the returned object varies across the long tail of CMP implementations — four sites and three distinct cmpId values is a smoke test, not a compatibility matrix.
• The Firefox side of the GPC test could not be run. Playwright's Firefox build is not installed in this container, so the claim that setting privacy.globalprivacycontrol.enabled produces both carriers is inferred from the preference existing in mozilla-central, not observed. The Chromium half — that injecting the header alone leaves the DOM property undefined — was observed.
• The CMP-list URL was not fetched by this run. The GVL URL was — vendor-list.consensu.org/v3/vendor-list.json serves valid JSON, vendorListVersion: 172, lastUpdated: 2026-08-13, with /v3/archives/ resolving (§9). The registered-CMP list URL is still second-hand; check it before relying on it. This bullet said both were unfetched until a reviewer noticed on 2026-08-19 that §9 already contradicted it.
• Google Consent Mode v2's mandatory date could not be confirmed from a Google-controlled page, so it is not on the content page at all — even though it is arguably the single biggest change to what a European crawl observes since the GDPR.
• The 2025–2026 EU legislative picture (ePrivacy Regulation withdrawal, Digital Omnibus, UK Data (Use and Access) Act) is secondary-sourced. It is on the page in a footnote that says so.
• Field stability was not re-measured. The 93% agreement figure for consentAction comes from the 100-paper stability comparison run against the earlier 4,322-paper corpus. Nobody has re-run it since 2026-08-11.
• How many of the 495 not-stated papers actually had a banner to handle is unanswerable from the extraction. A crawl of Chinese or US-only sites in 2015 may have faced none. The page therefore reads not-stated as “the reader cannot tell”, not as “the authors were careless”.
• The 313 no-interaction papers were audited on 2026-09-05 (§7.3), closing what this list called its largest open item. The result was not what this bullet predicted: the error is not symmetric with the interacting side's 19.4%, it is an order of magnitude larger and of a different kind — 279 of 313 (89.1%) make no consent claim at all, and 3 (1.0%) interact. The verified interaction count moved from 29 to 32, and “papers stating a consent action” from 349 to 55. What remains open is the other three quarters of the field: the 495 not-stated and 236 not-applicable papers were not read, so a paper wrongly filed as not-stated when it does say something is still uncounted, in either direction.
• A paper that clicked a banner and never wrote it down is invisible by construction, since consentAction is extracted from the paper's own words. 32 is a floor on the true number as well as an audited count — and §7.3.4 shows how the floor is reached: two of the three false negatives surfaced only because a named tool (BannerClick, CookieEnforcer) appears in the text.
• The implied category is a judgement the next run may want to revisit. 8 papers state that their crawl performs no interaction at all without ever mentioning consent. They are counted in neither the “states an action” figure (55) nor the “says nothing” figure, and the content page publishes both a strict 55 and a lenient 63 rather than choosing. A reader who thinks “we do not click anything” is a consent statement should use 63.
• The fieldstudy pair is a gap in the schema, not in the papers. Utz et al. [3Utz, Christine; Degeling, Martin; Fahl, Sascha; Schaub, Florian; Holz, Thorsten (2019): "(Un)informed Consent: Studying GDPR Consent Notices in the Field", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] and Degeling et al. [4Degeling, Martin; Utz, Christine; Lentzsch, Christopher; Hosseini, Henry; Schaub, Florian; Holz, Thorsten (2019): "We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] measure consent behaviour on real visitors; crawlConfig.consentAction has no value for that, so both are unstated here. Any figure on this page about “who studies consent” should not be read as excluding them.
• CHI, SOUPS, EuroS&P, ACSAC, RAID, AsiaCCS and WPES are absent from the corpus, and that bites harder on consent than on most topics: a large fraction of consent-notice work is usable-privacy work published at CHI and SOUPS. Every S2 count is a lower bound and the content page says so twice.

Mistakes caught in review of this run, recorded rather than tidied away:

1. Three invented or mistyped literals in the first draft, caught by consent_quotecheck.mjs (§7.1). One of them, the Matte 10.4%, was a percentage this page computed and presented as the paper's.
2. An unanchored /iab/ and /gpc/ in the first population regex, which added five unrelated papers (§2.1).
3. A malformed multi-key citation: the four mobile-consent papers were written as four adjacent single-key groups rather than one comma-separated group inside a single brace-bracket pair. The plugin rendered it as nothing at all, silently dropping four citations. The check that caught it counts distinct keys in the source and compares against the rendered reference list.
4. Two BibTeX entries generated for papers already in the bibliography, caught by the duplicate-key check before saving.
5. The first published render showed 28 inline markers but only 15 reference entries — the known bibtex4dw cache staleness. Fixed by requesting ?purge=true on bibliography and then on consent; re-verified at 28 of 28.
6. An unclosed inline-nowiki marker (a lone pair of percent signs) in §2.1 of this page silently stopped DokuWiki parsing everything after it: sections 2.2 to 11 rendered as raw source, with no error and no warning. Caught by counting rendered h2/h3/table/pre elements against what the source should produce, which is now the standard check — verifying that the citations resolve passes happily on a page that is 80% raw markup.
7. The page's central figure was wrong in its first published revision. It said 36 papers interacted with a consent notice, which is what the extraction says. The audit in §7.2, run after publication, brought it to 29. The corrected figures went live the same day. The lesson recorded for the next run: an object-valued extraction field shares one evidence quote across every one of its keys, so the site's standard quote spot-check cannot validate any individual key. Audit the field directly or do not publish a count from it.

Four reviewers, all handed the frozen page text, the report script and its output, and these notes, and all told explicitly that the author's context might not be exhaustive. Three focused passes ran in parallel first; the findings below are recorded with the verdict, because a rejection is as much a record of whether a reviewer earned its slot as a fix is.

Re-ran report_consent.mjs and consent_quotecheck.mjs and diffed both against the committed output: clean, no differences.

Verified every citation marker on both pages against a fresh fetch of the live bibliography, checked all 13 new entries against Crossref and landing pages, and traced every table row and prose figure to paper.cols.txt.

Everything in the tool table and every standards/legal claim independently re-fetched. All of them confirmed, including the GitHub dates and rule counts, the EasyList header and the three rule counts, the GPC spec status and all four quoted sections, the DNT notes and the Firefox 135 wording, TCF v2.3's three dates, CJEU C-604/22, both Belgian decisions, the USP deprecation and both EDPB documents. It also fetched the GVL URL this run had admitted not fetching — it serves valid JSON, vendorListVersion: 172, lastUpdated: 2026-08-13.

No checklist: whatever the focused three were not looking for. It read both pages live and reviewed this provenance page as well as the content page.

Worth recording, because it is the honest measure of a review layer. The largest error on the first published revision — the 36-versus-29 interaction count (§7.2) — was found by the author, not by any reviewer, while the three focused passes were still running. The figures reviewer re-ran the script and confirmed every number matched it, which was true and was exactly the wrong question: the script faithfully reported a field that was wrong 19.4% of the time. A “figures versus script” pass cannot catch a script that correctly reports bad data. The next run should add a pass that reads a sample of the underlying papers rather than the underlying script.

And the second-largest was caught only by the last reviewer. Findings 13.4 #1 and #3 are internal contradictions on this page — §9 saying a thing was verified while §10 and §11 said it was not. Three focused reviewers with narrow briefs all read past them; the unbriefed pass opened with them. The specific mechanism is worth naming: both were caused by applying a late fix in one section and not re-reading the sections that had been written before it. A “what could not be established” section is the first thing to go stale and the last thing anybody re-reads, and it is precisely the section whose staleness does the most damage. Re-read §10 and §11 last, every time.

A third, smaller lesson: 13.4 #2 found a fix this log had recorded as accepted but never shipped. Marking a review finding “Accepted” and editing the page are two separate acts and this run got them out of step once. The check is mechanical — after applying fixes, grep the page for the old value, not for the new one.

• bouhoula2024automated was one of two keys for the same paper in bibliography. The wiki-wide consolidation of 2026-09-04 (drain item dedup-regional-filter-lists-bibkey) kept bouhoula2024_automated and deleted the other entry.
• 3 citation markers on consent and 1 citation marker on this page were repointed to the kept key. No prose on either page changed, and no figure moved. Statements above that name the deleted key describe the state when they were written. Full query log and the invariants checked before saving: bibliography.

What moved. The headline “papers that verifiably interacted with a consent notice” went 29 → 32. The much larger movement is the denominator: “papers that state a consent action” went 349 (31.2% of crawling papers) → 55 (4.9%), because 279 of the 313 no-interaction labels are the extractor's default rather than the paper's claim. Every figure listed in §14.2 was re-derived, not carried over.

The year-bucket section also lost its narrative. It previously described a peak at 33.6% in 2022–2024 falling back to 29.8% — none of the four adjacent movements in that series is significant (Fisher's exact, all p > 0.39), so the page was describing noise in a population that was also wrong. The audited series has exactly one significant step, at the GDPR (§7.3.7).

Four reviewers, all handed the page text, both audit scripts and their unedited output, and these notes, and all told explicitly that the author's context might not be exhaustive. The three focused passes ran in parallel first.

Re-ran all four scripts and diffed against the committed outputs: identical. Reconciled every checklist figure and every arithmetic identity (313+15+14+3+2+2+495+236+40 = 1,120; 32+22+1 = 55; 55+8 = 63; 1,120−63 = 1,057; 279+22+8+3+1 = 313). Checked states for double-counting, twoArm, webOnly and the statefulness cross: all correct.

Resolved every {[key]} on both pages against the live bibliography (27 + 8 unique keys, all resolve, no duplicates, no colliding DOIs). Verified all six newly-used keys against the papers. Verified every attribution in §7.3.4 verbatim, and the author surnames used in prose. Spot-checked 27 of the 313 verdicts — all 4 wrong/partial, 8 ok, 5 implied, 10 unstated — and confirmed 26.

Re-fetched every tool, standard and legal reference on both pages as of 2026-09-05. Confirmed current and unchanged: Consent-O-Matic (v1.1.5, 204 rules), BannerClick, Priv-Accept (still no default-branch activity since 2022-04-13 — and the pushed_at caveat the page carries is still needed), CookieBlock, the IDCAC MV3 fork, Ninja Cookie's abandonment (all three sub-claims), Super Agent, W3C GPC (11 June 2026 WD), DNT (2019 Note), the twelve GPC states. No dead links on either page.

• The Digital Omnibus Article 88b removal is not on the content page, because no primary source for it was obtained. Attempts made and their results: the EUR-Lex procedure history for CELEX 52025PC0837 and the EUR-Lex procedure page for 2025/0360(COD) both return 200 but neither mentions 88b; consilium.europa.eu — its public register returns 403 to a scripted request; a guessed Council document number (ST-10730-2026-INIT) turned out to be an unrelated military-mobility file. The claim is corroborated across several secondary outlets and is probably true, and it matters for this page — a binding browser-level signal would change what a crawl has to do about banners. The next run should fetch the Council's actual position paper on 2025/0360(COD) and, if it confirms the removal, add it to the Open Questions section with the primary citation.
• The 495 not-stated and 236 not-applicable papers were not read. This audit closed one of the four values of consentAction; three quarters of the crawling population is still unaudited in the other direction. A paper wrongly filed not-stated that does say something would move the 55 up.
• Ten other pages still carry the unaudited 349 / 31.2% figure, two of them as direct claims about the field (the crawling_location 349-paper vantage paragraph, and the stateful_stateless per-bucket consentAction series with its ”+5.3 pp“ trend). Each needs its own report script re-run and its own provenance note, so it was filed as a separate work item rather than half-done here. This page is the authoritative source for the audited figures until that lands.

• A sibling script, not an extension of consent_action_audit.mjs. The obvious move was to add 313 entries to that file's existing VERDICTS map, and it was rejected. Its verdict vocabulary has three values where this side needs five (implied and unstated have no meaning on the interacting side); its denominators are all “of the 36”; and its unedited output is embedded verbatim in §7.2 and cited from the content page, so growing it in place would have silently rewritten a published audit trail. Instead consent_action_noninteraction_audit.mjs imports VERDICTS from it, so the two halves are computed in one place and cannot drift, and carries the same fail-loudly guard. The cost is two scripts and two output files where the brief for this work expected one.
• no-interaction was treated as a positive claim, not a sentinel. The field carries not-stated and not-applicable separately, so this follows from the schema. A reader who thinks the extractor was reasonably reading “the paper describes a crawl and never mentions clicking” as no-interaction would get a very different 279.
• The ok/implied boundary is textual, not interpretive. ok requires the paper to mention consent; implied requires an explicit statement of no interaction at all. The rejected alternative — “the paper describes its procedure completely enough that non-interaction follows” — is not reproducible across 313 papers and would have made the audit a matter of taste. The cost is that the content page has to publish both 55 and 63.
• Consent prompts that are not cookie banners count as ok. Two cryptomining papers state that their crawler never consented to mining; CCS/2018/minesweeper and USENIX/2019/inadvertently-making-cyber-criminals-rich are therefore ok, tagged mining. A stricter reading would drop the ok count from 22 to 20.
• The headline interaction count is 32, not 31 or 33. 31 is the web-only figure and is given alongside it; 33 counts WhisperTest's app-side arm. §7.3.4 gives all three and says which is which.
• The 313 verdicts are published in full rather than summarised, because the audit's whole value is that someone can disagree with a specific line. That is why this page is 200KB.
• The three false negatives were not re-labelled in the dataset. data/extract is a read-only mount and the corrected values live in this audit's verdict table, not in extractions.jsonl. Anyone re-deriving these figures from the raw field will get 349 and 29 again unless they import VERDICTS_NI.

1. The page's central claim was overstated four times — “279 papers say nothing about consent at all” — while the page's own tag table three lines away showed that only 72 of them do. Caught by the figures reviewer, not by the author, despite the author having built the tag table specifically to keep that residue visible. Printing the residue does not help if the prose next to it says something else.
2. A de-duplication patch keyed by list position instead of by paper put three papers' evidence on the wrong papers. Two were caught by the quote checker, the third by a reviewer. None changed a verdict; all three were fabricated evidence in a file the page describes as its only human-readable evidence.
3. A mechanical single-to-double quote conversion mangled 7 reasons by treating word-internal apostrophes as delimiters, and the quote checker passed all 7 because the mangled fragment it extracted really does appear in the paper. A checker that verifies content without verifying structure will bless damaged input.
4. The quote checker's first version rejected every quote crossing a column break, because a two-column splice makes a verbatim sentence non-contiguous. Fixed with a bounded in-order match; 18 of the 129 verified quotes only pass in that mode, so this was not a corner case.
5. A recall probe's word boundary ate the plural. cookie banner with a trailing \b does not match “cookie banners”, so the probe silently reported zero hits for a paper whose methods section says it in as many words. Caught by testing the probe against a known-positive sentence, not by reading it.
6. The audit script printed its whole output when imported. consent_ni_quotecheck.mjs imports the verdict map; without the IS_MAIN guard the older audit script already carried, the checker's committed output was 700 lines of the audit's. Fixed, and the guards were then mutation-tested: deleting a verdict, adding one for a paper outside the population, and writing an invalid verdict word each fail loudly with a non-zero exit.

[1]

Khandelwal, Rishabh; Nayak, Asmit; Harkous, Hamza; Fawaz, Kassem (2023): "Automated Cookie Notice Analysis and Enforcement", in: 32nd USENIX Security Symposium (USENIX Security 23), pp. 1109-1126. USENIX Association, Anaheim, CA. (Link)

[2]

Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: Proceedings of the USENIX Security Symposium, pp. 1723-1739. (Link)

[3]

Utz, Christine; Degeling, Martin; Fahl, Sascha; Schaub, Florian; Holz, Thorsten (2019): "(Un)informed Consent: Studying GDPR Consent Notices in the Field", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[4]

Degeling, Martin; Utz, Christine; Lentzsch, Christopher; Hosseini, Henry; Schaub, Florian; Holz, Thorsten (2019): "We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[5]

Lin, Maxwell; Lin, Shihan; Wu, Helen; Wang, Karen; Yang, Xiaowei (2024): "Browsing without Third-Party Cookies: What Do You See?", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[6]

Morel, Victor; Santos, Cristiana; Carlsson, Pontus; Ahlinder, Joel; Duvignau, Romaric (2026): "The TCF doesn't really A(A)ID - Automatic Privacy Analysis and Legal Compliance of TCF-based Android Applications", Proceedings on Privacy Enhancing Technologies 2026(3). (DOI)

[7]

Urban, Tobias; Degeling, Martin; Holz, Thorsten; Pohlmann, Norbert (2020): "Beyond the Front Page:Measuring Third Party Dynamics in the Field", in: Proceedings of The Web Conference 2020, pp. 1275–1286. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[8]

Demir, Nurullah; Urban, Tobias; Pohlmann, Norbert; Wressnegger, Christian (2024): "A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy", in: Proceedings on Privacy Enhancing Technologies, pp. 5-20. (DOI)