Differences

This shows you the differences between two versions of the page.

--- provenance:privacy:consent [2026/08/19 03:36] – Fix unclosed %% nowiki marker in section 2.1 that stopped DokuWiki parsing the rest of the page. Authored by Claude karel.kubicek.claude
+++ provenance:privacy:consent [2026/08/19 04:01] (current) – Fix two stale claims in sections 10 and 11 that contradicted section 9 (the TCF probe WAS run; the GVL WAS fetched), reverse the earlier CookieGuard verdict, refresh the embedded script output, and log the generic review pass with all ten findings and wha karel.kubicek.claude
@@ Line 10: / Line 10: @@
 | Folds it depends on | ''scripts/consent_fold.mjs'' (consent tools and CMP vendors), ''scripts/law_fold.mjs'' (shared with [[practices:legal_enforcement]]), ''scripts/geo.mjs'' (shared with [[design:crawling_location]]) |
 | Per-paper figure verification | ''scripts/consent_quotecheck.mjs'' — checks every literal figure the page publishes against the paper's own ''paper.cols.txt'' **and** ''paper.norm.txt'' |
+| Field audit | ''scripts/consent_action_audit.mjs'' — reads all 36 papers whose ''consentAction'' claims an interaction against their own full text, and recomputes every dependent figure |
 | Data | ''data/extract/run1/extractions.jsonl'' — 5,859 papers, 7 venues, 2010–2026 |
 | Written | 2026-08-19, against the corpus as extended on 2026-08-11 (commit ''8a6b843'') |
@@ Line 176: / Line 177: @@
 ----------------------------------  ------  -----
 vantage tuple, location not-stated  206     59.0%
-stated a non-EU/EEA vantage only    72      20.6%
+stated a non-EU/EEA vantage only    71      20.3%
 EU/EEA vantage                      68      19.5%
 no vantage tuple at all             3       0.9%
+location named but unmappable       1       0.3%
 Of the 36 papers that actually interacted with a notice, 21 (58.3%) did so from an EU/EEA vantage.
@@ Line 245: / Line 247: @@
 CookieCheck                      1       produced
 CookieEnforcer                   1       produced
-CookieGuard                      1       produced
 GDPR-Consent                     1       produced
 I don't care about cookies       1       used
@@ Line 1057: / Line 1058: @@
 ===== 6. Folds, and their residue =====
-==== 6.1 The consent-tool fold (''consent_fold.mjs'') ====
+==== 6.1 The consent-tool fold: consent_fold.mjs ====
 Two ordered rule lists, first match wins:
@@ Line 1075: / Line 1076: @@
 The last two are the honest judgement call: they could be folded into a third family. They were left as residue because the table they would join is headed //tools you can install and run//.
-==== 6.2 The law fold (''law_fold.mjs'') ====
+==== 6.2 The law fold: law_fold.mjs ====
 Reused unchanged from [[practices:legal_enforcement]], including its ordering (specific families before general) and its two hard-coded exceptions. Over the 53 S2 papers with a legal tuple it leaves **2 strings** in the catch-all family: ''Digital Economy Act 2017'' and ''Act against Unfair Competition (UWG)''. Both are correctly placed — neither is a data-protection instrument — and both are single papers.
@@ Line 1081: / Line 1082: @@
 The fold matters here. Unfolded, the raw strings split the CCPA across ''CCPA'' (16 papers) and ''California Consumer Privacy Act (CCPA)'' (4), and ePrivacy across ''ePrivacy Directive'' (15), ''ePrivacy directive'' (2) and ''ePrivacy Directive (2002/58/EC)'' (1). Publishing the raw counts would have understated US state privacy law by a fifth and ePrivacy by a sixth.
-==== 6.3 The vantage fold (''geo.mjs'') ====
+==== 6.3 The vantage fold: geo.mjs ====
 Reused unchanged from [[design:crawling_location]], including its ''EEA_COUNTRIES'' set and ''isEeaVantage()''. Note that the UK is deliberately **not** in that set (post-Brexit), which makes the page's EU/EEA figures slightly conservative — a UK-only vantage counts as non-EEA.
@@ Line 1092: / Line 1093: @@
 **Result: 61 literals, 60 found in both renderings, 1 in ''cols'' only, 0 not found.** The ''cols''-only case is ''62 (4.3%)'' in Matte et al.
+**The check is a superset of what the page publishes, not a mirror of it.** Ten of the 61 literals were checked and then not used on the page — Bouhoula's ''2353'' and ''95.1%'', Rasaii's ''6.91'', Utz's ''39.2'', Khandelwal's ''986'', Rasaii's ''98.2%'', Bollinger's ''87.2%'' and Koch's ''22.3%'', ''82.5%'' and ''4.0%''. They are figures the page considered and cut, kept in the check because a checked-and-cut figure is cheap to keep and expensive to re-derive if a later edit wants it back. **The direction that matters is the other one**: no literal on the page is absent from the check. A reviewer flagged the "checked against the page" framing as overstated on 2026-08-19; it is corrected here rather than quietly narrowed.
 <code>both        2024 USENIX  "100.0% precision and 86.9% recall"
@@ Line 1167: / Line 1170: @@
 | Demir et al., ''12 banners'' on average | The paper writes "interacts, on average, with 12 (65%) (SD: 21%; max: 95% min: 48%) of all banners" |
-The Matte case is the one worth keeping: a percentage that looks like it came from a paper, computed by the writer from a count and a denominator taken from two different tables. Reading the source turned up **four more** violation figures the draft did not have (46.5% pre-selected, 5.3% non-respect of choice, 54.29% any violation, 4.3% shared-cookie reuse), all of which are now on the page.
+The Matte case is the one worth keeping: a percentage that looks like it came from a paper, computed by the writer from a count and a denominator taken from two different tables. Reading the source turned up **four more** figures the draft did not have — 46.5% pre-selected, 5.3% non-respect of choice, 54.29% any violation, and the 4.3% shared-cookie consent reuse. The first three went into the results table immediately; the fourth was accidentally dropped between drafts and was restored, as a box in the TCF section, only after a reviewer noticed on 2026-08-19 that this very paragraph claimed it was on the page when it was not.
+==== 7.2 The ''consentAction'' audit, and why the standard quote check could not have caught it ====
+The page's central figure is "how many papers interacted with a consent notice". The extraction says **36**. Reading all 36 against their own text says **29**. That is a **19.4% false-positive rate** on the interacting values of ''crawlConfig.consentAction'', and it is the single most important thing on this provenance page.
+**Why the site's usual check is blind here.** The dataset's guidance is to read a handful of ''evidence.quote'' values behind any figure before publishing it. That check **cannot work for this field**. ''crawlConfig'' is an object, not an array, and it carries **one** evidence quote for the **whole** object — statefulness, browsers, headless, consent action, interaction depth, authentication, languages and repeat visits all share it. So the quote behind a ''consentAction'' value usually evidences something else entirely. Read literally, the quotes for the 36 papers include "we create a separate docker container for each URL we visit", "each crawl within a run is performed once without repetition" and "we visit each website afresh with storage cleared" — none of which says anything about a banner. One of them, for Trevisan et al., says the opposite of its label: **"No user action is performed on the page"** sits under a ''accept-and-reject'' value.
+Doing the check properly meant a different method: extract every sentence in each paper containing a consent/banner term **and** a first-person marker, read them, and record a verdict. ''consent_action_audit.mjs --sentences'' reproduces the sentences; the verdicts are hard-coded in that file with a one-line reason each, and the script **fails loudly** if a paper claims an interaction and has no verdict, or if a verdict refers to a paper that no longer claims one. That guard caught three truncated slugs in the first version of the verdict table.
+^ Verdict ^ Papers ^ Share of 36 ^
+| supported by the paper's own text | 28 | 77.8% |
+| supported, but the enum value overstates it | 1 | 2.8% |
+| **not supported — extraction false positive** | **7** | **19.4%** |
+**The seven false positives, and what the extraction mistook:**
+^ Paper ^ Claimed ^ What the paper actually contains ^
+| ''CCS/2018/pride-and-prejudice-in-progressive-web-apps-…'' | accept-all | the **push-notification permission prompt**, not a cookie banner |
+| ''WWW/2018/hiding-in-the-crowd-…'' | accept-all | no sentence in the paper mentions a consent notice or banner at all |
+| ''IMC/2020/when-push-comes-to-ads-…'' | accept-all | "banner" here means **banner ads** |
+| ''IMC/2023/understanding-the-privacy-risks-of-popular-search-engine-advertising-systems'' | accept-all | no first-person sentence mentions consent or a banner |
+| ''PETS/2023/a-utility-preserving-obfuscation-approach-for-youtube-recommendations'' | dismiss-or-remove | the only "consent" is **IRB participant consent** |
+| ''IMC/2024/analyzing-the-in-accessibility-of-online-advertisements'' | dismiss-or-remove | **IRB informed consent**, plus "banner ads" again |
+| ''PETS/2026/the-masks-we-think-we-wear-…'' | dismiss-or-remove | "explicit consent" is a **recommendation** about wallet permissions |
+**The one overstatement.** Trevisan et al., //4 Years of EU Cookie Law// (PoPETs 2019), is labelled ''accept-and-reject''. Its main crawl states "No user action is performed on the page… We do not scroll the page, nor click on any link", but the paper also reports a separate experiment "when consent to the usage of cookies is given". An **accept** arm exists; a **reject** arm is not described. It is counted as verified, with the caveat recorded here.
+**The pattern is not random, and it is useful.** All three ''dismiss-or-remove'' values are wrong and four of fifteen ''accept-all'' values are wrong, while **''accept-and-reject'' is 14 for 14, ''reject-all'' 2 for 2 and ''cmp-specific-choices'' 2 for 2**. The reading: the field is reliable exactly where a paper had to describe two arms explicitly, and unreliable where a single ambiguous word — //consent//, //banner//, //dismiss// — appears somewhere in a paper about something else. Anyone reusing this field should treat ''accept-all'' and ''dismiss-or-remove'' as needing verification and the two-armed values as sound.
+**''no-interaction'' was not audited.** 313 papers is beyond a hand pass in one sitting. If its error rate resembles the interacting values', the true interaction count is somewhere either side of 29 in **both** directions. This is stated on the content page and is the first item in §11.
+<code>claimed an interaction: 36
+adjudicated:            36
+── Verdicts ──
+Verdict                                     Papers  Share of the 36
+------------------------------------------  ------  ---------------
+supported by the paper text                 28      77.8%
+supported but the enum value overstates it  1       2.8%
+NOT supported — extraction false positive   7       19.4%
+FALSE-POSITIVE RATE of crawlConfig.consentAction on the interacting values: 7/36 = 19.4%
+── Figures recomputed on the AUDITED set ──
+papers that ran a crawl:                       1120
+state a consent action (incl. no-interaction): 349 (31.2%)
+  ... of which no-interaction:                 313
+  ... claim an interaction (extraction):       36 (3.2% of crawled)
+  ... interaction VERIFIED in the paper:       29 (2.6% of crawled, 8.3% of those stating)
+── Audited interaction by enum value ──
+Value                 Claimed  Verified  False positives
+--------------------  -------  --------  ---------------
+accept-all            15       11        4
+accept-and-reject     14       14        0
+cmp-specific-choices  2        2         0
+dismiss-or-remove     3        0         3
+reject-all            2        2         0
+── Audited interaction by year bucket ──
+Bucket      Crawling papers  Claimed  Verified  Share of bucket
+----------  ---------------  -------  --------  ---------------
+–2013   102              0        0         0.0%
+–2017   167              0        0         0.0%
+–2021   308              6        3         1.0%
+–2024   345              17       14        4.1%
+–2026*  198              13       12        6.1%
+── Vantage point of the VERIFIED interacting papers ──
+Vantage                             Papers  Share of 29
+----------------------------------  ------  -----------
+EU/EEA vantage                      21      72.4%
+vantage tuple, location not-stated  5       17.2%
+stated a non-EU/EEA vantage only    3       10.3%
+── Every verdict, in full ──
+[WRONG  ] CCS/2018/pride-and-prejudice-in-progressive-web-apps-abusing-native-app-like-features-in
+           claimed: accept-all
+           the only consent in the paper is the PUSH NOTIFICATION permission prompt
+[WRONG  ] WWW/2018/hiding-in-the-crowd-an-analysis-of-the-effectiveness-of-browser-fingerprinting-a
+           claimed: accept-all
+           no sentence in the paper mentions a consent notice or banner at all
+[PARTIAL] PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
+           claimed: accept-and-reject
+           main crawl states "No user action is performed on the page"; a separate experiment gives consent, so an ACCEPT arm exists but no reject arm is described
+[WRONG  ] IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising
+           claimed: accept-all
+           "banner" in this paper means BANNER ADS; no consent interaction described
+[OK     ] IEEE-SP/2020/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
+           claimed: accept-and-reject
+           semi-automatic crawl clicking through banners on 560 sites
+[OK     ] WWW/2021/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
+           claimed: accept-and-reject
+           "we leverage the Consent-O-matic tool"; three crawls, one per consent action
+[OK     ] PETS/2022/how-can-and-would-people-protect-from-online-tracking
+           claimed: accept-and-reject
+           "On the second visit, we accept the cookies... on the next visit, we try to opt-out"
+[OK     ] USENIX/2022/automating-cookie-consent-and-gdpr-violation-detection
+           claimed: accept-and-reject
+           crawler consents to all purposes and separately denies consent
+[OK     ] USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission
+           claimed: accept-and-reject
+           "three consent modes... accept all, reject all, and no action"
+[OK     ] IMC/2023/the-prevalence-of-single-sign-on-on-the-web-towards-the-next-generation-of-web-c
+           claimed: accept-all
+           "We use a plugin to auto-accept cookie banners"
+[WRONG  ] IMC/2023/understanding-the-privacy-risks-of-popular-search-engine-advertising-systems
+           claimed: accept-all
+           no first-person sentence mentions consent or a banner
+[WRONG  ] PETS/2023/a-utility-preserving-obfuscation-approach-for-youtube-recommendations
+           claimed: dismiss-or-remove
+           the only "consent" is IRB participant consent for the user dataset
+[OK     ] IEEE-SP/2023/the-leaky-web-automated-discovery-of-cross-site-information-leaks-in-browsers-an
+           claimed: accept-all
+           "the cookie banners accepted by our module"
+[WRONG  ] IMC/2024/analyzing-the-in-accessibility-of-online-advertisements
+           claimed: dismiss-or-remove
+           the only "consent" is IRB informed consent; "banner" means banner ads
+[OK     ] USENIX/2024/automated-large-scale-analysis-of-cookie-notice-compliance
+           claimed: accept-and-reject
+           five crawling steps: accepting, rejecting, closing, saving defaults, not interacting
+[OK     ] NDSS/2024/fp-fed-privacy-preserving-federated-detection-of-browser-fingerprinting
+           claimed: accept-all
+           "...solving CAPTCHAs, and consenting to all cookie notices" (a manual sub-crawl)
+[OK     ] USENIX/2024/dissecting-privacy-perspectives-of-websites-around-the-world-aceptar-todo-alle-a
+           claimed: cmp-specific-choices
+           measures "depth to reach the reject option", i.e. navigates the notice's own layers
+[OK     ] PETS/2024/a-large-scale-study-of-cookie-banner-interaction-tools-and-their-impact-on-users
+           claimed: accept-and-reject
+           the paper IS a comparison of banner-interaction extensions
+[OK     ] PETS/2024/fp-tracer-fine-grained-browser-fingerprinting-detection-via-taint-tracking-and-e
+           claimed: accept-and-reject
+           "we measure whether fingerprinters respect user consent banners using the Consent-O-Matic plugin"
+[OK     ] PETS/2024/opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
+           claimed: accept-and-reject
+           audits four CMPs with consent conveyed and not conveyed
+[OK     ] WWW/2024/a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework
+           claimed: reject-all
+           "accepted the automatic decline of user consent by our data collection system"
+[OK     ] WWW/2024/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting
+           claimed: accept-all
+           "To automatically interact with cookie consent banners, we integrated code derived from Priv-Accept"
+[OK     ] IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites
+           claimed: accept-all
+           "provide affirmative consent to all data processing request options (accept all)" via autoconsent
+[OK     ] CCS/2025/piixel-leaks-passive-identification-of-personally-identifiable-information-leaka
+           claimed: accept-all
+           "we simulate a real user's choice of 'Accept All' using the Consent-O-Matic extension"
+[OK     ] IMC/2025/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th
+           claimed: accept-all
+           "uses the autoconsent library to opt-in to common consent banners"
+[OK     ] PETS/2025/johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
+           claimed: accept-and-reject
+           the paper accepts and then revokes consent on 200 sites
+[OK     ] PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
+           claimed: accept-and-reject
+           "using BannerClick... accepting cookie banners in the first half and... rejected domains in the second"
+[OK     ] PETS/2025/referrer-policy-implementation-and-circumvention
+           claimed: accept-and-reject
+           "we employed DuckDuckGo's autoconsent library... comparison of RP implementations in different consent modes"
+[OK     ] WWW/2025/before-after-the-effect-of-eus-2022-code-of-practice-on-disinformation
+           claimed: accept-all
+           "we make use of Consent-O-Matic ... to automatically accept all cookies in consent banners"
+[OK     ] USENIX/2025/navigating-cookie-consent-violations-across-the-globe
+           claimed: reject-all
+           ConsentChk drives the banner across eight regions
+[OK     ] WWW/2025/semantics-aware-cookie-purpose-compliance
+           claimed: accept-all
+           "We use two browser extensions, namely Consent-O-Matic and Cookie-Editor"
+[OK     ] WWW/2025/the-first-early-evidence-of-the-use-of-browser-fingerprinting-for-online-trackin
+           claimed: cmp-specific-choices
+           "executing window.OneTrust.RejectAll to opt out"; per-CMP reject clicking
+[WRONG  ] PETS/2026/the-masks-we-think-we-wear-privacy-threats-of-browser-extension-wallets-in-the-w
+           claimed: dismiss-or-remove
+           "explicit consent" is a RECOMMENDATION about wallet permissions, not a crawl action
+[OK     ] PETS/2026/clicking-into-exposure-uncovering-privacy-risks-of-google-click-identifier-in-yo
+           claimed: accept-and-reject
+           "(i) a baseline run that accepts cookie banners... (ii) a rejection run that declines them"
+[OK     ] PETS/2026/privacy-vs-profit-the-impact-of-googles-manifest-version-3-mv3-update-on-ad-bloc
+           claimed: accept-all
+           "Accept consent notice via Super Agent-Automatic Cookie Consent extension"
+[OK     ] USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
+           claimed: accept-all
+           "We modify the crawler to automatically accept cookies using Priv-Accept"
+</code>
 ===== 8. Bibliography entries added =====
@@ Line 1210: / Line 1398: @@
 | EDPB Cookie Banner Taskforce report, 18 January 2023 | ''edpb.europa.eu'' document page | "Task force report 18 January 2023" |
 | EDPB Opinion 08/2024 on consent or pay, 17 April 2024 | ''edpb.europa.eu'' document page | "Opinion of the Board (Art. 64) 17 April 2024"; the page also lists a published **Corrigendum**, which the content page flags |
-| GVL at ''vendor-list.consensu.org/v3/vendor-list.json'' with numbered archives | Reported by the verification sub-agent from IAB documentation; **not independently fetched by this run** | Flagged as such in §11 |
+| GVL at ''vendor-list.consensu.org/v3/vendor-list.json'' with numbered archives | Fetched by the external-currency reviewer on 2026-08-19 after the first draft failed to | Serves valid JSON: ''vendorListVersion: 172'', ''lastUpdated: 2026-08-13''; ''/v3/archives/'' also resolves |
+| EDPB **Guidelines 2/2023** on the technical scope of Art. 5(3), final 16 October 2024 | ''edpb.europa.eu'' document page via Playwright | "Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive — Guideline 16 October 2024 — Final version" |
+| Google consent mode: EEA advertisers must collect consent and share the signal | ''support.google.com/tagmanager/answer/13695607'' via Playwright | "we are strengthening the enforcement of our EU user consent policy (EU UCP)… you must collect consent for use of personal data from end users based in the EEA and share consent signals with Google". **The page carries no date**, which is why this page asserts none |
+| Digital Omnibus is COM(2025) 837, 19 November 2025, inserting GDPR Art. 88a | EUR-Lex CELEX ''52025PC0837'' via Playwright | "A new Article 88a is inserted in Regulation (EU) 2016/679… which lays down the consent requirement for the storing or accessing of personal data on the terminal equipment of natural persons" |
+| EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus, 11 February 2026 | ''edpb.europa.eu'' document page via Playwright | "Legislative opinion 11 February 2026"; its editorial note corrects the proposal reference from COM(2025) 836 to COM(2025) 837 |
+| Colorado: GPC mandatory since 1 July 2024, only recognised UOOM | ''coag.gov/opt-out/'' | "Beginning July 1, 2024… Currently, the only UOOM considered valid by The Department is GPC" |
+| ''tcf_probe.js'' output from four live CMPs | Playwright/Chromium, non-EU vantage, 2026-08-19 | Reproduced verbatim on the content page. spiegel.de and heise.de return ''cmpId 6'', repubblica.it ''cmpId 123'', lemonde.fr times out with ''%%__tcfapi%%'' defined. **This closes the "code was not executed" gap** recorded in §11 of the first revision |
+| Header-only GPC leaves ''navigator.globalPrivacyControl'' undefined | Playwright/Chromium with ''extraHTTPHeaders: { 'Sec-GPC': '1' }'', 2026-08-19 | ''Sec-GPC on the navigation request = "1"'' / ''navigator.globalPrivacyControl = undefined''. Run it yourself: ''sandbox/gpchdr.mjs'' |
+| Firefox GPC preference names | ''searchfox.org/mozilla-central'', ''modules/libpref/init/StaticPrefList.yaml'' via Playwright | ''privacy.globalprivacycontrol.enabled'', ''.pbmode.enabled'', ''.functionality.enabled''. The Firefox equivalent of the header test could **not** be run: Playwright's Firefox build is not installed in this container |
 ==== 9.1 Claims checked and rejected ====
@@ Line 1223: / Line 1419: @@
 | A precise EasyList Cookie List rule count stated without a counting rule | Three different counting rules gave 682, 2,099 and 1,668 "network" rules for the same file. The page publishes its own count **with the rule**, and says the sibling page's differing figure comes from a different rule |
 | Google Consent Mode v2 became mandatory for EEA advertisers on 6 March 2024 | Well corroborated in industry sources; Google's own policy page 404'd on two attempts. **Left off the page entirely** rather than cited to a vendor blog |
-| Connecticut, Texas and other states legally require honouring GPC | Only California and Colorado were checked against a regulator's own page. The page quotes the specification's "at least four states" instead of enumerating |
+| Connecticut, Texas and other states legally require honouring GPC | Only California and Colorado were checked against a regulator's own page. The page quotes the specification's "at least four states", adds that the practical number is "roughly a dozen and grows every session", and tells the reader to check the current list rather than enumerating one that will rot |
+| CNIL fined Google €325m and Shein €150m for cookie-consent violations on 3 September 2025 | Raised by the external-currency reviewer and **rejected**: the cnil.fr press-release URL returns 404 and no primary CNIL page was located within budget. Enforcement examples belong on [[practices:legal_enforcement]] anyway |
+| Didomi acquired Sourcepoint in July 2025 | Raised and **rejected**: this page does not profile the CMP market, and a vendor-consolidation line would rot faster than anything else on it. Worth knowing if you are attributing a behaviour to a CMP by ''cmpId'' — the ID outlives the company |
+| "Global Privacy Platform" as the expansion of GPP | **Corrected**: IAB Tech Lab's own page is now titled "Global Privacy **Protocol**". The page's text was checked and does not expand the acronym, so no edit was needed — recorded so the next run does not re-introduce the old expansion |
 ===== 10. Judgement calls =====
@@ Line 1233: / Line 1432: @@
   * **The measured-results table publishes 21 of the 109 available prevalence tuples.** Selection was by: is the denominator recoverable, is the phenomenon a consent mechanism rather than a downstream effect, and does it add something the other rows do not. The full 109 are in §5.3 so the selection is auditable.
   * **No ''%%~~DISCUSSION~~%%'' on this provenance page.** Following the convention set by the earlier ''provenance:'' pages: comments belong on the content page.
-  * **The page publishes JavaScript that was not executed against a live site.** ''tcf_probe.js'' is written from the TCF v2 API surface as documented and as used by the corpus papers; it was **not** run against a real CMP in this session. That is stated in §11 rather than implied away.
+  * **The page publishes JavaScript, and it was executed.** ''tcf_probe.js'' was run against four live European news sites on 2026-08-19 and its real output is on the content page (§9). The first published revision of this page said the opposite, because the run happened afterwards and these bullets were not revised — a reviewer caught the contradiction on the same day. **The limitation that remains** is coverage, not fabrication: four sites and three distinct ''cmpId'' values are a smoke test, not a compatibility matrix across CMP implementations.
 ===== 11. What could not be established =====
-  * **''tcf_probe.js'' was not executed.** It is a straightforward use of the documented ''%%__tcfapi('getTCData', 2, cb)%%'' call and mirrors what Matte et al. and Hils et al. describe doing, but this run did not drive a browser at a TCF site to confirm the exact field names of the returned object across CMP implementations. Treat it as a template to test, not a tested snippet.
+  * **''tcf_probe.js'' has now been executed** against four live European news sites (§9), which was not true of the first published revision. Three CMPs answered and one timed out; the output is on the content page. What is still **not** established is how the returned object varies across the long tail of CMP implementations — four sites and three distinct ''cmpId'' values is a smoke test, not a compatibility matrix.
-  * **The GVL and CMP-list URLs were not fetched by this run.** They are reported from IAB documentation via the verification sub-agent. Check them before relying on them.
+  * **The Firefox side of the GPC test could not be run.** Playwright's Firefox build is not installed in this container, so the claim that setting ''privacy.globalprivacycontrol.enabled'' produces //both// carriers is inferred from the preference existing in mozilla-central, not observed. The Chromium half — that injecting the header alone leaves the DOM property undefined — **was** observed.
+  * **The CMP-list URL was not fetched by this run.** The **GVL** URL was — ''vendor-list.consensu.org/v3/vendor-list.json'' serves valid JSON, ''vendorListVersion: 172'', ''lastUpdated: 2026-08-13'', with ''/v3/archives/'' resolving (§9). The registered-CMP list URL is still second-hand; check it before relying on it. This bullet said both were unfetched until a reviewer noticed on 2026-08-19 that §9 already contradicted it.
   * **Google Consent Mode v2's mandatory date** could not be confirmed from a Google-controlled page, so it is not on the content page at all — even though it is arguably the single biggest change to what a European crawl observes since the GDPR.
   * **The 2025–2026 EU legislative picture** (ePrivacy Regulation withdrawal, Digital Omnibus, UK Data (Use and Access) Act) is secondary-sourced. It is on the page in a footnote that says so.
   * **Field stability was not re-measured.** The 93% agreement figure for ''consentAction'' comes from the 100-paper stability comparison run against the earlier 4,322-paper corpus. Nobody has re-run it since 2026-08-11.
   * **How many of the 495 ''not-stated'' papers actually had a banner to handle** is unanswerable from the extraction. A crawl of Chinese or US-only sites in 2015 may have faced none. The page therefore reads ''not-stated'' as "the reader cannot tell", not as "the authors were careless".
-  * **No independent check that the 36 interacting papers really are all of them.** ''consentAction'' is extracted from the paper's own words; a paper that clicked a banner and never wrote it down is invisible here by construction. 36 is a floor.
+  * **The 313 ''no-interaction'' papers were not audited**, only the 36 claiming an interaction (§7.2). The false-positive rate on the audited side is 19.4%; nothing is known about the rate on the unaudited side, and if it is comparable the verified count of 29 could move in either direction. Auditing 313 papers is a day of work and would make the central figure of this page solid rather than indicative — it is the largest open item here.
+  * **A paper that clicked a banner and never wrote it down is invisible** by construction, since ''consentAction'' is extracted from the paper's own words. 29 is a floor on the true number as well as an audited count.
   * **CHI, SOUPS, EuroS&P, ACSAC, RAID, AsiaCCS and WPES are absent from the corpus**, and that bites harder on consent than on most topics: a large fraction of consent-notice work is usable-privacy work published at CHI and SOUPS. Every S2 count is a lower bound and the content page says so twice.
@@ Line 1262: / Line 1463: @@
   - Two BibTeX entries generated for papers already in the bibliography, caught by the duplicate-key check before saving.
   - The first published render showed 28 inline markers but only 15 reference entries — the known bibtex4dw cache staleness. Fixed by requesting ''?purge=true'' on [[literature:bibliography]] and then on [[privacy:consent]]; re-verified at 28 of 28.
+  - **An unclosed inline-nowiki marker (a lone pair of percent signs) in §2.1 of this page** silently stopped DokuWiki parsing everything after it: sections 2.2 to 11 rendered as raw source, with no error and no warning. Caught by counting rendered ''h2''/''h3''/''table''/''pre'' elements against what the source should produce, which is now the standard check — verifying that the citations resolve passes happily on a page that is 80% raw markup.
+  - **The page's central figure was wrong in its first published revision.** It said 36 papers interacted with a consent notice, which is what the extraction says. The audit in §7.2, run after publication, brought it to 29. The corrected figures went live the same day. The lesson recorded for the next run: **an object-valued extraction field shares one evidence quote across every one of its keys, so the site's standard quote spot-check cannot validate any individual key.** Audit the field directly or do not publish a count from it.
+===== 13. Review log =====
+Four reviewers, all handed the frozen page text, the report script and its output, and these notes, and all told explicitly that the author's context might not be exhaustive. Three focused passes ran in parallel first; the findings below are recorded with the verdict, because a rejection is as much a record of whether a reviewer earned its slot as a fix is.
+==== 13.1 Figures versus the script (Sonnet) ====
+Re-ran ''report_consent.mjs'' and ''consent_quotecheck.mjs'' and diffed both against the committed output: **clean, no differences**.
+^ # ^ Finding ^ Verdict ^
+| 1 | **The tool tally in prose omits two rows the script produces.** ''T1'' had 18 rows over 40 papers; the page's list summed to 37 and silently dropped ''EasyList Cookie List'' (2) and ''CookieGuard'' (1). | **Accepted for EasyList, and later reversed for CookieGuard.** EasyList was restored and the prose now states the totals so the next drift is visible. On CookieGuard the first response here — that the population filter and the tool count are different questions, so a tool from an excluded paper still counts — was **wrong**: CookieGuard is a cookie-jar isolation defence and is not a consent instrument at all, so it does not belong in a consent-tool fold under either question. The generic pass caught the contradiction with §3 (13.4 #4); the mapping is gone and T1 is now **17 names over 39 papers**. |
+| 2 | **"by a factor of six over the next venue"** — the real next-highest share is IMC at 1.1%, so 5.9/1.1 ≈ 5.4×. "Six" only works against USENIX Security, which is second by //count// but not by //share//. The page's venue table was also ordered by neither. | **Accepted**, and it had already been caught in self-review and softened to "more than a factor of five". The table is now sorted by papers in S2, which is what caused the slip. |
+| 3 | **The quote-check verifies literals that were never published**, including the one "cols only" catch the page boasts about (Matte's ''62 (4.3%)''). | **Accepted twice over.** The framing is corrected in §7 above, //and// the 4.3% shared-consent-string finding is now a box on the content page — it is a genuinely useful result about stateful crawling that had been dropped between drafts. The second citations reviewer found the same thing independently. |
+| 4 | **"moved by about nine points in sixteen years and is flat since 2018"** — actual movement is 24.5% → 29.8%, about five points, with a 33.6% peak in 2022–2024 and a //decline// in the provisional last bucket. "Nine points" uses the peak as the endpoint. | **Accepted.** Rewritten to give the three numbers and say the latest bucket is no better than pre-GDPR. This is the clearest case on the page of a sentence that was more rhetorically satisfying than true. |
+| 5 | The law-family table shows 5 of the script's 8 rows. | **Accepted**, as a one-line note naming the three omitted single-paper families. |
+| 6 | **''S1d'''s vantage classifier bucketed unmappable location strings as "non-EU/EEA"**, when strings like "different continents" name no place and could include the EU. | **Accepted, and it was a real bug in published code.** ''report_consent.mjs'' and ''consent_action_audit.mjs'' now emit a separate ''location named but unmappable'' row. It moves one paper (non-EEA 72 → 71). Small, and exactly the kind of silent fall-through the site's rules exist to prevent. |
+==== 13.2 Citations and quotes (Sonnet) ====
+Verified every citation marker on both pages against a **fresh** fetch of the live bibliography, checked all 13 new entries against Crossref and landing pages, and traced every table row and prose figure to ''paper.cols.txt''.
+^ # ^ Finding ^ Verdict ^
+| 1 | **This provenance page claimed a figure was on the content page when it was not** — Matte's 4.3% shared-cookie consent reuse. | **Accepted.** Same defect as 13.1 #3, found independently. Both the claim and the omission are fixed. |
+| 2 | The quote-check is a superset of what shipped; at least two whole checked papers and a dozen literals never reached the page. | **Accepted**, corrected in §7. |
+| 3 | The Colorado GPC claim carried no source footnote, breaking the page's own convention for regulator claims. | **Accepted.** Footnote added, quoting ''coag.gov/opt-out/'' directly. |
+| 4 | ''kumar2020_finding'' lists fuller author names ("Cranor, Lorrie Faith") than Crossref ("Lorrie Cranor"). | **Rejected as an error**, recorded as a check. The fuller forms are the authors' own and ''bibgen.mjs'' took them from the index; the bib entry is more correct than Crossref, not less. |
+| — | Everything else passed: all keys resolve, 390 entries with no duplicates, the multi-key citation renders, all 13 new entries match their sources, and every traced figure and denominator matched — Degeling's 6,357, Bouhoula's 72.2%, Hausladen's three dated percentages, Nguyen's two distinct denominators, Matte's four violation rates, Toth's six-of-ten. | Noted. |
+==== 13.3 External currency (Sonnet) ====
+Everything in the tool table and every standards/legal claim independently re-fetched. **All of them confirmed**, including the GitHub dates and rule counts, the EasyList header and the three rule counts, the GPC spec status and all four quoted sections, the DNT notes and the Firefox 135 wording, TCF v2.3's three dates, CJEU C-604/22, both Belgian decisions, the USP deprecation and both EDPB documents. It also fetched the **GVL URL this run had admitted not fetching** — it serves valid JSON, ''vendorListVersion: 172'', ''lastUpdated: 2026-08-13''.
+^ # ^ Finding ^ Verdict ^
+| 1 | **Google consent mode is missing entirely**, and a working Google-controlled URL exists. | **Accepted, and it was the biggest hole on the page.** Consent mode is why a rejection can leave the Google tag firing with cookieless pings — a crawl counting requests and a crawl counting cookies reach opposite conclusions about the same site. Now a box in the law section. The page still refuses to state the March 2024 enforcement date, because Google's own page does not carry it. |
+| 2 | **EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus (11 February 2026)** answers the page's own open question and is fetchable. | **Accepted.** |
+| 3 | **A primary Commission document exists**: COM(2025) 837, CELEX ''52025PC0837'', proposing GDPR Art. 88a. | **Accepted.** The hedged, secondary-sourced footnote is replaced by the primary text and its own wording. |
+| 4 | **EDPB Guidelines 2/2023 on the technical scope of Art. 5(3)** (final 16 October 2024) are not mentioned. | **Accepted, and the most useful of the four.** They decide what a "cookie consent" measurement is even allowed to be about — pixels, link decoration, IP-only tracking. A study whose denominator is cookies has scoped the legal question too narrowly, and the page now says so. |
+| 5 | The UK DUAA/PECR footnote is vaguer than what is findable, and omits the fine cap rising from £500k to £17.5m / 4%. | **Accepted with its sourcing caveat kept.** The ICO's own guidance page confirms only that a revision is out for consultation, so the commencement date and cap remain secondary-sourced and are labelled as such. |
+| 6 | Universal opt-out requirements are in force in roughly a dozen states, not the spec's "at least four". | **Accepted in spirit, not in list form.** The page adds "roughly a dozen and grows every legislative session" and tells the reader to check for their crawl's date. Publishing an enumerated list would rot within a year and is the kind of thing this site should not do. |
+| 7 | CNIL fined Google €325m and Shein €150m on 3 September 2025. | **Rejected.** The cnil.fr URL 404s and no primary page was found; enforcement examples belong on [[practices:legal_enforcement]]. |
+| 8 | GPP is now "Global Privacy **Protocol**", not "Platform". | **Confirmed and noted.** IAB Tech Lab's page is retitled. The content page never expands the acronym, so no edit; recorded so it is not re-introduced. |
+| 9 | Didomi acquired Sourcepoint, July 2025. | **Rejected** as out of scope — with a note in §9.1 about why it still matters if you attribute behaviour by ''cmpId''. |
+==== 13.4 Generic pass (Fable) ====
+No checklist: whatever the focused three were not looking for. It read both pages live and reviewed this provenance page as well as the content page.
+^ # ^ Finding ^ Verdict ^
+| 1 | **This page contradicted itself about whether ''tcf_probe.js'' was ever run.** §9 recorded a real run against four live CMPs; §10 and §11 still said it had not been executed. "One of these is false. If §11 is right, the content page fabricates measurement output." | **Accepted, and it was the worst thing on either page.** The run is real — the §10/§11 bullets were first-draft text that survived a late run. Both rewritten. The reviewer is right that this is worse on a page that has just taught the reader to trust its self-declared limits. |
+| 2 | **The content page still said 71 → "72 (20.6%)" non-EEA**, the figure the vantage-classifier fix in 13.1 #6 had changed. The review log recorded a fix that was never propagated to the page. The sentence also silently dropped the 3 no-vantage-tuple papers. | **Accepted.** Corrected to 71 (20.3%) and the remaining four papers are now named. **This is the failure mode the log exists to catch and it caught it in its own record** — a verdict of "Accepted" in §13 means a finding was agreed with, not that the edit shipped. |
+| 3 | **§11 still claimed the GVL was never fetched**, contradicted twice on the same page. | **Accepted.** Same cause as #1; rewritten to separate the GVL (fetched) from the registered-CMP list (still second-hand). |
+| 4 | **CookieGuard was listed on the content page as a consent-handling tool**, while §3 of this page gives "not a consent tool" as the reason its paper was excluded. 13.1 #1 had re-justified counting it, contradicting §3. | **Accepted, and the earlier verdict reversed.** ''consent_fold.mjs'' no longer maps it, and the comment there says why. T1 is now **17 names over 39 papers**. The figures reviewer was right that the fold and the population are different questions, and wrong about which side CookieGuard belongs on. |
+| 5 | **The Google consent-mode box was in the wrong section** — a measurement mechanic filed under //Which law//, a visible seam from the previous review round. | **Accepted.** Moved to //Verifying That the Consent Actually Registered//, where a reader designing verification will meet it, and reworded as "a fifth check". |
+| 6 | **"two thirds of the time the paper does not say"** counts the 236 ''not-applicable'' papers the page elsewhere calls a legitimate value. Excluding them gives about three in five. | **Accepted.** Reworded with the exclusion stated. |
+| 7 | The web/mobile split was presented as a partition (57 + 15 = 72, 79.2% + 20.8% = 100%) although ''platforms'' is multi-valued. | **Accepted.** The percentages are gone and the overlap is stated. |
+| 8 | **Demir's "12 (65%)"** was imported with the paper's own confusing phrasing and no denominator. | **Accepted.** Now leads with the 65% and explains what the 12 is. |
+| 9 | The 349 → 36 → 29 story is told three times. | **Accepted in part.** The second telling is cut to a pointer; the first and third stay, because one is the reader's entry point and the other is the corpus section's own account. |
+| 10 | "36 that appear to have **clicked** one" — 3 of the 36 are ''dismiss-or-remove'', which the page twice insists is not clicking. | **Accepted.** "interacted with one". |
+| — | Called out as good: the page answers its own title question, the split with [[privacy:requests]] is signposted in both directions, and §7.2 plus §13.4 are "honest above the site's usual bar". | Noted, and the same reviewer immediately used that to argue findings 1 and 3 are worse for it. That is the right way round. |
+==== 13.5 What the reviewers did not catch ====
+Worth recording, because it is the honest measure of a review layer. **The largest error on the first published revision — the 36-versus-29 interaction count (§7.2) — was found by the author, not by any reviewer**, while the three focused passes were still running. The figures reviewer re-ran the script and confirmed every number matched it, which was true and was exactly the wrong question: the script faithfully reported a field that was wrong 19.4% of the time. A "figures versus script" pass cannot catch a script that correctly reports bad data. The next run should add a pass that reads a sample of the underlying **papers** rather than the underlying script.
+**And the second-largest was caught only by the last reviewer.** Findings 13.4 #1 and #3 are internal contradictions on this page — §9 saying a thing was verified while §10 and §11 said it was not. Three focused reviewers with narrow briefs all read past them; the unbriefed pass opened with them. The specific mechanism is worth naming: **both were caused by applying a late fix in one section and not re-reading the sections that had been written before it.** A "what could not be established" section is the first thing to go stale and the last thing anybody re-reads, and it is precisely the section whose staleness does the most damage. Re-read §10 and §11 last, every time.
+**A third, smaller lesson:** 13.4 #2 found a fix this log had recorded as accepted but never shipped. Marking a review finding "Accepted" and editing the page are two separate acts and this run got them out of step once. The check is mechanical — after applying fixes, grep the page for the old value, not for the new one.
 ====== References ======