Differences

This shows you the differences between two versions of the page.

--- provenance:privacy:consent [2026/08/19 04:01] – Fix two stale claims in sections 10 and 11 that contradicted section 9 (the TCF probe WAS run; the GVL WAS fetched), reverse the earlier CookieGuard verdict, refresh the embedded script output, and log the generic review pass with all ten findings and wha karel.kubicek.claude
+++ provenance:privacy:consent [2026/09/17 07:23] (current) – Markup rendering sweep: wrap escapes, CLI flag typography, and heading quotes. Authored by Claude. karel.kubicek.claude
@@ Line 10: / Line 10: @@
 | Folds it depends on | ''scripts/consent_fold.mjs'' (consent tools and CMP vendors), ''scripts/law_fold.mjs'' (shared with [[practices:legal_enforcement]]), ''scripts/geo.mjs'' (shared with [[design:crawling_location]]) |
 | Per-paper figure verification | ''scripts/consent_quotecheck.mjs'' — checks every literal figure the page publishes against the paper's own ''paper.cols.txt'' **and** ''paper.norm.txt'' |
-| Field audit | ''scripts/consent_action_audit.mjs'' — reads all 36 papers whose ''consentAction'' claims an interaction against their own full text, and recomputes every dependent figure |
+| Field audit, interacting side | ''scripts/consent_action_audit.mjs'' — reads all 36 papers whose ''consentAction'' claims an interaction against their own full text, and recomputes every dependent figure |
+| Field audit, ''no-interaction'' side | ''scripts/consent_action_noninteraction_audit.mjs'' — the same for all 313 papers labelled ''no-interaction'' (added 2026-09-05, §7.3) |
+| Verdict quote check | ''scripts/consent_ni_quotecheck.mjs'' — every phrase quoted in a ''no-interaction'' verdict, checked against the cited paper, with a mutation self-test |
+| Significance tests | ''scripts/consent_ni_significance.py'' — Fisher's exact on every adjacent year-bucket movement the audit changes |
 | Data | ''data/extract/run1/extractions.jsonl'' — 5,859 papers, 7 venues, 2010–2026 |
 | Written | 2026-08-19, against the corpus as extended on 2026-08-11 (commit ''8a6b843'') |
+| Amended | 2026-09-05 — the ''no-interaction'' audit (§7.3, §11, §14) |
 | Bibliography entries added | 13 (§8) |
-**Create, extend or overlap?** This is a **rewrite**. ''privacy:consent'' existed at 2,748 bytes and was explicitly labelled brainstorm notes: a ''%%<wrap todo>%%'' box and two bullet lists of topics to cover. Every topic it listed is now covered somewhere — notice detection and the Consent-O-Matic/autoconsent/IDCAC family, ML classification of consent choices, GPC, DNT, opt-out links. Nothing was deleted that carried information; the two citations the stub used ({[khandelwal2023automated]} and {[bouhoula2024automated]}) are both still cited.
+**Create, extend or overlap?** This is a **rewrite**. ''privacy:consent'' existed at 2,748 bytes and was explicitly labelled brainstorm notes: a ''%%<wrap todo>%%'' box and two bullet lists of topics to cover. Every topic it listed is now covered somewhere — notice detection and the Consent-O-Matic/autoconsent/IDCAC family, ML classification of consent choices, GPC, DNT, opt-out links. Nothing was deleted that carried information; the two citations the stub used ({[khandelwal2023automated]} and {[bouhoula2024_automated]}) are both still cited.
 **The overlap that mattered, and how it was resolved.** [[privacy:requests]] already carries a section called //Cookie Notices and Their Interactive Elements// which covers **detecting** the notice and **labelling its buttons**, with a comparison table of detectors, and which explicitly says "What the notice //means// legally, and what to do about consent, is on [[privacy:consent]]". That division was kept rather than re-litigated. This page therefore does **not** repeat the detector comparison; it starts one step later, at "you have found the banner, now what do you do with it". The judgement call and the alternative are in §10.
@@ Line 120: / Line 124: @@
 node scripts/report_consent.mjs --wiki         # the same, as DokuWiki tables
 node scripts/consent_quotecheck.mjs            # every published literal vs the source PDFs
+node scripts/consent_action_audit.mjs                    # the 36 interacting papers
+node scripts/consent_action_noninteraction_audit.mjs     # the 313 no-interaction papers
+node scripts/consent_action_noninteraction_audit.mjs --evidence  # per-paper consent sentences
+node scripts/consent_action_noninteraction_audit.mjs --probes    # the two recall probes
+node scripts/consent_ni_quotecheck.mjs --mutate          # verdict quotes + mutation self-test
+python3 scripts/consent_ni_significance.py               # Fisher's exact on the year buckets
 </code>
@@ Line 1172: / Line 1183: @@
 The Matte case is the one worth keeping: a percentage that looks like it came from a paper, computed by the writer from a count and a denominator taken from two different tables. Reading the source turned up **four more** figures the draft did not have — 46.5% pre-selected, 5.3% non-respect of choice, 54.29% any violation, and the 4.3% shared-cookie consent reuse. The first three went into the results table immediately; the fourth was accidentally dropped between drafts and was restored, as a box in the TCF section, only after a reviewer noticed on 2026-08-19 that this very paragraph claimed it was on the page when it was not.
-==== 7.2 The ''consentAction'' audit, and why the standard quote check could not have caught it ====
+==== 7.2 The consentAction audit, and why the standard quote check could not have caught it ====
 The page's central figure is "how many papers interacted with a consent notice". The extraction says **36**. Reading all 36 against their own text says **29**. That is a **19.4% false-positive rate** on the interacting values of ''crawlConfig.consentAction'', and it is the single most important thing on this provenance page.
@@ Line 1178: / Line 1189: @@
 **Why the site's usual check is blind here.** The dataset's guidance is to read a handful of ''evidence.quote'' values behind any figure before publishing it. That check **cannot work for this field**. ''crawlConfig'' is an object, not an array, and it carries **one** evidence quote for the **whole** object — statefulness, browsers, headless, consent action, interaction depth, authentication, languages and repeat visits all share it. So the quote behind a ''consentAction'' value usually evidences something else entirely. Read literally, the quotes for the 36 papers include "we create a separate docker container for each URL we visit", "each crawl within a run is performed once without repetition" and "we visit each website afresh with storage cleared" — none of which says anything about a banner. One of them, for Trevisan et al., says the opposite of its label: **"No user action is performed on the page"** sits under a ''accept-and-reject'' value.
-Doing the check properly meant a different method: extract every sentence in each paper containing a consent/banner term **and** a first-person marker, read them, and record a verdict. ''consent_action_audit.mjs --sentences'' reproduces the sentences; the verdicts are hard-coded in that file with a one-line reason each, and the script **fails loudly** if a paper claims an interaction and has no verdict, or if a verdict refers to a paper that no longer claims one. That guard caught three truncated slugs in the first version of the verdict table.
+Doing the check properly meant a different method: extract every sentence in each paper containing a consent/banner term **and** a first-person marker, read them, and record a verdict. ''consent_action_audit.mjs %%--sentences%%'' reproduces the sentences; the verdicts are hard-coded in that file with a one-line reason each, and the script **fails loudly** if a paper claims an interaction and has no verdict, or if a verdict refers to a paper that no longer claims one. That guard caught three truncated slugs in the first version of the verdict table.
 ^ Verdict ^ Papers ^ Share of 36 ^
@@ Line 1200: / Line 1211: @@
 **The pattern is not random, and it is useful.** All three ''dismiss-or-remove'' values are wrong and four of fifteen ''accept-all'' values are wrong, while **''accept-and-reject'' is 14 for 14, ''reject-all'' 2 for 2 and ''cmp-specific-choices'' 2 for 2**. The reading: the field is reliable exactly where a paper had to describe two arms explicitly, and unreliable where a single ambiguous word — //consent//, //banner//, //dismiss// — appears somewhere in a paper about something else. Anyone reusing this field should treat ''accept-all'' and ''dismiss-or-remove'' as needing verification and the two-armed values as sound.
-**''no-interaction'' was not audited.** 313 papers is beyond a hand pass in one sitting. If its error rate resembles the interacting values', the true interaction count is somewhere either side of 29 in **both** directions. This is stated on the content page and is the first item in §11.
+**''no-interaction'' was audited on 2026-09-05.** When this section was written it had not been, and the guess recorded here — that its error rate would resemble the interacting values' — was wrong by an order of magnitude. See §7.3.
 <code>claimed an interaction: 36
@@ Line 1356: / Line 1367: @@
            "We modify the crawler to automatically accept cookies using Priv-Accept"
 </code>
+==== 7.3 The no-interaction audit ====
+Run 2026-09-05. §7.2 audited the 36 papers claiming an interaction and left the complementary 313 unread, which meant the page's central denominator rested on an unaudited field. All 313 have now been read.
+**What ''no-interaction'' asserts.** It is **not** a sentinel. The same field carries ''not-stated'' (495 crawling papers) and ''not-applicable'' (236), so ''no-interaction'' is a positive claim: the paper says its crawl left the notice alone. A paper that never discusses consent should have been ''not-stated'', and counting it as a stated value inflates precisely the quantity the page is about.
+=== 7.3.1 Verdict scheme ===
+Five verdicts, each anchored in the paper's own words rather than in a judgement about how completely the crawl is described. That boundary was chosen deliberately: "the paper describes its procedure fully enough that non-interaction follows" is not reproducible across 313 papers, and would have made the audit a matter of taste.
+^ Verdict ^ Test ^ Papers ^
+| ''wrong'' | the paper describes its measurement acting on a consent notice — a **false negative** | 3 |
+| ''partial'' | an interacting arm exists, but ''no-interaction'' is defensible for the arm the label appears to describe | 1 |
+| ''ok'' | the paper says, in words, that it did not act on a consent notice (or on a consent prompt of another kind) | 22 |
+| ''implied'' | the paper states its crawl performs **no page interaction at all**, without ever mentioning consent | 8 |
+| ''unstated'' | nothing in the paper supports the value; it should have been ''not-stated'' | 279 |
+=== 7.3.2 Method ===
+  - **The 313 were partitioned mechanically first.** A deliberately wide vocabulary pattern (consent, cookie banner/notice/bar/wall/dialog/prompt, banner, CMP, GDPR, ePrivacy, opt-in, opt-out, accept all, reject all, the named banner tools, the named CMP vendors, pop-up, overlay, interstitial, modal) was run over **both** renderings of every full text — ''paper.cols.txt'' and ''paper.txt''. **72 papers contain no hit in either.** Those are ''unstated'' without further reading. Positive control: the pattern fires on **36 of 36** papers on the interacting side, including all 29 verified ones.
+  - **A third, independent extraction was run over a sample of the 72.** ''paper.cols.txt'' and ''paper.txt'' are both pypdf-derived, so agreeing that a paper has no consent vocabulary is weaker evidence than it looks. 12 of the 72 were drawn at random (seed 20260905) and re-extracted directly from ''paper.pdf'' with pypdf 6.16.2: **12 of 12 confirmed zero hits**, with 50k–97k characters extracted each, so the files are not truncated.
+  - **The remaining 241 were read.** For each, every sentence carrying a consent term was extracted, ranked (named tool > non-interaction phrase with a first-person marker > consent term with a first-person marker > consent term alone) and adjudicated by hand, in batches of 20, in publication order. Where the excerpt was ambiguous the paper's full text was queried directly with a targeted pattern; **21 papers needed that, and 7 changed verdict as a result** — ''my-cookie-is-a-phoenix'', ''everybodys-looking-for-ssomething'', ''comparing-large-scale-privacy-and-security-notifications'' and ''digital-disparities'' from ''unstated'' to ''ok'', ''reproducibility-and-replicability'' from ''unstated'' to ''implied'', CookieEnforcer from ''unstated'' to ''wrong'', and WhisperTest from ''ok'' to ''partial''.
+  - **Two recall probes were then run over all 313** as a check on the hand pass, one for statements of interaction and one for statements of non-interaction (§7.3.5). Neither found a paper the hand pass had missed. Neither alone finds every ''ok'' either, which is why they are a safety net and not the method.
+=== 7.3.3 Result ===
+The two sides of the field fail in different ways, and the ''no-interaction'' failure is both far more common and far more consequential.
+^  ^ interacting values (§7.2) ^ ''no-interaction'' (§7.3) ^
+| papers | 36 | 313 |
+| supported by the paper | 29 (80.6%) | 22 (7.0%) |
+| **not supported** | **7 (19.4%)** | **279 (89.1%)** |
+| wrong in the other direction | — | 3 (1.0%) |
+On the interacting side the extractor **misreads a word** — a push-notification prompt, a banner ad, an IRB consent form. On the ''no-interaction'' side it **supplies a default where the paper is silent**. The second is the error that matters, because it is what manufactures a reporting rate: 349 papers "stating a consent action" becomes **55**.
+**What the consent vocabulary in the 279 unsupported papers actually was.** This is the residue of the classification, printed so the part that could not be a consent claim stays visible:
+^ Tag ^ Papers ^ Share of 279 ^ What it means ^
+| ''noise'' | 74 | 26.5% | the wide pattern fired on //overlay//, //modal//, //bimodal//, //multi-modal//, //pop-up//, //adopting//, or on **Quantcast** as a top-list provider |
+| ''none'' | 72 | 25.8% | no consent vocabulary anywhere in either rendering |
+| ''phenomenon'' | 48 | 17.2% | consent is the studied object in a non-crawl sense: privacy-policy text, OAuth/SSO consent screens, cryptomining opt-in prompts, Android permissions, download-consent dialogs |
+| ''irb'' | 24 | 8.6% | human-subject, operator or ISP informed consent |
+| ''background'' | 22 | 7.9% | GDPR/ePrivacy as legal background, or a consent-related reference title |
+| ''adbanner'' | 19 | 6.8% | "banner" means an advertisement |
+| ''optout'' | 9 | 3.2% | NAI/DAA/EDAA industry opt-out programmes, GPC, robots.txt as an LLM-training opt-out |
+| ''protobanner'' | 6 | 2.2% | "banner" means an SSH/SMTP/zgrab2 service banner |
+| ''copyright'' | 3 | 1.1% | the ISOC/ACM "prior written consent" boilerplate |
+| ''fieldstudy'' | 2 | 0.7% | consent behaviour measured on **real visitors**, not by the crawler |
+The ''fieldstudy'' pair is worth naming because both are landmark consent papers and both are ''unstated'' here: Utz et al., //(Un)informed Consent// {[utz2019_informed]}, whose "no action" figures describe the field experiment's real visitors while its Selenium crawl is described only as visiting home pages and taking screenshots; and Degeling et al., //We Value Your Privacy… Now Take Some Cookies// {[degeling2019_value]}, which categorises notices and their interaction options but never states what its own crawler did. Neither paper is careless. The extraction simply has no value for "measured consent on humans".
+=== 7.3.4 The three false negatives, and the one partial ===
+^ Paper ^ Platform ^ What it actually does ^
+| ''USENIX/2023/automated-cookie-notice-analysis-and-enforcement'' (CookieEnforcer) {[khandelwal2023automated]} | web | "addresses these challenges by mimicking the actions of real users: it interacts with the cookie notices"; the backend was run over **85,473** of the top 100k Tranco sites to disable non-essential cookies. Correct value: ''cmp-specific-choices'' |
+| ''IMC/2024/browsing-without-third-party-cookies-what-do-you-see'' {[lin2024_browsing]} | web | "we adopted BannerClick" "to automatically click the accept and reject buttons in cookie notices", counting cookies "after BannerClick interaction". Correct value: ''accept-and-reject'' |
+| ''PETS/2026/the-tcf-doesn-t-really-a-a-id…'' {[morel2026_tcf]} | Android apps | "We design a methodology to semi-automatically interact with consent banners deployed by major CMPs in TCF-based Android apps, combining three approaches … disagree to all, legitimate interest purposes only, and consent to all". Correct value: ''cmp-specific-choices'' |
+| ''CCS/2025/whispertest-a-voice-control-based-library-for-ios-ui-automation'' — ''partial'' | iOS apps + web | its Safari **web** crawler genuinely "does not interact with consent dialogs", and the same paper drives 200 iOS apps "while accepting and rejecting consent dialogs". Both statements are true, of different arms |
+**Why the headline count is 32 and not 31 or 33.** 29 verified on the interacting side plus the 3 false negatives is **32**. Of those 32, **31** interact with a web consent notice; the TCF paper's interaction is entirely inside Android apps. Counting the ''partial'' as well gives 33. The content page publishes 32, and the platform split is in this table rather than in a footnote because a reader building a web-only comparison needs 31.
+**A pattern worth carrying.** Two of the three were found because a **named tool** appears in the text (BannerClick, CookieEnforcer). A paper that rolled its own clicking and described it in one unremarkable sentence would still be missed by both the extractor and this audit. That is why the content page calls 32 a floor.
+=== 7.3.5 The two recall probes, and their honest recall ===
+Probe A looks for statements of interaction; probe B for statements of non-interaction. Both are reported here, because a probe that is only reported when it agrees with you is not a check.
+  * **Probe A's positive control fires on 26 of 28** papers the interacting-side audit verified — **not** 28 of 28. It would have missed two real interactions. It does contain all 3 false negatives and the 1 partial.
+  * **Probe B misses 8 of the 22 ''ok'' papers**, listed in the output below. Several state non-interaction in wording no compact pattern catches: "we chose not to interact…", "as instrumenting opt-in/out was out of the scope of this work", "a lack of interaction with these banners".
+  * Probe A fires on **21** papers the hand pass ruled ''unstated'' and probe B on **12**. Each was re-read; none describes the paper's own crawl acting on a notice.
+**A bug found by mutating the probe rather than reading it.** Probe B's first version ended its pattern with a word boundary after the noun, so a pattern for "cookie banner" did not match "cookie banner**s**". It silently reported zero hits for //Beyond the Front Page// {[urban2020beyond]}, whose methods section says in as many words that its OpenWPM instance "does not interact with any cookie banners". The plural was the whole bug. It was caught by testing the pattern against a sentence already known to be positive, not by reading the regex.
+=== 7.3.6 Verdict quotes, checked ===
+The verdict reasons are this audit's only human-readable evidence, so a half-remembered quote there would be indistinguishable from a real one. ''consent_ni_quotecheck.mjs'' checks every double-quoted phrase against both renderings of the cited paper. It has to tolerate the **two-column splice**: both renderings are pypdf-derived, so a sentence crossing a column break is interleaved with its neighbour —
+<code>
+...appear on 767 websites our crawls, we did not interact with cookie
+banners on the visited (10.41% of the visited websites). websites, that
+is we never accepted nor rejected cookies during our visit.
+</code>
+— and a verbatim quote of that sentence is therefore not a contiguous substring of anything. The checker runs contiguous first and falls back to "the quote's words appear in order within a span no more than three times the quote's own length", which a splice satisfies and a fabrication does not.
+<code>
+quotes verbatim and contiguous in the source:        112
+quotes in order across a two-column splice:          17
+quotes NOT found in the cited paper:                 0
+verdicts carrying no verbatim quote (paraphrase):    200
+multi-word single-quoted mentions checked:           0
+  ... of those, NOT found in the cited paper:        0
+mutation self-test: 82 corrupted quotes rejected, 0 wrongly accepted
+</code>
+**What it caught on its first run.** 18 failures, of three kinds, all in the verdict file and none in the papers:
+  - **Two misattributions.** Two ''unstated'' reasons carried the evidence of a **different paper** — the "popup window / postMessage" sentence had been filed against ''WWW/2017/tracking-phishing-attacks-over-time'' and the "bimodal NTP distribution" sentence against ''PETS/2019/donttweetthis''. Both came from a patch that de-duplicated reasons **by position in a list instead of by key**. Neither changed a verdict, and neither would have been found by re-reading the file.
+  - **Paraphrases presented as quotes**, e.g. "adopting CAPTCHA as a cloaking technique" where the paper says "webpages adopting client-side cloaking can use a CAPTCHA". Rewritten to the papers' words.
+  - **Quotation-mark artefacts** from a mechanical conversion that promoted apostrophes inside words to quote delimiters, producing fragments such as "s subject is the browser".
+A **mutation self-test** (''%%--mutate%%'') corrupts the middle word of every quote of four words or more and requires a FAIL: **82 corrupted quotes, 82 rejected, 0 wrongly accepted.**
+**Then it missed a third misattribution, and a reviewer found it.** ''NDSS/2013/the-postman-always-rings-twice…'' carried the reason "one hit, Tor described as an 'overlay' network", which is the evidence of ''PETS/2022/from-onion-not-found-to-guard-discovery'' — the postMessage paper never mentions Tor. Its only //overlay// is inside the URL fragment ''overlay-analytics'', and the apparent "tor.js" is ''paper.txt'' line-wrapping ''selector.js'' into ''selec-'' and ''tor.js''. The verdict (''unstated'') was right; the evidence was another paper's. **It escaped because the checker's own convention exempted single-quoted text as "a word being mentioned"** — and this single-quoted run was a substantive claim, not a mention. The checker now verifies **every single-quoted run of three words or more** as well, excluding word-internal apostrophes and spans that contain a double quote. That check currently finds zero mentions to verify, which is a vacuous pass, so it was mutation-tested directly: injecting a fabricated ''%%'Tor is an overlay network of volunteer-run relays'%%'' into that same verdict produces ''MENTION NOT IN PAPER''.
+**And a structural check was added ahead of both.** The mechanical single-to-double conversion had also turned ''doesn't'' into ''doesn"t'' in **7** reasons, leaving an unbalanced delimiter. The verify step passed them, because the mangled fragment it extracted ("By default, it doesn") really does appear in the paper. Balanced quotes, and no quote mark inside a word, are now checked before any text is looked up. One of the 7 was ''WWW/2025/digital-disparities''; repairing it turned up the sentence after the one quoted — "While solutions exist, their reliability is untested" — which upgraded that verdict from a hedged ''weak'' to a plain ''explicit''.
+=== 7.3.7 Significance of the year-bucket movements ===
+The audited "states a consent action" series is 55 papers across five buckets, not 349, so every adjacent movement was tested before the content page described any of it.
+<code>
+audited 'states a consent action', adjacent buckets
+-2013 (0/102 = 0.0%) vs 2014-2017 (0/167 = 0.0%): p = 1  NOT significant at 0.05
+-2017 (0/167 = 0.0%) vs 2018-2021 (11/308 = 3.6%): p = 0.009883  significant at 0.05
+-2021 (11/308 = 3.6%) vs 2022-2024 (25/345 = 7.2%): p = 0.05751  NOT significant at 0.05
+-2024 (25/345 = 7.2%) vs 2025-2026* (19/198 = 9.6%): p = 0.3324  NOT significant at 0.05
+pre-GDPR 2010-2017 (0/269) vs 2018-2026 (55/851): p = 3.023e-07
+unaudited extraction series, adjacent buckets (what the page said before)
+-2013 (24.5%) vs 2014-2017 (29.9%): p = 0.4008  NOT significant
+-2017 (29.9%) vs 2018-2021 (32.1%): p = 0.679  NOT significant
+-2021 (32.1%) vs 2022-2024 (33.6%): p = 0.7387  NOT significant
+-2024 (33.6%) vs 2025-2026* (29.8%): p = 0.3911  NOT significant
+</code>
+Two things follow. The GDPR step is real, and everything after it is not established at conventional levels. And **none of the four adjacent movements in the unaudited series is significant either** — the "peak at 33.6%, back to 29.8%" narrative on the previous revision of the content page was describing noise, in a population that was both stale and underpowered. That narrative is gone.
+=== 7.3.8 Unedited output ===
+<code>
+no-interaction papers: 313
+adjudicated:           313
+── Verdicts on the 313 ──
+Verdict                                                               Papers  Share of 313
+--------------------------------------------------------------------  ------  ------------
+the paper says it did not act on a consent notice                     22      7.0%
+the paper says it does not interact at all (consent never mentioned)  8       2.6%
+NOT supported by the paper — should have been not-stated              279     89.1%
+an interacting arm is described elsewhere in the paper                1       0.3%
+the paper DOES act on a consent notice — false negative               3       1.0%
+UNSUPPORTED RATE of no-interaction: 279/313 = 89.1%
+FALSE-NEGATIVE RATE of no-interaction: 3/313 = 1.0%
+  (for comparison, the interacting values' false-positive rate is 7/36 = 19.4%)
+── What the consent vocabulary in the unsupported papers actually was ──
+Tag          Papers  Share of 279
+-----------  ------  ------------
+noise        74      26.5%
+none         72      25.8%
+phenomenon   48      17.2%
+irb          24      8.6%
+background   22      7.9%
+adbanner     19      6.8%
+optout       9       3.2%
+protobanner  6       2.2%
+copyright    3       1.1%
+fieldstudy   2       0.7%
+── The false negatives, in full ──
+[WRONG   ] USENIX/2023/automated-cookie-notice-analysis-and-enforcement
+           platforms: web
+           CookieEnforcer "addresses these challenges by mimicking the actions of real users: it interacts with the cookie notices", and the backend was run over 85,473 of the top 100k Tranco sites to disable non-essential cookies — a cmp-specific-choices interaction
+[WRONG   ] IMC/2024/browsing-without-third-party-cookies-what-do-you-see
+           platforms: web
+           "we adopted BannerClick" "to automatically click the accept and reject buttons in cookie notices", counting cookies "after BannerClick interaction" — an accept-and-reject design
+[PARTIAL ] CCS/2025/whispertest-a-voice-control-based-library-for-ios-ui-automation
+           platforms: mobile, web
+           the Safari web crawler "does not interact with consent dialogs", but the same paper drives 200 iOS apps "while accepting and rejecting consent dialogs" - an accept-and-reject arm exists on the app side
+[WRONG   ] PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
+           platforms: mobile, web
+           "We design a methodology to semi-automatically interact with consent banners deployed by major CMPs in TCF-based Android apps, combining three approaches ... disagree to all, legitimate interest purposes only, and consent to all"
+── Every paper that states a consent action, after auditing BOTH sides ──
+papers that ran a crawl:                                  1120
+  extraction says they state a consent action:            349 (31.2%)
+  ... AUDITED as stating one:                             55 (4.9%)
+  ... plus papers stating no interaction of any kind:     63 (5.6%)
+verifiably INTERACTED with a consent notice:              32 (2.9% of crawled)
+  ... of which on the web rather than in a mobile app:    31
+  ... plus the partial (an app-side accept/reject arm):   33
+verifiably did NOT act on a consent notice:               22 (2.0% of crawled)
+no consent action can be established from the paper:      1057 (94.4% of crawled)
+── The six-value table, extraction versus audit ──
+Value                 Extraction  Supported by the paper  Not supported
+--------------------  ----------  ----------------------  -------------
+accept-all            15          11                      4
+accept-and-reject     14          14                      0
+cmp-specific-choices  2           2                       0
+dismiss-or-remove     3           0                       3
+reject-all            2           2                       0
+no-interaction        313         22                      283
+(for no-interaction, "not supported" = 279 unstated + 3 false negatives + 1 partial;
+ the 8 "implied" papers are counted in neither column)
+── By year bucket, on the AUDITED set ──
+Bucket      Crawling papers  Audited: states an action  Share  Of those, interacted
+----------  ---------------  -------------------------  -----  --------------------
+–2013   102              0                          0.0%   0
+–2017   167              0                          0.0%   0
+–2021   308              11                         3.6%   3
+–2024   345              25                         7.2%   16
+–2026*  198              19                         9.6%   13
+── Vantage point ──
+  papers AUDITED as stating a consent action (n=55):
+Vantage                             Papers  Share of 55
+----------------------------------  ------  -----------
+EU/EEA vantage                      37      67.3%
+vantage tuple, location not-stated  11      20.0%
+stated a non-EU/EEA vantage only    7       12.7%
+  papers whose INTERACTION is verified (n=32):
+Vantage                             Papers  Share of 32
+----------------------------------  ------  -----------
+EU/EEA vantage                      22      68.8%
+vantage tuple, location not-stated  6       18.8%
+stated a non-EU/EEA vantage only    4       12.5%
+  papers that verifiably did NOT act (n=22):
+Vantage                             Papers  Share of 22
+----------------------------------  ------  -----------
+EU/EEA vantage                      14      63.6%
+vantage tuple, location not-stated  5       22.7%
+stated a non-EU/EEA vantage only    3       13.6%
+── Two-armed designs (an accept arm AND a reject arm), audited ──
+papers with a verified two-armed design: 16 (was 14 before this audit; 17 counting the partial)
+       PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
+       IEEE-SP/2020/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
+       WWW/2021/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
+       PETS/2022/how-can-and-would-people-protect-from-online-tracking
+       USENIX/2022/automating-cookie-consent-and-gdpr-violation-detection
+       USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission
+       USENIX/2024/automated-large-scale-analysis-of-cookie-notice-compliance
+       PETS/2024/a-large-scale-study-of-cookie-banner-interaction-tools-and-their-impact-on-users
+       PETS/2024/fp-tracer-fine-grained-browser-fingerprinting-detection-via-taint-tracking-and-e
+       PETS/2024/opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
+   NEW IMC/2024/browsing-without-third-party-cookies-what-do-you-see
+       PETS/2025/johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
+       PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
+       PETS/2025/referrer-policy-implementation-and-circumvention
+       PETS/2026/clicking-into-exposure-uncovering-privacy-risks-of-google-click-identifier-in-yo
+   NEW PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
+── Statefulness crossed with an AUDITED consent action ──
+papers stating both an audited consent action and a statefulness: 32
+Statefulness / action    Papers
+-----------------------  ------
+stateless / interacted   10
+stateless / did not act  8
+both / interacted        6
+stateful / interacted    4
+stateful / did not act   4
+</code>
+The two recall probes:
+<code>
+            no consent vocabulary anywhere in either rendering of the full text
+── Probe A (statements of INTERACTION) ──
+positive control: fires on 26/28 papers the interacting-side audit verified
+   MISSED: NDSS/2024/fp-fed-privacy-preserving-federated-detection-of-browser-fingerprinting
+   MISSED: IEEE-SP/2023/the-leaky-web-automated-discovery-of-cross-site-information-leaks-in-browsers-an
+fires on 42 of the 313 no-interaction papers
+of those, hand verdict: wrong=3, partial=1, ok=17, implied=0, unstated=21
+every "wrong"/"partial" paper is in probe A's hits: true
+probe-A hits the hand pass ruled "unstated" (each re-read; none describes the paper's own crawl acting on a notice): 21
+   CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections  [phenomenon]
+   IEEE-SP/2013/cookieless-monster-exploring-the-ecosystem-of-web-based-device-fingerprinting  [phenomenon]
+   USENIX/2016/investigating-commercial-pay-per-install-and-the-distribution-of-unwanted-softwa  [phenomenon]
+   PETS/2017/why-can-t-users-choose-their-identity-providers-on-the-web  [phenomenon]
+   USENIX/2018/o-single-sign-off-where-art-thou-an-empirical-analysis-of-single-sign-on-account  [phenomenon]
+   CCS/2019/un-informed-consent-studying-gdpr-consent-notices-in-the-field  [fieldstudy]
+   IMC/2019/measuring-ewhoring  [irb]
+   NDSS/2019/we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy  [fieldstudy]
+   NDSS/2021/tales-of-favicons-and-caches-persistent-tracking-in-modern-browsers  [phenomenon]
+   PETS/2021/privacy-preference-signals-past-present-and-future  [phenomenon]
+   CCS/2022/do-opt-outs-really-opt-me-out  [phenomenon]
+   PETS/2022/checking-websites-gdpr-consent-compliance-for-marketing-emails  [phenomenon]
+   PETS/2022/setting-the-bar-low-are-websites-complying-with-the-minimum-requirements-of-the  [phenomenon]
+   CCS/2023/policychecker-analyzing-the-gdpr-completeness-of-mobile-apps-privacy-policies  [phenomenon]
+   USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks  [adbanner]
+   PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part  [irb]
+   PETS/2024/privacy-policies-on-the-fediverse-a-case-study-of-mastodon-instances  [irb]
+   WWW/2024/experimental-security-analysis-of-sensitive-data-access-by-browser-extensions  [irb]
+   PETS/2025/understanding-privacy-norms-through-web-forms  [phenomenon]
+   USENIX/2025/analyzing-the-ai-nudification-application-ecosystem  [phenomenon]
+   USENIX/2025/evaluating-privacy-policies-under-modern-privacy-laws-at-scale-an-llm-based-auto  [phenomenon]
+── Probe B (statements of NON-interaction) ──
+fires on 29 of the 313 no-interaction papers
+of those, hand verdict: wrong=2, partial=1, ok=14, implied=0, unstated=12
+"ok" papers probe B does NOT find (why the hand pass, not the probe, is the method): 8
+   USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
+   CCS/2020/fill-in-the-blanks-empirical-analysis-of-the-privacy-threats-of-browser-form-aut
+   PETS/2020/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
+   NDSS/2021/reining-in-the-webs-inconsistencies-with-site-policy
+   PETS/2022/atom-ad-network-tomography
+   IMC/2025/a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
+   WWW/2025/digital-disparities-a-comparative-web-measurement-study-across-economic-boundari
+   PETS/2025/unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie
+probe-B hits the hand pass ruled "unstated" (each re-read; all are consent as a phenomenon, ethics or background): 12
+   IMC/2017/tripwire-inferring-internet-site-compromise  [irb]
+   CCS/2019/un-informed-consent-studying-gdpr-consent-notices-in-the-field  [fieldstudy]
+   IEEE-SP/2019/resident-evil-understanding-residential-ip-proxy-as-a-dark-service  [protobanner]
+   NDSS/2019/we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy  [fieldstudy]
+   CCS/2021/consistency-analysis-of-data-usage-purposes-in-mobile-apps  [phenomenon]
+   NDSS/2021/tales-of-favicons-and-caches-persistent-tracking-in-modern-browsers  [phenomenon]
+   PETS/2021/privacy-preference-signals-past-present-and-future  [phenomenon]
+   PETS/2022/checking-websites-gdpr-consent-compliance-for-marketing-emails  [phenomenon]
+   CCS/2023/cookiegraph-understanding-and-detecting-first-party-tracking-cookies  [noise]
+   CCS/2023/policychecker-analyzing-the-gdpr-completeness-of-mobile-apps-privacy-policies  [phenomenon]
+   PETS/2024/privacy-policies-on-the-fediverse-a-case-study-of-mastodon-instances  [irb]
+   USENIX/2024/dancer-in-the-dark-synthesizing-and-evaluating-polyglots-for-blind-cross-site-sc  [irb]
+</code>
+All 313 verdicts, one line per paper:
+<file text consent_action_noninteraction_verdicts.txt>
+── Every verdict, in full ──
+[UNSTATED|phenomenon] CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections
+            the paper's subject is the browser's own download-consent dialog: it looks for a click whose coordinates fall "in the areas of download consent dialogs"; no web consent notice appears
+[UNSTATED|adbanner  ] IEEE-SP/2010/on-the-incoherencies-in-web-browser-access-control-policies
+            the only 'banner' is an ad banner in an access-control discussion
+[UNSTATED|adbanner  ] IMC/2010/challenges-in-measuring-online-advertising-systems
+            'banner ads' as an ad format
+[UNSTATED|none      ] WWW/2010/analyzing-content-level-properties-of-the-web-adversphere
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] CCS/2011/surf-detecting-and-measuring-search-poisoning
+            the WIDE hits are 'adopting'/'overlay' prose; no consent term
+[UNSTATED|none      ] IEEE-SP/2011/click-trajectories-end-to-end-analysis-of-the-spam-value-chain
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|irb       ] IMC/2011/analyzing-facebook-privacy-settings-user-expectations-vs-reality
+            the survey's participant consent form
+[UNSTATED|noise     ] IMC/2011/measuring-the-state-of-ecn-readiness-in-servers-clients-and-routers
+            ICMP 'quotation' and 'adopting' prose; no consent term
+[UNSTATED|noise     ] USENIX/2011/dirty-jobs-the-role-of-freelance-labor-in-web-service-abuse
+            one hit, the word 'overlay' in a normalisation sentence
+[UNSTATED|none      ] USENIX/2011/measuring-and-analyzing-search-redirection-attacks-in-the-illicit-online-prescri
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads
+            the phrase "without the user" and its consent clause describe the drive-by download attack, not a crawl
+[UNSTATED|noise     ] WWW/2011/heat-seeking-honeypots-design-and-experience
+            one hit, 'crawling' adjacency; no consent term
+[UNSTATED|none      ] WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|protobanner] CCS/2012/manufacturing-compromise-the-emergence-of-exploit-as-a-service
+            SMTP server banners, plus affiliate ad banners
+[UNSTATED|noise     ] IEEE-SP/2012/lastor-a-low-latency-as-aware-tor-client
+            'Quantcast' is the top-list provider, not the CMP
+[UNSTATED|phenomenon] IEEE-SP/2012/memento-learning-secrets-from-process-footprints
+            "This requires neither the phone owner" nor any permission — an Android side-channel discussion, not a web notice
+[UNSTATED|none      ] WWW/2012/branded-with-a-scarlet-c-cheaters-in-a-gaming-social-network
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] WWW/2012/counting-beyond-a-yottabyte-or-how-sparql-1-1-property-paths-will-prevent-adopti
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] WWW/2012/serf-and-turf-crowdturfing-for-fun-and-profit
+            one hit, 'pop-up' describing QQ desktop messages
+[UNSTATED|protobanner] CCS/2013/protocol-misidentification-made-easy-with-format-transforming-encryption
+            SSH/SMB protocol banner messages in an FTE discussion
+[UNSTATED|phenomenon] IEEE-SP/2013/cookieless-monster-exploring-the-ecosystem-of-web-based-device-fingerprinting
+            'opting-out' of fingerprinting in general; no crawl treatment
+[UNSTATED|noise     ] NDSS/2013/the-postman-always-rings-twice-attacking-and-defending-postmessage-in-html5-webs
+            the sole hit is the word overlay inside the URL fragment "overlay-analytics"; the apparent Tor reference is paper.txt line-wrapping "selector.js" into "selec-" and "tor.js"
+[UNSTATED|none      ] WWW/2013/i-know-the-shortened-urls-you-clicked-on-twitter-inference-attack-using-public-c
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] WWW/2013/the-role-of-web-hosting-providers-in-detecting-compromised-websites
+            "take no action" describes hosting providers' abuse response, not the crawler
+[UNSTATED|none      ] CCS/2014/a-critical-evaluation-of-website-fingerprinting-attacks
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|optout    ] CCS/2014/the-web-never-forgets-persistent-tracking-mechanisms-in-the-wild
+            opts out via the NAI and EDAA industry opt-out pages (2014, pre-GDPR); no consent notice
+[UNSTATED|optout    ] CCS/2014/your-online-interests-pwned-a-pollution-attack-against-targeted-advertising
+            a Microsoft ad opt-out URL; "top banner display ad"
+[UNSTATED|none      ] IMC/2014/censorship-in-the-wild-analyzing-internet-filtering-in-syria
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] IMC/2014/search-seizure-the-effectiveness-of-interventions-on-seo-campaigns
+            the only hits are Google Safe Browsing "interstitial" pages in search results
+[UNSTATED|copyright ] NDSS/2014/dspin-detecting-automatically-spun-content-on-the-web
+            the ACM "copies bear this notice" boilerplate
+[UNSTATED|adbanner  ] USENIX/2014/hulk-eliciting-malicious-behavior-in-browser-extensions
+            banner replacement by malicious extensions; Chrome install consent
+[UNSTATED|none      ] USENIX/2014/optimizing-seed-selection-for-fuzzing
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] USENIX/2014/ssoscan-automated-testing-of-web-applications-for-single-sign-on-vulnerabilities
+            OAuth user consent to issue a token; 'quantcast' is the top list
+[UNSTATED|none      ] USENIX/2014/the-long-taile-of-typosquatting-domain-names
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] USENIX/2014/understanding-the-dark-side-of-domain-parking
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] CCS/2015/caronte-detecting-location-leaks-for-deanonymizing-tor-hidden-services
+            one hit, Tor described as "an overlay of the Internet"
+[UNSTATED|phenomenon] IEEE-SP/2015/ad-injection-at-scale-assessing-deceptive-advertisement-modifications
+            ad injection "irrespective of user consent"; fly-in ad banners
+[IMPLIED |noclick   ] IMC/2015/affiliate-crookies-characterizing-affiliate-marketing-abuse
+            "While crawling we do not click on any links" - an explicit no-interaction statement, but the paper never mentions consent notices (2015)
+[UNSTATED|optout    ] IMC/2015/from-academy-to-zone-an-analysis-of-the-new-tld-land-rush
+            a registrar's opt-out domain offering
+[UNSTATED|adbanner  ] NDSS/2015/parking-sensors-analyzing-and-detecting-parked-domains
+            parked-domain advertising banners; ISOC copyright consent
+[UNSTATED|copyright ] NDSS/2015/upgrading-https-in-mid-air-an-empirical-study-of-strict-transport-security-and-k
+            the ISOC "prior written consent" boilerplate is the only consent sentence
+[UNSTATED|none      ] USENIX/2015/circuit-fingerprinting-attacks-passive-deanonymization-of-tor-hidden-services
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] USENIX/2015/measuring-the-longitudinal-evolution-of-the-online-anonymous-marketplace-ecosyst
+            one hit, a reference title, "Privacy-enhancing overlays in bitcoin"
+[UNSTATED|phenomenon] WWW/2015/understanding-malvertising-through-ad-injecting-browser-extensions
+            extensions inserting ads "without user consents"
+[UNSTATED|none      ] CCS/2016/online-tracking-a-1-million-site-measurement-and-analysis
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] CCS/2016/protecting-insecure-communications-with-topology-aware-network-tunnels
+            ICMP prose; no consent term
+[UNSTATED|noise     ] IEEE-SP/2016/cloak-of-visibility-detecting-when-machines-browse-a-different-web
+            "opting to measure" is the verb, not an opt-out
+[UNSTATED|none      ] IEEE-SP/2016/seeking-nonsense-looking-for-trouble-efficient-promotional-infection-detection-t
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|adbanner  ] IEEE-SP/2016/sending-out-an-sms-characterizing-the-security-of-the-sms-ecosystem-with-public
+            an anti-adblock banner; SMS gateway 'opt-in'
+[UNSTATED|noise     ] IMC/2016/browser-feature-usage-on-the-modern-web
+            one hit, "pop-up windows" in a postMessage discussion
+[UNSTATED|phenomenon] PETS/2016/are-you-sure-you-want-to-contact-us-quantifying-the-leakage-of-pii-via-website-c
+            PII reaching third parties "without the user" knowing or consenting; Quantcast appears as a top-list provider
+[UNSTATED|noise     ] USENIX/2016/internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-study-of-w
+            third-party popups as a tracking mechanism; no consent term
+[UNSTATED|phenomenon] USENIX/2016/investigating-commercial-pay-per-install-and-the-distribution-of-unwanted-softwa
+            software-install consent dialogues in the pay-per-install ecosystem
+[UNSTATED|none      ] USENIX/2016/the-ever-changing-labyrinth-a-large-scale-analysis-of-wildcard-dns-powered-black
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] WWW/2016/an-empirical-study-of-web-cookies
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] WWW/2016/characterizing-long-tail-seo-spam-on-cloud-web-hosting-services
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] CCS/2017/how-unique-is-your-onion-an-analysis-of-the-fingerprintability-of-tor-onion-serv
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] IEEE-SP/2017/how-to-learn-klingon-without-a-dictionary-detection-and-measurement-of-black-key
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] IEEE-SP/2017/stack-overflow-considered-harmful-the-impact-of-copy-paste-on-android-applicatio
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|background] IEEE-SP/2017/xhound-quantifying-the-fingerprintability-of-browser-extensions
+            no consent bearing on the crawl
+[UNSTATED|adbanner  ] IMC/2017/the-ad-wars-retrospective-measurement-and-analysis-of-anti-adblock-filter-lists
+            "examplebanner" is a filter-rule example
+[UNSTATED|irb       ] IMC/2017/tripwire-inferring-internet-site-compromise
+            research ethics: consent of the monitored websites; Quantcast as a top list
+[UNSTATED|irb       ] NDSS/2017/dial-one-for-scam-a-large-scale-analysis-of-technical-support-scams
+            an IRB waiver of consent for deceiving scammers; ISOC copyright
+[UNSTATED|copyright ] NDSS/2017/thou-shalt-not-depend-on-me-analysing-the-use-of-outdated-javascript-libraries-o
+            the ISOC "prior written consent" notice is the sole consent sentence in the paper
+[UNSTATED|optout    ] PETS/2017/cross-device-tracking-measurement-and-disclosures
+            DAA and NAI industry opt-out programmes are the object of study; the crawl exercises none
+[UNSTATED|noise     ] PETS/2017/detecting-anti-ad-blockers-in-the-wild
+            anti-adblock pop-up notifications; no consent term
+[UNSTATED|adbanner  ] PETS/2017/topics-of-controversy-an-empirical-analysis-of-web-censorship-lists
+            the only hit is a censorship-list page using "banners and links" as advertising
+[UNSTATED|noise     ] PETS/2017/towards-seamless-tracking-free-web-improved-detection-of-trackers-via-one-class
+            a Privacy Badger "cookieblocklist" URL matched the tool pattern
+[UNSTATED|phenomenon] PETS/2017/why-can-t-users-choose-their-identity-providers-on-the-web
+            the GitHub/OAuth identity-provider consent screen is the subject
+[UNSTATED|noise     ] USENIX/2017/a-privacy-analysis-of-cross-device-tracking
+            'Quantcast' is the top-list provider
+[UNSTATED|noise     ] USENIX/2017/ccsp-controlled-relaxation-of-content-security-policies-by-runtime-policy-compos
+            'banner.jpg' inside a CSP code sample
+[UNSTATED|noise     ] USENIX/2017/how-the-web-tangled-itself-uncovering-the-history-of-client-side-web-in-security
+            one hit, "popup window" in a postMessage discussion
+[UNSTATED|none      ] WWW/2017/extended-tracking-powers-measuring-the-privacy-diffusion-enabled-by-browser-exte
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] WWW/2017/tracking-phishing-attacks-over-time
+            one hit, "we have a bimodal distribution" of phishing-cluster lifetimes
+[OK      |mining    ] CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense
+            "That is, the crawler did not give any consent for cryptomining" - explicit, though the prompt is a cryptomining consent button, not a cookie notice
+[UNSTATED|adbanner  ] IEEE-SP/2018/surveylance-automatically-detecting-online-survey-scams
+            overlay ads and pop-ups in survey-scam pages
+[UNSTATED|phenomenon] IEEE-SP/2018/the-spyware-used-in-intimate-partner-violence
+            "without interaction with the current user" describes stalkerware apps
+[UNSTATED|phenomenon] IMC/2018/digging-into-browser-based-crypto-mining
+            AuthedMine's mining-consent prompt is the object of study
+[UNSTATED|none      ] IMC/2018/impact-of-device-performance-on-mobile-internet-qoe
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] PETS/2018/i-never-signed-up-for-this-privacy-implications-of-email-tracking
+            "pop-up windows" and the literal strings 'modal'/'dialog' in an email-tracking discussion
+[UNSTATED|none      ] USENIX/2018/analysis-of-privacy-protections-in-fitness-tracking-social-networks-or-you-can-r
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] USENIX/2018/freezing-the-web-a-study-of-redos-vulnerabilities-in-javascript-based-web-server
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] USENIX/2018/o-single-sign-off-where-art-thou-an-empirical-analysis-of-single-sign-on-account
+            the OpenID Connect end-user consent step
+[UNSTATED|adbanner  ] WWW/2018/adbudgetkiller-online-advertising-budget-draining-attack
+            responsive ad banners and a banner image
+[UNSTATED|irb       ] WWW/2018/auditing-the-personalization-and-composition-of-politically-related-search-engin
+            participants provided informed consent for the audit study
+[UNSTATED|noise     ] WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics
+            'Quantcast' as an analytics provider in a phishing table
+[UNSTATED|irb       ] WWW/2018/crimebb-enabling-cybercrime-research-on-underground-forums-at-scale
+            informed consent for underground-forum research
+[UNSTATED|noise     ] WWW/2018/exposing-search-and-advertisement-abuse-tactics-and-infrastructure-of-technical
+            tech-support-scam pop-ups; no consent term
+[UNSTATED|none      ] WWW/2018/uncovering-http-header-inconsistencies-and-the-impact-on-desktop-mobile-websites
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] CCS/2019/poster-video-fingerprinting-in-tor
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|fieldstudy] CCS/2019/un-informed-consent-studying-gdpr-consent-notices-in-the-field
+            the "no action" figures describe the field experiment's real visitors; the Selenium crawl is described only as visiting home pages and taking screenshots
+[UNSTATED|background] IEEE-SP/2019/characterizing-pixel-tracking-through-the-lens-of-disposable-email-services
+            GDPR consent as background to email tracking
+[UNSTATED|none      ] IEEE-SP/2019/dangerous-skills-understanding-and-mitigating-security-risks-of-voice-controlled
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni
+            "consents" is a de-columning artefact where two columns interleave mid-word
+[UNSTATED|protobanner] IEEE-SP/2019/resident-evil-understanding-residential-ip-proxy-as-a-dark-service
+            Nmap service banners grabbed from proxy IPs; ToS consent of the proxy users
+[UNSTATED|noise     ] IMC/2019/ddos-hide-seek-on-the-effectiveness-of-a-booter-services-takedown
+            'bimodal' matched the pattern; no consent term
+[UNSTATED|irb       ] IMC/2019/measuring-ewhoring
+            a REB waiver of informed consent
+[UNSTATED|adbanner  ] IMC/2019/no-more-chasing-waterfalls-a-measurement-study-of-the-header-bidding-ad-ecosyste
+            ad-slot sizes named 'top banner' and 'side banner'
+[UNSTATED|optout    ] IMC/2019/rpki-is-coming-of-age-a-longitudinal-study-of-rpki-deployment-and-invalid-route
+            "incremental opt-in adoption" of ASPA objects in RPKI
+[UNSTATED|none      ] IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs
+            no consent vocabulary anywhere in either rendering of the full text
+[OK      |explicit  ] IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
+            "Furthermore, we do not interact with the consent notices displayed by the websites" and "we never gave actual consent to the use of cookies"
+[UNSTATED|none      ] IMC/2019/visiblev8-in-browser-monitoring-of-javascript-in-the-wild
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|adbanner  ] IMC/2019/what-you-see-is-not-what-you-get-discovering-and-tracking-social-engineering-att
+            overlay and banner ads in social-engineering campaigns
+[UNSTATED|irb       ] NDSS/2019/quantity-vs-quality-evaluating-user-interest-profiles-using-ad-preference-managers
+            participants installed an extension after informed consent
+[UNSTATED|none      ] NDSS/2019/the-use-of-tls-in-censorship-circumvention
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] NDSS/2019/time-does-not-heal-all-wounds-a-longitudinal-analysis-of-security-mechanism-support-in-mobile-browsers
+            "script sniffing opt-out" is the X-Content-Type-Options header
+[UNSTATED|fieldstudy] NDSS/2019/we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy
+            the paper categorises consent notices and their interaction options but never states a crawler consent action; its automated arm searches for privacy policies
+[UNSTATED|noise     ] PETS/2019/donttweetthis-scoring-private-information-in-social-networks
+            one hit, false alarms that "may prevent users from adopting it"
+[UNSTATED|background] PETS/2019/maps-scaling-privacy-compliance-analysis-to-a-million-apps
+            GDPR compliance of mobile apps' code and policies
+[UNSTATED|adbanner  ] USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web
+            "trick banners" and banner-ad click-through rates
+[OK      |mining    ] USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
+            "We have instructed the crawler to never explicitly consent to any mining operation" - explicit, though the prompt is a cryptomining opt-in, not a cookie notice
+[UNSTATED|none      ] WWW/2019/anything-to-hide-studying-minified-and-obfuscated-code-in-the-web
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] WWW/2019/auditing-the-partisanship-of-google-search-snippets
+            'bimodal' snippet-score distributions
+[UNSTATED|background] WWW/2019/before-and-after-gdpr-the-changes-in-third-party-presence-at-public-and-private
+            the GDPR is the subject of the before/after comparison; no crawler consent action
+[UNSTATED|none      ] WWW/2019/doppelgangers-on-the-dark-web-a-large-scale-assessment-on-phishing-hidden-web-se
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild
+            cryptomining consent; the manual check asks whether the site's opt-in system was enabled, not what the crawler did
+[UNSTATED|noise     ] WWW/2019/unnecessarily-identifiable-quantifying-the-fingerprintability-of-browser-extensi
+            the extension manifest's "exclude_matches" opt-out
+[UNSTATED|none      ] WWW/2019/who-watches-the-watchmen-exploring-complaints-on-the-web
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] CCS/2020/deploying-android-security-updates-an-extensive-study-involving-manufacturers-ca
+            "adopting security updates" by end users
+[OK      |explicit  ] CCS/2020/fill-in-the-blanks-empirical-analysis-of-the-privacy-threats-of-browser-form-aut
+            "While our initial plan was to programmatically interact with the consent overlays and accept the use of cookies, we found that ... complications ... prevent us"
+[UNSTATED|adbanner  ] IEEE-SP/2020/adgraph-a-graph-based-approach-to-ad-and-tracker-blocking
+            'banner' as an ad keyword in the AdGraph feature set
+[UNSTATED|phenomenon] IEEE-SP/2020/an-analysis-of-pre-installed-android-software
+            Android vendors' consent forms are the object of study
+[UNSTATED|noise     ] IEEE-SP/2020/high-precision-open-world-website-fingerprinting
+            "opting to use the word distance"; "consenting Tor clients" is a hypothetical
+[UNSTATED|noise     ] NDSS/2020/carnus-exploring-the-privacy-threats-of-browser-extension-fingerprinting
+            one hit, the reference title "Why johnny can" not opt out, a usability evaluation of behavioural-advertising controls
+[UNSTATED|noise     ] NDSS/2020/complex-security-policy-a-longitudinal-analysis-of-deployed-content-security-policies
+            CSP and HSTS opt-in/opt-out security mechanisms
+[UNSTATED|none      ] NDSS/2020/deceptive-previews-a-study-of-the-link-preview-trustworthiness-in-social-platforms
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] NDSS/2020/melting-pot-of-origins-compromising-the-intermediary-web-services-that-rehost-websites
+            "adopting HTTP" by rehosting services
+[UNSTATED|phenomenon] NDSS/2020/uiscope-accurate-instrumentation-free-and-visible-attack-investigation-for-gui-applications
+            a vulnerability opening "a pop-up window to explicitly ask for" the user's consent, inside the NDSS 2020 attack-investigation example
+[OK      |explicit  ] PETS/2020/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
+            "we did not emit any user behavior", written in explanation of cookies set before a user clicks the consent button
+[UNSTATED|background] PETS/2020/the-price-is-not-right-comparing-privacy-in-free-and-paid-apps
+            GDPR/COPPA parental consent in app privacy policies
+[UNSTATED|noise     ] USENIX/2020/phishtime-continuous-longitudinal-measurement-of-the-effectiveness-of-anti-phish
+            CAPTCHA and popup cloaking; "users who opt in" to Safe Browsing
+[UNSTATED|noise     ] WWW/2020/a-first-look-at-commercial-5g-performance-on-smartphones
+            ICMP RTT tables and "adopting mmWave"
+[OK      |explicit  ] WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field
+            "Our measurement platform, a customized OpenWPM instance, does not interact with any cookie banners" and "we never interacted with any cookie banners"
+[UNSTATED|noise     ] WWW/2020/de-kodi-understanding-the-kodi-ecosystem
+            "always opting to re-crawl an already crawled addon"
+[UNSTATED|adbanner  ] WWW/2020/filter-list-generation-for-underserved-regions
+            banner ads used as a table of contents on a forum
+[UNSTATED|noise     ] WWW/2020/open-knowledge-enrichment-for-long-tail-entities
+            "adopting effective estimators"
+[UNSTATED|none      ] WWW/2020/towards-ip-based-geolocation-via-fine-grained-and-stable-webcam-landmarks
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] CCS/2021/all-your-credentials-are-belong-to-us-on-insecure-wpa2-enterprise-configurations
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] CCS/2021/consistency-analysis-of-data-usage-purposes-in-mobile-apps
+            privacy-policy sentences about consent are the classifier's input
+[UNSTATED|none      ] CCS/2021/encodermi-membership-inference-against-pre-trained-encoders-in-contrastive-learn
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] CCS/2021/t-reqs-http-request-smuggling-with-differential-fuzzing
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] IMC/2021/knock-and-talk-investigating-local-network-communications-on-websites
+            a proposed opt-in model for local-network access
+[UNSTATED|noise     ] IMC/2021/polls-clickbait-and-commemorative-2-bills-problematic-political-advertising-on-n
+            modal newsletter dialogs occluding political ads; no consent term
+[UNSTATED|noise     ] IMC/2021/who-you-gonna-call-an-empirical-evaluation-of-website-security-txt-deployment
+            "adopting security.txt"; GDPR gutting WHOIS
+[UNSTATED|optout    ] NDSS/2021/cv-inspector-towards-automating-detection-of-adblock-circumvention
+            the Acceptable Ads whitelist opt-out; 'sourcepoint' appears only in a reference
+[UNSTATED|background] NDSS/2021/from-whois-to-whowas-a-large-scale-measurement-study-of-domain-registration-privacy-under-the-gdpr
+            the GDPR's effect on WHOIS records, not on a web crawl
+[UNSTATED|phenomenon] NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system
+            cryptojacking "without taking consent of visitors" is the threat model
+[OK      |weak      ] NDSS/2021/reining-in-the-webs-inconsistencies-with-site-policy
+            "1,995 (18%) sites did not set any first-party cookie ... can be attributed to the presence of GDPR banners which require users to click through" - the crawl's non-clicking is stated in explanation of a result, not in the methods
+[UNSTATED|phenomenon] NDSS/2021/tales-of-favicons-and-caches-persistent-tracking-in-modern-browsers
+            a GDPR pop-up cited as a user-distraction technique
+[UNSTATED|phenomenon] NDSS/2021/uiscope-accurate-instrumentation-free-and-visible-attack-investigation-for-gui-applications
+            the same attack-investigation example, in the paper's NDSS 2021 reprint
+[UNSTATED|noise     ] PETS/2021/domain-name-encryption-is-not-enough-privacy-leakage-via-ip-based-website-finger
+            "refrain from" applies to "other traffic features", not to a notice; Quantcast appears as a top list
+[UNSTATED|background] PETS/2021/ml-cb-machine-learning-canvas-block
+            "notice and choice has a long history of well-documented failures" as motivation
+[UNSTATED|noise     ] PETS/2021/oblivious-dns-over-https-odoh-a-practical-privacy-enhancement-to-dns
+            "clients adopting DoH"; GDPR in reference titles
+[UNSTATED|phenomenon] PETS/2021/privacy-preference-signals-past-present-and-future
+            TCF/CMP adoption is measured by probing for __tcfapi, never by acting on a notice
+[UNSTATED|noise     ] USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web
+            postMessage popups; "opt out from future scans" by notified websites
+[UNSTATED|none      ] USENIX/2021/catching-phishers-by-their-bait-investigating-the-dutch-phishing-landscape-throu
+            no consent vocabulary anywhere in either rendering of the full text
+[OK      |explicit  ] USENIX/2021/effective-notification-campaigns-on-the-web-a-matter-of-trust-framing-and-suppor
+            "We do not check sites for the presence of consent banners; technically, a consent banner could hide the existence of a non-compliant GA instance"
+[UNSTATED|noise     ] USENIX/2021/fingerprinting-in-style-detecting-browser-extensions-via-injected-style-sheets
+            a CSS-isolation popup in the detection script
+[UNSTATED|irb       ] USENIX/2021/phishprint-evading-phishing-detection-crawlers-by-prior-profiling
+            prior user consent for the fingerprinting experiment's participants
+[UNSTATED|phenomenon] USENIX/2021/prisec-a-privacy-settings-enforcement-controller
+            PriSEC's crawler clicks every interactable element on privacy-settings pages; no consent-notice treatment is stated
+[UNSTATED|none      ] USENIX/2021/u-cant-debug-this-detecting-javascript-anti-debugging-techniques-in-the-wild
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] WWW/2021/an-empirical-study-of-real-world-webassembly-binaries-security-languages-use-cas
+            WebAssembly used to "match cryptocurrencies" mined without users' consent
+[UNSTATED|phenomenon] WWW/2021/have-you-been-properly-notified-automatic-compliance-analysis-of-privacy-policy
+            GDPR Article 13 compliance of privacy-policy text
+[UNSTATED|none      ] WWW/2021/its-not-just-the-site-its-the-contents-intra-domain-fingerprinting-social-media
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|background] WWW/2021/privacy-policies-over-time-curation-and-analysis-of-a-million-document-dataset
+            the GDPR's historic impact on privacy policies
+[UNSTATED|noise     ] WWW/2021/towards-realistic-and-reproducibleweb-crawl-measurements
+            "adopting an access control system"; GDPR as an IP-blocking motive
+[UNSTATED|none      ] CCS/2022/a-run-a-day-wont-keep-the-hacker-away-inference-attacks-on-endpoint-privacy-zone
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] CCS/2022/cart-ology-intercepting-targeted-advertising-via-ad-network-identity-entanglemen
+            a reference title about bypassing GDPR consent
+[UNSTATED|phenomenon] CCS/2022/do-opt-outs-really-opt-me-out
+            trackers' opt-out policy statements are classified from privacy-policy text; the crawl exercises no opt-out
+[UNSTATED|protobanner] CCS/2022/exposing-the-rat-in-the-tunnel-using-traffic-analysis-for-tor-based-malware-dete
+            SMTP server banners relayed to malware; ICMP logs
+[UNSTATED|phenomenon] CCS/2022/im-spartacus-no-im-spartacus-proactively-protecting-users-from-phishing-by-inten
+            the tool's own privacy consent notice shown to its users
+[UNSTATED|none      ] IEEE-SP/2022/meshup-stateless-cache-side-channel-attack-on-cpu-mesh
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] IEEE-SP/2022/timing-based-browsing-privacy-vulnerabilities-via-site-isolation
+            a site-isolation attack working "without requiring the consent from the user"
+[UNSTATED|none      ] IMC/2022/characterizing-permanently-dead-links-on-wikipedia
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|adbanner  ] IMC/2022/muzeel-assessing-the-impact-of-javascript-dead-code-elimination-on-mobile-web-pe
+            a cookie banner appears in a screenshot illustrating dead-code-elimination breakage; no crawler consent action
+[UNSTATED|background] NDSS/2022/auto-draft-209
+            GDPR/CCPA data-deletion requests as a fallback assumption
+[UNSTATED|noise     ] NDSS/2022/auto-draft-211
+            "adopting attack mitigations" in embedded firmware
+[OK      |explicit  ] PETS/2022/atom-ad-network-tomography
+            banner sites are excluded rather than acted on: "as instrumenting opt-in/out was out of the scope of this work"
+[UNSTATED|phenomenon] PETS/2022/checking-websites-gdpr-consent-compliance-for-marketing-emails
+            consent checkboxes in website registration forms for marketing email, not a cookie notice
+[UNSTATED|noise     ] PETS/2022/from-onion-not-found-to-guard-discovery
+            Tor described as an 'overlay' network
+[OK      |explicit  ] PETS/2022/my-cookie-is-a-phoenix-detection-measurement-and-lawfulness-of-cookie-respawning
+            "we crawled websites and even if a website provided a consent banner, we did not give consent thereto"
+[UNSTATED|phenomenon] PETS/2022/setting-the-bar-low-are-websites-complying-with-the-minimum-requirements-of-the
+            CCPA "Do Not Sell My Personal Information" links are located, not clicked
+[UNSTATED|none      ] PETS/2022/toward-uncensorable-anonymous-and-private-access-over-satoshi-blockchains
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] PETS/2022/who-knows-i-like-jelly-beans-an-investigation-into-search-privacy
+            CMPs appear in a list of contacted entities; Quantcast as an entity
+[UNSTATED|background] USENIX/2022/a-large-scale-investigation-into-geodifferences-in-mobile-apps
+            GDPR/CCPA in app privacy policies; collaborators' informed consent
+[UNSTATED|none      ] USENIX/2022/behind-the-tube-exploitative-monetization-of-content-on-youtube
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] USENIX/2022/measurement-by-proxy-on-the-accuracy-of-online-marketplace-measurements
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
+            'adopting" prior solutions; "do not sell individual plugins'
+[UNSTATED|phenomenon] USENIX/2022/ovrseen-auditing-network-traffic-and-privacy-policies-in-oculus-vr
+            notice and consent in Oculus app privacy policies
+[UNSTATED|irb       ] USENIX/2022/phish-in-sheeps-clothing-exploring-the-authentication-pitfalls-of-browser-finger
+            "We did not interact with or affect other Bank-A users" is an ethics statement about people
+[UNSTATED|noise     ] USENIX/2022/the-security-lottery-measuring-client-side-web-security-inconsistencies
+            one hit, a reference title ending "notifications after gdpr"
+[UNSTATED|irb       ] USENIX/2022/watching-the-watchers-bias-and-vulnerability-in-remote-proctoring-software
+            informed consent to proctoring software is the object of study
+[UNSTATED|noise     ] WWW/2022/am-i-a-real-or-fake-celebrity-evaluating-face-recognition-and-verification-apis
+            "adopting face as a primary authentication"
+[OK      |explicit  ] WWW/2022/et-tu-brute-privacy-analysis-of-government-websites-and-mobile-apps
+            "Note that our crawler does not click on the cookie consent prompts, if present" and "our automation does not accept cookie banners on sites crawled"
+[UNSTATED|none      ] WWW/2022/i-have-no-text-in-my-post-using-visual-hints-to-model-user-emotions-in-social-me
+            no consent vocabulary anywhere in either rendering of the full text
+[IMPLIED |noclick   ] WWW/2022/leveraging-googles-publisher-specific-ids-to-detect-website-administration
+            "We do not interact with any component in the visited website, and only passively observe network traffic" - explicit, but consent notices are never mentioned
+[UNSTATED|noise     ] WWW/2022/measuring-the-privacy-vs-compatibility-trade-off-in-preventing-third-party-state
+            Firefox's Total Cookie Protection opt-in mode
+[IMPLIED |noclick   ] WWW/2022/reproducibility-and-replicability-of-web-measurement-studies
+            one arm is "no interaction" - "we do not interact with the website at all"; the other arm is generic "artificial user interaction", never described as banner interaction
+[UNSTATED|noise     ] CCS/2023/cookiegraph-understanding-and-detecting-first-party-tracking-cookies
+            CookieBlock is a cookie classifier compared against, not a consent tool
+[UNSTATED|none      ] CCS/2023/jack-in-the-box-an-empirical-study-of-javascript-bundling-on-the-web-and-its-sec
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|background] CCS/2023/marketing-to-children-through-online-targeted-advertising-targeting-mechanisms-a
+            COPPA verifiable parental consent; floating banner ads
+[UNSTATED|phenomenon] CCS/2023/policychecker-analyzing-the-gdpr-completeness-of-mobile-apps-privacy-policies
+            GDPR completeness of mobile-app privacy policies
+[UNSTATED|none      ] CCS/2023/read-between-the-lines-detecting-tracking-javascript-with-bytecode-classificatio
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] CCS/2023/realistic-website-fingerprinting-by-augmenting-network-traces
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] CCS/2023/transformer-based-model-for-multi-tab-website-fingerprinting-attack
+            "adopting a more randomized methodology"
+[UNSTATED|noise     ] CCS/2023/txphishscope-towards-detecting-and-understanding-transaction-based-phishing-on-e
+            popup windows showing transaction parameters
+[UNSTATED|none      ] CCS/2023/under-the-dark-a-systematical-study-of-stealthy-mining-pools-ab-use-in-the-wild
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] IEEE-SP/2023/detection-of-inconsistencies-in-privacy-practices-of-browser-extensions
+            "without clicking the extension icon" describes the extension's behaviour, not a notice
+[UNSTATED|background] IEEE-SP/2023/fashion-faux-pas-implicit-stylistic-fingerprints-for-bypassing-browsers-anti-fin
+            GDPR/CCPA as legislative background; opt-in browser defaults
+[UNSTATED|none      ] IEEE-SP/2023/investigating-package-related-security-threats-in-software-registries
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] IEEE-SP/2023/robust-multi-tab-website-fingerprinting-attacks-in-the-wild
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|adbanner  ] IMC/2023/a-longitudinal-study-of-vulnerable-client-side-resources-and-web-developers-upda
+            a Flash banner as dynamic page content
+[UNSTATED|protobanner] IMC/2023/does-it-spin-on-the-adoption-and-use-of-quics-spin-bit
+            zgrab2 is "a golang-based banner grabber"
+[UNSTATED|protobanner] IMC/2023/ecn-with-quic-challenges-in-the-wild
+            zgrab2 banner grabber and ICMP quotations
+[IMPLIED |noclick   ] IMC/2023/not-only-e-t-phones-home-analysing-the-native-user-tracking-of-mobile-browsers
+            "We do not interact with any component inside a website, and only passively observe network traffic" - the mobile-browser study's wording of a sentence three papers from this group share; consent notices are never mentioned
+[OK      |explicit  ] IMC/2023/on-the-similarity-of-web-measurements-under-different-experimental-setups
+            "our crawler ... does not interact with content notices" — the extracted text reads 'content' where the paper plainly means consent, and the same setup section describes a profile run "without user interaction"
+[UNSTATED|none      ] NDSS/2023/double-and-nothing-understanding-and-detecting-cryptocurrency-giveaway-scams
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] NDSS/2023/navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
+            "adopting methods like redirection chains"
+[OK      |explicit  ] PETS/2023/comparing-large-scale-privacy-and-security-notifications
+            the violation definition is "Use of Third-Party Cookies Without Consent Notice or Before Interaction With Consent Notice", so the measured state is explicitly pre-interaction
+[OK      |explicit  ] PETS/2023/everybodys-looking-for-ssomething-a-large-scale-evaluation-on-the-privacy-of-oau
+            "We excluded elements which contain keywords related to cookie banners" when clicking OAuth buttons, and third-party cookies are measured "before the user has interacted with the cookie banner"
+[UNSTATED|irb       ] PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part
+            participants' consent form for the GitHub recruitment study
+[UNSTATED|noise     ] PETS/2023/raven-stateless-rapid-ip-address-variation-for-enterprise-networks
+            opt-in versus opt-out RAVEN client control groups
+[UNSTATED|phenomenon] PETS/2023/senrev-measurement-of-personal-information-disclosure-in-online-health-communiti
+            consent between healthcare professionals and patients is the object of study
+[UNSTATED|phenomenon] USENIX/2023/abuse-vectors-a-framework-for-conceptualizing-iot-enabled-interpersonal-abuse
+            IoT devices operated "without the consent" of household members
+[UNSTATED|noise     ] USENIX/2023/access-denied-assessing-physical-risks-to-internet-access-networks
+            ICMP traceroutes; no consent term
+[UNSTATED|noise     ] USENIX/2023/autofr-automated-filter-rule-generation-for-adblocking
+            filter rules that block consent-form domains are an observation about lists, not a crawl action
+[WRONG   |interacts ] USENIX/2023/automated-cookie-notice-analysis-and-enforcement
+            CookieEnforcer "addresses these challenges by mimicking the actions of real users: it interacts with the cookie notices", and the backend was run over 85,473 of the top 100k Tranco sites to disable non-essential cookies — a cmp-specific-choices interaction
+[UNSTATED|noise     ] USENIX/2023/knowledge-expansion-and-counterfactual-interaction-for-reference-based-phishing
+            "webpages adopting client-side cloaking"
+[UNSTATED|adbanner  ] USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks
+            the crawler clicks social-engineering ads, not consent notices
+[UNSTATED|none      ] WWW/2023/a-passage-level-reading-behavior-model-for-mobile-search
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|irb       ] WWW/2023/an-empirical-study-of-the-usage-of-checksums-for-web-downloads
+            respondents' consent for the checksum survey; QuantCast as a top list
+[UNSTATED|none      ] WWW/2023/do-nfts-owners-really-possess-their-assets-a-first-look-at-the-nft-to-asset-conn
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|none      ] WWW/2023/efficient-and-low-overhead-website-fingerprinting-attacks-and-defenses-based-on
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|background] WWW/2023/the-hitchhikers-guide-to-facebook-web-tracking-with-invisible-pixels-and-click-i
+            GDPR sensitive categories; "adopting FB Pixel"
+[UNSTATED|irb       ] WWW/2023/visual-aware-testing-and-debugging-for-web-performance-optimization
+            IRB-approved recruitment of 18 users; "rotating banners" as dynamic content
+[IMPLIED |noclick   ] WWW/2023/who-funds-misinformation-a-systematic-analysis-of-the-ad-related-profit-routines
+            "We do not interact with any component inside a website" — the fake-news-funding study's wording of a sentence three papers from this group share; consent notices are never mentioned
+[UNSTATED|none      ] CCS/2024/a-comprehensive-analysis-of-security-vulnerabilities-and-attacks-in-satellite-mo
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] CCS/2024/vpvet-vetting-privacy-policies-of-virtual-reality-apps
+            consent clauses in VR app privacy policies
+[UNSTATED|irb       ] IEEE-SP/2024/false-negative-that-one-is-going-to-kill-you-understanding-industry-perspectives
+            interview and survey informed-consent forms
+[UNSTATED|background] IEEE-SP/2024/to-auth-or-not-to-auth-a-comparative-analysis-of-the-pre-and-post-login-security
+            the cookie-banner XSS result is cited from related work; no consent action of their own is stated
+[WRONG   |interacts ] IMC/2024/browsing-without-third-party-cookies-what-do-you-see
+            "we adopted BannerClick" "to automatically click the accept and reject buttons in cookie notices", counting cookies "after BannerClick interaction" — an accept-and-reject design
+[UNSTATED|none      ] IMC/2024/collecting-self-reported-semantics-of-bgp-communities-and-investigating-their-co
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|background] IMC/2024/of-choices-and-control-a-comparative-analysis-of-government-hosting
+            GDPR-aligned hosting jurisdictions; "governments opting for third-party providers"
+[UNSTATED|phenomenon] IMC/2024/whatcha-lookin-at-investigating-third-party-web-content-in-popular-android-apps
+            in-app web content shown "without explicit consent from the users"
+[UNSTATED|none      ] NDSS/2024/experimental-analyses-of-the-physical-surveillance-risks-in-client-side-content-scanning
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|irb       ] PETS/2024/a-black-box-privacy-analysis-of-messaging-service-providers-chat-message-process
+            "we did not interact with other users at all" is about the messaging experiment's counterparties
+[UNSTATED|none      ] PETS/2024/automatic-generation-of-web-censorship-probe-lists
+            no consent vocabulary anywhere in either rendering of the full text
+[OK      |explicit  ] PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
+            "Our crawler did not click on or otherwise interact with advertisements or consent banners"; opt-out is instead conveyed through GPC and an injected USP String, never through the notice
+[UNSTATED|phenomenon] PETS/2024/on-the-quality-of-privacy-policy-documents-of-virtual-personal-assistant-applica
+            GDPR quality of virtual-personal-assistant privacy policies
+[UNSTATED|irb       ] PETS/2024/privacy-policies-on-the-fediverse-a-case-study-of-mastodon-instances
+            instance administrators' consent to be studied
+[OK      |explicit  ] PETS/2024/the-devil-is-in-the-details-detection-measurement-and-lawfulness-of-server-side
+            "we did not interact with cookie banners on the visited" websites, "that is we never accepted nor rejected cookies during our visit"
+[UNSTATED|background] PETS/2024/website-data-transparency-in-the-browser
+            notice and choice as motivation for a transparency dashboard
+[IMPLIED |noclick   ] USENIX/2024/arcanum-detecting-and-evaluating-the-privacy-risks-of-browser-extensions-on-web
+            "we do not interact with the pages or extensions (e.g., we do not click buttons on the page)" - explicit, but consent notices are never mentioned
+[UNSTATED|irb       ] USENIX/2024/dancer-in-the-dark-synthesizing-and-evaluating-polyglots-for-blind-cross-site-sc
+            site operators' consent for the large-scale XSS study
+[UNSTATED|background] USENIX/2024/fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
+            Google's EU User Consent Policy is cited as advertiser obligation; no crawl treatment
+[UNSTATED|irb       ] USENIX/2024/into-the-dark-unveiling-internal-site-search-abused-for-black-hat-seo
+            "we did not interactively analyze their content" is an ethics statement about illegal sites
+[UNSTATED|noise     ] USENIX/2024/iot-market-dynamics-an-analysis-of-device-sales-security-and-privacy-signals-and
+            one hit, a GDPR reference title
+[UNSTATED|noise     ] USENIX/2024/phishdecloaker-detecting-captcha-cloaked-phishing-websites-via-hybrid-vision-bas
+            "adopting CAPTCHA as a cloaking technique"
+[OK      |explicit  ] USENIX/2024/purl-safe-and-effective-sanitization-of-link-decoration
+            "We conduct our crawls entirely from the vantage point of an academic institution in the US, hence, we do not interact with consent banners"
+[UNSTATED|none      ] USENIX/2024/smudged-fingerprints-characterizing-and-improving-the-performance-of-web-applica
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|phenomenon] WWW/2024/detecting-and-understanding-self-deleting-javascript-code
+            scripts "tracking user activities without user consent"
+[UNSTATED|irb       ] WWW/2024/experimental-security-analysis-of-sensitive-data-access-by-browser-extensions
+            "We did not interact with human subjects"; CookieEnforcer appears only in a reference title
+[UNSTATED|noise     ] WWW/2024/panoptichrome-a-modern-in-browser-taint-analysis-framework
+            "reasons for adopting a static+dynamic taint analysis"
+[UNSTATED|none      ] WWW/2024/quic-is-not-quick-enough-over-fast-internet
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|irb       ] WWW/2024/tiktok-and-the-art-of-personalization-investigating-exploration-and-exploitation
+            explicit consent from the TikTok data-donation participants
+[UNSTATED|phenomenon] CCS/2025/automatically-detecting-online-deceptive-patterns
+            AutoBot classifies deceptive patterns from screenshots of cookie banners; nothing is clicked
+[UNSTATED|background] CCS/2025/exploiting-the-shared-storage-api
+            GDPR consent requirements applied to Shared Storage
+[UNSTATED|optout    ] CCS/2025/the-odyssey-of-robots-txt-governance-measuring-convention-implications-of-web-bo
+            robots.txt as an LLM-training opt-out mechanism
+[PARTIAL |twoarm    ] CCS/2025/whispertest-a-voice-control-based-library-for-ios-ui-automation
+            the Safari web crawler "does not interact with consent dialogs", but the same paper drives 200 iOS apps "while accepting and rejecting consent dialogs" - an accept-and-reject arm exists on the app side
+[UNSTATED|background] IEEE-SP/2025/gptracker-a-large-scale-measurement-of-misused-gpts
+            GDPR compliance of the study's own data management
+[OK      |explicit  ] IMC/2025/a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
+            "the crawler pauses for 20 seconds without any interaction", and the limitation is named as permissions used "only after specific interactions (e.g., clicking a button, accepting cookie banner)"
+[UNSTATED|phenomenon] IMC/2025/an-in-depth-investigation-of-data-collection-in-llm-app-ecosystems
+            opt-out controls in LLM app ecosystems
+[UNSTATED|none      ] IMC/2025/exploration-of-the-dynamics-of-buy-and-sale-of-social-media-accounts
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] IMC/2025/fishing-for-smishing-understanding-sms-phishing-infrastructure-and-strategies-by
+            "scammers adopting that norm"; "direct consent is not possible in internet measurement research"
+[IMPLIED |noclick   ] IMC/2025/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
+            "records trackers on the homepage of websites with no interaction (e.g., no scrolling)" - explicit, but consent notices are never mentioned
+[UNSTATED|phenomenon] NDSS/2025/cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange
+            the victim cannot revoke a certificate "without the attacker" agreeing — an SXG attack property, not a crawl treatment
+[UNSTATED|noise     ] NDSS/2025/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector
+            an over-general filter rule blocks the script that loads a consent dialog - an observation about rules, not a crawl action
+[UNSTATED|none      ] NDSS/2025/misdirection-of-trust-demystifying-the-abuse-of-dedicated-url-shortening-service
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|noise     ] NDSS/2025/secret-spilling-drive-leaking-user-behavior-through-ssd-contention
+            "overlay in red" in a signal plot
+[UNSTATED|noise     ] NDSS/2025/the-discriminative-power-of-cross-layer-rtts-in-fingerprinting-proxy-traffic
+            "advise caution in adopting multiplexing as the only mitigation strategy"
+[UNSTATED|adbanner  ] PETS/2025/buy-it-now-track-me-later-attacking-user-privacy-via-wi-fi-ap-online-auctions
+            the "This listing sold" banner on auction pages
+[UNSTATED|optout    ] PETS/2025/measuring-the-accuracy-and-effectiveness-of-pii-removal-services
+            data-broker opt-out requests submitted by PII removal services
+[UNSTATED|noise     ] PETS/2025/onion-location-measurements-and-fingerprinting
+            the 'opt-in' circuit-labelling method of prior work
+[OK      |explicit  ] PETS/2025/tracker-installations-are-not-created-equal-understanding-tracker-configuration
+            "We chose not to interact with cookie consent banners present on the page to avoid bias", with the resulting blind spot quantified
+[UNSTATED|phenomenon] PETS/2025/understanding-privacy-norms-through-web-forms
+            cookie consent dialogs are one of the form types the classifier must exclude
+[OK      |explicit  ] PETS/2025/unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie
+            "our manual examination of IMSS sites found three sites displaying cookie banners. This finding significantly reduces the likelihood that a lack of interaction with these banners has substantially affected our analysis"
+[UNSTATED|phenomenon] PETS/2025/who-s-watching-you-zoom-investigating-privacy-of-third-party-zoom-apps
+            informed consent in the Zoom marketplace's power asymmetry
+[UNSTATED|phenomenon] USENIX/2025/analyzing-the-ai-nudification-application-ecosystem
+            consent of the image subject in nudification apps
+[UNSTATED|irb       ] USENIX/2025/assessing-the-aftermath-the-effects-of-a-global-takedown-against-ddos-for-hire-s
+            consent of individuals on the monitored forums
+[UNSTATED|phenomenon] USENIX/2025/dns-flare-a-flush-reload-attack-on-dns-forwarders
+            an attack working "without requiring explicit consent or interaction"
+[IMPLIED |noclick   ] USENIX/2025/double-edged-shield-on-the-fingerprintability-of-customized-ad-blockers
+            "Our crawlers do not interact with the web server in any other way" - explicit, but consent notices are never mentioned
+[UNSTATED|phenomenon] USENIX/2025/evaluating-privacy-policies-under-modern-privacy-laws-at-scale-an-llm-based-auto
+            GDPR and US state-law clauses in privacy-policy text
+[UNSTATED|noise     ] USENIX/2025/evaluating-the-effectiveness-and-robustness-of-visual-similarity-based-phishing
+            'CookiePopup' is a screenshot-artefact label in a phishing dataset
+[UNSTATED|none      ] USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|background] USENIX/2025/no-way-to-sign-out-unpacking-non-compliance-with-google-plays-app-account-deleti
+            GDPR right to erasure in app account deletion
+[UNSTATED|noise     ] USENIX/2025/web-execution-bundles-reproducible-accurate-and-archivable-web-measurements
+            two consent-related reference titles; no consent statement of its own
+[UNSTATED|optout    ] USENIX/2025/websites-global-privacy-control-compliance-at-scale-and-over-time
+            compliance is measured by reading privacy strings and sending the GPC signal; no notice interaction is stated either way
+[UNSTATED|irb       ] USENIX/2025/when-llms-go-online-the-emerging-threat-of-web-enabled-llms
+            participants' informed consent in the phishing survey
+[UNSTATED|adbanner  ] WWW/2025/assessing-compliance-in-digital-advertising-a-deep-dive-into-acceptable-ads-stan
+            display ads "such as banners and pop-ups"; ACM copyright notice
+[OK      |explicit  ] WWW/2025/beyond-the-crawl-unmasking-browser-fingerprinting-in-real-user-interactions
+            "As we aim to study what type of user interactions trigger fingerprinting scripts, our automated crawler does not accept cookie consent banners" (the paper's separate human arm did instruct participants to accept)
+[OK      |explicit  ] WWW/2025/digital-disparities-a-comparative-web-measurement-study-across-economic-boundari
+            of its Lighthouse crawl: "handle cookie banners, which may prevent full webpage rendering. While solutions exist" their "reliability is untested" — the second sentence rules out having used one
+[UNSTATED|none      ] WWW/2025/whats-in-phishers-a-longitudinal-study-of-security-configurations-in-phishing-we
+            no consent vocabulary anywhere in either rendering of the full text
+[UNSTATED|background] IEEE-SP/2026/setting-the-course-but-forgetting-to-steer-analyzing-compliance-with-gdprs-right
+            GDPR right of access; the study downloads data packages rather than crawling
+[UNSTATED|noise     ] NDSS/2026/on-borrowed-time-measurement-informed-understanding-of-the-ntp-pools-robustness-to-monopoly-attacks
+            "adopting prior recommendations" for NTP monitors
+[UNSTATED|noise     ] NDSS/2026/time-and-time-again-leveraging-tcp-timestamps-to-improve-remote-timing-attacks
+            microsecond TCP timestamps as "an opt-in feature"
+[UNSTATED|background] PETS/2026/chatbot-confessions-large-scale-analysis-of-private-data-disclosure-in-shared-ai
+            GDPR Article 9 categories in chatbot transcripts
+[UNSTATED|noise     ] PETS/2026/more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr
+            "multi-modal structure" matched the pattern
+[WRONG   |interacts ] PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
+            "We design a methodology to semi-automatically interact with consent banners deployed by major CMPs in TCF-based Android apps, combining three approaches ... disagree to all, legitimate interest purposes only, and consent to all"
+[UNSTATED|irb       ] USENIX/2026/a-large-scale-study-of-personalized-phishing-using-large-language-models
+            mandatory phishing-awareness training without informed consent
+[UNSTATED|irb       ] USENIX/2026/from-mirai-to-gorilla-deep-dive-into-a-long-lasting-ddos-for-hire-botnet
+            the ISP's consent for self-attacks; Gorilla advertisement banners
+[UNSTATED|none      ] WWW/2026/webgeoinfer-structure-free-multi-stage-framework-for-geolocation-inference-from
+</file>
 ===== 8. Bibliography entries added =====
@@ Line 1443: / Line 2413: @@
   * **Field stability was not re-measured.** The 93% agreement figure for ''consentAction'' comes from the 100-paper stability comparison run against the earlier 4,322-paper corpus. Nobody has re-run it since 2026-08-11.
   * **How many of the 495 ''not-stated'' papers actually had a banner to handle** is unanswerable from the extraction. A crawl of Chinese or US-only sites in 2015 may have faced none. The page therefore reads ''not-stated'' as "the reader cannot tell", not as "the authors were careless".
-  * **The 313 ''no-interaction'' papers were not audited**, only the 36 claiming an interaction (§7.2). The false-positive rate on the audited side is 19.4%; nothing is known about the rate on the unaudited side, and if it is comparable the verified count of 29 could move in either direction. Auditing 313 papers is a day of work and would make the central figure of this page solid rather than indicative — it is the largest open item here.
+  * **The 313 ''no-interaction'' papers were audited on 2026-09-05** (§7.3), closing what this list called its largest open item. The result was not what this bullet predicted: the error is not symmetric with the interacting side's 19.4%, it is an order of magnitude larger and of a different kind — **279 of 313 (89.1%) make no consent claim at all**, and 3 (1.0%) interact. The verified interaction count moved from 29 to **32**, and "papers stating a consent action" from 349 to **55**. What remains open is the other three quarters of the field: the **495 ''not-stated''** and **236 ''not-applicable''** papers were **not** read, so a paper wrongly filed as ''not-stated'' when it does say something is still uncounted, in either direction.
-  * **A paper that clicked a banner and never wrote it down is invisible** by construction, since ''consentAction'' is extracted from the paper's own words. 29 is a floor on the true number as well as an audited count.
+  * **A paper that clicked a banner and never wrote it down is invisible** by construction, since ''consentAction'' is extracted from the paper's own words. 32 is a floor on the true number as well as an audited count — and §7.3.4 shows how the floor is reached: two of the three false negatives surfaced only because a **named tool** (BannerClick, CookieEnforcer) appears in the text.
+  * **The ''implied'' category is a judgement the next run may want to revisit.** 8 papers state that their crawl performs no interaction at all without ever mentioning consent. They are counted in neither the "states an action" figure (55) nor the "says nothing" figure, and the content page publishes both a strict 55 and a lenient 63 rather than choosing. A reader who thinks "we do not click anything" //is// a consent statement should use 63.
+  * **The ''fieldstudy'' pair is a gap in the schema, not in the papers.** Utz et al. {[utz2019_informed]} and Degeling et al. {[degeling2019_value]} measure consent behaviour on real visitors; ''crawlConfig.consentAction'' has no value for that, so both are ''unstated'' here. Any figure on this page about "who studies consent" should not be read as excluding them.
   * **CHI, SOUPS, EuroS&P, ACSAC, RAID, AsiaCCS and WPES are absent from the corpus**, and that bites harder on consent than on most topics: a large fraction of consent-notice work is usable-privacy work published at CHI and SOUPS. Every S2 count is a lower bound and the content page says so twice.
@@ Line 1532: / Line 2504: @@
 **A third, smaller lesson:** 13.4 #2 found a fix this log had recorded as accepted but never shipped. Marking a review finding "Accepted" and editing the page are two separate acts and this run got them out of step once. The check is mechanical — after applying fixes, grep the page for the old value, not for the new one.
+===== Amendment, 2026-09-04: citekey consolidation =====
+  * ''bouhoula2024automated'' was one of two keys for the same paper in [[:literature:bibliography]]. The wiki-wide consolidation of 2026-09-04 (drain item ''dedup-regional-filter-lists-bibkey'') kept ''bouhoula2024_automated'' and deleted the other entry.
+  * 3 citation markers on [[:privacy:consent]] and 1 citation marker on this page were repointed to the kept key. No prose on either page changed, and no figure moved. Statements above that name the deleted key describe the state when they were written. Full query log and the invariants checked before saving: [[:provenance:literature:bibliography]].
+===== 14. Amendment, 2026-09-05: the no-interaction audit =====
+==== 14.1 The run ====
+^  ^  ^
+| Date | 2026-09-05 |
+| Scope | audit all 313 papers labelled ''crawlConfig.consentAction = no-interaction'', and refresh every figure on [[privacy:consent]] that depends on either side of that field. §7.3 is the result. |
+| Corpus at the time | 5,859 extracted papers, 7 venues, 2010–2026, unchanged since the 2026-08-11 extension (''8a6b843'') |
+| Agent | Claude (Opus 5) — the 241-paper hand read, the audit and check scripts, the page and provenance text, the primary-source fetches in §14.4 |
+| Sub-agents | four reviewers (§14.3): three ''sonnet'' focused passes in parallel, then one ''fable'' generic pass |
+| Scripts added | ''consent_action_noninteraction_audit.mjs'', ''consent_ni_quotecheck.mjs'', ''consent_ni_significance.py'', each with its committed ''-output.txt'' |
+**What moved.** The headline "papers that verifiably interacted with a consent notice" went **29 → 32**. The much larger movement is the denominator: "papers that state a consent action" went **349 (31.2% of crawling papers) → 55 (4.9%)**, because 279 of the 313 ''no-interaction'' labels are the extractor's default rather than the paper's claim. Every figure listed in §14.2 was re-derived, not carried over.
+==== 14.2 Figures this amendment changed ====
+^ Figure ^ Was ^ Now ^ Where ^
+| papers stating a consent action | 349 (31.2%) | **55 (4.9%)**, or 63 (5.6%) counting papers that state no interaction of any kind | headline box, §7.3.3 |
+| verifiably interacted | 29 (2.6%) | **32 (2.9%)**; 31 on the web, 33 counting the ''partial'' | headline box, §7.3.4 |
+| verifiably did not act | not measured | **22 (2.0%)** | six-action table |
+| papers where nothing can be established | not stated | **1,057 (94.4%)** | headline box |
+| two-armed (accept //and// reject) designs | 14 | **16**, or 17 counting the ''partial'' | "Two arms or no claim" box |
+| state both a consent action and a statefulness | 115, of which 93 no-interaction | **32** audited, 20 interacted / 12 did not, 18 of them stateless | stateful/stateless box |
+| vantage, among papers stating an action | 349 → 68 (19.5%) EU/EEA | **55 → 37 (67.3%)** EU/EEA, 7 non-EEA only, 11 location not stated | jurisdiction section |
+| vantage, among papers that interacted | 29 → 21 (72.4%) | **32 → 22 (68.8%)** | jurisdiction section |
+| year-bucket "states an action" | 24.5 / 29.9 / 32.1 / 33.6 / 29.8 % | **0.0 / 0.0 / 3.6 / 7.2 / 9.6 %** audited | year-bucket table |
+The year-bucket section also lost its narrative. It previously described a peak at 33.6% in 2022–2024 falling back to 29.8% — **none of the four adjacent movements in that series is significant** (Fisher's exact, all //p// > 0.39), so the page was describing noise in a population that was also wrong. The audited series has exactly one significant step, at the GDPR (§7.3.7).
+==== 14.3 Review log ====
+Four reviewers, all handed the page text, both audit scripts and their unedited output, and these notes, and all told explicitly that the author's context might not be exhaustive. The three focused passes ran in parallel first.
+=== Figures versus script (sonnet) ===
+Re-ran all four scripts and diffed against the committed outputs: identical. Reconciled every checklist figure and every arithmetic identity (313+15+14+3+2+2+495+236+40 = 1,120; 32+22+1 = 55; 55+8 = 63; 1,120−63 = 1,057; 279+22+8+3+1 = 313). Checked ''states'' for double-counting, ''twoArm'', ''webOnly'' and the statefulness cross: all correct.
+^ # ^ Finding ^ Verdict ^
+| 1 | **HIGH.** The page said the 279 unsupported papers "say nothing about consent at all" / "never mention consent at all" / "make no consent claim at all" in **four** places, contradicting the page's own tag table a few lines away: only **72** of the 279 carry the ''none'' tag; the other 207 do contain consent-adjacent vocabulary, just not evidence of their own crawl's action. | **Accepted in full.** All four rewritten to "no evidence of their own crawl's consent action", with a parenthesis saying most of the 279 //do// use the word //consent// somewhere — which is how the extractor came to fill the field. This was the largest error in the published draft and the reviewer earned its slot on this finding alone. |
+| 2 | **LOW–MEDIUM.** "44.2% of crawling papers say nothing about consent" applies the same unverified reading to the **''not-stated''** bucket, which was not audited. | **Accepted.** The bullet now leads with the audited 94.4% and adds: the 44.2% row is the extraction's own count and was not audited, and after what this audit found, no unaudited row on the page should be read as a claim about the papers. |
+| 3 | **LOW, clarity.** "279 of those 313 papers never mention consent at all, and 3 of them turned out to interact" — "3 of them" can misread as 3 of the 279. | **Accepted.** Rewritten as "a further **3**". |
+=== Citations and quotes (sonnet) ===
+Resolved every %%{[key]}%% on both pages against the live bibliography (27 + 8 unique keys, all resolve, no duplicates, no colliding DOIs). Verified all six newly-used keys against the papers. Verified every attribution in §7.3.4 verbatim, and the author surnames used in prose. Spot-checked **27 of the 313 verdicts** — all 4 ''wrong''/''partial'', 8 ''ok'', 5 ''implied'', 10 ''unstated'' — and confirmed 26.
+^ # ^ Finding ^ Verdict ^
+| 1 | **MEDIUM.** ''NDSS/2013/the-postman-always-rings-twice…'' carried another paper's evidence ("Tor described as an 'overlay' network"). A **third** instance of the misattribution family §7.3.6 already documented, and it escaped the quote check because single-quoted text was exempt by design. | **Accepted in full.** Reason rewritten to what the paper actually contains, and the checker extended to verify multi-word single-quoted runs too — then mutation-tested, because that check now finds zero mentions and a zero-count check asserts nothing. §7.3.6 records both. |
+| 2 | Noted that three ''implied'' papers use the word //consent// in unrelated contexts, a minor imprecision in the reason wording. | **Noted, not changed.** The ''implied'' verdict turns on the paper stating no interaction //at all//, not on the absence of the word; the reasons already say so. |
+=== External currency (sonnet) ===
+Re-fetched every tool, standard and legal reference on both pages as of 2026-09-05. Confirmed current and unchanged: Consent-O-Matic (v1.1.5, 204 rules), BannerClick, Priv-Accept (still no default-branch activity since 2022-04-13 — and the ''pushed_at'' caveat the page carries is still needed), CookieBlock, the IDCAC MV3 fork, Ninja Cookie's abandonment (all three sub-claims), Super Agent, W3C GPC (11 June 2026 WD), DNT (2019 Note), the twelve GPC states. **No dead links on either page.**
+^ # ^ Finding ^ Verdict ^
+| 1 | **autoconsent has moved**: v16.23.0 (2026-08-18) → **v16.37.0** (2026-09-05), rules 571+331 → **567+356**. | **Accepted and fixed**, after re-deriving all three numbers independently from the GitHub API. The row now dates its rule count and notes fourteen releases in eighteen days, which is the point a reader pinning it needs. |
+| 2 | **"I don't care about cookies"** original: the page said "last updated 2023-11"; AMO's API says **2023-12-06, v3.5.0**. | **Accepted and fixed**, verified directly against ''addons.mozilla.org/api/v5''. The reviewer also reported a newer v3.5.1 on the vendor's own site; **not published**, because it could not be confirmed from the page's own text. |
+| 3 | EasyList Cookie List header date and the GVL version have both moved since 2026-08-19. | **Rejected as a defect.** Both are published as explicitly dated observations of a file the page tells the reader to re-fetch, which is the correct treatment for the fastest-rotting artefacts on the page. |
+| 4 | **MODERATE.** The Council reportedly dropped **Digital Omnibus Article 88b** — the provision that would have made a browser-level consent signal binding — on 18 June 2026. Directly relevant to this page's GPC section, and predates the page's write date. | **Not added.** See §14.4. |
+| 5 | California AB 566 and Cal. Code Regs. §7025(c)(6). | **Rejected for the content page.** The page deliberately does not enumerate a rotting state list and hedges with "check the current list for your crawl's date"; both facts sit inside that hedge. Recorded here so the next run does not re-litigate it. |
+| 6 | ''iabtechlab.com'' returns **406** to a plain ''curl'' and 200 with a browser User-Agent. | **Accepted as a note.** Added to the set of bot-gated domains this site already tracks; no page claim was affected. |
+==== 14.4 What this amendment could not establish ====
+  * **The Digital Omnibus Article 88b removal is not on the content page**, because no primary source for it was obtained. Attempts made and their results: the EUR-Lex procedure history for CELEX ''52025PC0837'' and the EUR-Lex procedure page for 2025/0360(COD) both return 200 but neither mentions 88b; ''consilium.europa.eu'' — its public register returns **403** to a scripted request; a guessed Council document number (ST-10730-2026-INIT) turned out to be an unrelated military-mobility file. The claim is corroborated across several secondary outlets and is probably true, and it matters for this page — a binding browser-level signal would change what a crawl has to do about banners. **The next run should fetch the Council's actual position paper on 2025/0360(COD) and, if it confirms the removal, add it to the Open Questions section with the primary citation.**
+  * **The 495 ''not-stated'' and 236 ''not-applicable'' papers were not read.** This audit closed one of the four values of ''consentAction''; three quarters of the crawling population is still unaudited in the other direction. A paper wrongly filed ''not-stated'' that does say something would move the 55 up.
+  * **Ten other pages still carry the unaudited 349 / 31.2% figure**, two of them as direct claims about the field (the [[design:crawling_location]] 349-paper vantage paragraph, and the [[programming:stateful_stateless]] per-bucket consentAction series with its "+5.3 pp" trend). Each needs its own report script re-run and its own provenance note, so it was **filed as a separate work item** rather than half-done here. This page is the authoritative source for the audited figures until that lands.
+==== 14.5 Judgement calls ====
+  * **A sibling script, not an extension of ''consent_action_audit.mjs''.** The obvious move was to add 313 entries to that file's existing ''VERDICTS'' map, and it was rejected. Its verdict vocabulary has three values where this side needs five (''implied'' and ''unstated'' have no meaning on the interacting side); its denominators are all "of the 36"; and its unedited output is embedded verbatim in §7.2 and cited from the content page, so growing it in place would have silently rewritten a published audit trail. Instead ''consent_action_noninteraction_audit.mjs'' **imports ''VERDICTS'' from it**, so the two halves are computed in one place and cannot drift, and carries the same fail-loudly guard. The cost is two scripts and two output files where the brief for this work expected one.
+  * **''no-interaction'' was treated as a positive claim, not a sentinel.** The field carries ''not-stated'' and ''not-applicable'' separately, so this follows from the schema. A reader who thinks the extractor was reasonably reading "the paper describes a crawl and never mentions clicking" as no-interaction would get a very different 279.
+  * **The ''ok''/''implied'' boundary is textual, not interpretive.** ''ok'' requires the paper to mention consent; ''implied'' requires an explicit statement of no interaction at all. The rejected alternative — "the paper describes its procedure completely enough that non-interaction follows" — is not reproducible across 313 papers and would have made the audit a matter of taste. The cost is that the content page has to publish both 55 and 63.
+  * **Consent prompts that are not cookie banners count as ''ok''.** Two cryptomining papers state that their crawler never consented to mining; ''CCS/2018/minesweeper'' and ''USENIX/2019/inadvertently-making-cyber-criminals-rich'' are therefore ''ok'', tagged ''mining''. A stricter reading would drop the ''ok'' count from 22 to 20.
+  * **The headline interaction count is 32, not 31 or 33.** 31 is the web-only figure and is given alongside it; 33 counts WhisperTest's app-side arm. §7.3.4 gives all three and says which is which.
+  * **The 313 verdicts are published in full** rather than summarised, because the audit's whole value is that someone can disagree with a specific line. That is why this page is 200KB.
+  * **The three false negatives were not re-labelled in the dataset.** ''data/extract'' is a read-only mount and the corrected values live in this audit's verdict table, not in ''extractions.jsonl''. Anyone re-deriving these figures from the raw field will get 349 and 29 again unless they import ''VERDICTS_NI''.
+==== 14.6 Mistakes in this run, recorded rather than tidied away ====
+  - **The page's central claim was overstated four times** — "279 papers say nothing about consent at all" — while the page's own tag table three lines away showed that only 72 of them do. Caught by the figures reviewer, not by the author, despite the author having built the tag table specifically to keep that residue visible. **Printing the residue does not help if the prose next to it says something else.**
+  - **A de-duplication patch keyed by list position instead of by paper** put three papers' evidence on the wrong papers. Two were caught by the quote checker, the third by a reviewer. None changed a verdict; all three were fabricated evidence in a file the page describes as its only human-readable evidence.
+  - **A mechanical single-to-double quote conversion mangled 7 reasons** by treating word-internal apostrophes as delimiters, and the quote checker passed all 7 because the mangled fragment it extracted really does appear in the paper. A checker that verifies content without verifying structure will bless damaged input.
+  - **The quote checker's first version rejected every quote crossing a column break**, because a two-column splice makes a verbatim sentence non-contiguous. Fixed with a bounded in-order match; **18 of the 129 verified quotes only pass in that mode**, so this was not a corner case.
+  - **A recall probe's word boundary ate the plural.** ''cookie banner'' with a trailing ''%%\b%%'' does not match "cookie banners", so the probe silently reported zero hits for a paper whose methods section says it in as many words. Caught by testing the probe against a known-positive sentence, not by reading it.
+  - **The audit script printed its whole output when imported.** ''consent_ni_quotecheck.mjs'' imports the verdict map; without the ''IS_MAIN'' guard the older audit script already carried, the checker's committed output was 700 lines of the audit's. Fixed, and the guards were then mutation-tested: deleting a verdict, adding one for a paper outside the population, and writing an invalid verdict word each fail loudly with a non-zero exit.
 ====== References ======
 <bibtex bibliography></bibtex>
+===== Markup sweep, 2026-09-17 =====
+Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.