Working notes behind consent — every query with its population and its denominator, the scripts and their unedited output, the folds and their residue, the figures checked against the source papers, the external sources and how each was verified, and what could not be established. Corpus-level caveats that apply to every page on this site are on corpus and are not restated here.

Create, extend or overlap? This is a rewrite. privacy:consent existed at 2,748 bytes and was explicitly labelled brainstorm notes: a <wrap todo> box and two bullet lists of topics to cover. Every topic it listed is now covered somewhere — notice detection and the Consent-O-Matic/autoconsent/IDCAC family, ML classification of consent choices, GPC, DNT, opt-out links. Nothing was deleted that carried information; the two citations the stub used ([1Khandelwal, Rishabh; Nayak, Asmit; Harkous, Hamza; Fawaz, Kassem (2023): "Automated Cookie Notice Analysis and Enforcement", in: 32nd USENIX Security Symposium (USENIX Security 23), pp. 1109-1126. USENIX Association, Anaheim, CA. (Link)] and [2Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 1723-1739. USENIX Association, Philadelphia, PA. (Link)]) are both still cited.

The overlap that mattered, and how it was resolved. requests already carries a section called Cookie Notices and Their Interactive Elements which covers detecting the notice and labelling its buttons, with a comparison table of detectors, and which explicitly says “What the notice means legally, and what to do about consent, is on consent”. That division was kept rather than re-litigated. This page therefore does not repeat the detector comparison; it starts one step later, at “you have found the banner, now what do you do with it”. The judgement call and the alternative are in §10.

Two handles, because they answer different questions and only partly overlap.

S1 is an enum and is published as percentages. crawlConfig.consentAction is in the schema's most stable band: an independent extraction run over the same 100 papers agreed with it on 93%. That figure was measured on the earlier 4,322-paper corpus and has not been re-measured on this one; it is quoted on the content page with that caveat attached.

S2 is a judgement and is published as counts and rankings, never as a share of the corpus. No field in the extraction means “is about consent”. The construction is below in full.

A paper enters the raw candidate set if any of these fields contains a match for the CORE regex in report_consent.mjs:

• classification[].resourceName
• classification[].targetDetail
• detection[].phenomenon
• legal[].whatWasAssessed
• tools[].name and otherToolsMentioned[].name

or if any classification[] tuple has target == “consent-notice”.

The regex deliberately does not match a bare consent. In this corpus a bare “consent” is overwhelmingly research-ethics informed consent — “Consent, data handling, storage, and publication of interview data”, “Consent and anonymous research-data collection” — which is a different page's subject. It matches compound terms only: cookie bann*, consent notice, consent dialog, before consent, without consent, consent revocation, named CMPs, named tools, \btcf\b, \bcmp\b, \bgpc\b, \bdnt\b, opt-out and so on. The full alternation list is the CORE constant in the script.

classification.target == “consent-notice” fires on 39 papers. The hand audit keeps 24 of them. The 15 it drops are not marginal calls — they are the enum firing on things that are not consent artefacts at all: cryptomining opt-in notices (two 2018 papers and OUTGUARD), Twitter misinformation labels, GPTzero output, taint-style vulnerability detection, ad-disclosure keywords, login/registration form heuristics, LlamaGuard safety labels, and privacy-policy rule checking. Using the enum as the population would have made a 38% error rate invisible.

In the other direction the enum misses most of the field: of the 72 papers in S2, only 24 carry the enum at all. Papers that measure GPC compliance, opt-out links, TCF string contents or pre-consent tracking classify something, but not “a consent notice”.

28 of the 100 raw candidates were excluded, each with a recorded reason. This list is the part of the population definition most worth disagreeing with, which is why it is printed here rather than left in a script.

One key in that list (IMC/2025/cookieguard-…) no longer matches the sweep at all: an earlier draft of consent_fold.mjs had cookieguard in the candidate vocabulary, which was wrong — CookieGuard is a first-party-cookie-jar isolation defence, not a consent tool. The key is kept in the exclusion map and the script marks it ? rather than x so the record of the decision survives.

Borderline calls that were kept, and would be reasonable to drop:

• NDSS/2021/your-phone-is-my-proxy — measures user understanding of proxy-SDK consent dialogs. A consent dialog, but not a tracking-consent one.
• IMC/2024/watching-tv-with-the-second-party and NDSS/2023/i-still-know-what-you-watched-last-sunday — smart-TV opt-out and pre-consent tracking. Not the web, but the same measurement.
• PETS/2022/atom-ad-network-tomography — kept because its consent decision was to exclude sites with banners from the sample, which is itself a consent-handling choice worth having in the population.
• IMC/2025/an-in-depth-investigation-of-data-collection-in-llm-app-ecosystems — measures availability of opt-out controls in LLM app ecosystems.

Borderline calls that were dropped, and would be reasonable to keep:

• CCS/2023/policychecker and the COPPA/parental-consent papers — they assess whether consent was obtained, but measure no consent mechanism.
• IEEE-SP/2025/analyzing-the-ios-local-network-permission — an OS permission rationale is arguably the mobile analogue of a consent notice.

Moving every borderline paper the other way changes S2 by about ±6 papers, i.e. under 10%. No figure on the content page turns on it, because S2 is only ever reported as counts and rankings.

cd /workspace/artifacts/wiki
node scripts/report_consent.mjs                # the numbers, with denominators
node scripts/report_consent.mjs --wiki         # the same, as DokuWiki tables
node scripts/consent_quotecheck.mjs            # every published literal vs the source PDFs

Both scripts resolve the dataset through scripts/lib.mjs → dataRoot(), so they work whether the mount root is /workspace/publications_dataset or /workspace/publications_dataset/data.

corpus: 5859 papers, 7 venues, 2010-2026
2025 and 2026 are provisional venue-years (see literature:corpus).

── S1. Consent action, of every paper that ran an automated web crawl ──
population 'crawled' (crawlConfig present OR studyTypes includes automated-web-crawl): 1120
of those, a crawlConfig object was extracted for: 1080
Value                  Papers  Share of 1120  Sentinel?
---------------------  ------  -------------  -------------------
no-interaction         313     27.9%
accept-all             15      1.3%
accept-and-reject      14      1.3%
reject-all             2       0.2%
dismiss-or-remove      3       0.3%
cmp-specific-choices   2       0.2%
not-stated             495     44.2%          YES — not an answer
not-applicable         236     21.1%          YES — not an answer
no-crawlConfig-object  40      3.6%           YES — not an answer

STATED a consent action: 349 of 1120 (31.2%)
Of the 349 that state one, 36 (10.3%) actually touched the notice;
the other 313 (89.7%) state that they did not.
Papers in the whole corpus that state a consent action other than no-interaction: 36

── S1b. Is the reporting gap closing? consent action stated, by year bucket ──
Bucket      Crawling papers  State an action  Share  Actually interacted  Share
----------  ---------------  ---------------  -----  -------------------  -----
2010–2013   102              25               24.5%  0                    0.0%
2014–2017   167              50               29.9%  0                    0.0%
2018–2021   308              99               32.1%  6                    1.9%
2022–2024   345              116              33.6%  17                   4.9%
2025–2026*  198              59               29.8%  13                   6.6%
* 2025-2026 is provisional: CCS/IMC 2026 not held, IEEE S&P/WWW 2026 incompletely selected.

── S1c. Consent action x statefulness (of crawling papers stating BOTH) ──
population: 115 papers state a consent action AND a statefulness
Consent action        stateful  stateless  both  Total
--------------------  --------  ---------  ----  -----
accept-all            2         4          1     7
accept-and-reject     1         4          5     10
cmp-specific-choices  1         1          0     2
dismiss-or-remove     0         1          1     2
no-interaction        21        62         10    93
reject-all            0         1          0     1

── S1d. Consent action x vantage point: did the crawl run where the law applies? ──
population: 349 crawling papers that state a consent action
Vantage                             Papers  Share
----------------------------------  ------  -----
vantage tuple, location not-stated  206     59.0%
stated a non-EU/EEA vantage only    71      20.3%
EU/EEA vantage                      68      19.5%
no vantage tuple at all             3       0.9%
location named but unmappable       1       0.3%

Of the 36 papers that actually interacted with a notice, 21 (58.3%) did so from an EU/EEA vantage.
Locations folded with scripts/geo.mjs; EEA membership list is in that file.
geo.mjs residue over this population: 5 unmapped strings: "not-stated", "all operating systems and geographic regions", "vantage country", "different continents", "various geographic regions"

── S2. Papers that measure or manipulate a consent mechanism ──
raw vocabulary + enum sweep: 100 candidates
hand-audited exclusions:      28
S2 population:                72 papers
(exclusion keys in EXCLUDED that no longer match the sweep: 1)

── S2b. S2 by venue and by year ──
Venue    Papers in S2  Papers in corpus  Share of venue
-------  ------------  ----------------  --------------
PETS     30            510               5.9%
USENIX   14            1410              1.0%
WWW      8             843               0.9%
CCS      7             990               0.7%
IMC      7             638               1.1%
NDSS     3             701               0.4%
IEEE-SP  3             767               0.4%

Year   Papers in S2
-----  ------------
2018   1
2019   4
2020   3
2021   5
2022   9
2023   9
2024   20
2025*  15
2026*  6
* provisional venue-year.

── S2c. Object of study vs instrument ──
Role of consent in the paper                                                         Papers  Share of S2
-----------------------------------------------------------------------------------  ------  -----------
consent mechanism is measured (fires on a detection / classification / legal field)  60      83.3%
consent handling is only an instrument (fires on a tool name only)                   12      16.7%

── S2d. Platform measured, of S2 papers ──
population: 72 S2 papers; platforms is multi-valued so shares do not sum to 100%
Platform              Papers  Share of S2
--------------------  ------  -----------
web                   57      79.2%
mobile                15      20.8%
other-online-service  7       9.7%
iot                   2       2.8%
offline               1       1.4%

── T1. Consent-handling tools, whole corpus, used or produced only ──
denominator: all 5859 papers; tuples filtered to usedOrMentioned in {used, produced}
Tool                             Papers  Role
-------------------------------  ------  -------------
Consent-O-Matic                  9       used
BannerClick                      4       produced+used
CookieBlock                      4       used
custom GPC extension or crawler  4       produced+used
autoconsent                      3       used
EasyList Cookie List             2       used
Priv-Accept                      2       used
TC-string decoder                2       used
ConsentChk                       1       produced
CookieCheck                      1       produced
CookieEnforcer                   1       produced
CookieGuard                      1       produced
GDPR-Consent                     1       produced
I don't care about cookies       1       used
Ninja Cookie                     1       used
Opt-Out Easy                     1       produced
OptOutCheck                      1       produced
Super Agent                      1       used

UNMAPPED RESIDUE of the consent-tool fold: 5 distinct names over 5 papers
    1  IAB anti-ad-block script
    1  Interactive Advertising Bureau (IAB) taxonomy
    1  IAB Europe's CMP Compliance Programme
    1  IAB Europe Transparency and Consent Framework
    1  IAB ads.txt crawler

── T2. CMP vendors named as a tool used, whole corpus ──
denominator: all 5859 papers
CMP            Papers
-------------  ------
OneTrust       6
Quantcast      3
Cookiebot      3
Cookie Script  3
Didomi         1
This counts papers that name the CMP as a tool, not CMP market share.

── C1. Method used to classify a consent notice (audited subset of the enum) ──
population: 24 S2 papers carrying a classification tuple with target=consent-notice
(the enum fires on 39 papers before the audit)
Method               Papers  Share of subset
-------------------  ------  ---------------
heuristic-rules      11      45.8%
manual-labelling     9       37.5%
supervised-ml        3       12.5%
regex-or-signature   2       8.3%
blocklist            2       8.3%
third-party-service  1       4.2%
curated-database     1       4.2%
llm                  1       4.2%

── C2. Ground truth and validation, same subset ──
population: 24 papers
Validation         Papers  Share
-----------------  ------  -----
manual-validation  19      79.2%
none-reported      4       16.7%
cross-validation   2       8.3%
held-out-test-set  1       4.2%
not-applicable     1       4.2%

Names a ground-truth source: 19 of 24 (79.2%)

── L1. Laws assessed by S2 papers, folded with scripts/law_fold.mjs ──
population: 53 of 72 S2 papers carry a legal tuple (corpus-wide, 402 papers do)
Law family                                  Papers  Share of the 53
------------------------------------------  ------  ---------------
EU data protection (GDPR and predecessors)  42      79.2%
ePrivacy / cookie law                       20      37.7%
US state privacy law                        20      37.7%
US children / education / health / finance  7       13.2%
EU platform / digital-market regulation     2       3.8%
Sector, national and other rules            1       1.9%
UNMAPPED                                    1       1.9%
Non-EU/US data protection law               1       1.9%

Strings that fell into the catch-all family or matched nothing: 2
    1  Act against Unfair Competition (UWG)
    1  Digital Economy Act 2017

── X. Cross-check: S2 papers that ran a crawl and what they did with the notice ──
population: 51 of 72 S2 papers ran an automated web crawl
Consent action        Papers  Share
--------------------  ------  -----
no-interaction        18      35.3%
accept-and-reject     14      27.5%
accept-all            8       15.7%
not-stated            6       11.8%
cmp-specific-choices  2       3.9%
reject-all            2       3.9%
not-applicable        1       2.0%

── E. The exclusion list, in full ──
  x CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
      cryptomining opt-in notice, not a tracking-consent mechanism
  x CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense
      cryptomining opt-in notice, not a tracking-consent mechanism
  x CCS/2021/android-on-pc-on-the-security-of-end-user-android-emulators
      screenshot capture by emulators; "without consent" used colloquially
  x CCS/2023/cookiegraph-understanding-and-detecting-first-party-tracking-cookies
      cookie classification; CookieBlock appears only as a compared baseline
  x CCS/2024/octopustaint-advanced-data-flow-analysis-for-detecting-taint-based-vulnerabiliti
      consent-notice enum misfire on a taint-analysis paper
  x IEEE-SP/2021/trouble-over-the-air-an-analysis-of-fota-apps-in-the-android-ecosystem
      app installation without consent; no consent mechanism measured
  x IEEE-SP/2024/to-auth-or-not-to-auth-a-comparative-analysis-of-the-pre-and-post-login-security
      consent-notice enum misfire on login/registration form heuristics
  x IEEE-SP/2025/analyzing-the-ios-local-network-permission-from-a-technical-and-user-perspective
      OS permission rationale, not a tracking-consent mechanism
  x IEEE-SP/2025/detecting-taint-style-vulnerabilities-in-microservice-structured-web-application
      consent-notice enum misfire
  x IMC/2013/understanding-the-effectiveness-of-video-ads-a-measurement-study
      IAB ad-format definition, not IAB Europe TCF
  x IMC/2024/analyzing-the-in-accessibility-of-online-advertisements
      consent-notice enum misfire on ad-disclosure keywords
  ? IMC/2025/cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
      cookie-jar isolation defence; name collides with the tool vocabulary
  x NDSS/2019/measuring-the-facebook-advertising-ecosystem
      IAB content taxonomy, not IAB Europe TCF
  x NDSS/2025/attributing-open-source-contributions-is-critical-but-difficult-a-systematic-analysis-of-github-practices-and-their-impact-on-software-supply-chain-security
      consent-notice enum misfire (GPTzero)
  x NDSS/2026/dom-xss-detection-via-webpage-interaction-fuzzing-and-url-component-synthesis
      IAB content taxonomy, not IAB Europe TCF
  x PETS/2017/detecting-anti-ad-blockers-in-the-wild
      IAB anti-ad-block script, not IAB Europe TCF
  x PETS/2020/angel-or-devil-a-privacy-study-of-mobile-parental-control-apps
      no consent mechanism measured; consent inferred from data flows
  x PETS/2025/your-signal-their-data-an-empirical-privacy-analysis-of-wireless-scanning-sdks-i
      consent-notice enum misfire on SDK rationale detection
  x PETS/2026/ai-in-the-loop-privacy-preserving-real-time-scam-detection-and-conversational-sc
      consent-notice enum misfire (LlamaGuard safety labels)
  x PETS/2026/audagent-automated-auditing-of-privacy-policy-compliance-in-ai-agents
      consent-notice enum misfire on privacy-policy rules
  x PETS/2026/no-privacy-for-privates-how-military-communities-experience-and-perceive-the-pri
      consent-notice enum misfire on data-safety label comparison
  x USENIX/2018/unveiling-and-quantifying-facebook-exploitation-of-sensitive-personal-data-for-a
      no consent mechanism measured
  x USENIX/2022/electronic-monitoring-smartphone-apps-an-analysis-of-risks-from-technical-human
      pre-login transmissions; no consent mechanism measured
  x USENIX/2025/exploring-user-security-and-privacy-attitudes-and-concerns-toward-the-use-of-gen
      attitudes study; opt-out appears only in a legal framing sentence
  x WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild
      cryptomining opt-in notice, not a tracking-consent mechanism
  x WWW/2019/think-outside-the-dataset-finding-fraudulent-reviews-using-cross-dataset-analysi
      consent-notice enum misfire on review-fraud labels
  x WWW/2022/the-impact-of-twitter-labels-on-misinformation-spread-and-user-engagement-lesson
      consent-notice enum misfire on misinformation labels
  x WWW/2023/not-seen-not-heard-in-the-digital-world-measuring-privacy-practices-in-childrens
      COPPA parental consent inferred from data flows; no mechanism measured
  x WWW/2025/welcome-to-the-dark-side-analyzing-the-revenue-flows-of-fraud-in-the-online-ad-e
      IAB ads.txt, not IAB Europe TCF

  x = excluded from a live sweep hit; ? = key no longer matches the sweep

This is the block the content page's What the papers found table was built from — 109 tuples across 50 papers, each with its metric, its prevalence as the authors stated it, and the verbatim evidence quote with its section. It is long. It is here because the alternative is that nobody can check which of these the page chose to publish and which it passed over.

── D1. Every consent-related detection tuple in S2 that carries a prevalence ──
109 tuples across 50 papers
metric names the unit, not always the population — check the paper before quoting.

WWW 2018 an-automated-approach-to-auditing-disclosure-of-third-party-data-collection-in-w
  phenomenon: Do Not Track policy support
  metric:     policy share mentioning or respecting DNT
  prevalence: 7% contained “do not track”; 64.80% explicitly did not honor DNT; 19.46% clearly committed to honor it.
  quote [results]: Across the population of website policies analyzed, 7% contain the string "do not track". A manual analysis of a sample of policies determines if the string is in reference to DNT

WWW 2018 an-automated-approach-to-auditing-disclosure-of-third-party-data-collection-in-w
  phenomenon: third-party Do Not Track support
  metric:     number of policies mentioning or supporting DNT
  prevalence: Nine of 25 mentioned DNT; two offered qualified support; none offered unqualified support.
  quote [results]: Despite this awareness, only nine of 25 data collectors mention the DNT standard in their privacy policies. As with first-party disclosures, the majority of these mentions are to specify that DNT is ignored.

CCS 2019 un-informed-consent-studying-gdpr-consent-notices-in-the-field
  phenomenon: Consent-notice GUI properties
  metric:     share of consent notices
  prevalence: 57.4% used nudging; 92.3% contained an additional-information link
  quote [methodology]: Nudging & Dark Patterns. Consent notices often (57.4 %) use interface design to steer website visitors towards accepting privacy-unfriendly options.

CCS 2019 un-informed-consent-studying-gdpr-consent-notices-in-the-field
  phenomenon: Visitor consent behavior
  metric:     number of unique visitors
  prevalence: 82,890 cleaned visitor logs
  quote [results]: Our cleaned dataset contained event logs of 82,890 unique website visitors: 14,135 in Experiment 1, 36,530 in Experiment 2, and 32,225 in Experiment 3.

IMC 2019 tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
  phenomenon: cookie consent banners
  metric:     share of pornographic websites
  prevalence: 4.41% in the EU and 3.76% in the USA
  quote [results]: The proportion of pornographic webpages with cookie banners is very small, being only 4% of the total.

NDSS 2019 we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy
  phenomenon: cookie-consent notices
  metric:     share of websites displaying notices
  prevalence: 62.1% in May 2018, up from 46.1% in January
  quote [results]: The GDPR's most notable (and visible for users) effect we observed is the increase of cookie consent notifications, which rose from 46.1 % in January to 62.1 % in May.

PETS 2019 4-years-of-eu-cookie-law-results-and-lessons-learned
  phenomenon: Consent-related cookie installation
  metric:     share of websites
  prevalence: 80.5% install profiling cookies before consent
  quote [results]: All other websites, i.e., 80.5% install profiling cookies before consent, and possibly install more after that.

PETS 2020 multiple-purposes-multiple-problems-a-user-study-of-consent-dialogs-after-gdpr
  phenomenon: Consent-dialog interaction effort
  metric:     response time
  prevalence: Reduced-choice participants spent approximately five seconds less responding on average than participants shown three purposes.
  quote [results]: The measurement starts when the cookie dialog appears and ends when the participant clicks a button.

WWW 2020 finding-a-choice-in-a-haystack-automatic-extraction-of-opt-out-statements-from-p
  phenomenon: opt-out hyperlinks
  metric:     precision, recall, and F1
  prevalence: precision 0.93, recall 0.90, F1 0.91
  quote [results]: When crafting simple rules to automatically detect these opt-outs and combining these rules with our classifiers, we are actually able to achieve an overall recall of 0.90 and a precision of 0.93 and an F1 score of 0.91.

WWW 2020 finding-a-choice-in-a-haystack-automatic-extraction-of-opt-out-statements-from-p
  phenomenon: opt-out hyperlinks
  metric:     share of hyperlinks
  prevalence: 441 of 3,251 hyperlinks (14%) were easily identifiable third-party opt-outs
  quote [results]: In our annotated corpus, the 11 easily-identifiable third party opt-out services accounted for 441 of 3,251 hyperlinks, which represents 14% of the hyperlinks.

WWW 2020 finding-a-choice-in-a-haystack-automatic-extraction-of-opt-out-statements-from-p
  phenomenon: opt-out categories
  metric:     percentage of detected opt-outs
  prevalence: 60% advertising, 17% cookies, 10% communication, 7% third-party sharing, and 6% analytics
  quote [results]: advertising opt-outs (AD) account overall for 60% of all detected opt-outs, following by 17% of cookie opt-outs (CK), 10% communication opt-outs (CM)

WWW 2020 finding-a-choice-in-a-haystack-automatic-extraction-of-opt-out-statements-from-p
  phenomenon: opt-outs by website popularity
  metric:     mean opt-outs per site
  prevalence: U.S. Alexa ranks 1–200: 3.43; 200–1000: 2.49; above 1000: 1.22
  quote [results]: The average number of opt-outs varies with the website's Alexa rank. This is true both when looking solely at U.S. websites

IEEE-SP 2020 do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
  phenomenon: TCF cookie banners
  metric:     share of reachable and authorized websites
  prevalence: 1,426 of 22,949 websites (6.2%)
  quote [results]: Among reachable and authorized websites, 1 426 (6.2%) had a TCF banner

IEEE-SP 2020 do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
  phenomenon: No way to opt out
  metric:     share of semi-automatically crawled websites
  prevalence: 38 of 560 websites (6.8%)
  quote [results]: We find that 38 (6.8%) websites do no provide any way to refuse consent.

IEEE-SP 2020 do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
  phenomenon: Shared-cookie consent reuse
  metric:     share of semi-automatically crawled websites
  prevalence: 62 of 1,426 websites (4.3%) returned the same consent string
  quote [results]: Using this protocol, 62 (4.3%) websites return the same consent strings.

PETS 2021 privacy-preference-signals-past-present-and-future
  phenomenon: TCF implementation and version
  metric:     share of crawled websites
  prevalence: 7,582 TCF implementations in the top 100k
  quote [methodology]: As each CMP must implement a __cmp() function for TCF 1.x and __tcfapi() function for TCF 2.x, we check for the presence of these functions

PETS 2021 privacy-preference-signals-past-present-and-future
  phenomenon: TCF 2.0 migration
  metric:     longitudinal adoption and transition counts
  prevalence: 5.7 million Quantcast and 1.4 million OneTrust captures
  quote [methodology]: we identified distinct HTTP requests that indicate the use of specific TCF versions.

PETS 2021 privacy-preference-signals-past-present-and-future
  phenomenon: TCF vendor adoption
  metric:     vendor joins, departures, switches, and legal-basis declarations
  prevalence: More than 600 vendors had adopted TCF by October 2020
  quote [methodology]: We then inspected these previous versions for longitudinal changes and measured every instance when an AdTech vendor joins, leaves, or switches to TCF 2.0.

PETS 2021 privacy-preference-signals-past-present-and-future
  phenomenon: Cookie notices and consent prompts
  metric:     estimated share of websites with cookie prompts
  prevalence: 5% overall error rate in manual checking
  quote [methodology]: In a manual inspection of 50 randomly picked domains with and 50 domains without "cookie" in their DOM tree, we found five domains

NDSS 2021 your-phone-is-my-proxy-detecting-and-understanding-mobile-proxy-networks
  phenomenon: user understanding of consent dialogs
  metric:     percentage of participants
  prevalence: 72% considered dialogs not at all clear after explanation
  quote [results]: After knowing the concepts of web proxy and relaying network traffic, 72% of the participants think the dialogs are "Not at all clear"

PETS 2021 managing-potentially-intrusive-practices-in-the-browser-a-user-centered-perspect
  phenomenon: Users’ opt-out preferences
  metric:     percentage of instances
  prevalence: Participants preferred to opt out in 81% of instances on average.
  quote [results]: Overall, participants preferred to opt out in 81% of instances on average.

USENIX 2021 share-first-ask-later-or-never-studying-violations-of-gdprs-explicit-consent-in
  phenomenon: Personal-data transmission without consent
  metric:     share of successfully analyzed apps
  prevalence: 24,838 apps (34.4%) sent personal data to third-party data controllers
  quote [results]: this means that 34.4% of them sent out PD to third-party data controllers, thereby violating GDPR's mandated consent

USENIX 2021 share-first-ask-later-or-never-studying-violations-of-gdprs-explicit-consent-in
  phenomenon: Consent notices in violating apps
  metric:     share of 100 sampled apps
  prevalence: 25 apps showed consent notices; 11 offered rejection
  quote [results]: Among these 100 apps, we found only 25 apps present any type of consent notices to users. Of these, only 11 apps provide an option to reject

CCS 2022 do-opt-outs-really-opt-me-out
  phenomenon: opt-out buttons
  metric:     precision and recall
  prevalence: OptOutCheck identified opt-out cookies from 165 trackers
  quote [results]: After excluding 30 trackers with non-English opt-out pages, OptOutCheck identified 265 opt-out cookies from 165 trackers.

CCS 2022 do-opt-outs-really-opt-me-out
  phenomenon: opt-out policy statements
  metric:     precision and recall
  prevalence: 55 No-data-collection and No-tracking policies from 54 sentences of 42 trackers
  quote [results]: OptOutCheck extracted 55 No-data-collection and No-tracking policies from 54 sentences of 42 trackers.

CCS 2022 do-opt-outs-really-opt-me-out
  phenomenon: opt-out cookies
  metric:     F1 score, precision, and recall
  prevalence: 84% F1, 97% precision, and 74% recall on the test set
  quote [evaluation]: the classifier achieves a high F1 score of 84% (97% precision and 74% recall) on the test set.

CCS 2022 do-opt-outs-really-opt-me-out
  phenomenon: opt-out inconsistencies
  metric:     number of inconsistent trackers
  prevalence: 11 trackers continued tracking or data collection inconsistently with policies
  quote [results]: OptOutCheck detected 11 trackers that had conducted tracking and data collection inconsistently with their opt-out policies after activating the opt-out choices.

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: consent notices
  metric:     share of analyzed apps
  prevalence: 13,082 consent notices among 239,381 successfully analyzed apps
  quote [results]: As a result, we identified 13,082 privacy-related user interfaces that are any form of consent notices.

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: consent interaction mechanisms
  metric:     share of consent notices
  prevalence: confirmation-only 43.87%; opt-out personalized ads 30.19%; binary choices 21.95%; complex choices 4%
  quote [results]: we identified the four mechanisms for user interaction that are currently widely implemented by Android apps

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: lack of consent notices
  metric:     share of apps sending personal data to ad domains
  prevalence: 30,160 of 32,341 apps (93.26%)
  quote [results]: we identified a significant number of 30,160 (93.26% of 32,341) apps have no implemented any form of consent notices.

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: sharing data before consent
  metric:     share of consent-notice apps
  prevalence: 2,181 apps (16.67%) sent personal data before explicit consent
  quote [results]: we identified 3,007 (23%) apps that sent users' personal data to the Internet before any given consent ... 2,181 (16,67% of 13,082) apps sent personal data to third-party data controllers

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: no way to opt out
  metric:     share of consent-notice apps
  prevalence: 1,084 apps (8.28%) sent data to advertising controllers without refusal options
  quote [results]: 1,084 (8.28% of 13,082) apps sent to third-party data controllers in which their consent notices do not offer a way to refuse consent.

CCS 2022 freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio
  phenomenon: non-respect of opt-out
  metric:     number of apps
  prevalence: 134 apps sent personal data after explicit opt-out
  quote [results]: We found 134 apps that still sent users' personal data to third-party advertising data controller after explicitly opting-out the data sharing

PETS 2022 are-iphones-really-better-for-privacy-a-comparative-study-of-ios-and-android-app
  phenomenon: tracking before consent
  metric:     share of apps contacting tracking domains at startup
  prevalence: 81.44% of Android apps and 68.46% of iOS apps potentially shared data before consent.
  quote [results]: This suggests potentially widespread violations of applicable data protection law (in 81.44% of Android apps, and 68.46% of iOS apps).

PETS 2022 checking-websites-gdpr-consent-compliance-for-marketing-emails
  phenomenon: GDPR consent violations
  metric:     share of websites
  prevalence: 17.3% of websites sending marketing emails had at least one potential violation.
  quote [results]: 17.3% of websites have at least one potential violation.

PETS 2022 how-can-and-would-people-protect-from-online-tracking
  phenomenon: Opt-out difficulty
  metric:     mean number of clicks
  prevalence: Opting out averaged 3 clicks initially and 6 clicks after previously accepting consent.
  quote [results]: For the remaining websites, it would take the user to opt-out from the cookie notice by 3 clicks on average... changes mind later, it would take them 6 clicks on average to opt-out.

PETS 2022 on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
  phenomenon: unbalanced consent choices
  metric:     share of studied consent pop-ups
  prevalence: six out of ten studied consent pop-ups showed a difference between the “Accept” and “Reject” button by default
  quote [results]: We found out that six out of ten studied consent pop-ups - Quantcast, Cookiebot free, Cookiebot paid, and Cookie Script Free, Lite, and Plus - showed a difference between the “Accept” and “Reject” button by default

PETS 2022 on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
  phenomenon: CMP tracker-scanner manipulation
  metric:     number of CMPs offering tracker scanners
  prevalence: four CMPs proposed tracker scanners
  quote [results]: We found out that four CMPs - CookiePro, Cookiebot, Crownpeak, and Cookie Script - propose tracker scanners.

PETS 2022 on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
  phenomenon: pre-consent Quantcast tracking
  metric:     third-party requests and tracking cookies
  prevalence: Quantcast initially set a user-specific one-year mc cookie before consent
  quote [results]: This tracking pixel was integrated by default in all Quantcast Choice banners even before the user makes a decision regarding acceptance or refusal of consent

PETS 2022 on-dark-patterns-and-manipulation-of-website-publishers-by-cmps
  phenomenon: third-party tracking in Cookie Script report
  metric:     requests and cookies observed
  prevalence: 41 third-party requests and 6 cookies were deposited without prior consent
  quote [results]: The tracker scan page includes a Google Analytics service, as well as social sharing buttons, all which generating a total of 41 third-party requests and the deposit of 6 cookies without the user's prior consent

USENIX 2022 automating-cookie-consent-and-gdpr-violation-detection
  phenomenon: Cookies before consent
  metric:     share of websites setting non-necessary cookies
  prevalence: 69.7% of examined websites
  quote [results]: By crawling the website without interacting with the cookie banner, we inspect if websites set any cookies with a purpose that is not declared as necessary. We find that 69.7%

USENIX 2022 automating-cookie-consent-and-gdpr-violation-detection
  phenomenon: Cookies despite negative consent
  metric:     share of websites
  prevalence: 21.3% of 29,398 websites
  quote [results]: We then verify that the recorded consent status of the CMP is indeed negative, and identify which of these websites still set non-necessary cookies.

CCS 2023 policychecker-analyzing-the-gdpr-completeness-of-mobile-apps-privacy-policies
  phenomenon: Consent-withdrawal omissions
  metric:     share of consent-based policies
  prevalence: 66.1% of 77,522 consent-based policies
  quote [introduction]: among 77,522 privacy policies that indicated consent-based data processing, 66.1% of them failed to further indicate whether users have the right to withdraw their consents

NDSS 2023 i-still-know-what-you-watched-last-sunday-privacy-of-the-hbbtv-protocol-in-the-european-smart-tv-landscape
  phenomenon: Tracking before consent
  metric:     share of TV channels
  prevalence: 26 of 36 channels communicated with trackers before consent
  quote [discussion]: All the 36 TV channels we analyzed contact at least one tracking domain; further, 26 communicate with trackers before the user has expressed their consent.

IMC 2023 thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web
  phenomenon: cookiewall prevalence
  metric:     share of queried websites
  prevalence: 280 of 45,222 websites (0.6%)
  quote [results]: In total, we find cookiewalls on 280 unique websites, resulting in an overall cookiewall rate of 0.6%

IMC 2023 thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web
  phenomenon: cookiewall detection
  metric:     precision and recall
  prevalence: 98.2% precision; 100% precision and recall on 1,000 sampled websites
  quote [methodology]: We find that 280 websites have indeed a cookiewall, whereas 5 detections are classified as false positives. This results in a detection precision of 98.2%.

USENIX 2023 automated-cookie-notice-analysis-and-enforcement
  phenomenon: cookie notice detection
  metric:     accuracy
  prevalence: 986 of 2000 domains identified as having cookie notices; 16 false negatives and 2 false positives
  quote [results]: The module identified 986 domains as having cookie notices, with 2 false positives and 16 false negatives.

USENIX 2023 automated-cookie-notice-analysis-and-enforcement
  phenomenon: cookie notices at scale
  metric:     share of websites with notices
  prevalence: 52.7% of 85,473 analyzed websites
  quote [results]: First, we find that CookieEnforcer detects a cookie notice on 52.7% of the websites.

USENIX 2023 automated-cookie-notice-analysis-and-enforcement
  phenomenon: multiple-view cookie notices
  metric:     share of websites with notices
  prevalence: 35.4% had multiple views; 64.6% had a single-view notice
  quote [results]: 35.4% of the websites with notices had cookie notices with multiple views while 64.6% had a single-view cookie notice.

USENIX 2023 automated-cookie-notice-analysis-and-enforcement
  phenomenon: one-click opt-out
  metric:     share of websites with cookie notices
  prevalence: 21.5% provided a one-click opt-out mechanism
  quote [results]: We find that in total, only 21.5% of the websites with cookie notices provide a One-click opt-out mechanism

USENIX 2023 the-ok-is-not-enough-a-large-scale-study-of-consent-dialogs-in-smartphone-applic
  phenomenon: privacy consent dialogs
  metric:     share of successfully analyzed apps
  prevalence: 814 (22.3%) apps displayed a privacy consent dialog on start; 434 (11.9%) displayed a proper dialog.
  quote [results]: Overall, we detected 814 (22.3%) apps displaying a privacy consent dialog on start. 232 (6.3%) displayed a link, 165 (4.5%) displayed a notice, and 434 (11.9%) displayed a proper dialog.

USENIX 2023 the-ok-is-not-enough-a-large-scale-study-of-consent-dialogs-in-smartphone-applic
  phenomenon: pre-consent tracker traffic
  metric:     apps contacting monitored tracking endpoints before interaction
  prevalence: 3013 (82.5%) analyzed apps contacted a covered tracking endpoint before interaction.
  quote [results]: Mapping the requests back to apps, leads to 3013 (82.5%) of apps contacted one of our covered tracking endpoints before any interaction took place.

USENIX 2023 the-ok-is-not-enough-a-large-scale-study-of-consent-dialogs-in-smartphone-applic
  phenomenon: TCF usage
  metric:     apps setting TCF-related strings
  prevalence: 146 (4.0%) apps set TCF-related settings during execution.
  quote [results]: We detected only TCF-related settings in 146 (4.0%) apps. This highly limits any analysis approach based on frameworks.

PETS 2023 comparing-large-scale-privacy-and-security-notifications
  phenomenon: third-party cookies without consent
  metric:     share of candidate sites
  prevalence: 7.34% of sites with at least one privacy issue
  quote [methodology]: followed by Before Consent (7.57 %) and No Consent (7.34 %).

PETS 2023 comparing-large-scale-privacy-and-security-notifications
  phenomenon: third-party cookies before consent
  metric:     share of candidate sites
  prevalence: 7.57% of sites with at least one privacy issue
  quote [methodology]: followed by Before Consent (7.57 %) and No Consent (7.34 %).

PETS 2023 everybodys-looking-for-ssomething-a-large-scale-evaluation-on-the-privacy-of-oau
  phenomenon: Preselected marketing consent
  metric:     share of sites with marketing consent preselected
  prevalence: 31.82% of minimal-scope and 54.55% of non-minimal-scope sites.
  quote [results]: 14 out of these 44 (31.82%) websites include a preselected choice. On websites that use OAuth with non-minimal scopes ... 30 (54.55%)

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: Willingness to enable GPC
  metric:     share of participants
  prevalence: 46/49 (94%) opted to enable GPC
  quote [results]: 46/49 (94%) of the participants in our Browser Setup Survey opted to enable GPC

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: Understanding of GPC
  metric:     share answering correctly
  prevalence: 81% correctly answered that advertisers would not receive their data
  quote [results]: Based on the explanation, 81% of the participants in our GPC Survey correctly answered that advertisers would not receive their data if they turned on GPC.

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: GPC compliance detection accuracy
  metric:     accuracy
  prevalence: 89/100 sites
  quote [results]: Our extension ran successfully and correctly on 89/100 sites of the Test Set

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: US Privacy String detection
  metric:     F-1 score
  prevalence: 0.98 on the test-set subset
  quote [results]: With one false positive and an F-1 score of 0.98 our extension reliably identified the US Privacy String

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: GPC compliance among combined-set sites
  metric:     compliant sites with US Privacy Strings
  prevalence: 27/64 sites as of August 2022
  quote [results]: As of August 2022, a total of 27/64 sites that implement the US Privacy String were compliant and respected GPC.

PETS 2023 usability-and-enforceability-of-global-privacy-control
  phenomenon: GPC compliance at scale
  metric:     sites respecting GPC
  prevalence: 54/464 (12%) sites with a US Privacy String
  quote [results]: with only 54/464 (12%) of the sites with US Privacy String opting us out ... GPC non-compliance appears widespread

IMC 2024 diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc
  phenomenon: Pre-consent data processing
  metric:     share of audited services
  prevalence: All services collected data before consent and age disclosure; all but one shared identifiers and personal information with third-party ATS.
  quote [results]: All of the services engaged in data collection and/or sharing prior to consent and age disclosure.

PETS 2024 block-cookies-not-websites-analysing-mental-models-and-usability-of-the-privacy
  phenomenon: CookieBlock mental-model accuracy
  metric:     accuracy category counts
  prevalence: Before: 15 inaccurate, 11 partially accurate, 14 accurate; After: 14, 12, and 12
  quote [results]: The results are shown in Table 1 and illustrated in the following:

PETS 2024 crumbling-cookie-categories-deconstructing-common-cookie-categories-to-create-ca
  phenomenon: Consent-interface comprehension
  metric:     recall and focused comprehension accuracy
  prevalence: Focused comprehension for performance cookies was 79.0% with old terms versus 95.2% with new terms.
  quote [results]: Performance cookies 79.0% 95.2%*

PETS 2024 crumbling-cookie-categories-deconstructing-common-cookie-categories-to-create-ca
  phenomenon: Consent behavior
  metric:     consent-decision proportion
  prevalence: 63.1% accepted only necessary cookies; 33.8% accepted all cookies.
  quote [results]: The most common consent decision was to accept only necessary cookies with 63.1% of participants selecting this option. 33.8% of participants accepted all cookies

PETS 2024 generalizable-active-privacy-choice-designing-a-graphical-user-interface-for-glo
  phenomenon: GPC interface usability
  metric:     agreement with usability statements
  prevalence: 87% disagreed or strongly disagreed that opting out took a lot of effort.
  quote [results]: Across schemes, 87% disagreed or strongly disagreed that it took them a lot of effort to opt out

PETS 2024 generalizable-active-privacy-choice-designing-a-graphical-user-interface-for-glo
  phenomenon: GPC comprehension
  metric:     correct-response rate
  prevalence: 83% correctly explained GPC in free-form responses.
  quote [results]: The correct responses to the multiple choice question were confirmed by an 83% rate of participants' correct free-form responses to the question

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: USP String cookie storage
  metric:     share of publishers
  prevalence: 358 of 10,000 publishers (3.6%) stored a USP String in a cookie
  quote [results]: In our data from Crawl 1 we detect the USP String value being stored in a cookie on 358 (3.6%) publishers out of 10 K

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: USP String HTTP propagation
  metric:     share of requests containing injected opt-out value
  prevalence: 354,416 of 421,497 requests (84.1%) contained 1YYN
  quote [results]: 421,497 HTTP requests contained a URL with a USP parameter, of which 354,416 (84.1%) contained our chosen USP String value of 1YYN.

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: USP String propagation in inclusion chains
  metric:     share of A&A chains rooted at USP-API publishers
  prevalence: 218,541 of 1,214,540 chains (17.9%) contained at least one USP String transmission
  quote [results]: There are 1,214,540 A&A inclusion chains rooted in the 821 publishers that implement the USP API, of which 218,541 (17.9%) contained at least one HTTP request transmitting the USP String.

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: USP String pairwise sharing
  metric:     share of A&A pairs sharing in every chain
  prevalence: 47.1% of A&A pairs shared the USP String in all observed chains
  quote [results]: only 47.1% of A&A pairs share the USP String in all chains in which they appear.

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: GPC-to-USP opt-out conversion
  metric:     share of USP-API publishers setting opt-out
  prevalence: 380 of 825 publishers (46.1%) set the USP String to opt-out
  quote [results]: In Crawl 3, when GPC was enabled, 380 out of 825 (46.1%) publishers with the USP API set the USP String to opt-out.

PETS 2024 johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework
  phenomenon: Tracking-pixel response to opt-out
  metric:     tracking pixels per publisher
  prevalence: No statistically significant reduction for most crawl comparisons
  quote [results]: GPC and a USP String set to opt-out do not significantly reduce the number of tracking pixels embedded in publishers

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: opt-out-of-sale links
  metric:     share of top-25,000 websites
  prevalence: 2,429 websites (9.9%) provided manual opt-out links in November 2022.
  quote [results]: 2,429 websites (9.9%) provided manual opt-out of sale links on their homepage

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: GPC signal honoring
  metric:     number of websites honoring GPC
  prevalence: 814 websites honored GPC in November 2023.
  quote [results]: Our final crawl, conducted in November 2023, 2,987 websites provided some form of opt-out mechanism and 814 honored GPC signals.

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: GPC-only opt-out mechanisms
  metric:     number of websites
  prevalence: 340 websites supported GPC as the only opt-out mechanism in November 2023.
  quote [results]: there were 340 websites for which GPC signals were the only supported mechanism for opting-out of sale.

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: loss of opt-out mechanisms
  metric:     share of previously compliant websites
  prevalence: Approximately 24% subsequently provided no opt-out mechanism.
  quote [results]: Most of the websites that provided opt-out of sale links in November 2022 and subsequently removed them provided no opt-out of sale mechanism after CPRA went into effect.

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: GPC-related privacy-policy language
  metric:     number of websites
  prevalence: 1,350 policies included GPC-related expressions by November 2023.
  quote [results]: By November 2023, 1,350 websites in our dataset privacy policies that included one or more GPC-related expressions.

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: gpc.json files
  metric:     number of websites
  prevalence: 56 websites had such files when CPRA enforcement began.
  quote [results]: at which point 56 websites had such files

PETS 2024 two-steps-forward-and-one-step-back-the-right-to-opt-out-of-sale-under-cpra
  phenomenon: GPC awareness
  metric:     share of participants understanding GPC
  prevalence: Only 5.9% of responses indicated an understanding of GPC.
  quote [results]: Only 5.9% of responses indicated an understanding of what GPC is.

IMC 2024 watching-tv-with-the-second-party-a-first-look-at-automatic-content-recognition
  phenomenon: ACR traffic after opt-out
  metric:     presence or absence of communication with ACR domains
  prevalence: Opting out produced a complete absence of communication with previously identified ACR domains.
  quote [results]: once opt-out is exercised (Table 1), there is a complete absence of communication with any previously identified ACR domains

USENIX 2024 automated-large-scale-analysis-of-cookie-notice-compliance
  phenomenon: Cookie notice detection
  metric:     precision and recall
  prevalence: 100.0% precision and 86.9% recall
  quote [appendix]: We achieve 100.0% precision and 86.9% recall.

USENIX 2024 automated-large-scale-analysis-of-cookie-notice-compliance
  phenomenon: Cookie consent violations
  metric:     share of crawled websites with violations
  prevalence: 72.2% of successfully crawled websites contained at least one privacy violation
  quote [results]: We found that 72.2% of these websites contained at least one privacy violation.

USENIX 2024 dissecting-privacy-perspectives-of-websites-around-the-world-aceptar-todo-alle-a
  phenomenon: cookie consent banner presence
  metric:     share of successfully loaded websites
  prevalence: 37% (1511) of the total dataset included a cookie consent notice
  quote [methodology]: 37% (1511) included a cookie consent notice as a banner as part of the website's privacy policy.

USENIX 2024 abandon-all-hope-ye-who-enter-here-a-dynamic-longitudinal-investigation-of-andro
  phenomenon: Consent-choice violations
  metric:     share of apps with discrepancies among consent-dialog apps
  prevalence: 78.61% across the three reject scenarios
  quote [results]: Overall, for the three "Reject" scenarios (scenario-iii, scenario-iv, scenario-v), we found that 78.61% (σ = 0.54) of the apps that present a consent dialogue have discrepancies

PETS 2024 opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
  phenomenon: Advertiser data usage after opt-out
  metric:     advertiser bid CPM distributions
  prevalence: Most personas received higher bids than control after opting out under GDPR and CCPA.
  quote [discussion]: Overall we note that under CMPs most personas receive higher bids compared to control when users opt-out of data processing and selling under GDPR and CCPA.

PETS 2024 opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
  phenomenon: Pre-opt-out tracking
  metric:     bids and cookie syncing events
  prevalence: Advertisers continued using data and syncing cookies after pre-opt-out.
  quote [appendix]: we conduct additional experiments where we opt-out prior to simulating personas.

PETS 2024 opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
  phenomenon: CMP and prebid deployment
  metric:     number of websites
  prevalence: 352 websites supported selected CMPs and client-side header bidding.
  quote [methodology]: scanning top-100K websites allows us to filter a meaningful number (i.e., 352) of websites that deploy CMPs and prebid.js under both GDPR and CCPA.

USENIX 2024 the-effect-of-design-patterns-on-present-and-future-cookie-consent-decisions
  phenomenon: User satisfaction with consent choices
  metric:     satisfaction percentage
  prevalence: 78% of those declining were satisfied, compared with 48% of those accepting.
  quote [results]: Our analyses reveal that people who declined tended to be more satisfied by their choice: 78% of those who declined were satisfied, while only 48% of those who had accepted were satisfied.

WWW 2024 a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework
  phenomenon: TCF consent-recording noncompliance
  metric:     percentage of domains and crawls with violations
  prevalence: TCF violations occurred in 2.2% of domains and 1.3% of crawls.
  quote [results]: In total there are 117 crawls to 48 distinct domains where TCF policies are violated, which is 1.3% of all crawls and 2.2% of all domains, respectively.

WWW 2024 a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework
  phenomenon: Tracking cookies after consent rejection
  metric:     average tracking cookies and percentage of domains setting them
  prevalence: Compliant, non-empty-TC domains averaged 1.28 tracking cookies; all domains averaged 1.11.
  quote [results]: The average number of tracking cookies set when no violation occurs is the average number of cookies set in domains belonging to the first two rows of Table 3 (1.09 tracking cookies).

PETS 2025 johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
  phenomenon: difficult consent revocation
  metric:     share of reachable websites
  prevalence: 19.87% (32/158) offered revocation via a substantially different interface
  quote [results]: Overall, 32 (19.87%) websites out of 158 offered the option to revoke consent via an interface that is substantially different

PETS 2025 johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
  phenomenon: consent-storage inconsistency
  metric:     websites with mismatches
  prevalence: 5 TCF cookie/API, 3 TCF localStorage/API, and 4 OneTrust mismatches
  quote [results]: Five websites implementing the TCF returned different TCStrings from __tcfapi and the TCString stored in the cookie after revocation.

PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
  phenomenon: GPC effect
  metric:     average reduction in intractable cookies
  prevalence: approximately 30%, with an additional 32% after subsequent rejection
  quote [results]: enabling GPC reduces intractable cookies by approximately 30% on average ... further rejection of the banner can lead to an additional 32% reduction

USENIX 2025 evaluating-privacy-policies-under-modern-privacy-laws-at-scale-an-llm-based-auto
  phenomenon: frictionless opt-out signals
  metric:     share of domains mentioning GPC
  prevalence: 506 of 639 E8 domains (79%) mentioned Global Privacy Control
  quote [results]: The vast majority of these domains (506, or 79%) mentioned Global Privacy Control, or GPC [3], as a frictionless opt-out signal.

USENIX 2025 websites-global-privacy-control-compliance-at-scale-and-over-time
  phenomenon: GPC compliance
  metric:     share of sites opting out through all implemented privacy strings
  prevalence: 44% (1,411/3,226) in December 2023; 43% (1,473/3,402) in February 2024; 45% (1,620/3,566) in April 2024
  quote [abstract]: In December 2023, 44% (1,411/3,226) of such sites opted users out via all implemented privacy strings.

USENIX 2025 navigating-cookie-consent-violations-across-the-globe
  phenomenon: cookie consent violations
  metric:     share of websites with at least one violation
  prevalence: 96.18% in the EU to 97.72% in the US
  quote [introduction]: ConsentChk detected that 96.18% (EU) - 97.72% (US) of websites across all regions contain at least one cookie consent violation.

USENIX 2025 navigating-cookie-consent-violations-across-the-globe
  phenomenon: consent enforcement
  metric:     share of websites correctly enforcing consent
  prevalence: 3.82% of websites
  quote [results]: Specifically, only 3.82% of websites correctly enforced the consent preferences of users.

CCS 2025 whispertest-a-voice-control-based-library-for-ios-ui-automation
  phenomenon: tracker domains by consent mode
  metric:     total distinct tracker domains
  prevalence: 512–943 accept; 409–805 reject
  quote [results]: Total distinct tracker domains 512 - 943 409 - 805

CCS 2025 layered-overlapping-and-inconsistent-a-large-scale-analysis-of-the-multiple-priv
  phenomenon: CCPA opt-out implementation
  metric:     share of disclosing banks lacking required opt-outs
  prevalence: 22 of 45 banks (48.9%) acknowledging CCPA sale/sharing failed to implement required opt-outs
  quote [results]: Of the 45 banks that did acknowledge to sell/share data under CCPA, 22 (48.9%) failed to implement required opt-outs.

CCS 2025 layered-overlapping-and-inconsistent-a-large-scale-analysis-of-the-multiple-priv
  phenomenon: GPC compliance
  metric:     number of websites respecting GPC
  prevalence: 64 websites respected GPC signals
  quote [methodology]: In total, 64 were found to respect GPC signals.

PETS 2026 exercising-the-ccpa-opt-out-right-on-android-legally-mandated-but-practically-ch
  phenomenon: app-level CCPA opt-out settings
  metric:     share of apps
  prevalence: 48 of 100 apps implemented a legally mandated CCPA opt-out setting
  quote [results]: Only 48 of the 100 apps we evaluated implement the legally mandated CCPA opt-out setting

PETS 2026 exercising-the-ccpa-opt-out-right-on-android-legally-mandated-but-practically-ch
  phenomenon: GPC opt-out compliance
  metric:     privacy-flag opt-out rate
  prevalence: 338 apps remained opted_in for Vungle while 26 were opted_out under No AdID + GPC
  quote [results]: when sending GPC signals and disabling apps' access to the AdID, 338 apps still had the ccpa status of the ad network Vungle set to opted_in while only 26 had set it to opted_out.

PETS 2026 the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
  phenomenon: TCF implementation prevalence
  metric:     share of downloaded apps
  prevalence: 576 of 4482 apps (12.85%)
  quote [results]: 576 apps were identified as implementing the TCF ... representing 12.85% of the downloaded apps.

PETS 2026 the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
  phenomenon: Incorrect consent-choice storage
  metric:     share of TCF-based apps
  prevalence: 15 apps stored choices only after consent to all processing
  quote [results]: 15 apps only stored our choices if provided with consent to all data processing

PETS 2026 the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
  phenomenon: AAID transmission without consent
  metric:     share of analyzed apps
  prevalence: 66.2% transmitted AAID in the passive-stage Ø-approach; 55.3% transmitted it during active interaction
  quote [results]: In the passive-stage of traffic analysis, 66.2% of analyzed apps share personal data when using the Ø-approach.

PETS 2026 the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of
  phenomenon: AAID transmission before consent
  metric:     share of active-stage apps
  prevalence: 284 of 513 apps (55.3%) transmitted AAID before consent
  quote [results]: During this stage, we found 284 apps that transmitted AAID before or during banner interaction, prior to obtaining consent.

USENIX 2026 bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
  phenomenon: consent-bypass localhost tracking
  metric:     share of sites triggering communications without consent
  prevalence: Meta: 75.8% EU and 78.2% USA; Yandex: 84.4% EU and 83.5% USA
  quote [results]: localhost communications were triggered without user consent by Meta Pixel. Yandex Metrica triggered localhost communications on 84.4% (EU), 83.5% (USA) of websites without user consent.

Two ordered rule lists, first match wins:

• CONSENT_TOOLS — what a researcher drives a banner with, or decodes a signal with. Merges Consent-O-Matic/Consent-O-matic and autoconsent/DuckDuckGo autoconsent; maps a family of GPC … extension/GPC … crawler/GPC … compliance strings to one entry; maps IAB consent-string decoding script and IAB TC String Decoder to TC-string decoder.
• CMPS — the vendor being measured. Merges OneTrust, OneTrust CMP and CookiePro (OneTrust acquired CookiePro); Cookie-Script and Cookie Script; Quantcast and Quantcast Choice.

A separate CANDIDATE regex decides what the fold was ever meant to see, so a name that never matched it is not reported as residue. Residue of the fold, printed in full by the script: 5 distinct names over 5 papers, and all five are IAB artefacts that are not banner-interaction tools:

The last two are the honest judgement call: they could be folded into a third family. They were left as residue because the table they would join is headed tools you can install and run.

Reused unchanged from legal_enforcement, including its ordering (specific families before general) and its two hard-coded exceptions. Over the 53 S2 papers with a legal tuple it leaves 2 strings in the catch-all family: Digital Economy Act 2017 and Act against Unfair Competition (UWG). Both are correctly placed — neither is a data-protection instrument — and both are single papers.

The fold matters here. Unfolded, the raw strings split the CCPA across CCPA (16 papers) and California Consumer Privacy Act (CCPA) (4), and ePrivacy across ePrivacy Directive (15), ePrivacy directive (2) and ePrivacy Directive (2002/58/EC) (1). Publishing the raw counts would have understated US state privacy law by a fifth and ePrivacy by a sixth.

Reused unchanged from crawling_location, including its EEA_COUNTRIES set and isEeaVantage(). Note that the UK is deliberately not in that set (post-Brexit), which makes the page's EU/EEA figures slightly conservative — a UK-only vantage counts as non-EEA.

Residue over the 349 papers of S1: 5 strings, all of which name no resolvable place — not-stated, all operating systems and geographic regions, vantage country, different continents, various geographic regions. Of these only not-stated is common, and the script counts it in its own row rather than folding it away.

Every literal figure the content page attributes to a corpus paper was searched for in that paper's own full text, in both renderings — paper.cols.txt (column reading order repaired; the one the extraction read) and paper.norm.txt. They fail on different sentences, so a figure found in either counts as verified and the report says which. Whitespace, thin and non-breaking spaces, curly quotes and unicode dashes are normalised first, because a PDF text layer produces all of them for what the author typed as a plain space or hyphen.

Result: 61 literals, 60 found in both renderings, 1 in cols only, 0 not found. The cols-only case is 62 (4.3%) in Matte et al.

The check is a superset of what the page publishes, not a mirror of it. Ten of the 61 literals were checked and then not used on the page — Bouhoula's 2353 and 95.1%, Rasaii's 6.91, Utz's 39.2, Khandelwal's 986, Rasaii's 98.2%, Bollinger's 87.2% and Koch's 22.3%, 82.5% and 4.0%. They are figures the page considered and cut, kept in the check because a checked-and-cut figure is cheap to keep and expensive to re-derive if a later edit wants it back. The direction that matters is the other one: no literal on the page is absent from the check. A reviewer flagged the “checked against the page” framing as overstated on 2026-08-19; it is corrected here rather than quietly narrowed.

both        2024 USENIX  "100.0% precision and 86.9% recall"
both        2024 USENIX  "72.2%"
both        2024 USENIX  "2353"
both        2024 USENIX  "95.1%"
both        2020 IEEE-SP  "6.2%"
both        2020 IEEE-SP  "28 257"
both        2020 IEEE-SP  "141 out of 1 426 (10%)"
both        2020 IEEE-SP  "9.9% (141/1426)"
both        2020 IEEE-SP  "6.8% (38/560)"
both        2020 IEEE-SP  "46.5% (236/508)"
both        2020 IEEE-SP  "5.3% (27/508)"
both        2020 IEEE-SP  "54.29%"
cols only   2020 IEEE-SP  "62 (4.3%)"
both        2023 USENIX  "52.7%"
both        2023 USENIX  "21.5%"
both        2023 USENIX  "35.4%"
both        2023 USENIX  "986"
both        2024 PETS  "12 (65%)"
both        2024 PETS  "SD: 21%"
both        2023 IMC  "280"
both        2023 IMC  "0.6%"
both        2023 IMC  "98.2%"
both        2025 PETS  "30%"
both        2025 PETS  "32%"
both        2025 PETS  "6.91"
both        2025 USENIX  "96.18%"
both        2025 USENIX  "97.72%"
both        2025 USENIX  "3.82%"
both        2024 USENIX  "37%"
both        2024 USENIX  "1511"
both        2019 NDSS  "62.1"
both        2019 NDSS  "46.1"
both        2022 USENIX  "69.7%"
both        2022 USENIX  "87.2%"
both        2019 CCS  "57.4"
both        2019 CCS  "39.2"
both        2021 PETS  "__tcfapi"
both        2021 PETS  "__cmp"
both        2023 PETS  "54/464"
both        2023 PETS  "12%"
both        2025 USENIX  "1,411/3,226"
both        2025 USENIX  "44%"
both        2024 PETS  "2,429"
both        2024 PETS  "9.9%"
both        2024 PETS  "814"
both        2024 PETS  "46.1%"
both        2024 PETS  "825"
both        2022 PETS  "six out of ten"
both        2026 PETS  "12.85%"
both        2026 PETS  "55.3%"
both        2026 PETS  "576"
both        2024 WWW  "2.2%"
both        2024 WWW  "1.3%"
both        2025 PETS  "19.87%"
both        2025 PETS  "158"
both        2022 CCS  "13,082"
both        2022 CCS  "93.26%"
both        2023 USENIX  "22.3%"
both        2023 USENIX  "82.5%"
both        2023 USENIX  "4.0%"
both        2019 IMC  "4.41"

both: 60   cols only: 1   norm only: 0   NOT FOUND: 0

Three literals failed on the first run, and all three were errors in this page's draft, not in the extraction:

The Matte case is the one worth keeping: a percentage that looks like it came from a paper, computed by the writer from a count and a denominator taken from two different tables. Reading the source turned up four more figures the draft did not have — 46.5% pre-selected, 5.3% non-respect of choice, 54.29% any violation, and the 4.3% shared-cookie consent reuse. The first three went into the results table immediately; the fourth was accidentally dropped between drafts and was restored, as a box in the TCF section, only after a reviewer noticed on 2026-08-19 that this very paragraph claimed it was on the page when it was not.

The page's central figure is “how many papers interacted with a consent notice”. The extraction says 36. Reading all 36 against their own text says 29. That is a 19.4% false-positive rate on the interacting values of crawlConfig.consentAction, and it is the single most important thing on this provenance page.

Why the site's usual check is blind here. The dataset's guidance is to read a handful of evidence.quote values behind any figure before publishing it. That check cannot work for this field. crawlConfig is an object, not an array, and it carries one evidence quote for the whole object — statefulness, browsers, headless, consent action, interaction depth, authentication, languages and repeat visits all share it. So the quote behind a consentAction value usually evidences something else entirely. Read literally, the quotes for the 36 papers include “we create a separate docker container for each URL we visit”, “each crawl within a run is performed once without repetition” and “we visit each website afresh with storage cleared” — none of which says anything about a banner. One of them, for Trevisan et al., says the opposite of its label: “No user action is performed on the page” sits under a accept-and-reject value.

Doing the check properly meant a different method: extract every sentence in each paper containing a consent/banner term and a first-person marker, read them, and record a verdict. consent_action_audit.mjs –sentences reproduces the sentences; the verdicts are hard-coded in that file with a one-line reason each, and the script fails loudly if a paper claims an interaction and has no verdict, or if a verdict refers to a paper that no longer claims one. That guard caught three truncated slugs in the first version of the verdict table.

The seven false positives, and what the extraction mistook:

The one overstatement. Trevisan et al., 4 Years of EU Cookie Law (PoPETs 2019), is labelled accept-and-reject. Its main crawl states “No user action is performed on the page… We do not scroll the page, nor click on any link”, but the paper also reports a separate experiment “when consent to the usage of cookies is given”. An accept arm exists; a reject arm is not described. It is counted as verified, with the caveat recorded here.

The pattern is not random, and it is useful. All three dismiss-or-remove values are wrong and four of fifteen accept-all values are wrong, while accept-and-reject is 14 for 14, reject-all 2 for 2 and cmp-specific-choices 2 for 2. The reading: the field is reliable exactly where a paper had to describe two arms explicitly, and unreliable where a single ambiguous word — consent, banner, dismiss — appears somewhere in a paper about something else. Anyone reusing this field should treat accept-all and dismiss-or-remove as needing verification and the two-armed values as sound.

no-interaction was not audited. 313 papers is beyond a hand pass in one sitting. If its error rate resembles the interacting values', the true interaction count is somewhere either side of 29 in both directions. This is stated on the content page and is the first item in §11.

claimed an interaction: 36
adjudicated:            36

── Verdicts ──
Verdict                                     Papers  Share of the 36
------------------------------------------  ------  ---------------
supported by the paper text                 28      77.8%
supported but the enum value overstates it  1       2.8%
NOT supported — extraction false positive   7       19.4%

FALSE-POSITIVE RATE of crawlConfig.consentAction on the interacting values: 7/36 = 19.4%

── Figures recomputed on the AUDITED set ──
papers that ran a crawl:                       1120
state a consent action (incl. no-interaction): 349 (31.2%)
  ... of which no-interaction:                 313
  ... claim an interaction (extraction):       36 (3.2% of crawled)
  ... interaction VERIFIED in the paper:       29 (2.6% of crawled, 8.3% of those stating)

── Audited interaction by enum value ──
Value                 Claimed  Verified  False positives
--------------------  -------  --------  ---------------
accept-all            15       11        4
accept-and-reject     14       14        0
cmp-specific-choices  2        2         0
dismiss-or-remove     3        0         3
reject-all            2        2         0

── Audited interaction by year bucket ──
Bucket      Crawling papers  Claimed  Verified  Share of bucket
----------  ---------------  -------  --------  ---------------
2010–2013   102              0        0         0.0%
2014–2017   167              0        0         0.0%
2018–2021   308              6        3         1.0%
2022–2024   345              17       14        4.1%
2025–2026*  198              13       12        6.1%

── Vantage point of the VERIFIED interacting papers ──
Vantage                             Papers  Share of 29
----------------------------------  ------  -----------
EU/EEA vantage                      21      72.4%
vantage tuple, location not-stated  5       17.2%
stated a non-EU/EEA vantage only    3       10.3%

── Every verdict, in full ──
[WRONG  ] CCS/2018/pride-and-prejudice-in-progressive-web-apps-abusing-native-app-like-features-in
           claimed: accept-all
           the only consent in the paper is the PUSH NOTIFICATION permission prompt
[WRONG  ] WWW/2018/hiding-in-the-crowd-an-analysis-of-the-effectiveness-of-browser-fingerprinting-a
           claimed: accept-all
           no sentence in the paper mentions a consent notice or banner at all
[PARTIAL] PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
           claimed: accept-and-reject
           main crawl states "No user action is performed on the page"; a separate experiment gives consent, so an ACCEPT arm exists but no reject arm is described
[WRONG  ] IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising
           claimed: accept-all
           "banner" in this paper means BANNER ADS; no consent interaction described
[OK     ] IEEE-SP/2020/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i
           claimed: accept-and-reject
           semi-automatic crawl clicking through banners on 560 sites
[OK     ] WWW/2021/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
           claimed: accept-and-reject
           "we leverage the Consent-O-matic tool"; three crawls, one per consent action
[OK     ] PETS/2022/how-can-and-would-people-protect-from-online-tracking
           claimed: accept-and-reject
           "On the second visit, we accept the cookies... on the next visit, we try to opt-out"
[OK     ] USENIX/2022/automating-cookie-consent-and-gdpr-violation-detection
           claimed: accept-and-reject
           crawler consents to all purposes and separately denies consent
[OK     ] USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission
           claimed: accept-and-reject
           "three consent modes... accept all, reject all, and no action"
[OK     ] IMC/2023/the-prevalence-of-single-sign-on-on-the-web-towards-the-next-generation-of-web-c
           claimed: accept-all
           "We use a plugin to auto-accept cookie banners"
[WRONG  ] IMC/2023/understanding-the-privacy-risks-of-popular-search-engine-advertising-systems
           claimed: accept-all
           no first-person sentence mentions consent or a banner
[WRONG  ] PETS/2023/a-utility-preserving-obfuscation-approach-for-youtube-recommendations
           claimed: dismiss-or-remove
           the only "consent" is IRB participant consent for the user dataset
[OK     ] IEEE-SP/2023/the-leaky-web-automated-discovery-of-cross-site-information-leaks-in-browsers-an
           claimed: accept-all
           "the cookie banners accepted by our module"
[WRONG  ] IMC/2024/analyzing-the-in-accessibility-of-online-advertisements
           claimed: dismiss-or-remove
           the only "consent" is IRB informed consent; "banner" means banner ads
[OK     ] USENIX/2024/automated-large-scale-analysis-of-cookie-notice-compliance
           claimed: accept-and-reject
           five crawling steps: accepting, rejecting, closing, saving defaults, not interacting
[OK     ] NDSS/2024/fp-fed-privacy-preserving-federated-detection-of-browser-fingerprinting
           claimed: accept-all
           "...solving CAPTCHAs, and consenting to all cookie notices" (a manual sub-crawl)
[OK     ] USENIX/2024/dissecting-privacy-perspectives-of-websites-around-the-world-aceptar-todo-alle-a
           claimed: cmp-specific-choices
           measures "depth to reach the reject option", i.e. navigates the notice's own layers
[OK     ] PETS/2024/a-large-scale-study-of-cookie-banner-interaction-tools-and-their-impact-on-users
           claimed: accept-and-reject
           the paper IS a comparison of banner-interaction extensions
[OK     ] PETS/2024/fp-tracer-fine-grained-browser-fingerprinting-detection-via-taint-tracking-and-e
           claimed: accept-and-reject
           "we measure whether fingerprinters respect user consent banners using the Consent-O-Matic plugin"
[OK     ] PETS/2024/opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
           claimed: accept-and-reject
           audits four CMPs with consent conveyed and not conveyed
[OK     ] WWW/2024/a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework
           claimed: reject-all
           "accepted the automatic decline of user consent by our data collection system"
[OK     ] WWW/2024/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting
           claimed: accept-all
           "To automatically interact with cookie consent banners, we integrated code derived from Priv-Accept"
[OK     ] IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites
           claimed: accept-all
           "provide affirmative consent to all data processing request options (accept all)" via autoconsent
[OK     ] CCS/2025/piixel-leaks-passive-identification-of-personally-identifiable-information-leaka
           claimed: accept-all
           "we simulate a real user's choice of 'Accept All' using the Consent-O-Matic extension"
[OK     ] IMC/2025/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th
           claimed: accept-all
           "uses the autoconsent library to opt-in to common consent banners"
[OK     ] PETS/2025/johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
           claimed: accept-and-reject
           the paper accepts and then revokes consent on 200 sites
[OK     ] PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
           claimed: accept-and-reject
           "using BannerClick... accepting cookie banners in the first half and... rejected domains in the second"
[OK     ] PETS/2025/referrer-policy-implementation-and-circumvention
           claimed: accept-and-reject
           "we employed DuckDuckGo's autoconsent library... comparison of RP implementations in different consent modes"
[OK     ] WWW/2025/before-after-the-effect-of-eus-2022-code-of-practice-on-disinformation
           claimed: accept-all
           "we make use of Consent-O-Matic ... to automatically accept all cookies in consent banners"
[OK     ] USENIX/2025/navigating-cookie-consent-violations-across-the-globe
           claimed: reject-all
           ConsentChk drives the banner across eight regions
[OK     ] WWW/2025/semantics-aware-cookie-purpose-compliance
           claimed: accept-all
           "We use two browser extensions, namely Consent-O-Matic and Cookie-Editor"
[OK     ] WWW/2025/the-first-early-evidence-of-the-use-of-browser-fingerprinting-for-online-trackin
           claimed: cmp-specific-choices
           "executing window.OneTrust.RejectAll to opt out"; per-CMP reject clicking
[WRONG  ] PETS/2026/the-masks-we-think-we-wear-privacy-threats-of-browser-extension-wallets-in-the-w
           claimed: dismiss-or-remove
           "explicit consent" is a RECOMMENDATION about wallet permissions, not a crawl action
[OK     ] PETS/2026/clicking-into-exposure-uncovering-privacy-risks-of-google-click-identifier-in-yo
           claimed: accept-and-reject
           "(i) a baseline run that accepts cookie banners... (ii) a rejection run that declines them"
[OK     ] PETS/2026/privacy-vs-profit-the-impact-of-googles-manifest-version-3-mv3-update-on-ad-bloc
           claimed: accept-all
           "Accept consent notice via Super Agent-Automatic Cookie Consent extension"
[OK     ] USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost
           claimed: accept-all
           "We modify the crawler to automatically accept cookies using Priv-Accept"

13 entries appended to bibliography before the closing </bibtex>. Authors, titles and DOIs come from scripts/bibgen.mjs, which reads the publisher metadata in data/corpus2/.meta rather than anything a model recalled. Four needed hand-work, recorded here because the failure mode is silent:

libert2018_automated and liu2024_opted were generated and then dropped from the additions because both already existed in the live bibliography. The assembled file was checked for duplicate keys before saving: 390 entries, 0 duplicates.

Everything on the content page that is not from the corpus was fetched on 2026-08-19 from a primary source — the project's own repository, the vendor's own page, the standards body's own document, or the regulator's own press release. Where the site is behind Cloudflare (w3.org, iabeurope.eu, dataprotectionauthority.be, edpb.europa.eu) the fetch used Playwright's own Chromium build rather than curl, which gets an interstitial.

• This page rather than broadening requests. privacy:requests already covers notice detection and button labelling well, and explicitly delegates the rest here. The alternative — move the whole consent topic onto privacy:requests — was rejected because that page's subject is classifying requests, and consent is a crawl-design decision that affects cookies, requests, fingerprinting and legal analysis alike. The cost of the split is that a reader looking for “how do I find the banner” lands on the wrong page first; the page mitigates it with a pointer in the second paragraph.
• Mobile apps were kept in S2. 15 of 72 S2 papers measure apps rather than the web, and the page is titled Granting Consent to Websites. They were kept because the measurement problem is the same one and the field treats them together, and the page states the split rather than hiding it. Dropping them would take S2 to 57.
• The tool table dates every tool and says which are dead. This is the “currency” requirement taken literally: a corpus that runs to 2026 will still recommend Ninja Cookie and Priv-Accept if you only read what papers used, because papers used them. Every row carries a check date and a verdict.
• no-interaction is treated as a stated value, not a sentinel. A paper that says “we did not interact with cookie notices” has answered the question. Counting it as silence would have made the reporting rate 3.2% instead of 31.2% and would have been wrong. The content page keeps the two numbers visibly separate for exactly this reason.
• The measured-results table publishes 21 of the 109 available prevalence tuples. Selection was by: is the denominator recoverable, is the phenomenon a consent mechanism rather than a downstream effect, and does it add something the other rows do not. The full 109 are in §5.3 so the selection is auditable.
• No ~~DISCUSSION~~ on this provenance page. Following the convention set by the earlier provenance: pages: comments belong on the content page.
• The page publishes JavaScript that was not executed against a live site. tcf_probe.js is written from the TCF v2 API surface as documented and as used by the corpus papers; it was not run against a real CMP in this session. That is stated in §11 rather than implied away.

• tcf_probe.js was not executed. It is a straightforward use of the documented __tcfapi('getTCData', 2, cb) call and mirrors what Matte et al. and Hils et al. describe doing, but this run did not drive a browser at a TCF site to confirm the exact field names of the returned object across CMP implementations. Treat it as a template to test, not a tested snippet.
• The GVL and CMP-list URLs were not fetched by this run. They are reported from IAB documentation via the verification sub-agent. Check them before relying on them.
• Google Consent Mode v2's mandatory date could not be confirmed from a Google-controlled page, so it is not on the content page at all — even though it is arguably the single biggest change to what a European crawl observes since the GDPR.
• The 2025–2026 EU legislative picture (ePrivacy Regulation withdrawal, Digital Omnibus, UK Data (Use and Access) Act) is secondary-sourced. It is on the page in a footnote that says so.
• Field stability was not re-measured. The 93% agreement figure for consentAction comes from the 100-paper stability comparison run against the earlier 4,322-paper corpus. Nobody has re-run it since 2026-08-11.
• How many of the 495 not-stated papers actually had a banner to handle is unanswerable from the extraction. A crawl of Chinese or US-only sites in 2015 may have faced none. The page therefore reads not-stated as “the reader cannot tell”, not as “the authors were careless”.
• The 313 no-interaction papers were not audited, only the 36 claiming an interaction (§7.2). The false-positive rate on the audited side is 19.4%; nothing is known about the rate on the unaudited side, and if it is comparable the verified count of 29 could move in either direction. Auditing 313 papers is a day of work and would make the central figure of this page solid rather than indicative — it is the largest open item here.
• A paper that clicked a banner and never wrote it down is invisible by construction, since consentAction is extracted from the paper's own words. 29 is a floor on the true number as well as an audited count.
• CHI, SOUPS, EuroS&P, ACSAC, RAID, AsiaCCS and WPES are absent from the corpus, and that bites harder on consent than on most topics: a large fraction of consent-notice work is usable-privacy work published at CHI and SOUPS. Every S2 count is a lower bound and the content page says so twice.

Mistakes caught in review of this run, recorded rather than tidied away:

1. Three invented or mistyped literals in the first draft, caught by consent_quotecheck.mjs (§7.1). One of them, the Matte 10.4%, was a percentage this page computed and presented as the paper's.
2. An unanchored /iab/ and /gpc/ in the first population regex, which added five unrelated papers (§2.1).
3. A malformed multi-key citation: the four mobile-consent papers were written as four adjacent single-key groups rather than one comma-separated group inside a single brace-bracket pair. The plugin rendered it as nothing at all, silently dropping four citations. The check that caught it counts distinct keys in the source and compares against the rendered reference list.
4. Two BibTeX entries generated for papers already in the bibliography, caught by the duplicate-key check before saving.
5. The first published render showed 28 inline markers but only 15 reference entries — the known bibtex4dw cache staleness. Fixed by requesting ?purge=true on bibliography and then on consent; re-verified at 28 of 28.
6. An unclosed inline-nowiki marker (a lone pair of percent signs) in §2.1 of this page silently stopped DokuWiki parsing everything after it: sections 2.2 to 11 rendered as raw source, with no error and no warning. Caught by counting rendered h2/h3/table/pre elements against what the source should produce, which is now the standard check — verifying that the citations resolve passes happily on a page that is 80% raw markup.
7. The page's central figure was wrong in its first published revision. It said 36 papers interacted with a consent notice, which is what the extraction says. The audit in §7.2, run after publication, brought it to 29. The corrected figures went live the same day. The lesson recorded for the next run: an object-valued extraction field shares one evidence quote across every one of its keys, so the site's standard quote spot-check cannot validate any individual key. Audit the field directly or do not publish a count from it.

Four reviewers, all handed the frozen page text, the report script and its output, and these notes, and all told explicitly that the author's context might not be exhaustive. Three focused passes ran in parallel first; the findings below are recorded with the verdict, because a rejection is as much a record of whether a reviewer earned its slot as a fix is.

Re-ran report_consent.mjs and consent_quotecheck.mjs and diffed both against the committed output: clean, no differences.

Verified every [key] against a fresh fetch of the live bibliography, checked all 13 new entries against Crossref and landing pages, and traced every table row and prose figure to paper.cols.txt.

Everything in the tool table and every standards/legal claim independently re-fetched. All of them confirmed, including the GitHub dates and rule counts, the EasyList header and the three rule counts, the GPC spec status and all four quoted sections, the DNT notes and the Firefox 135 wording, TCF v2.3's three dates, CJEU C-604/22, both Belgian decisions, the USP deprecation and both EDPB documents. It also fetched the GVL URL this run had admitted not fetching — it serves valid JSON, vendorListVersion: 172, lastUpdated: 2026-08-13.

Worth recording, because it is the honest measure of a review layer. The largest error on the first published revision — the 36-versus-29 interaction count (§7.2) — was found by the author, not by any reviewer, while the three focused passes were still running. The figures reviewer re-ran the script and confirmed every number matched it, which was true and was exactly the wrong question: the script faithfully reported a field that was wrong 19.4% of the time. A “figures versus script” pass cannot catch a script that correctly reports bad data. The next run should add a pass that reads a sample of the underlying papers rather than the underlying script.

[1]

Khandelwal, Rishabh; Nayak, Asmit; Harkous, Hamza; Fawaz, Kassem (2023): "Automated Cookie Notice Analysis and Enforcement", in: 32nd USENIX Security Symposium (USENIX Security 23), pp. 1109-1126. USENIX Association, Anaheim, CA. (Link)

[2]

Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 1723-1739. USENIX Association, Philadelphia, PA. (Link)

[3]

Demir, Nurullah; Urban, Tobias; Pohlmann, Norbert; Wressnegger, Christian (2024): "A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy", in: Proceedings on Privacy Enhancing Technologies, pp. 5-20. (DOI)