Working notes behind cookie_syncing — every query with its population and denominator, the scripts and their unedited output, the hand labels and their residue, the quotes checked against the source papers, the external sources and how each was verified, what could not be established, and the judgement calls. Corpus-level caveats that apply to every page on this site are on corpus and are not restated here.

This page carries no ~~DISCUSSION~~: comments belong on the content page, which is the convention the earlier provenance pages on this site set.

Creating, not extending. sitemap.mjs and a live pages listing over the JSON-RPC API were run first; there is no page in any namespace about cookie or ID syncing. A sibling sweep of fourteen plausible neighbours, grepping each page's raw export for cookie[ -]*(sync|match), id[ -]*sync and uid smug, found the topic on exactly one:

Two live pages were edited to make the new one reachable, and the sweep above was run before those edits: start gained a line in the Privacy section of the outline, and privacy:requests gained a Related-Pages line. Nothing else on either page was touched. Anyone re-running the sibling sweep today will therefore see one match on privacy:requests that the table records as zero.

So this is a new page, not a broadening of a neighbour. The alternative considered and rejected was widening privacy:cookies from “Classifying Cookies” to “Cookies”: rejected because that page's whole apparatus (purpose taxonomies, label databases, CookieBlock) is orthogonal to identifier exchange, and because syncing's method literature overlaps privacy:requests far more than privacy:cookies. Recorded in §8.

The extraction schema has no field for cookie syncing. detection[].phenomenon is free text and names what a paper headlines, so a paper that measures syncing as one of ten mechanisms may carry no matching tuple. That forces a full-text population.

The 10-paper gap between FT-all (5,869) and X-all (5,859) is pre-existing: ten papers have readable text but no extraction record. Pass A uses 5,869 and passes B/C use the extraction, so no figure mixes the two.

Four wordings were counted separately rather than as one regex, because the choice of width decides the claim. Papers, not tuples; denominator FT-all = 5,869.

The regexes themselves, verbatim from report_cookie_syncing.mjs (a table cell cannot hold an unescaped |, so they are in a code block):

const PATTERNS = {
  'cookie sync / synchronisation': /cookie[\s-]*(?:sync|synchroni[sz])/i,
  'cookie matching':               /cookie[\s-]*match/i,
  'ID / UID syncing':              /\b(?:id|identifier|uid|user[\s-]?id)[\s-]*(?:sync|synchroni[sz])/i,
  'pixel / tag syncing':           /\b(?:pixel|tag|beacon)[\s-]*(?:sync|synchroni[sz])/i,
};

The exploratory probe (cookiesync_fulltext_probe.mjs, §4.3) is slightly wider — it drops beacon and adds a bare tag alternative — and it also counts three adjacent phenomena that are not on the content page: header bidding (24 papers), real-time bidding or RTB (64), and cookie ghosting/respawning (22). They are excluded because counting them as syncing would fill the population with papers that never look at an identifier crossing a domain boundary. The per-paper occurrence counts quoted in §2.2 come from that exploratory probe, so they can differ by one or two from the report script's; the published population counts all come from the report script.

Text normalisation before matching: end-of-line hyphenation joined (-\n is replaced by nothing), then all whitespace collapsed to single spaces. Without this, cookie syn- + newline + chronization, and any phrase broken across a line, go undetected. This is not hypothetical — it is why a plain grep -rl over the corpus returns fewer papers than the script does.

The ≥5-occurrence threshold exists so that 106 papers did not all have to be read; it is not a definition of “measures syncing”, and it fails badly at the low end. Four papers below the threshold were added to CAND by hand:

There is no way to know how many others the threshold missed. This is stated on the content page as a limitation, and the honest reading of “106 papers mention it” is “at least 106”.

These are in CAND, matched the regex or produced a matching tuple, and were excluded by hand. Naming them is the point: without the list, the exclusion is unfalsifiable.

Five of the nine have zero full-text occurrences of any syncing wording and are in CAND purely because a detection or classification tuple used the words “identifier sharing”. Those are strong exclusions. The other four rest on reading the passage.

The report prints these too, because otherwise the label counts do not add up to the number of rows in the map and nobody would know why. Three exist:

Each of the 30 MEAS papers carries a hand label naming the technique that does the identifier-sharing work — not the paper's overall contribution. The labels are in scripts/report_cookie_syncing.mjs as a literal map, one line per paper, so a disagreement can be pointed at a line.

The coarseness is real. PURL builds a graph and does syntactic value matching; Khaleesi does chain analysis and trains a random forest. Each paper was assigned the family that does the identifier work. The content page says to read the table as a ranking, not a partition.

cd /workspace/publications_dataset          # read-only mount of pdf_fetcher
node /workspace/artifacts/wiki/scripts/report_cookie_syncing.mjs
node /workspace/artifacts/wiki/scripts/cookie_syncing_quotecheck.mjs
node /workspace/artifacts/wiki/scripts/cookiesync_fulltext_probe.mjs   # the wider exploratory sweep
node /workspace/artifacts/wiki/scripts/cookie_syncing_number_guard.mjs pages/draft/privacy_cookie_syncing.txt

scripts/lib.mjs locates the data root, so the scripts run from either working directory. The full-text pass reads ~5,869 files and takes about a minute; nothing is cached.

report_cookie_syncing-output.txt

=== PASS A — corpus reach ===
papers with a readable paper.cols.txt: 5869   <-- denominator for pass A
papers mentioning any syncing wording at least once: 106 (1.8%)
papers mentioning it 5+ times:                       31 (0.5%)
 
=== PASS A — papers matching each wording (denominator: 5869) ===
    86   1.5%  cookie sync / synchronisation
    36   0.6%  cookie matching
    10   0.2%  ID / UID syncing
     2   0.0%  pixel / tag syncing
 
=== PASS A — by year (2025 thin at the edges, 2026 provisional: CCS/IMC 2026 not held) ===
  year  papers  >=1 mention  >=5 mentions
  2010     118            0             0
  2011     116            0             0
  2012     151            2             0
  2013     125            0             0
  2014     165            1             1
  2015     190            2             0
  2016     182            5             3
  2017     232            6             2
  2018     254            5             1
  2019     402            9             3
  2020     402            9             4
  2021     380           10             3
  2022     546           17             8
  2023     720           14             1
  2024     701           10             3
  2025     770           13             2
  2026     415            3             0
 
=== PASS A — by venue (denominator: that venue's papers with full text) ===
  PETS       510 papers   28 >=1 (5.5%)    9 >=5 (1.8%)
  USENIX    1410 papers   15 >=1 (1.1%)    6 >=5 (0.4%)
  WWW        843 papers   20 >=1 (2.4%)    6 >=5 (0.7%)
  CCS        989 papers    8 >=1 (0.8%)    4 >=5 (0.4%)
  IMC        637 papers   18 >=1 (2.8%)    4 >=5 (0.6%)
  IEEE-SP    779 papers    6 >=1 (0.8%)    2 >=5 (0.3%)
  NDSS       701 papers   11 >=1 (1.6%)    0 >=5 (0.0%)
 
=== PASS B — candidate set and hand labels ===
candidates (>=5 mentions OR a syncing tuple, plus 4 added by hand): 44
  labelled "measures identifier sharing": 30
  labelled "cites only":                  5
  labelled "phrase means something else": 9
  UNLABELLED RESIDUE:                     0
  labels written for papers NOT in the candidate set: 3
    -- NDSS/2026/cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews  (in corpus, below threshold and no matching tuple)
    -- USENIX/2019/a-billion-open-interfaces-for-eve-and-mallory-mitm-dos-and-tracking-attacks-on-i  (in corpus, below threshold and no matching tuple)
    -- IEEE-SP/2019/tracking-the-trackers-analyzing-the-global-tracking-landscape-with-ghostrack  (NOT IN CORPUS)
 
=== PASS B — the 30 papers that measure identifier sharing, by detection family ===
   15  50.0%  syntactic
    4  13.3%  chain
    3  10.0%  ad-seman
    3  10.0%  graph-ml
    3  10.0%  passive
    1   3.3%  secondary
    1   3.3%  taint
 
=== PASS B — the same set, by year and family ===
  2014 CCS      syntactic    48 mentions  the-web-never-forgets-persistent-tracking-mechanisms-in-the-wild
  2016 CCS      syntactic    17 mentions  online-tracking-a-1-million-site-measurement-and-analysis
  2016 USENIX   ad-seman     75 mentions  tracing-information-flows-between-ad-exchanges-using-retargeted-ads
  2017 IMC      passive       7 mentions  if-you-are-not-paying-for-it-you-are-the-product-how-much-do-advertisers-pay-to
  2017 PETS     syntactic    12 mentions  cross-device-tracking-measurement-and-disclosures
  2018 WWW      passive      18 mentions  the-cost-of-digital-advertisement-comparing-user-and-advertiser-views
  2019 IMC      syntactic    10 mentions  tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
  2019 WWW      passive      32 mentions  cookie-synchronization-everything-you-always-wanted-to-know-but-were-afraid-to-a
  2020 PETS     ad-seman     27 mentions  inferring-tracker-advertiser-relationships-in-the-online-advertising-ecosystem-u
  2020 PETS     syntactic    50 mentions  missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
  2020 WWW      syntactic    14 mentions  stop-tracking-me-bro-differential-tracking-of-user-demographics-on-hyper-partisa
  2021 IEEE-SP  secondary    11 mentions  fingerprinting-the-fingerprinters-learning-to-detect-browser-fingerprinting-beha
  2021 PETS     syntactic    34 mentions  a-calculus-of-tracking-theory-and-practice
  2021 WWW      syntactic     3 mentions  cookie-swap-party-abusing-first-party-cookies-for-web-tracking
  2021 WWW      syntactic    39 mentions  user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
  2022 CCS      ad-seman      6 mentions  cart-ology-intercepting-targeted-advertising-via-ad-network-identity-entanglemen
  2022 IEEE-SP  chain         5 mentions  journey-to-the-center-of-the-cookie-ecosystem-unraveling-actors-roles-and-relati
  2022 IMC      syntactic     9 mentions  measuring-uid-smuggling-in-the-wild
  2022 PETS     chain        21 mentions  atom-ad-network-tomography
  2022 USENIX   chain        39 mentions  khaleesi-breaker-of-advertising-and-tracking-request-chains
  2022 USENIX   graph-ml      5 mentions  webgraph-capturing-advertising-and-tracking-information-flows-for-robust-blockin
  2023 CCS      graph-ml      5 mentions  cookiegraph-understanding-and-detecting-first-party-tracking-cookies
  2023 IMC      chain         3 mentions  tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
  2024 PETS     syntactic   109 mentions  opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
  2024 USENIX   graph-ml      6 mentions  purl-safe-and-effective-sanitization-of-link-decoration
  2025 IMC      syntactic     3 mentions  cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
  2025 PETS     syntactic     6 mentions  intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
  2025 PETS     syntactic    34 mentions  tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we
  2026 PETS     syntactic     1 mentions  clicking-into-exposure-uncovering-privacy-risks-of-google-click-identifier-in-yo
  2026 PETS     taint         2 mentions  from-syntactic-matching-to-taint-tracking-and-back-a-comparative-study-of-web-tr
 
=== PASS B — first appearance of each detection family ===
  syntactic  first 2014, most recent 2026
  ad-seman   first 2016, most recent 2022
  passive    first 2017, most recent 2019
  secondary  first 2021, most recent 2021
  chain      first 2022, most recent 2023
  graph-ml   first 2022, most recent 2024
  taint      first 2026, most recent 2026
 
=== PASS C — extraction fields for the 30 measuring papers ===
  of which ran an automated crawl (crawlConfig fired): 25
 
  crawlConfig.statefulness  (denominator: 25 measuring papers that crawled)
     10  40.0%  stateful
      6  24.0%  both
      6  24.0%  not-stated   <-- sentinel
      3  12.0%  stateless
 
  crawlConfig.consentAction  (denominator: 25 measuring papers that crawled)
     12  48.0%  not-stated   <-- sentinel
      9  36.0%  no-interaction
      4  16.0%  accept-and-reject
 
  crawlConfig.interactionDepth  (denominator: 25 measuring papers that crawled)
     11  44.0%  landing-page-only
      7  28.0%  landing-plus-subpages
      4  16.0%  single-target-page
      2   8.0%  not-stated   <-- sentinel
      1   4.0%  deep-crawl
 
  crawlConfig.headless  (denominator: 25 measuring papers that crawled)
     20  80.0%  not-stated   <-- sentinel
      3  12.0%  headless
      2   8.0%  headful
 
  temporal.mode  (denominator: 30 measuring papers)
     25  83.3%  live-crawl
      4  13.3%  existing-dataset
      3  10.0%  passive-collection
      2   6.7%  active-probing
 
  artifacts.availability  (denominator: 30 measuring papers)
     13  43.3%  public
     10  33.3%  none-mentioned   <-- sentinel, not an answer
      5  16.7%  promised-not-yet-available
 
=== PASS C — vantage locations, folded (geo.mjs); residue printed ===
  measuring papers stating at least one vantage location: 19 of 30
     13  United States
      4  Europe
      3  Spain
      3  India
      2  Germany
      2  Brazil
      2  Australia
      1  Singapore
      1  Russia
      1  United Kingdom
      1  France
      1  Japan
  unmapped residue (2):
    !! IMC/2017/if-you-are-not-paying-for-it-you-are-the-product-how-much-do-advertisers-pay-to: same country
    !! WWW/2019/cookie-synchronization-everything-you-always-wanted-to-know-but-were-afraid-to-a: same country; country not-stated
 
=== PASS C — classification tuples targeting web-request, within the measuring set ===
  CCS/2016/online-tracking-a-1-million-site-measurement-and-analysis
     method=blocklist resource=EasyList groundTruth=null validation=none-reported
     method=blocklist resource=EasyPrivacy groundTruth=null validation=none-reported
     method=blocklist resource=Disconnect groundTruth=null validation=none-reported
  USENIX/2016/tracing-information-flows-between-ad-exchanges-using-retargeted-ads
     method=blocklist resource=EasyList groundTruth=EasyList filter rules validation=not-applicable
  IMC/2017/if-you-are-not-paying-for-it-you-are-the-product-how-much-do-advertisers-pay-to
     method=blocklist resource=Disconnect groundTruth=null validation=none-reported
  PETS/2017/cross-device-tracking-measurement-and-disclosures
     method=heuristic-rules resource=hostname string matching (custom) groundTruth=null validation=manual-validation
  WWW/2018/the-cost-of-digital-advertisement-comparing-user-and-advertiser-views
     method=blocklist resource=Disconnect blacklist groundTruth=null validation=none-reported
     method=heuristic-rules resource=custom RTB price pattern matching groundTruth=public keyword lists from past studies and RTB documentation validation=none-reported
  IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
     method=blocklist resource=EasyList and EasyPrivacy groundTruth=EasyList and EasyPrivacy rules validation=none-reported
  PETS/2020/inferring-tracker-advertiser-relationships-in-the-online-advertising-ecosystem-u
     method=blocklist resource=EasyList groundTruth=null validation=not-applicable
     method=blocklist resource=EasyPrivacy groundTruth=null validation=not-applicable
  PETS/2020/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
     method=heuristic-rules resource=BehaviorTrack groundTruth=invisible-pixels dataset and two simultaneous crawls validation=none-reported
     method=blocklist resource=EasyList and EasyPrivacy groundTruth=null validation=comparison-to-other-method
  PETS/2021/a-calculus-of-tracking-theory-and-practice
     method=blocklist resource=Ghostery groundTruth=null validation=none-reported
     method=blocklist resource=Disconnect groundTruth=null validation=none-reported
     method=blocklist resource=Adblock Plus groundTruth=null validation=none-reported
     method=blocklist resource=EasyList groundTruth=null validation=none-reported
     method=blocklist resource=EasyPrivacy groundTruth=null validation=none-reported
     method=blocklist resource=Privacy Badger groundTruth=null validation=none-reported
  WWW/2021/cookie-swap-party-abusing-first-party-cookies-for-web-tracking
     method=blocklist resource=EasyList/EasyPrivacy groundTruth=null validation=not-applicable
  WWW/2021/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
     method=heuristic-rules resource=custom ID-matching rules groundTruth=manual inspection of cookie values from over 2.5K websites validation=manual-validation
  CCS/2022/cart-ology-intercepting-targeted-advertising-via-ad-network-identity-entanglemen
     method=regex-or-signature resource=Criteo and Yahoo Analytics API URL matching groundTruth=null validation=none-reported
     method=regex-or-signature resource=Criteo and Yahoo Analytics API identification groundTruth=null validation=none-reported
  PETS/2022/atom-ad-network-tomography
     method=blocklist resource=EasyPrivacy groundTruth=EasyPrivacy tracker list validation=none-reported
     method=blocklist resource=EasyList groundTruth=EasyList filters validation=manual-validation
  USENIX/2022/khaleesi-breaker-of-advertising-and-tracking-request-chains
     method=blocklist resource=EasyList groundTruth=EasyList and EasyPrivacy filter-list matches validation=manual-validation
     method=blocklist resource=EasyPrivacy groundTruth=EasyList and EasyPrivacy filter-list matches validation=manual-validation
     method=supervised-ml resource=random forest (custom) groundTruth=EasyList and EasyPrivacy filter-list labels validation=cross-validation
  USENIX/2022/webgraph-capturing-advertising-and-tracking-information-flows-for-robust-blockin
     method=blocklist resource=filter lists used by AdGraph, including EasyList and EasyPrivacy groundTruth=filter-list membership; ATS if present in one or more filter lists validation=comparison-to-other-method
     method=supervised-ml resource=decision tree classifier (custom) groundTruth=filter-list labels validation=cross-validation
  CCS/2023/cookiegraph-understanding-and-detecting-first-party-tracking-cookies
     method=blocklist resource=EasyList and EasyPrivacy groundTruth=EasyList and EasyPrivacy URL rules validation=not-applicable
  IMC/2023/tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
     method=blocklist resource=filter lists groundTruth=null validation=manual-validation
  PETS/2024/opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
     method=heuristic-rules resource=custom prebid.js probe groundTruth=null validation=manual-validation
  USENIX/2024/purl-safe-and-effective-sanitization-of-link-decoration
     method=blocklist resource=EasyList and EasyPrivacy groundTruth=EasyList and EasyPrivacy request-matching rules validation=not-applicable
  PETS/2026/from-syntactic-matching-to-taint-tracking-and-back-a-comparative-study-of-web-tr
     method=heuristic-rules resource=syntactic matching algorithm (custom) groundTruth=null validation=manual-validation
     method=dynamic-analysis resource=Foxhound groundTruth=null validation=manual-validation
  measuring papers with a web-request classification tuple: 20 of 30
  ... of which report a non-sentinel validation: 9
      PETS/2017/cross-device-tracking-measurement-and-disclosures
      PETS/2020/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
      WWW/2021/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
      PETS/2022/atom-ad-network-tomography
      USENIX/2022/khaleesi-breaker-of-advertising-and-tracking-request-chains
      USENIX/2022/webgraph-capturing-advertising-and-tracking-information-flows-for-robust-blockin
      IMC/2023/tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
      PETS/2024/opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
      PETS/2026/from-syntactic-matching-to-taint-tracking-and-back-a-comparative-study-of-web-tr
  ... naming EasyList and/or EasyPrivacy: 12 of 20
  ... naming Disconnect:                  4 of 20
  ... with any blocklist-method tuple:    15 of 20
  resources named in web-request tuples (paper-counted, of 20):
        6  EasyList
        5  EasyPrivacy
        4  EasyList and EasyPrivacy
        3  Disconnect
        1  hostname string matching (custom)
        1  Disconnect blacklist
        1  custom RTB price pattern matching
        1  BehaviorTrack
        1  Ghostery
        1  Adblock Plus
        1  Privacy Badger
        1  EasyList/EasyPrivacy
        1  custom ID-matching rules
        1  Criteo and Yahoo Analytics API URL matching
        1  Criteo and Yahoo Analytics API identification
        1  random forest (custom)
        1  filter lists used by AdGraph, including EasyList and EasyPrivacy
        1  decision tree classifier (custom)
        1  filter lists
        1  custom prebid.js probe
        1  syntactic matching algorithm (custom)
        1  Foxhound
  (corpus-wide, 262 of the 4,439 papers that classified anything target web-request)
 
=== PASS C — measured results: detection[].prevalence on syncing-related tuples ===
  Quoted with the paper that made them. The denominator is NOT in this field:
  it has to be read out of the paper. See the page for the ones that carry one.
 
  -- CCS/2014/the-web-never-forgets-persistent-tracking-mechanisms-in-the-wild
     [cookie synchronization] IDs and parties involved in synchronization => Disabling third-party cookies reduced synced IDs and parties by nearly a factor of two
     [respawned-ID cookie syncing] share of browsing history linkable across clearing => At least 11% of a user's history could be tracked over time
 
  -- CCS/2016/online-tracking-a-1-million-site-measurement-and-analysis
     [cookie syncing] share of top third parties syncing => 45 of the top 50 and 85 of the top 100 third parties synced cookies with at least one other party.
 
  -- USENIX/2016/tracing-information-flows-between-ad-exchanges-using-retargeted-ads
     [Cookie matching] share of publisher-side chains => forward matching 69%, backward matching 55% before clustering
     [Heuristic cookie-matching detection failures] fraction of matching partners missed => 31% of cookie-matching partners were missed; 4.1% of chains were completely missed
 
  -- PETS/2017/cross-device-tracking-measurement-and-disclosures
     [Cookie syncing] domains and recipient domains => 106 domains transmitted cookie IDs to 210 different domains
 
  -- WWW/2018/the-cost-of-digital-advertisement-comparing-user-and-advertiser-views
     [Cookie Synchronization] share of users exposed and synchronizations per request => 97% of regular users were exposed at least once
 
  -- IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
     [cookie synchronization] share of pornographic websites => 2,867 websites, covering 58% of the top-100 popular sites
 
  -- WWW/2019/cookie-synchronization-everything-you-always-wanted-to-know-but-were-afraid-to-a
     [Cookie synchronization] share of regular users exposed => 97% of regular web users were exposed to CSync
     [Cookie synchronization] CSync requests => 263,635 synchronization events involving 22,329 unique synced userIDs
 
  -- PETS/2020/inferring-tracker-advertiser-relationships-in-the-online-advertising-ecosystem-u
     [tracker–advertiser relationships] classification accuracy => 75–83% accuracy; 15 relationships inferred, including 11 not detected by cookie syncing
     [client-side cookie syncing] validated inferred relationships => 4 of 15 inferred relationships detected by client-side cookie syncing
 
  -- PETS/2020/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
     [first-to-third-party cookie syncing] share of visited domains => 67.96% of visited domains
 
  -- WWW/2020/stop-tracking-me-bro-differential-tracking-of-user-demographics-on-hyper-partisa
     [cookie synchronization] cookie synchronizations per website => right-leaning websites facilitated up to 50% more synchronizations
 
  -- PETS/2021/a-calculus-of-tracking-theory-and-practice
     [tracking relations] number of derived predicates => Top 50 domains contacted 190 different websites with more than 6k connections.
     [cookie syncing] number of Cookie_sync predicates => 8 Cookie_sync predicates for the Top 50 domains.
 
  -- WWW/2021/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
     [third-party ID synchronization] average unique synchronizations per website => 3.51 synchronizations before consent and 3.91 after Reject All
 
  -- PETS/2022/atom-ad-network-tomography
     [validation of inferred sharing relationships] validated relationships => 9 of 11 inferred relationships were validated.
     [cookie syncing] advertisers engaging in cookie syncing => 7 advertisers engaged in cookie syncing; 4 synced with an Alphabet-owned tracker.
 
  -- USENIX/2022/khaleesi-breaker-of-advertising-and-tracking-request-chains
     [cookie syncing] share of request chains and domains => More than half of request chains in most configurations participated in cookie syncing.
 
  -- IMC/2023/tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
     [Cookie syncing] number of advertisers and third parties => 41 advertisers synced cookies with Amazon and 247 other third parties
 
  -- PETS/2024/opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
     [Client-side cookie syncing] cookie syncing events => Cookie syncing persisted after opt-out across CMPs and jurisdictions.
     [Pre-opt-out tracking] bids and cookie syncing events => Advertisers continued using data and syncing cookies after pre-opt-out.
 
  -- PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
     [cookie synchronization] share synchronized at least once => 76 of 2,545 unique intractable cookies, or 3%
 
  -- PETS/2025/tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we
     [Cookie synchronization and ID bridging] origin and destination SLDs => Cookie synchronization involved 1,190 SLDs, with 44% associated with ATSes
 
=== PASS C — artifact links released by the measuring papers ===
  CCS/2016/online-tracking-a-1-million-site-measurement-and-analysis
     https://github.com/citp/OpenWPM
  USENIX/2016/tracing-information-flows-between-ad-exchanges-using-retargeted-ads
     http://personalization.ccs.neu.edu/
  WWW/2020/stop-tracking-me-bro-differential-tracking-of-user-demographics-on-hyper-partisa
     http://tiny.cc/partisan-tracking
     http://tiny.cc/partisan-tracking
  IMC/2022/measuring-uid-smuggling-in-the-wild
     https://github.com/ucsdsysnet/crumbcruncher
  PETS/2022/atom-ad-network-tomography
     https://vitalstatistix.cs.uiowa.edu:2443/maaz/atom-archive
  USENIX/2022/khaleesi-breaker-of-advertising-and-tracking-request-chains
     https://uiowa-irl.github.io/Khaleesi/
     https://uiowa-irl.github.io/Khaleesi/
  CCS/2023/cookiegraph-understanding-and-detecting-first-party-tracking-cookies
     https://github.com/cookiegraph/CookieGraph
     https://github.com/cookiegraph/CookieGraph
  IMC/2023/tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
     https://privsec-research.github.io/alexaechos
     https://privsec-research.github.io/alexaechos
  USENIX/2024/purl-safe-and-effective-sanitization-of-link-decoration
     https://github.com/purl-sanitizer/purl
     https://raw.githubusercontent.com/purl-sanitizer/purl/main/data/breakage-analysis-sites.md
  IMC/2025/cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
     https://github.com/pooneh-nb/cookieGuard
  PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
     bannerclick.github.io
  PETS/2025/tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we
     https://github.com/WebViews-2025/Artifacts
     https://github.com/WebViews-2025/Artifacts
  PETS/2026/clicking-into-exposure-uncovering-privacy-risks-of-google-click-identifier-in-yo
     https://doi.org/10.17617/3.H5T0W4
  PETS/2026/from-syntactic-matching-to-taint-tracking-and-back-a-comparative-study-of-web-tr
     http://purl.org/tracking-detection-paper
     http://purl.org/tracking-detection-paper

Every figure and every quoted phrase the content page takes from a corpus paper is pinned by a literal here and checked against both renderings of that paper — paper.cols.txt (column order repaired; the one the extraction read) and paper.norm.txt. They fail on different sentences, so a literal found in either is verified and the report says which.

The coverage claim in the previous sentence was false when it was first written and is the review's best catch. The check then held 61 literals and the content page carried at least fourteen more paper-derived figures and quotes that were not among them — Vallina's 2,867 and 58%, the WebViews 44%, Rasaii's 76, Bashir's “90 personas”, Calzavara's 4%–7% and its “no consensus” sentence, Khaleesi's “more than half of the request chains”, Englehardt's “is essential” and “includes both events where it is a referer and where it is a receiver”, Acar's “by nearly a factor of two”. The reviewer verified all of them by hand and every one was correct, so nothing on the page changed — but a provenance page whose headline coverage claim is checkable and false is worse than one that claims less. They are all pinned now, which is why the count is 80 and not 61. 80 literals, 0 not found.

A dozen literals failed across successive runs as the check was extended, and every one of them was an error in the check or in my paraphrase, never in the paper. Three kinds:

• Paraphrase presented as quotation — “97% of regular web users” for the paper's “97% of the regular web users”; “supporting measurement instances in a 'headless' container” for “We support launching measurement instances in a 'headless' container”; “2.7% of navigation paths” for “2.7% of the navigation paths we studied”. The content page was changed to the papers' wording in each case. This is the failure the check exists to catch: a near-quote reads exactly like a quote.
• ASCII where the PDF has Unicode — 8 ⇐ length(parameter-value) ⇐ 100 for 8 ≤ length(parameter-value) ≤ 100.
• Phrases the two-column rendering interleaves. Both .cols and .norm splice the neighbouring column into the middle of a sentence, so a long quote is not contiguous in either. Two on this page are affected: the Zeber et al. sentence about stateless crawlers being “a clear target for cookie syncing”, and the OpenWPM “headless container” sentence, which in both renderings reads …in a “headthe LevelDBAggregator for de-duplication. less” container, by using the pyvirtualdisplay library to inJavascript Access…. The quotes are accurate when read across the interleave, but they cannot be machine-verified end to end, so the check pins the longest contiguous fragment of each and the content page quotes only short fragments around a paraphrase. Anyone re-checking these two by grep will get a false FAIL.

cookie_syncing_quotecheck-output.txt

-- 2014/CCS/the-web-never-forgets-persistent-tracking-mechanisms-in-the-wild
   OK   [cols|norm]  at least 11%
   OK   [cols|norm]  respawning
   OK   [cols|norm]  by nearly a factor of two
 
-- 2016/CCS/online-tracking-a-1-million-site-measurement-and-analysis
   OK   [cols|----]  45 of the top 50, 85 of the top 100, 157 of the top 200, and 460 of the top 1,000
   OK   [cols|norm]  8 ≤ length(parameter-value) ≤ 100
   OK   [cols|norm]  expiration date over 90 days in the future
   OK   [cols|norm]  ratcliff-obershelp
   OK   [cols|norm]  108 different cookies with 118
   OK   [cols|----]  76% of all third-party domains present on more than 5 of the top 100,000 sites
   OK   [cols|----]  visits the top 10,000 sites in a serial fashion
   OK   [cols|norm]  it is essential
   OK   [cols|----]  includes both events where it is a referer and where it is a receiver
   OK   [cols|norm]  by using the pyvirtualdisplay library
 
-- 2016/USENIX/tracing-information-flows-between-ad-exchanges-using-retargeted-ads
   OK   [cols|norm]  for 31% of our cookie matching partners
   OK   [cols|norm]  We train 90 personas
   OK   [cols|----]  4.1% cookie matching chains that would be completely missed
   OK   [cols|norm]  35,448
 
-- 2019/WWW/cookie-synchronization-everything-you-always-wanted-to-know-but-were-afraid-to-a
   OK   [cols|norm]  97% of the regular web users are exposed to csync
   OK   [cols|norm]  3.5 different domains
   OK   [cols|norm]  factor of 6.75
   OK   [cols|norm]  synchronization per 68 http requests
   OK   [cols|----]  850 real mobile users
   OK   [cols|norm]  specific length (> 10 characters)
 
-- 2020/PETS/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
   OK   [cols|norm]  67.96% of websites
   OK   [cols|norm]  stateful crawl of alexa
   OK   [cols|norm]  top 10, 000 domains
 
-- 2021/WWW/user-tracking-in-the-post-cookie-era-how-websites-bypass-gdpr-consent-to-track-u
   OK   [cols|norm]  3.51
   OK   [cols|norm]  3.91
   OK   [cols|norm]  4.86
   OK   [cols|norm]  24.03
   OK   [cols|norm]  26.20
   OK   [cols|norm]  29.61
   OK   [cols|norm]  27,180
 
-- 2022/USENIX/khaleesi-breaker-of-advertising-and-tracking-request-chains
   OK   [cols|norm]  cookie syncing
   OK   [cols|norm]  bounce tracking
   OK   [cols|norm]  more than half of the request chains
 
-- 2022/IMC/measuring-uid-smuggling-in-the-wild
   OK   [cols|norm]  8.11%
   OK   [cols|norm]  10,814
   OK   [cols|norm]  four crawlers
   OK   [cols|----]  greater than or equal to eight characters
   OK   [cols|norm]  2.7% of the navigation paths we studied
   OK   [cols|norm]  8.11% of the unique URL paths
   OK   [cols|norm]  Dedicated Smugglers 27
 
-- 2022/IEEE-SP/journey-to-the-center-of-the-cookie-ecosystem-unraveling-actors-roles-and-relati
   OK   [cols|norm]  138m cookie creation events
   OK   [cols|norm]  6.2m web pages
   OK   [cols|norm]  cookie ghostwriting
 
-- 2023/IMC/tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
   OK   [cols|norm]  41 advertisers
   OK   [cols|norm]  247
 
-- 2024/USENIX/purl-safe-and-effective-sanitization-of-link-decoration
   OK   [cols|norm]  73.02%
   OK   [cols|norm]  10.75
 
-- 2025/PETS/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
   OK   [cols|norm]  2,545
   OK   [cols|norm]  76
   OK   [cols|norm]  we define intractable
   OK   [cols|norm]  accepts the banner
 
-- 2025/PETS/tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we
   OK   [cols|norm]  1,190
   OK   [cols|norm]  44%
 
-- 2019/IMC/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
   OK   [cols|norm]  2,867
   OK   [cols|norm]  58%
 
-- 2023/WWW/the-hitchhikers-guide-to-facebook-web-tracking-with-invisible-pixels-and-click-i
   OK   [cols|norm]  6.2 third
 
-- 2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion
   OK   [cols|norm]  1,899
   OK   [cols|norm]  1,295
 
-- 2021/IEEE-SP/fingerprinting-the-fingerprinters-learning-to-detect-browser-fingerprinting-beha
   OK   [cols|----]  17.28% of the fingerprinting vendors participate in cookie syncing
 
-- 2020/WWW/the-representativeness-of-automated-web-crawls-as-a-surrogate-for-human-browsing
   OK   [cols|norm]  cookie syncing is not necessary for users who have already had
 
-- 2026/PETS/clicking-into-exposure-uncovering-privacy-risks-of-google-click-identifier-in-yo
   OK   [cols|norm]  568
   OK   [cols|norm]  133
   OK   [cols|norm]  64 (out of 76) advertisers persist
   OK   [cols|----]  41 out of 74) stored the gclid as a first-party cookie
   OK   [cols|norm]  leaked to 133 third-party domains
 
-- 2026/PETS/from-syntactic-matching-to-taint-tracking-and-back-a-comparative-study-of-web-tr
   OK   [cols|norm]  40,605 tracking requests
   OK   [cols|norm]  33,584 tracking requests exposed by syntactic matching
   OK   [cols|norm]  17,496 tracking requests (43%)
   OK   [cols|norm]  7,021 requests identified by taint tracking alone
   OK   [cols|norm]  16%-19%
   OK   [cols|norm]  27%-30% when considering only those requests
   OK   [cols|----]  -24% reduction in the number of tracking requests
   OK   [cols|norm]  -36% reduction in the number of distinct trackers
   OK   [cols|norm]  tranco top 10k
   OK   [cols|norm]  zxcvbn
   OK   [cols|norm]  there is no consensus on the most effective heuristic
   OK   [cols|norm]  is then 4%-7%
 
80 literals verified, 0 not found.

cookiesync_fulltext_probe.mjs

// Full-text probe for cookie/ID syncing across the 7-venue corpus.
//
// Why full text and not only the extraction: `detection.phenomenon` is free
// text and names the phenomenon the paper *headlines*. A paper that measures
// syncing as one of ten tracking mechanisms may never surface the word in a
// tuple. So: stream every paper.cols.txt, collapse whitespace (a PDF line
// break inside "cookie syn-\nchronization" otherwise hides the match), and
// count PAPERS per pattern.
//
//   node scripts/cookiesync_fulltext_probe.mjs [--json out.json]
import fs from 'node:fs';
import path from 'node:path';
import { dataRoot } from './lib.mjs';
 
const ROOT = path.join(dataRoot(), 'fulltext');
 
// Width matters: a narrow regex returns a confident wrong number. Each pattern
// is reported separately so the page can say which wording it is counting.
const PATTERNS = {
  'cookie sync (any form)': /cookie[\s-]*(?:sync|synchroni[sz])/i,
  'cookie matching': /cookie[\s-]*match/i,
  'ID sync': /\b(?:id|identifier|uid|user[\s-]?id)[\s-]*(?:sync|synchroni[sz])/i,
  'ad/RTB sync': /\b(?:rtb|bid|exchange|advertis\w+)[\s-]*(?:sync|synchroni[sz])/i,
  'pixel/tag sync': /\b(?:pixel|tag|beacon)[\s-]*(?:sync|synchroni[sz])/i,
  'cookie ghosting/respawn': /cookie[\s-]*(?:ghost|respawn|resurrect)/i,
  'header bidding': /header[\s-]*bidding/i,
  'real-time bidding': /real[\s-]*time[\s-]*bidding|\bRTB\b/,
};
const ANY_SYNC = /(?:cookie|\b(?:id|identifier|uid|user[\s-]?id)|pixel|tag)[\s-]*(?:sync|synchroni[sz])|cookie[\s-]*match/i;
 
// A paper that only says the word once, in related work, is not a paper that
// measured it. Count occurrences too so the page can threshold.
const ANY_G = new RegExp(ANY_SYNC.source, 'gi');
 
const files = [];
for (const year of fs.readdirSync(ROOT).sort()) {
  const yd = path.join(ROOT, year);
  if (!fs.statSync(yd).isDirectory()) continue;
  for (const venue of fs.readdirSync(yd).sort()) {
    const vd = path.join(yd, venue);
    if (!fs.statSync(vd).isDirectory()) continue;
    for (const slug of fs.readdirSync(vd).sort()) {
      const f = path.join(vd, slug, 'paper.cols.txt');
      if (fs.existsSync(f)) files.push({ year: +year, venue, slug, f });
    }
  }
}
 
const counts = Object.fromEntries(Object.keys(PATTERNS).map((k) => [k, 0]));
const perYear = new Map();
const rows = [];
for (const it of files) {
  // Hyphenation at a line break: "syn-\nchronization" -> "synchronization".
  const raw = fs.readFileSync(it.f, 'utf8');
  const text = raw.replace(/-\n/g, '').replace(/\s+/g, ' ');
  const occ = (text.match(ANY_G) || []).length;
  const hitNames = [];
  for (const [name, re] of Object.entries(PATTERNS)) {
    if (re.test(text)) {
      counts[name]++;
      hitNames.push(name);
    }
  }
  if (occ > 0) {
    rows.push({ ...it, occ, patterns: hitNames.filter((n) => !/bidding/.test(n)) });
    const y = perYear.get(it.year) || { any: 0, ge5: 0, ge20: 0, total: 0 };
    y.any++;
    if (occ >= 5) y.ge5++;
    if (occ >= 20) y.ge20++;
    perYear.set(it.year, y);
  }
  const y = perYear.get(it.year) || { any: 0, ge5: 0, ge20: 0, total: 0 };
  y.total++;
  perYear.set(it.year, y);
}
 
console.log(`papers with a paper.cols.txt: ${files.length}`);
console.log('\n== Papers matching each wording (denominator: all %d papers with full text) =='.replace('%d', files.length));
for (const [name, n] of Object.entries(counts).sort((a, b) => b[1] - a[1]))
  console.log(`  ${String(n).padStart(4)}  ${((100 * n) / files.length).toFixed(1)}%  ${name}`);
 
console.log('\n== Any syncing wording, by year (2026 provisional; 2025 thin) ==');
console.log('  year  papers  >=1 occ  >=5 occ  >=20 occ');
for (const y of [...perYear.keys()].sort((a, b) => a - b)) {
  const v = perYear.get(y);
  console.log(
    `  ${y}  ${String(v.total).padStart(6)}  ${String(v.any).padStart(7)}  ${String(v.ge5).padStart(7)}  ${String(v.ge20).padStart(8)}`
  );
}
 
rows.sort((a, b) => b.occ - a.occ);
console.log('\n== Top 40 papers by occurrence count of syncing wording ==');
for (const r of rows.slice(0, 40))
  console.log(`  ${String(r.occ).padStart(4)}  ${r.year} ${r.venue.padEnd(8)} ${r.slug}`);
 
const argJson = process.argv.indexOf('--json');
if (argJson > -1) fs.writeFileSync(process.argv[argJson + 1], JSON.stringify(rows, null, 1));

Separately from the literal check in §4.2, the crawlConfig evidence quotes behind the crawl-configuration table were read by hand for five of the 25 crawling papers. The finding is a limitation, not a confirmation.

So: an object-valued family with one shared quote cannot be quote-checked field by field. Four of the five quotes do not touch the field the page leans on hardest. This is stated on the content page in a box beside the table rather than buried here.

One value was traced further because it looked wrong. CCS/2016 is recorded headless=headless; OpenWPM in 2016 drove Firefox under Xvfb, which is a headful browser on a virtual framebuffer. The paper's own words are “supporting measurement instances in a 'headless' container, by using the pyvirtualdisplay library to interface with Xvfb” — the scare quotes are the authors'. The extraction is faithful to the paper's wording and the paper's wording is loose. The content page says so, because the difference is detectable by anti-bot logic and therefore matters to a measurement.

Every run of digits on the content page is checked against four sources, and the check fails if any figure matches none of them:

1. the corpus report output — every corpus figure must be printed there;
2. the quote-check literals — every figure quoted from a paper must be pinned by a literal that was verified against that paper's own text;
3. an EXTERNAL map, each entry carrying the URL it came from;
4. a DERIVED map, for the two figures this page computed itself from two verified ones (17,496 / 33,584 = 52% and 850 / 10,814 = 7.86%), spelled out so a reader can redo the division rather than trust it.

The shared check_page_numbers.mjs passes over the Use in Publications window. Over the whole page it reports 48 unaccounted figures, all of them per-paper or per-vendor — which is what the page-specific guard exists to resolve rather than to suppress. It failed the windowed check once during the second review round, on a bare 24 where the report prints 24.0%; the figure was right and the prose formatting was not, and the prose now matches the table. Current state:

$ node scripts/cookie_syncing_number_guard.mjs pages/draft/privacy_cookie_syncing.txt
figures checked: 171
OK — every figure traces to the report, to a verified quote literal, to a named external source, or to arithmetic on two verified figures.

The guard let two stale figures through, and the re-review caught them. After the 29→30 correction the page still said “the 83%” for a value that had become 80.0%, and “the seven rows sum to 29” for a column that summed to 30. Both passed, and the reason is worth stating precisely because it bounds what either guard is worth:

• 83 appears in the report twice, both times as something else — 83.3% as a temporal.mode share, and 75–83% accuracy as a classifier's accuracy range in one of the papers. The shared guard's word-boundary matching does not help: 83 really is there, as a whole token, in 75–83%.
• 29 appears in the report in a dozen places.

A guard that asks “does this digit-string appear anywhere in the report” cannot ask “does it appear as this quantity.” That is not an implementation defect to fix; it is the ceiling of the technique, and it is the same ceiling the shared script's own comments describe. The only defence found is to re-read the prose by hand after any denominator change. Both stale figures were in prose, not in a table, which is where to look first.

Running it during the first review caught nine figures with no pinned source, six of which were per-paper figures the quote check had never been told about; the generic reviewer then found fourteen more of the same kind that the guard could not see because they are quotes rather than digits. All are pinned now, which is what took the quote check from 42 literals at first draft to 80.

Numbers deliberately not published. The report prints temporal.mode for MEAS (25 live-crawl, 4 existing-dataset, 3 passive-collection, 2 active-probing). It is on the report but not on the page: temporal.mode is a 69%-agreement field and the interesting contrast (crawl versus passive logs) is already carried by the family table, where it rests on hand labels rather than on a 69% field.

Only one field on this page needed folding: vantage.locations, through the shared scripts/geo.mjs. Denominator MEAS = 30; 19 papers state at least one non-sentinel location.

• Folded result: United States 13, Europe 4, Spain 3, India 3, Germany 2, Brazil 2, Australia 2, and one each for Singapore, Russia, United Kingdom, France, Japan.
• Unmapped residue, printed in full (2 strings, both from the same construction):
  • IMC/2017/if-you-are-not-paying-for-it…: same country
  • WWW/2019/cookie-synchronization…: same country; country not-stated

Both are the extraction faithfully recording that the paper says the vantage was in the same country as the users but does not name it. Neither is a geography and neither was silently dropped.

The other counted fields (statefulness, consentAction, interactionDepth, headless, classification.target, classification.method) are enums, not free text, and are published unfolded. classification.resourceName is free text and is reported as a paper-counted ranking with the raw strings printed in the report output, not as a percentage — the folding there is one manual step, grouping any string matching /easy/i as EasyList/EasyPrivacy (12 papers) and /disconnect/i as Disconnect (4). The unfolded list is in §4.1.

A bug found and fixed during this run. The first version of the enumField helper counted tuples, not papers: a paper with three live-crawl temporal tuples was counted three times, which produced “29 of 29 papers (100%) live-crawl” from a set of 29 papers of which only 24 crawled at all — those were the counts before the boundary correction in §8 took MEAS to 30 and 25. Fixed to count distinct values per paper before the first figure reached the page. Noted here because it is exactly the failure mode OVERVIEW.md warns about and it still happened.

Every row was fetched on 2026-08-26. Vendor and browser-vendor documentation only; no secondary summaries were used for any load-bearing claim.

1. New page rather than broadening privacy:cookies. See §1. The deciding argument: syncing's method literature (identifier heuristics, request chains, filter lists, graph ML) overlaps privacy:requests far more than the cookie-purpose literature on privacy:cookies. A reasonable person could instead have retitled privacy:cookies to “Cookies” and made this a section of it.
2. Which methods were called superseded. Five: fixed length windows as the identifier test, long-expiry as a necessary condition, two synchronised profiles, plaintext-only matching, and the “post-cookie era” framing. Each rests on a named, dated source that supersedes it, not on my reading of the trend: the length and randomness change on [1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)]'s own comparison table plus its hand-verified false-positive analysis; the expiry and two-profile changes on [2Randall, Audrey; Snyder, Peter; Ukani, Alisha; Snoeren, Alex C.; Voelker, Geoffrey M.; Savage, Stefan; Schulman, Aaron (2022): "Measuring UID smuggling in the wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]'s stated reasons for dropping them; the plaintext point on [3Bashir, Muhammad Ahmad; Arshad, Sajjad; Robertson, William; Wilson, Christo (2016): "Tracing information flows between ad exchanges using retargeted ads", in: 25th USENIX Security Symposium (USENIX Security 16), pp. 481-496. (Link)] and [4Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2019): "Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask", in: Proceedings of the ACM Web Conference. (DOI)]; the framing on Google's two announcements. No method was dated as superseded on corpus counts alone. That matters because the corpus counts would have supported a different and wrong story — the family table shows syntactic as the largest family by a factor of three, running from 2014 to the most recent year in the corpus, which reads as “the state of the art” if you do not read the 2026 paper that measures its error rate.
3. The 2025–2026 slice is thin, and the page says so in the table itself rather than in a footnote. Three papers in 2026 mention syncing at all and none mention it five times, so no “current practice” claim on the page rests on a 2026 count. The one 2026 paper that carries weight ([1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)]) carries it on its content, not on its being recent.
4. “PoPETs is where this literature lives” is a claim about ≥5-mention papers, where PoPETs has 9 of the 31. At the ≥1 level PoPETs still leads (28 of 106). It is stated as a venue signal, not as a quality judgement.
5. Per-paper prevalence figures are quoted with their own denominators and never aggregated. The temptation was a single “syncing prevalence over time” chart. It would have been fabricated: the units are sites, users, chains, cookies, domain pairs and third parties, over populations from 50 to 850,000. The page instead opens the section with a unit table and says explicitly that none of the numbers can be averaged or plotted against each other.
6. detection[].prevalence was used only as a pointer. Every figure it surfaced was re-read in the paper's own text before publication, because the field records the metric but not the denominator, and the denominator is where these numbers go wrong. Two examples of what that caught: [5Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2021): "User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users", in: Proceedings of the ACM Web Conference. (DOI)]'s 24.03% is of 27,180 sites with a CMP and no error in all three consent runs, not of the 850K Tranco list crawled or the 628,213 parsed; [4Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2019): "Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask", in: Proceedings of the ACM Web Conference. (DOI)]'s 97% is of 850 real mobile users, not of any site population. Neither denominator is in the extraction.
7. Where the boundary of “measures identifier sharing” sits, and a correction made because it was inconsistent. The set was first drawn to exclude link-decoration papers on the grounds that link decoration is the successor phenomenon and belongs to privacy:requests. But [6Munir, Shaoor; Lee, Patrick; Iqbal, Umar; Shafiq, Zubair; Siby, Sandra (2024): "PURL: Safe and Effective Sanitization of Link Decoration", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 4103-4120. USENIX Association, Philadelphia, PA. (Link)] (PURL) was in the set and [7Dao, Ha; Shinde, Abhishek; Athar, Sana; Gosain, Devashish (2026): "Clicking into Exposure: Uncovering Privacy Risks of Google Click Identifier in YouTube Ads", Proceedings on Privacy Enhancing Technologies 2026(2):92-107. (DOI)] (gclid in YouTube ads) was not, which is the same object — an identifier reaching a party that did not set it — judged two different ways. On re-reading the gclid paper's extraction (cross-party gclid leakage … 133 distinct third-party domains received gclid values) the exclusion was not defensible. MEAS went from 29 to 30 and every derived figure on the content page was re-computed, not patched: the family split, the crawl-configuration table and its denominator, the artifact and vantage counts, and the sentences that quote them. Both stale-number guards were re-run afterwards. The alternative — dropping PURL to keep the set at 28 — would have been consistent too, and would have lost the page its best link-decoration citation.
8. The Bashir et al. 31% figure is presented as a 2016 measurement, not as a current one. It is widely cited as if it were current; the content page says so and lists repeating it as the highest-value open question.

Four reviewers, all told the same thing: that my context may not be exhaustive, and all handed the page text, both scripts and their unedited output, and these notes. The three focused ones ran in parallel; the generic one ran after their findings were acted on. All four were then re-run against the corrected pages.

Rows 1–15 predate the boundary correction in §8, so every count in them refers to the 29-paper set. They are left as the reviewers wrote them.

Two further defects were found by re-reading rather than by a reviewer, and are recorded because they are the same class:

• The paraphrase-as-quote problem, twice. “supporting measurement instances in a 'headless' container” and “2.7% of navigation paths” were both written as quotations and are both a word or two away from what the papers say. Caught by extending the quote check after the fact; see §4.2.
• A tuple-counting bug in my own helper, which briefly produced “100% live-crawl” from a 29-paper set. See §6.

One thing this reviewer could not see. It reviewed the drafts as they stood before the boundary correction in §8, so its counts refer to a 29-paper set. Nothing in its findings depends on that count.

All four reviewers were re-run against the corrected pages. Three returned findings.

• How many syncing papers the regex missed. There is no ground-truth list of papers that measure identifier sharing. Four were added by hand — three for under-recall, one to correct the boundary — and the true recall of the population is unknown, which is why the page says “at least 106”.
• Whether syncing prevalence has risen or fallen. No two papers in the corpus measure the same unit over the same population, so no trend can be computed from them, and the per-year mention counts measure attention, not prevalence. Listed as the second open question.
• The size of the seed-profile self-sync artefact predicted by [11Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] in 2016. Still unmeasured; also open on programming:stateful_stateless.
• Deployment of deterministic-ID frameworks. No corpus paper measures UID2, EUID or their competitors, and I found no primary measurement outside the corpus that I could verify. The page states the gap and does not guess at it.
• Two papers that meet the boundary and are not in the set. [12Bekos, Paschalis; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2023): "The Hitchhiker's Guide to Facebook Web Tracking with Invisible Pixels and Click IDs", in: Proceedings of the ACM Web Conference. (DOI)] (TheWebConf 2023) measures a median website passing identifiers to 6.2 third parties; [13Dimova, Yana; Acar, Gunes; Olejnik, Lukasz; Joosen, Wouter; Van Goethem, Tom (2021): "The CNAME of the game: Large-scale analysis of DNS-based tracking evasion", Proceedings on Privacy Enhancing Technologies 2021:394–412. (DOI) (Link)] (PoPETs 2021) finds 1,899 cookie leaks in request URLs on 1,295 distinct sites. Both were found by a late sweep for detection tuples using identifier-flow language without the word “sync”, after the set had been fixed and every figure derived from it. They are named on the content page rather than added, because adding papers as one stumbles on them is how a hand-curated set stops being reproducible — and because two papers change no table's shape. The same sweep is the reason to believe the recall problem is real rather than hypothetical: it found two in one pass and was not exhaustive.
• Whether the nine “not-syncing” exclusions would survive another reader. Four of them (in-vehicle networks, COPPA, Apple logging, analytics dashboards) plus the Meta server-side paper are extraction-only matches with no full-text occurrence of any syncing wording, which is a strong exclusion. The other four rest on reading the passage — and one of those, the privacy-vs-compatibility paper, is arguable, because it does measure a cross-site identifier flow, just not a cross-vendor one.
• A pre-existing bibliography defect, not fixed. literature:bibliography contains two papers twice under different keys — fouad2022my / fouad2022_cookie (DOI 10.56553/popets-2022-0063) and bottger2025_regional / boettger2025_regional (DOI 10.56553/popets-2025-0063). Found by a DOI scan run before appending this page's entries. Not touched, because other pages may cite either key and deduplicating is a site-wide edit with its own review. Recorded here so the next run does not have to rediscover it.

Eight entries appended before the closing </bibtex>, after scanning the fresh export for both key collisions and DOI collisions:

Two entries were generated and then discarded as duplicates of papers already present under other keys: Roesner et al. 2012 (already roesner2012_detecting) and Sánchez-Rola et al. 2019 (already sanchezrola2019can, DOI 10.1145/3321705.3329806). The page cites the existing keys.

The other 24 keys the two pages cite were already in the bibliography and were not touched. Four of them are worth naming because a reviewer flagged them as possibly added without a record: calzavara2026_syntactic, bahrami2025_cookieguard, dao2026_gclid and dimova2021cname were all present in the export taken before this run's first append, and the reviewer's contrary evidence turned out to be a local copy of the bibliography from 2026-08-19. Check against a fresh ?do=export_raw, never against a copy on disk.

• Content page: cookie_syncing
• Corpus-level provenance: corpus
• Shared bibliography: bibliography

[1]

Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)

[2]

Randall, Audrey; Snyder, Peter; Ukani, Alisha; Snoeren, Alex C.; Voelker, Geoffrey M.; Savage, Stefan; Schulman, Aaron (2022): "Measuring UID smuggling in the wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[3]

Bashir, Muhammad Ahmad; Arshad, Sajjad; Robertson, William; Wilson, Christo (2016): "Tracing information flows between ad exchanges using retargeted ads", in: 25th USENIX Security Symposium (USENIX Security 16), pp. 481-496. (Link)

[4]

Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2019): "Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask", in: Proceedings of the ACM Web Conference. (DOI)

[5]

Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2021): "User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users", in: Proceedings of the ACM Web Conference. (DOI)

[6]

Munir, Shaoor; Lee, Patrick; Iqbal, Umar; Shafiq, Zubair; Siby, Sandra (2024): "PURL: Safe and Effective Sanitization of Link Decoration", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 4103-4120. USENIX Association, Philadelphia, PA. (Link)

[7]

Dao, Ha; Shinde, Abhishek; Athar, Sana; Gosain, Devashish (2026): "Clicking into Exposure: Uncovering Privacy Risks of Google Click Identifier in YouTube Ads", Proceedings on Privacy Enhancing Technologies 2026(2):92-107. (DOI)

[8]

Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair (2021): "Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[9]

Fouad, Imane; Bielova, Nataliia; Legout, Arnaud; Sarafijanovic-Djukic, Natasa (2020): "Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels", in: Proceedings on Privacy Enhancing Technologies, pp. 499-518. (DOI)

[10]

Acar, Gunes; Eubank, Christian; Englehardt, Steven; Juarez, Marc; Narayanan, Arvind; Díaz, Claudia (2014): "The Web Never Forgets: Persistent Tracking Mechanisms in the Wild", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[11]

Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[12]

Bekos, Paschalis; Papadopoulos, Panagiotis; Markatos, Evangelos P.; Kourtellis, Nicolas (2023): "The Hitchhiker's Guide to Facebook Web Tracking with Invisible Pixels and Click IDs", in: Proceedings of the ACM Web Conference. (DOI)

[13]

Dimova, Yana; Acar, Gunes; Olejnik, Lukasz; Joosen, Wouter; Van Goethem, Tom (2021): "The CNAME of the game: Large-scale analysis of DNS-based tracking evasion", Proceedings on Privacy Enhancing Technologies 2021:394–412. (DOI) (Link)