This is the working log for Tracker Radar Collector. It records the decisions and checks specific to that page; dataset-wide extraction caveats live on the corpus provenance page. It deliberately has no discussion block: comments belong on the content page.

The content page and this page were created and “reviewed” in a single 4 min 23 s pass by the cheap model tier, and its outcome note claimed only “all checks passed” — no reviewer count, no findings, no named script. The revision log is the evidence:

rev 1786716609  C  20905  Create Tracker Radar Collector page
rev 1786716871  E    236  Clarify Tracker Radar output schema
prov 1786716614 C  24707  Add Tracker Radar Collector provenance
prov 1786716731 E     58  Add shared bibliography references
prov 1786716872 E    311  Log Tracker Radar schema review adjustment

Every comparable page in this namespace (openwpm, traffic_files, pagegraph, webxray, foxhound) needed three to five review passes, and every pass found blocking defects. So the absence of findings was evidence about the review, not about the page. The 2026-09-03 run therefore ran the full review layer over the published pages. Every published corpus figure held up: the script reproduces byte for byte, an independent full-text probe finds the same 10 papers, and every clause of every per-paper claim survived a clause-by-clause check. Two things that came out of the first pass's own script did not — its quote-check summary (“2 exact” was really 1 verbatim and 1 case-only) and a sliding-window match that passed a mutated quote — so “the arithmetic was fine, only the reading was wrong” would be too flattering. What was wrong in bulk was the reading: the tool's README, its dependency's changelog, an open bug in its issue tracker, and the neighbouring page's numbers.

Run from /workspace/artifacts/wiki:

node scripts/sitemap.mjs
node scripts/report_tracker_radar_collector.mjs
node scripts/trc_review_probe.mjs
node scripts/trc_index_reconcile.mjs
node scripts/trc_paper_detail.mjs
TRC_UNSAFE_DISABLE_SANDBOX=1 PUPPETEER_EXECUTABLE_PATH=... node scripts/trc_smoke.mjs sandbox/trc out/trc_smoke

The page says “10 papers in the 1,120-paper CRAWLED population”, never “10 of 5,859”. The all-paper 5,859 and the broad 21/11 appear only with the all-paper boundary definition stated.

Three numbers exist across the wiki and each is right for its own documented rule. Pass (d) reconstructed the difference exactly:

• 58 — automation-category filter, used/produced, intersected with CRAWLED. What report_tracker_radar_collector.mjs computes, and what the crawler index's folded-framework table publishes.
• 59 — the same, without the category filter.
• 60 — no category filter, over all 5,859 papers. The openwpm page's headline.

The one-paper delta between 58 and 59 is PETS/2020/a-comparative-measurement-study-of-web-tracking-on-mobile-and-desktop-environmen, whose tuple is “OpenWPM Firefox extension” with category: “browser” and usedOrMentioned: “used”. It is a browser-category tuple, so this page's automation filter excludes it and the openwpm page's rule keeps it. Nothing is wrong; nothing was reconciled before this run either.

scripts/tool_fold.mjs line 27 is:

F('Tracker Radar Collector', /tracker.?radar/i),

a family named after the crawler that matches the dataset, the entity list, the entity map and the wiki. The crawler index publishes that family as | Tracker Radar Collector | 21 | 1 | 2021–2026 | and said in prose that extending the corpus “tripled Tracker Radar Collector (8 → 21)”. All 11 papers in the difference used the dataset, not the crawler. trc_index_reconcile.mjs prints both rules side by side and lists them:

trc_index_reconcile-output.txt

Populations: all papers = 5859; CRAWLED = 1120
 
  21 / 5859   index family rule, all papers, used/produced
  21 / 5859   index family rule, all papers, any status
  10 / 1120   index family rule, CRAWLED, automation + used/produced
  10 / 5859   subpage rule, all papers, automation + used/produced
  10 / 1120   subpage rule, CRAWLED, automation + used/produced
  10 / 5859   subpage rule, all papers, any category/status
 
published on programming:crawler ("Which specialised crawlers actually get used"): 21 papers using or producing
published on programming:crawler (folded framework table, within CRAWLED): 10 papers, 0.9%
published on programming:crawler:tracker_radar_collector: 10 papers of 1,120 CRAWLED
 
=== in the index family (used/produced, all papers) but NOT in the subpage query: 11 ===
  2022  WWW/2022/investigating-advertisers-domain-changing-behaviors-and-their-impacts-on-ad-bloc
        "Tracker Radar" [classification-service/used]
  2023  PETS/2023/evaluating-practical-quic-website-fingerprinting-defenses-for-the-masses
        "DuckDuckGo Tracker Radar" [classification-service/used]
  2024  IMC/2024/diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc
        "DuckDuckGo Tracker Radar" [cookie-database/used]
  2025  IEEE-SP/2025/only-as-strong-as-the-weakest-link-on-the-security-of-brokered-single-sign-on-on
        "Tracker Radar Entity List" [other/used]
  2025  IMC/2025/cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
        "DuckDuckGo Tracker Radar" [classification-service/used]
  2025  NDSS/2025/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector
        "DuckDuckGo Tracker Radar Wiki" [classification-service/used]
  2025  WWW/2025/before-after-the-effect-of-eus-2022-code-of-practice-on-disinformation
        "DuckDuckGo Tracker Radar" [classification-service/used]
  2025  CCS/2025/whispertest-a-voice-control-based-library-for-ios-ui-automation
        "DuckDuckGo Tracker Radar" [classification-service/used]
  2026  NDSS/2026/cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews
        "DuckDuckGo Tracker Radar" [classification-service/used]
  2026  PETS/2026/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government
        "DuckDuckGo Tracker Radar" [classification-service/used]
  2026  USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web
        "Tracker Radar Entity Map" [classification-service/used]
 
=== in the subpage query but NOT in the index family: 0 ===

Both fixes were applied to the index on 2026-09-03: the 21 row now carries a footnote with the split, and the prose now says “the Tracker Radar family” and points at the crawler-only row. tool_fold.mjs was not changed, because renaming the family would relabel the folded-framework row where the 10 genuinely is the crawler, and would change figures on a page outside this run's scope. The label still matches the script; the footnote carries the truth. That is a compromise and it is recorded as one.

The report's fold pattern is case-insensitive:

tracker[\s-]?radar[\s-]?collector

It permits a DuckDuckGo prefix and a (TRC) suffix because the match is on the full tool name, then restricts the population to the two automation categories and used/produced statuses. This is deliberately narrower than tracker[- ]radar.

Four raw strings map to the Collector: DuckDuckGo Tracker Radar Collector (4 tuples), Tracker Radar Collector (4), DuckDuckGo tracker-radar-collector (1), Tracker Radar Collector (TRC) (1).

The complete excluded radar-name residue, printed in full:

  8  "DuckDuckGo Tracker Radar"
  1  "DuckDuckGo Tracker Radar Wiki"
  1  "Tracker Radar"
  1  "Tracker Radar Entity List"
  1  "Tracker Radar Entity Map"

Nine distinct radar strings, four mapped, five excluded, and no string lands in both maps. Two cautions a reader needs:

• The residue is counted in tuples, not papers. Twelve tuples over five strings is not twelve extra papers.
• The residue is not paper-disjoint from the 10. Pass (a) found that PETS/2025/referrer-policy-implementation-and-circumvention has both a Collector tuple (so it is one of the 10) and a “DuckDuckGo Tracker Radar” tuple (so it also feeds the residue). The paper-level “11 excluded” figure does filter out any paper with a qualifying Collector tuple, so 10 and 11 are disjoint; the tuple residue is not.

trc_review_probe.mjs reads paper.cols.txt for all 5,859 extracted papers, ignoring tools[] entirely, and prints every hit with its extraction status and every match context — not the first, because one window hides a reference-list-only mention behind a methods mention. Result:

full-text probe over 5855 papers with a paper.cols.txt (4 of 5859 extracted papers have none)
probe: /tracker[\s-]*radar[\s-]*collector/ on whitespace-collapsed, hyphen-normalised text

papers whose full text names the Collector: 10
papers in the report's TRC population: 10
in probe but NOT in the report population: 0
in the report population but NOT in the probe: 0  []
...
=== tools[] tuples naming the Collector, by category and status (no filter) ===
    1 papers  browser-automation / used
    9 papers  crawler-framework / used

Pass (a) widened it further over the same 5,855 papers and the population did not move: radar[\s-]*collector → 10, duckduckgo.{0,40}collector → 10, \btrc\b near crawl → 6, no extras in any case. It also checked the four papers with no .cols rendering against paper.norm.txt (USENIX/2010/idle-port-scanning, CCS/2014/beware-your-hands-reveal-your-secrets, IMC/2020/bgp-beacons, IEEE-SP/2020/burglars-iot-paradise — zero hits for “tracker radar”, “puppeteer” or “trc”), and swept for papers where \btrc\b is frequent and “collector” absent: five Rowhammer and DRAM papers where TRC means Target Row Refresh or Target Row Counter. All true negatives.

This is the check that makes the 10 worth publishing. It is independent of tools[].category, which is the field most likely to drop a paper silently.

report_tracker_radar_collector-output.txt

corpus: 5859 papers, 7 venues, 2010–2026
population CRAWLED: 1120 papers (crawlConfig or automated-web-crawl study type)
population TRC: 10 papers with a used/produced automation-tool tuple naming the Collector
generated by scripts/report_tracker_radar_collector.mjs
 
=== A. Population and the Collector/dataset boundary ===
 
Population                        Papers  Definition
--------------------------------  ------  --------------------------------------------------------------------------------
TRC crawler users                 10      tools[].name matches Tracker Radar Collector; automation category; used/produced
TRC crawler users inside CRAWLED  10      same query ∩ CRAWLED (1120)
OpenWPM users inside CRAWLED      58      same automation-category/used-or-produced rule; OpenWPM fold
Any Tracker Radar tool name       21      broad radar name match, including dataset/entity/wiki names
Radar names excluded from TRC     11      any radar name but no Collector automation tuple
The page uses the first row for the Collector adoption count. The broad Tracker Radar rows are a boundary check, not a second crawler count.
 
=== B. Year-by-year use ===
 
Year   Crawling papers  TRC users  Share of that year’s crawling papers
-----  ---------------  ---------  ------------------------------------
2021   75               1          1.3%
2022   110              1          0.9%
2023   125              1          0.8%
2024   110              3          2.7%
2025*  129              3          2.3%
2026*  69               1          1.4%
* 2025–2026 are provisional venue-years: CCS/IMC 2026 have not been held, and IEEE S&P/WWW 2026 are incompletely selected.
Across the complete 2021–2024 window: 6 TRC users; in the provisional 2025–2026 window: 4.
 
=== C. Folded names and unmapped residue ===
 
Fold rule: case-insensitive `tracker[- ]radar[- ]collector`, after allowing DuckDuckGo as a vendor prefix and `(TRC)` as a suffix; only automation categories and used/produced tuples enter the TRC population. Counts below are tuples for residue auditing, never paper percentages.
Raw tool string folded to Tracker Radar Collector  Tuples
-------------------------------------------------  ------
"DuckDuckGo Tracker Radar Collector"               4
"Tracker Radar Collector"                          4
"DuckDuckGo tracker-radar-collector"               1
"Tracker Radar Collector (TRC)"                    1
Excluded radar-name residue (printed in full):
  8  "DuckDuckGo Tracker Radar"
  1  "DuckDuckGo Tracker Radar Wiki"
  1  "Tracker Radar"
  1  "Tracker Radar Entity List"
  1  "Tracker Radar Entity Map"
Radar-name audit: 9 distinct strings; Collector fold mapped 4; excluded residue 5.
 
=== D. Papers in the TRC population ===
 
Year  Paper key                                                                                    Tool string(s)                                           Evidence quote(s)
----  -------------------------------------------------------------------------------------------  -------------------------------------------------------  -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
2021  PETS/2021/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion           DuckDuckGo Tracker Radar Collector [crawler-framework]   "We built our crawler by modifying the DuckDuckGo Tracker Radar Collector [21], a Puppeteer-based crawler that uses the Chrome DevTools Protocol (CDP)."
2022  USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission    Tracker Radar Collector [crawler-framework]              "We develop an interactive, instrumented crawler based on DuckDuckGo's Tracker Radar Collector"
2023  USENIX/2023/is-your-wallet-snitching-on-you-an-analysis-on-the-privacy-implications-of-web3  DuckDuckGo Tracker Radar Collector [crawler-framework]   "We use DuckDuckGo's Tracker Radar Collector (TRC) to crawl popular websites and measure their behavior."
2024  IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites         Tracker Radar Collector [crawler-framework]              "we extended Tracker Radar Collector (TRC) [93]. TRC is a Puppeteer-based [94] web crawler"
2024  PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework              DuckDuckGo Tracker Radar Collector [browser-automation]  "We used code from DuckDuckGo's Tracker Radar Collector (TRC) that allowed us to set non-invasive breakpoints on the DOM cookie methods and record the JavaScript stack traces"
2024  WWW/2024/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting    Tracker Radar Collector [crawler-framework]              "Our web crawler is a fork of Tracker Radar Collector (TRC), a crawler created by DuckDuckGo."
2025  IMC/2025/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th    DuckDuckGo Tracker Radar Collector [crawler-framework]   "We modified DuckDuckGo's Tracker Radar Collector [22], a Puppeteer-based Web crawler."
2025  PETS/2025/referrer-policy-implementation-and-circumvention                                   Tracker Radar Collector [crawler-framework]              "We extended the open-source crawler Tracker Radar Collector (TRC) [32]."
2025  PETS/2025/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic   DuckDuckGo tracker-radar-collector [crawler-framework]   "To collect ads, we utilized the DuckDuckGo tracker-radar-collector framework, built on the Puppeteer web crawler."
2026  USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost               Tracker Radar Collector (TRC) [crawler-framework]        "We perform web crawls using a customized version of DuckDuckGo's Tracker Radar Collector (TRC), an opensource Puppeteer-based crawler equipped with anti-bot measures"
 
=== E. Evidence quote checks ===
 
12-word-compact  PETS/2021/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion  /workspace/publications_dataset/data/fulltext/2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion/paper.cols.txt
  "We built our crawler by modifying the DuckDuckGo Tracker Radar Collector [21], a Puppeteer-based crawler that uses the Chrome DevTools Protocol (CDP)."
6-word-compact  USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission  /workspace/publications_dataset/data/fulltext/2022/USENIX/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission/paper.cols.txt
  "We develop an interactive, instrumented crawler based on DuckDuckGo's Tracker Radar Collector"
8-word-compact  USENIX/2023/is-your-wallet-snitching-on-you-an-analysis-on-the-privacy-implications-of-web3  /workspace/publications_dataset/data/fulltext/2023/USENIX/is-your-wallet-snitching-on-you-an-analysis-on-the-privacy-implications-of-web3/paper.cols.txt
  "We use DuckDuckGo's Tracker Radar Collector (TRC) to crawl popular websites and measure their behavior."
exact  IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites  /workspace/publications_dataset/data/fulltext/2024/IEEE-SP/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites/paper.cols.txt
  "we extended Tracker Radar Collector (TRC) [93]. TRC is a Puppeteer-based [94] web crawler"
10-word-compact  PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework  /workspace/publications_dataset/data/fulltext/2024/PETS/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework/paper.cols.txt
  "We used code from DuckDuckGo's Tracker Radar Collector (TRC) that allowed us to set non-invasive breakpoints on the DOM cookie methods and record the JavaScript stack traces"
11-word-compact  WWW/2024/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting  /workspace/publications_dataset/data/fulltext/2024/WWW/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting/paper.cols.txt
  "Our web crawler is a fork of Tracker Radar Collector (TRC), a crawler created by DuckDuckGo."
exact-except-case  IMC/2025/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th  /workspace/publications_dataset/data/fulltext/2025/IMC/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th/paper.cols.txt
  "We modified DuckDuckGo's Tracker Radar Collector [22], a Puppeteer-based Web crawler."
9-word-compact  PETS/2025/referrer-policy-implementation-and-circumvention  /workspace/publications_dataset/data/fulltext/2025/PETS/referrer-policy-implementation-and-circumvention/paper.cols.txt
  "We extended the open-source crawler Tracker Radar Collector (TRC) [32]."
10-word-compact  PETS/2025/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic  /workspace/publications_dataset/data/fulltext/2025/PETS/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic/paper.cols.txt
  "To collect ads, we utilized the DuckDuckGo tracker-radar-collector framework, built on the Puppeteer web crawler."
12-word-compact  USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost  /workspace/publications_dataset/data/fulltext/2026/USENIX/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost/paper.cols.txt
  "We perform web crawls using a customized version of DuckDuckGo's Tracker Radar Collector (TRC), an opensource Puppeteer-based crawler equipped with anti-bot measures"
Quote checks: 1 verbatim, 1 exact except capitalisation, 8 partial (longest 5–12 word run containing "tracker radar collector"), 0 matched only outside the anchor, 0 not located, 10 TRC tool tuples checked.
A "partial" grade means the run was split by the column repair, not that the source is silent: every accepted window contains the anchor phrase itself.
"exact except capitalisation" means the extraction dropped a leading clause and capitalised a mid-sentence word. The sentence supports the claim; the string is an edited fragment and must not be printed as verbatim.
 
=== F. What the ten papers configured (crawlConfig, sentinels shown as values) ===
 
crawlConfig is an enum-bearing object, so these are publishable as counts -- but note that all of
crawlConfig, ethics and artifacts share one evidence quote per paper, so no single key here is
independently quote-checked. Sentinels are printed, never subtracted.
Year  Paper                               statefulness  headless    consentAction      interactionDepth       browsers                                                             subpagesPerSite
----  ----------------------------------  ------------  ----------  -----------------  ---------------------  -------------------------------------------------------------------  ---------------
2021  the-cname-of-the-game-large-scale-  stateless     headless    not-stated         landing-plus-subpages  Chrome                                                               20
2022  leaky-forms-a-study-of-email-and-p  not-stated    not-stated  accept-and-reject  landing-plus-subpages  Chrome+mobile-emulated browser                                       10
2023  is-your-wallet-snitching-on-you-an  not-stated    not-stated  not-stated         landing-page-only      Chromium                                                             null
2024  targeted-and-troublesome-tracking-  stateless     not-stated  accept-all         landing-plus-subpages  Puppeteer/TRC desktop browser+Puppeteer/TRC emulated mobile browser  5
2024  johnny-still-cant-opt-out-assessin  not-stated    not-stated  no-interaction     landing-plus-subpages  Chrome                                                               9
2024  the-double-edged-sword-identifying  not-stated    headless    accept-all         landing-plus-subpages  Chrome                                                               15
2025  canvassing-the-fingerprinters-char  not-stated    not-stated  accept-all         landing-page-only      (empty)                                                              null
2025  referrer-policy-implementation-and  not-stated    not-stated  accept-and-reject  landing-plus-subpages  Chrome                                                               null
2025  sheeps-clothing-wolfish-intent-aut  both          not-stated  not-stated         landing-plus-subpages  Chrome                                                               3
2026  bridges-to-self-silent-web-to-app-  not-stated    not-stated  accept-all         landing-page-only      (empty)                                                              null
statefulness: not-stated=7, stateless=2, both=1
headless: not-stated=8, headless=2
consentAction: accept-all=4, not-stated=3, accept-and-reject=2, no-interaction=1
interactionDepth: landing-plus-subpages=7, landing-page-only=3
browsers: Chrome=5, (empty)=2, Chrome+mobile-emulated browser=1, Chromium=1, Puppeteer/TRC desktop browser+Puppeteer/TRC emulated mobile browser=1
subpagesPerSite: null=4, 10=1, 15=1, 20=1, 3=1, 5=1, 9=1
Papers with a crawlConfig object at all: 10 of 10.
 
=== G. What the ten papers measured, verbatim, with each paper's own denominator ===
 
detection[].prevalence, printed unaggregated. Ten papers with ten denominators do not add up, and
`metric` names the unit, not the population -- read the quote, not the metric.
 
2021  PETS/2021/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion  (8 of 8 detection tuples carry a prevalence string)
  - [share of websites] 9.98% of the top 10,000 websites employed at least one CNAME-based tracker.
      quote (introduction): "9.98% of the top 10,000 websites employ at least one CNAME-based tracker."
  - [relative increase in publishers] 21% growth over 22 months, compared with −3% and −8% for comparison tracker groups.
      quote (results): "the CNAME-based trackers are rapidly gaining popularity, with a growth of 21% over the past 22 months"
  - [share of sites with leaks] 95% of sites with an identified CNAME tracker had one or more cookie leaks.
      quote (results): "We identified one or more cookie leaks on 7,377 sites (95%) out of the 7,797 sites where we could identify the presence of at least one CNAME-based tracker."
  - [sites leaking sensitive information] 13 of 50 successfully registered sites leaked sensitive information.
      quote (methodology): "In total, we found that on 13 of these websites sensitive information leaked to a CNAME tracker."
  - [number of leaked cookies and sites] 166 cookies on 94 distinct sites were sent in POST bodies.
      quote (results): "We found that 166 cookies (on 94 distinct sites) set by another party were sent to a CNAME tracker's subdomain in a POST request body."
  - [number of leaks and sites] 1,899 cookie leaks on 1,295 distinct sites.
      quote (results): "We found 1,899 cookie leaks in request URLs to CNAME subdomains on 1,295 distinct sites."
  - [number of websites] 19 websites requested active content over HTTP; 72 sent analytics over HTTP from HTTPS pages.
      quote (results): "we did identify 19 websites where active content, i.e. HTML or JavaScript, was requested from the tracker over an insecure connection."
  - [number of vulnerable trackers] Two different trackers had vulnerabilities affecting publishers that included them.
      quote (methodology): "For up to maximum 30 minutes per tracker, we analyzed the requests and responses to/from the CNAME subdomain for client-side web vulnerabilities."
 
2022  USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission  (4 of 4 detection tuples carry a prevalence string)
  - [number of distinct websites] 1,844 EU websites and 2,950 US websites
      quote (abstract): "Our crawler finds and fills email and password fields, monitors the network traffic for leaks, and intercepts script access to filled input fields."
  - [number of distinct websites] 52 websites in follow-up crawls without password input-type swapping
      quote (results): "We found that passwords are collected by trackers on 52 distinct websites even for users who do not use ShowPassword or similar extensions."
  - [number of domains and percentage increase] 41 tracker domains; 13.4% EU and 4.2% US increase in leaky websites
      quote (methodology): "we uncover 41 tracker domains that are not listed in any of the popular blocklists."
  - [received emails and source websites] 290 emails from 88 desktop-crawl sites in six weeks
      quote (results): "In the six-week period following the crawls, we received 290 emails from 88 distinct sites on the email addresses used in the desktop crawls"
 
2023  USENIX/2023/is-your-wallet-snitching-on-you-an-analysis-on-the-privacy-implications-of-web3  (5 of 5 detection tuples carry a prevalence string)
  - [websites with wallet-API calls] 1,325 of 96,905 successfully crawled websites
      quote (results): "We found 1, 114 unique scripts on 1, 325 websites which made in total 1, 517 JavaScript calls to at least one wallet APIs listed in Table 1."
  - [fingerprinting scripts and websites] 878 scripts belonging to 1,099 websites
      quote (results): "we find that 878 scripts (79%) belonging to 1, 099 websites (83%) engage in browser fingerprinting and leverage wallet information to enhance the fingerprints they generate."
  - [connected DApps leaking wallet addresses] 211 of 616 connected DApps (35%)
      quote (results): "Our framework identified 211 unique DApp websites (35% of the connected DApps) which leak the user's wallet address across 137 unique third-parties."
  - [wallet extensions leaking wallet addresses] 13 of 100 extensions
      quote (results): "We found 13 out of 100 analyzed extensions which leak the user's wallet address to at least one of 24 third-parties."
  - [blocked third parties] 60 of 108 checked third parties (56%) blocked by all five combined
      quote (results): "the combination of all five blocklists results in blocking 60 third-parties (56%)"
 
2024  IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites  (8 of 8 detection tuples carry a prevalence string)
  - [number of verified websites] 2,004 websites in 48 languages
      quote (results): "Our final list contained 2,004 websites in 48 distinct languages after eliminating false positives and deduplicating websites by their registrable domain"
  - [share of crawled pages with ads] 36% of pages contained one or more ads
      quote (results): "An average of 36% of the pages contained one or more ads"
  - [share of pages and disclosed ads] 27% of crawled pages; 73% of 40,281 disclosed ads
      quote (results): "targeting was enabled for 73% of the ads with disclosures"
  - [share of sites with tracker domains] around 90% of websites
      quote (results): "We find that around 90% of the websites have at least one tracker domain, and over 93% embed at least one third-party domain."
  - [share of sites] 9% in Frankfurt and 10% in NYC desktop crawls
      quote (results): "we detect fingerprinting scripts on 176 (9%) and 218 (10%) websites in Frankfurt and NYC crawls, respectively."
  - [number of ads] 1,003 improper ads across 311 distinct websites
      quote (results): "Table 5 shows the number of improper ads identified in each crawl, amounting to 1,003 across 311 distinct websites."
  - [flagged links] 149 of nearly 3,940 links flagged malicious or phishing
      quote (results): "149 of the nearly 3,940 scanned links were flagged as malicious or phishing by at least one scan engine."
  - [accuracy and error shares] 85% correctly detected; 7.5% false non-ads and 7.5% blank or empty ads
      quote (evaluation): "The crawler correctly detected ads in 85% of cases, misidentified non-ads in 7.5%, and captured blank or empty ads in 7.5%."
 
2024  PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework  (8 of 8 detection tuples carry a prevalence string)
  - [share of publishers] 821 of 10,000 publishers (8.2%) in Crawl 1
      quote (results): "In Crawl 1 we detected the presence of the USP API on 821 (8.2%) publishers."
  - [share of publishers] 358 of 10,000 publishers (3.6%) stored a USP String in a cookie
      quote (results): "In our data from Crawl 1 we detect the USP String value being stored in a cookie on 358 (3.6%) publishers out of 10 K"
  - [share of requests containing injected opt-out value] 354,416 of 421,497 requests (84.1%) contained 1YYN
      quote (results): "421,497 HTTP requests contained a URL with a USP parameter, of which 354,416 (84.1%) contained our chosen USP String value of 1YYN."
  - [share of A&A chains rooted at USP-API publishers] 218,541 of 1,214,540 chains (17.9%) contained at least one USP String transmission
      quote (results): "There are 1,214,540 A&A inclusion chains rooted in the 821 publishers that implement the USP API, of which 218,541 (17.9%) contained at least one HTTP request transmitting the USP String."
  - [share of A&A pairs sharing in every chain] 47.1% of A&A pairs shared the USP String in all observed chains
      quote (results): "only 47.1% of A&A pairs share the USP String in all chains in which they appear."
  - [share of USP-API publishers setting opt-out] 380 of 825 publishers (46.1%) set the USP String to opt-out
      quote (results): "In Crawl 3, when GPC was enabled, 380 out of 825 (46.1%) publishers with the USP API set the USP String to opt-out."
  - [tracking pixels per publisher] No statistically significant reduction for most crawl comparisons
      quote (results): "GPC and a USP String set to opt-out do not significantly reduce the number of tracking pixels embedded in publishers"
  - [false-positive and false-negative rates] 2% false positives; zero false negatives in sampled negatives
      quote (methodology): "Our crawler successfully detected the USP API on 49 websites, yielding a false positive rate of 2%."
 
2024  WWW/2024/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting  (6 of 6 detection tuples carry a prevalence string)
  - [share of visited pages] 9.2% of visited pages
      quote (results): "Table 5 shows that 9.2% of the pages our crawler visited were flagged as fingerprinting."
  - [share of authentication pages] 10.2% of login and sign-up pages
      quote (results): "when we consider only login and sign-up pages, the percentage rises slightly to 10.2%"
  - [share of fingerprinting homepages] 93.10% of fingerprinting homepages
      quote (results): "nearly every homepage that performs fingerprinting engages in canvas fingerprinting (93.10%)."
  - [share of fingerprinting scripts] 50.50% on login pages and 55.65% on sign-up pages
      quote (results): "home pages have the highest rate of tracking at 61.46%, compared to login pages at 50.50% and sign-up pages at 55.65%."
  - [share of domains fingerprinting on both pages] 505 of 515 domains (98.06%)
      quote (results): "Of these 515 domains, 505 (98.06%) used scripts from the same set of third parties"
  - [manually inspected websites] Disruptions observed on deezer.com and hepsiburada.com
      quote (results): "Due to the scalability challenges, we conducted a manual inspection of 30 websites where fingerprinting attempts were detected on login pages."
 
2025  IMC/2025/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th  (7 of 7 detection tuples carry a prevalence string)
  - [share of successfully crawled sites] 12.7% of 16,276 popular sites; 9.9% of 17,260 tail sites
      quote (results): "Of the 16,276 popular sites crawled successfully, 2,067 (12.7%) of them extracted at least one fingerprintable canvas."
  - [number of unique fingerprinting canvases and site reach] 504 popular-site canvases and 288 tail-site canvases
      quote (results): "Popular sites generated a total of 504 unique fingerprinting canvases, and tail sites generated 288."
  - [sites linked to vendors] Akamai reached 485 popular and 205 tail sites; FingerprintJS reached 462 and 298
      quote (results): "Akamai has the greatest reach of any one fingerprinting service. Its unique test canvas was generated on 485 (23%) popular sites and 205 (12%) tail sites."
  - [share of test canvases] 45% of top-20k and 37% of tail test canvases matched at least one list
      quote (results): "Nearly half (45%) of test canvases in the top 20k sites and over one-third (37%) in the tail 20k sites are generated by a script that has been included in one of the three lists."
  - [reduction in generated test canvases and sites] The number of test canvases and sites decreased by about 5%.
      quote (results): "Under both crawls with ad blockers, the number of test canvases generated, and the number of sites that generate at least one test canvas, only decreased by about 5%."
  - [share of fingerprinting sites] 49% of top-20k and 52% of tail sites had a first-party-rendered test canvas
      quote (results): "49% of the top 20k and 52% of the tail 20k sites engaging in canvas fingerprinting have at least one test canvas rendered by a script that is served first-party."
  - [share of fingerprinting sites] 45% had at least one test canvas generated and extracted twice
      quote (results): "Nearly half of them perform this canvas inconsistency check: 45% of them have at least one test canvas that was generated and extracted twice."
 
2025  PETS/2025/referrer-policy-implementation-and-circumvention  (6 of 6 detection tuples carry a prevalence string)
  - [share of distinct websites] 48.38% of websites implemented document-wide referrer policies
      quote (abstract): "Our findings reveal that 48.38% of websites implement document-wide referrer policies"
  - [share of distinct websites] 13.39% of websites applied element-specific referrer policies
      quote (abstract): "13.39% apply element-specific referrer policies."
  - [share of distinct websites] 77.20% of websites had at least one circumvention
      quote (results): "RP circumventions were identified on 77.20% of the websites (Table 10) and in 11.57% of the third-party requests"
  - [share of distinct websites] 21,084 websites, or 76.91%, had full URL circumventions
      quote (results): "Circumventions with full URL leaks were observed in 21,084 websites, corresponding to 76.91% of the studied websites."
  - [share of distinct websites] 2,704 websites, or 9.86%, had partial URL circumventions
      quote (results): "Circumventions with partial URL (path and/or query), on the other hand, were detected on 2,704 websites (9.86%)"
  - [share of distinct websites] location.href was accessed on 89.63% of SF-crawled websites
      quote (results): "The location.href property, which contains the full URL, was accessed on 89.63% of the websites."
 
2025  PETS/2025/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic  (4 of 4 detection tuples carry a prevalence string)
  - [share of collected advertisements] 35.87% of ads were problematic
      quote (conclusion): "Overall, 35.87% of the ads were found to be problematic."
  - [difference in problematic-ad proportions] 13.6% overall increase; 17.6% US and 21.8% under-18
      quote (introduction): "Our findings reveal a significant increase of 13.6% in the number of problematic ads shown to ABP's users on average compared to users with no adblocker installed"
  - [share of under-18 advertisements] 9.57% of ads shown to underage users violated regulations
      quote (conclusion): "9.57% of ads shown to underage users violated regulations"
  - [problematic-ad ratio difference] 34% increase, from 0.49 control to 0.67 treatment
      quote (results): "we see a significant 34% increase in the problematic ad ratios from control (0.49) to treatment (0.67)."
 
2026  USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost  (5 of 5 detection tuples carry a prevalence string)
  - [number of sites establishing localhost connections] 15,819 EU sites and 17,368 USA sites
      quote (results): "When visited from the EU and the USA, our crawls identify 15,819 and 17,368 sites establishing localhost connections"
  - [share of localhost cases attributable to Meta] Meta accounted for 99.1% of EU cases and 99.2% of USA cases
      quote (results): "with Meta accounting for 99.1% of EU cases and 99.2% of the USA cases."
  - [share of HTTP(S) localhost cases attributable to Yandex] Yandex accounted for 95.0% of EU cases and 95.1% of USA cases
      quote (results): "of which Yandex is responsible for 95.0% and 95.1% of these cases, respectively."
  - [share of sites triggering communications without consent] Meta: 75.8% EU and 78.2% USA; Yandex: 84.4% EU and 83.5% USA
      quote (results): "localhost communications were triggered without user consent by Meta Pixel. Yandex Metrica triggered localhost communications on 84.4% (EU), 83.5% (USA) of websites without user consent."
  - [observed deployment span] Yandex observed since February 2017; discontinued June 3, 2025
      quote (results): "Yandex has used localhost channels since February 2017 ... until June 3rd 2025, when Yandex discontinued the practice"
 
=== H. Current-tool interpretation ===
 
The corpus identifies TRC users in 2021–2026. The complete 2021–2024 count is historical evidence; the 2025–2026 count is a provisional current-use signal, not a prevalence estimate for the field.
No query here claims that TRC supersedes OpenWPM. The repositories were checked separately for current maintenance and the page compares capture surfaces rather than ranking one as a standard.

trc_paper_detail.mjs prints the same ten papers' full crawlConfig, population and detection records, one field per line, and is not reproduced here because sections F and G above carry everything the page uses from it.

All 10 evidence quotes behind the adoption count were checked against /workspace/publications_dataset/data/fulltext/<year>/<venue>/<slug>/paper.cols.txt. The first run reported “2 exact, 8 partial, 0 not located” and explained every partial as a repaired-column artefact. Both halves of that were wrong, and the checker is now stricter in two ways (§10.2, §10.3):

• Anchored windows. A sliding-window match is not a check unless the window contains the phrase the claim rests on. Every accepted window must now contain tracker radar collector in normal or compacted form; a run matching only outside it is graded unanchored and counted separately. The window search also now runs to 12 words.
• Case-explicit grading. normal() lowercases, so exact had always meant case-insensitive-exact. The checker now also tests the raw source and reports exact-except-case separately.

The result is now 1 verbatim, 1 exact except capitalisation, 8 partial, 0 unanchored, 0 not located.

So six of the partials are extraction or column-repair artefacts and three quotes are edited fragments that drop a leading clause and recapitalise a word. None is a fabrication and none is unlocatable, but the page no longer describes any of them as verbatim.

Pass (b) checked every clause of every row of the ten-paper table against that paper's own full text — the long technical lists (“inner-page discovery, email/password filling, Fathom and Consent-O-Matic, browser-API/cookie/request collection, CDP breakpoints with JavaScript stacks, WebSocket capture and POST/input observations” and the like), which are exactly where a weak model confabulates. Every clause was supported. No confabulated clause in any row. That is the strongest single result of this review and it is worth recording as a pass, not just as an absence of findings.

Read in the papers, not taken from detection[].prevalence, because metric names the unit and often not the population.

A regex note, recorded because it nearly produced a false finding. The first probe for the wallet paper's denominator was 96,?905 over whitespace-collapsed text and returned zero hits in every rendering — which looked like the extraction had invented a denominator. The PDF renders it 96, 905: comma, space, digits. Widening to 96,?\s?905 found it in paper.txt, paper.cols.txt and paper.norm.txt. Collapsing whitespace is not enough when the digits themselves are split.

The page's install section is written from a real checkout and a real crawl, not from the README. What was run, in order:

git clone https://github.com/duckduckgo/tracker-radar-collector.git sandbox/trc
git -C sandbox/trc checkout 8b64006691a1ce3929cfdfeeb425e7cc64be6543
cd sandbox/trc && npm i --no-audit --no-fund      # added 445 packages in 5s
node ./cli/crawl-cli --help                        # published verbatim on the page
 
# CLI attempt, aarch64 host:
node ./cli/crawl-cli -u https://example.com -o /tmp/trcout -d requests,cookies,apis,targets -v
#   Error: Failed to launch the browser process!
#   rosetta error: failed to open elf at /lib64/ld-linux-x86-64.so.2
#   Max number of retries (2) exceeded for "https://example.com".
#   ✅ Finished successfully.   <-- on 0/1 successful crawls
#   Sucessful crawls: 0/1 (0.00%)
 
# Module route, which works:
TRC_UNSAFE_DISABLE_SANDBOX=1 \
PUPPETEER_EXECUTABLE_PATH=/workspace/.playwright/chromium-1234/chrome-linux/chrome \
node scripts/trc_smoke.mjs /workspace/artifacts/wiki/sandbox/trc out/trc_smoke
#   [trc] crawling https://example.com/
#   [trc] wrote out/trc_smoke/https_example_com_.json
#   [trc] crawling https://www.wikipedia.org/
#   [trc] wrote out/trc_smoke/https_www_wikipedia_org_.json
 
# and one consent run, against a site with a real CMP:
#   collectorFlags: {autoconsentAction: 'optOut'}, CookiePopupsCollector + CookieCollector
#   -> cookiepopups keys ["cmps","performance","scrapedFrames"]
#      cmps: [{"final":false,"name":"Sourcepoint-frame","open":false,"started":false,
#              "succeeded":false,"selfTestFail":false,"errors":[],"patterns":[],
#              "snippets":[],"filterListMatched":false}]
#      3 cookies set anyway

Two facts about this that belong in a log rather than on the page:

• The <file javascript trc_smoke.mjs> block on the content page is byte-identical to the committed scripts/trc_smoke.mjs. The committed file was regenerated from the page block and the published block was then downloaded from ?do=export_code and run verbatim: it produced both JSON files. A published script that is an abridged sample of the real one has caused a defect on this wiki before.
• The published example.com JSON is a real capture, but size is not reproducible. A second run of the same script against the same URL gave size: 474 where the published block says 473, with an identical responseBodyHash. That is what led to the encodedDataLength pitfall on the page: RequestCollector.js sets request.size = data.encodedDataLength from Network.loadingFinished — wire bytes including headers — and coerces negatives to null with the comment “make sure we can use unsigned int for this field in clickhouse”. The discrepancy is disclosed on the page rather than hidden by re-pasting the second run.

Every external fact re-fetched on 2026-09-03. Claims about the output schema come from source files and from real output, never from a README summary.

• SEO “best scraper” and “top web crawler” listicles: no source-level schema or Tracker Radar provenance. Not used for architecture, currency or recommendations. Carried over from the first run's rejection list, and re-affirmed.
• Unverified vendor summaries and search-result snippets: discovery at most, never primary evidence for a maintenance claim.
• “TRC is the industry or research standard”: rejected. The repositories show an active project; the corpus has 10 identified research users under the narrow query and no matched comparison.
• The TRC README as a source for defaults. Rejected during this run, having been accepted during the first. It is stale on maxLoadTimeMs (2022-01-13, never updated; code changed 2025-07-08), on the “hard limit of 38” crawlers (removed in 963f9ec, 2025-04-16) and on a browserContext option the code does not have. Two of the four review passes independently re-confirmed the README's 30 s rather than the code's 60 s, so this is not a mistake only a cheap model makes.

• The corpus contains no formal TRC paper and no same-sample, same-browser, same-question comparison of TRC with OpenWPM or a plain Playwright crawl. Pass (d) searched for one specifically — regex sweeps for comparison language near crawler names over all 5,855 papers, plus an extraction join for papers naming OpenWPM together with Playwright, TRC or Puppeteer — and found two papers that compare crawler architectures without involving TRC ([14Ahmad, Syed Suleman; Dar, Muhammad Daniyal; Zaffar, Muhammad Fareed; Vallina-Rodriguez, Narseo; Nithyanand, Rishab (2020): "Apophanies or Epiphanies? How Crawlers Impact Our Understanding of the Web", in: Proceedings of The Web Conference, pp. 271-280. (DOI)], [15Sánchez-Rola, Iskander; Bilge, Leyla; Balzarotti, Davide; Buescher, Armin; Efstathopoulos, Petros (2023): "Rods with Laser Beams: Understanding Browser Fingerprinting on Phishing Pages", in: Proceedings of the USENIX Security Symposium. (Link)]). Both are now cited on the page. The negative claim is scoped to “no paper in these seven venues compares TRC with another instrument on the same sample”, never to “nobody has compared crawlers”.
• The 10/1,120 figure is adoption in seven selected venues under an extraction query. It is not field prevalence, commercial usage, or a share of all web measurement.
• The 2025–2026 slice is provisional and cannot support an end-of-year trend.
• Whether DuckDuckGo has said anything publicly about tracker-radar-detector's dormancy. No archive flag, no README notice, nothing either way. The page states the dormancy as an observed fact and draws no conclusion about intent.
• Whether screenshots and trace behave as described, and whether the fork-only capabilities do. Those rows are checked against source only; requests, cookies, apis, targets and cookiepopups were checked against real output.
• The extraction's crawlConfig, ethics and artifacts objects share one evidence quote per paper, so no single key in the crawlConfig survey is independently quote-checked. The page says so in a box rather than presenting the row totals as verified per-key counts.
• No performance benchmark was run. One two-site crawl proves the tool starts and what it emits; it says nothing about throughput, failure rates at scale, or bot detection.

Five passes over the published pages, each told explicitly that the author's context might not be exhaustive and to verify from primary sources. Every pass was handed the page text, the provenance text, the report script, its real output, the recall probe and its output, and the two neighbouring pages. Findings are recorded whether accepted or rejected: a rejection is the only record of whether a reviewer earns its slot.

X14 (the revision-log timing of the first run) and X17 (the script repairs) are recorded in §1.1 and §10.2 rather than as page changes. X19 is §6.2.

Re-ran the report independently and confirmed byte-identity with both the committed output and the <file text> block on the published provenance page (one trailing blank line apart). Hand-verified every per-year denominator, numerator and percentage, the 6/4 window split, the 21/11 paper-level figures, the 9 = 4 + 5 string audit, and that all 10 TRC papers are inside CRAWLED. Confirmed no shelled-out or back-calculated denominator anywhere in the script.

Checked all 14 published keys, the render on both pages, a DOI-and-title duplicate scan, BibTeX hygiene, every author list and DOI against a primary source, all 10 quotes by hand, and every clause of every row of the ten-paper table.

Fetched rather than recalled: three fresh clones, npm ci, a real –help, a real crawl, the Node release schedule, the npm registry and all three repository links.

Read the openwpm page in full, cloned OpenWPM (v0.36.0, HEAD 61d285f), and checked every cell of the comparison table against both.

It returned after the pages were already published, and it justified its slot: twelve findings on a page four focused passes had cleared, including the one boundary the whole page is about. Every finding was verified against the paper or the repository before being accepted, and every one was accepted.

A guard that never fires asserts nothing, so the new line was tested in both directions instead of read. The first attempt was misleading and is worth recording: forcing maxLoadTimeMs: 1 makes crawl() throw a TimeoutError outright, because maxTotalTimeMs = maxLoadTimeMs * 2 + collectorExtraTimeMs kills the whole crawl before the inner path runs — no result, no file, guard never reached. That would have “passed” while proving nothing.

The reachable path needs maxLoadTimeMs large enough that maxTotalTimeMs still covers the 2.5 s settle. crawler.js catches a navigation TimeoutError at line 338, sends Page.stopLoading, sets timeout = true at line 349, and carries on collecting, returning a partial result at line 380. Reproduced with a local server serving a page whose image handler sleeps 12 s, and maxLoadTimeMs: 5000:

# with the guard:
[trc] crawling http://127.0.0.1:8099/
   [log] Page navigation timeout
  if (data.timeout) throw new Error(`${u} hit the crawler's timeout path; capture is partial`);
Error: http://127.0.0.1:8099/ hit the crawler's timeout path; capture is partial
--- files written: (none)

# same run with the guard line deleted:
[trc] crawling http://127.0.0.1:8099/
[trc] wrote /tmp/trcout7/http_127_0_0_1_8099_.json
/tmp/trcout7/http_127_0_0_1_8099_.json timeout = True | requests: 2

So the guard does real work: without it the script announces success over a two-request partial capture. The published block and scripts/trc_smoke.mjs were then re-synchronised and the amended script re-run against the two live sites to confirm it still completes normally.

Worth reading before re-checking anything. It independently reproduced the rendered-DOM audit on both pages (all anchors resolve, zero real red links — it correctly identified that the one wikilink2 string on this page is literal text inside a code block — no list item containing preformatted text, no uneven table rows, all four WRAP boxes rendering as plugins, the footnote rendering, and the citekey-to-reference counts on both pages); confirmed the –help block is byte-identical to the real command at the pinned commit; and re-verified some thirty repository facts including the user-agent constants, the viewports, VISUAL_DEBUG, the 60000/2500 defaults, the UA and browser-close gating, the unconditional downloadChrome, the size coercion and its clickhouse comment, the saveHeaders default, the responseReceivedExtraInfo listener that makes set-cookie real, filterListMatched being written once and only read, and 82 commits since 2026-01-01 (so “actively developed” holds). It also established that example.com currently returns none of the nine safelisted headers, so the empty responseHeaders in the published output is correct rather than a capture failure — a check nobody else thought to make. On the index page it confirmed the diff contains only the three intended edits and that the 9/1/1 footnote split matches the reconcile output.

• Reviewed and rewrote rather than replaced. The first pass's corpus work was sound and its structure was reasonable. Every figure it published survived — though not everything its script printed about those figures — and roughly half its non-corpus prose did not. The page kept its skeleton and gained an install section, a pitfalls box, three new subsections and two new citations.
• Edited a neighbour. Fixing programming:crawler's 21-row label and its “38 crawlers” bullet is outside a strict reading of “review this page”, but publishing a contradiction and leaving the wrong side live would have been worse. tool_fold.mjs was deliberately not changed (§2.2).
• Did not aggregate the measured results. detection[] has 61 prevalence strings across the ten papers. Three are published, each with the denominator read out of the paper. A “TRC papers find X% of sites do Y” number would have been the most quotable thing on the page and the least defensible.
• Published a real crawl of two live sites and one CMP site. Three page loads of public homepages, no login, no interaction beyond the consent action the collector performs. The scraped button text from that run is described but not published, because it is third-party page content.
• Kept the size: 473 block and disclosed the 474. Re-running until the numbers matched would have hidden the finding that produced the pitfall.
• Left the corpus figures alone. The temptation on a “least-verified page” review is to find something wrong with the numbers. Four passes and an independent probe say the numbers are right, and that is the finding.
• No ~~DISCUSSION~~ on this page, following the first run's call and the rest of the provenance: namespace: comments belong on the content page.

cd /workspace/artifacts/wiki
node scripts/report_tracker_radar_collector.mjs   # every corpus figure on the page
node scripts/trc_review_probe.mjs                 # recall, independent of the extraction
node scripts/trc_index_reconcile.mjs              # the 10-versus-21 split
node scripts/trc_paper_detail.mjs                 # full per-paper crawlConfig/population/detection

The four corpus reports are deterministic against the mounted run1 extraction. trc_smoke.mjs needs a TRC checkout and a Chromium of the host architecture, and is not deterministic: timestamps, time and size move. If the corpus changes, refresh the outputs, re-run the quote checks and update this log before changing a figure on the content page.

[1]

Dimova, Yana; Acar, Gunes; Olejnik, Lukasz; Joosen, Wouter; Van Goethem, Tom (2021): "The CNAME of the game: Large-scale analysis of DNS-based tracking evasion", Proceedings on Privacy Enhancing Technologies 2021:394–412. (DOI) (Link)

[2]

Senol, Asuman; Acar, Gunes; Humbert, Mathias; Zuiderveen Borgesius, Frederik (2022): "Leaky Forms: A Study of Email and Password Exfiltration Before Form Submission", in: 31st USENIX Security Symposium (USENIX Security 22). (Link)

[3]

Ferreira Torres, Christof; Willi, Fiona; Shinde, Shweta (2023): "Is Your Wallet Snitching On You? An Analysis on the Privacy Implications of Web3", in: 32nd USENIX Security Symposium (USENIX Security 23). (Link)

[4]

Moti, Zahra; Senol, Asuman; Bostani, Hamid; Zuiderveen Borgesius, Frederik J.; Moonsamy, Veelasha; Mathur, Arunesh; Acar, Gunes (2024): "Targeted and Troublesome: Tracking and Advertising on Children's Websites", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[5]

Aziz, Muhammad Abu Bakar; Wilson, Christo (2024): "Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[6]

Senol, Asuman; Ukani, Alisha; Cutler, Dylan; Bilogrevic, Igor (2024): "The Double Edged Sword: Identifying Authentication Pages and their Fingerprinting Behavior", in: Proceedings of the ACM Web Conference 2024. (DOI)

[7]

Luo, Elisa; Ritter, Tom; Savage, Stefan; Voelker, Geoffrey M. (2025): "Canvassing the Fingerprinters: Characterizing Canvas Fingerprinting Use Across the Web", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[8]

Zagi, Luqman; Moti, Zahra; Acar, Gunes (2025): "Referrer Policy: Implementation and Circumvention", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[9]

Roongta, Ritik; Jose, Julia; Habib, Hussam; Greenstadt, Rachel (2025): "Sheep's Clothing, Wolfish Intent: Automated Detection and Evaluation of Problematic 'Allowed' Advertisements", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[10]

Vlummens, Tim; Girish, Aniketh; Weerasekara, Nipuna; Zuiderveen Borgesius, Frederik; Acar, Gunes; Vallina-Rodriguez, Narseo (2026): "Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost", in: Proceedings of the USENIX Security Symposium. (Link)

[11]

DuckDuckGo, (2026): "Tracker Radar Collector". GitHub repository. Source and README checked at main commit 8b64006691a1ce3929cfdfeeb425e7cc64be6543 on 2026-08-14 (Link)

[12]

DuckDuckGo, (2026): "DuckDuckGo Tracker Radar". GitHub repository and data model. README and docs/DATA_MODEL.md checked at main commit a1d894db2312f3fdeea06d6c784739b97eb727c8 on 2026-08-14 (Link)

[13]

DuckDuckGo, (2026): "DuckDuckGo Tracker Radar Detector". GitHub repository. README and build scripts checked at main commit 0f6eb7db39bbf7cf7357db7279535941e1c0eb4b on 2026-08-14 (Link)

[14]

Ahmad, Syed Suleman; Dar, Muhammad Daniyal; Zaffar, Muhammad Fareed; Vallina-Rodriguez, Narseo; Nithyanand, Rishab (2020): "Apophanies or Epiphanies? How Crawlers Impact Our Understanding of the Web", in: Proceedings of The Web Conference, pp. 271-280. (DOI)

[15]

Sánchez-Rola, Iskander; Bilge, Leyla; Balzarotti, Davide; Buescher, Armin; Efstathopoulos, Petros (2023): "Rods with Laser Beams: Understanding Browser Fingerprinting on Phishing Pages", in: Proceedings of the USENIX Security Symposium. (Link)

[16]

Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)