Working notes behind Filter Lists: every query with its population, the scripts and their unedited output, the folds and their residue, the quotes checked against paper full text, the external sources verified and the ones rejected, and the judgement calls. Corpus-level caveats — how the extraction was made, what it is and is not good for — are on corpus and are not repeated here.

This is a working log, not prose. It is read by someone checking a number.

Reproduce:

node scripts/report_filter_lists.mjs --run /workspace/publications_dataset/data/extract/run1
bash scripts/external_checks_filter_lists.sh
python3 pages/filterlist_provenance.py > /dev/null   # counts go to stderr

There is no field in the extraction meaning “used a filter list”. The population is built by hand:

• take every tools[] entry and every classification[].resourceName whose usedOrMentioned is used or produced;
• fold the raw string through LIST_FAMILIES in req_fold.mjs;
• keep the paper if any family it matches has kind === “list”.

kind matters and is the reason the number is not larger. Four kinds exist in the fold and only one qualifies a paper:

Why mentioned and compared are excluded. A paper that beats EasyList is not a paper that adopted it. The 18 excluded are 8.4% of the 216 a raw name search would score as adoption.

Difference from Requests. That page's “S1” signal reports 197 where this reports 198, with per-list counts differing by one or two. Both scripts share req_fold.mjs, so the fold is identical; the difference is the membership rule. report_requests.mjs builds S1 inside a population that is then intersected with a request-classification task fold and reported after that page's own exclusions; report_filter_lists.mjs takes every paper the fold fires on, with no topic restriction. Neither is wrong. The delta is published on both pages rather than reconciled, because the honest lesson is that a population definition moves a count by a percent or two and belongs in the provenance.

Each row names the population it counts over. “5,859” is never the denominator except in the two rows that say so.

Sentinels. not-applicable and none-reported are printed as themselves in the validation table and never folded into a stated value. They are the two largest rows and that is the finding. The validation rows overlap and must not be added: 11 papers carry both a sentinel and a real value, so 69 + 61 is not 130 papers that failed to validate. The script computes the paper-level figure separately — 119 of 167 (71.3%) carry nothing but sentinels — and that is the number the page publishes. The same applies to the three granularity groups: 17 papers are in more than one, so 60.5% + 31.7% + 18.0% correctly exceeds 100% and the page says so. The version query has no sentinel to mishandle — tools[].version is either null or a string — but note that a null does not mean the paper gave no version, only that the extraction did not attach one to that tool entry. The page says so.

scripts/report_filter_lists.mjs. Every number in the Use in Publications section of the page is a line of this output. Section 3's per-paper roster and section 4's learned-classifier roster are the checkable evidence behind the two claims the page leans hardest on.

report_filter_lists-output.txt

corpus: 5859 papers, 7 venues, 2010-2026
generated by scripts/report_filter_lists.mjs


=== 1. POPULATION =======================================================
   corpus                                                     5859 
   USED or PRODUCED a filter list  == POPULATION               198 3.4% of corpus
     ... named in tools[]                                      178 
     ... named in classification[].resourceName                167 
     ... in both                                               147 
     ... tools[] only (instrument, never a labelling step)      31 
   named a list but only MENTIONED / COMPARED (excluded)        18 


=== 2. WHICH LISTS, FOLDED  (denominator: the population above) =========
   denominator: 198 papers that used or produced a filter list
   (a paper naming several lists is counted under each, so shares do not sum to 100%)
   list family                                              papers  share   spellings  unfolded
   EasyList                                                    112   56.6%         28        92
   EasyPrivacy                                                  71   35.9%         22        58
   Disconnect                                                   48   24.2%         23        26
   Ghostery / WhoTracks.me                                      34   17.2%          9        20
   hosts-file lists (hpHosts, AdAway, MoaAB, Pi-hole, NoTrack, …)     27   13.6%         33         3
   Adblock Plus (lists shipped with it)                         26   13.1%          8        20
   uBlock Origin (lists)                                        17    8.6%         11        13
   DuckDuckGo Tracker Radar (list)                              15    7.6%          9         8
   unnamed / aggregated filter lists                            10    5.1%         10         1
   AdGuard                                                       8    4.0%         13         4
   EasyList annoyance / anti-adblock variants                    7    3.5%          8         2
   anti-adblock scripts and services                             3    1.5%          4         1
   cryptomining lists (NoCoin, CoinBlockerLists, MinerBlock)      3    1.5%          4         3
   Acceptable Ads exception list                                 1    0.5%          1         1

-- engines and parsers named (used|produced) — these are NOT lists and do not qualify a paper
   tracker-radar-collector (crawler, not a list)                10 
   adblockparser (Python)                                        9 
   adblock-rust (Brave engine)                                   7 
   uBlock Origin Core (engine)                                   2 
   abp-blocklist-parser / BlockListParser                        1 
   Adblock Plus library (Android)                                1 


=== 3. WHAT THE LIST IS USED TO LABEL  (denominator: papers with >=1 list-backed classification tuple) 
   denominator: 167 papers
   web-request                                                 101 60.5%
   domain                                                       53 31.7%
   cookie                                                        8 4.8%
   website-category                                              7 4.2%
   javascript                                                    5 3.0%
   other                                                         3 1.8%
   fingerprinting-script                                         3 1.8%
   network-traffic                                               2 1.2%
   consent-notice                                                2 1.2%
   email-message                                                 1 0.6%

-- grouped by granularity
   The list's own unit — a URL pattern evaluated with request context    101 60.5%
   Coarser than the list — a hostname or eTLD+1; path, resource-type and $third-party options are discarded     53 31.7%
   Objects a filter list was not written to label — the list supplies provenance, not a rule match     30 18.0%
   granularity-fold residue (targets in no group): (none)
   papers in MORE THAN ONE granularity group (so shares exceed 100%)     17 of 167

-- the papers behind each non-request target, so the claim is checkable
   domain:
     2016 IMC/should-you-use-the-app-for-that-comparing-the-privacy-implications-of-app-and-we  [curated-database] "EasyList"
     2018 CCS/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea  [blocklist] "NoCoin"
     2018 IMC/a-long-way-to-the-top-significance-structure-and-stability-of-internet-top-lists  [blocklist] "MalwareBytes hpHosts ATS"
     2018 USENIX/who-left-open-the-cookie-jar-a-comprehensive-evaluation-of-third-party-cookie-po  [blocklist] "EasyList and EasyPrivacy"
     2019 IMC/a-longitudinal-analysis-of-the-ads-txt-standard  [curated-database] "WhoTracksMe"
     2019 IMC/shamfinder-an-automated-framework-for-detecting-idn-homographs  [curated-database] "hpHosts"
     2019 PETS/4-years-of-eu-cookie-law-results-and-lessons-learned  [curated-database] "Ghostery"
     2020 PETS/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix  [curated-database] "Disconnect"
     2020 WWW/beyond-the-front-page-measuring-third-party-dynamics-in-the-field  [curated-database] "WhoTracks.me"
     2020 WWW/the-representativeness-of-automated-web-crawls-as-a-surrogate-for-human-browsing  [blocklist] "Disconnect"
     2021 IEEE-SP/fingerprinting-the-fingerprinters-learning-to-detect-browser-fingerprinting-beha  [curated-database] "Disconnect tracking protection list"
     2021 PETS/blocking-without-breaking-identification-and-mitigation-of-non-essential-iot-tra  [blocklist] "Pi-hole Default"
     2020 IEEE-SP/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i  [blocklist] "Disconnect"
     2022 PETS/my-cookie-is-a-phoenix-detection-measurement-and-lawfulness-of-cookie-respawning  [blocklist] "Disconnect"
     2022 PETS/who-knows-i-like-jelly-beans-an-investigation-into-search-privacy  [curated-database] "Disconnect Tracker Protection lists"
     2022 USENIX/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission  [blocklist] "Disconnect, WhoTracks.me, DuckDuckGo, and uBlock Origin blocklists"
     2022 USENIX/ovrseen-auditing-network-traffic-and-privacy-policies-in-oculus-vr  [blocklist] "Pi-hole's Default List"
     2022 USENIX/when-sally-met-trackers-web-tracking-from-the-users-perspective  [curated-database] "Disconnect, WhoTracks.me, and webxray"
     2022 WWW/investigating-advertisers-domain-changing-behaviors-and-their-impacts-on-ad-bloc  [blocklist] "EasyList, EasyPrivacy, AdGuard, and Peter-Lowe's Blocklist"
     2023 IMC/understanding-the-privacy-risks-of-popular-search-engine-advertising-systems  [curated-database] "Disconnect Entity List"
     2023 PETS/evaluating-practical-quic-website-fingerprinting-defenses-for-the-masses  [curated-database] "DuckDuckGo Tracker Radar"
     2023 IEEE-SP/protected-or-porous-a-comparative-analysis-of-threat-detection-capability-of-iot  [curated-database] "EasyList"
     2023 USENIX/a-study-of-multi-factor-and-risk-based-authentication-availability  [curated-database] "Disconnect.me tracker list"
     2023 USENIX/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks  [curated-database] "Categorical BlockList"
     2023 PETS/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part  [curated-database] "WhoTracks.me"
     2024 IMC/diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc  [curated-database] "DuckDuckGo Tracker Radar"
     2023 WWW/the-hitchhikers-guide-to-facebook-web-tracking-with-invisible-pixels-and-click-i  [curated-database] "Disconnect.me list"
     2023 USENIX/rods-with-laser-beams-understanding-browser-fingerprinting-on-phishing-pages  [curated-database] "EasyPrivacy and other tracker lists"
     2023 WWW/who-funds-misinformation-a-systematic-analysis-of-the-ad-related-profit-routines  [blocklist] "Disconnect"
     2024 PETS/honesty-is-the-best-policy-on-the-accuracy-of-apple-privacy-labels-compared-to-a  [blocklist] "EasyList, EasyPrivacy, and WhoTracks.Me"
     2024 IMC/darkdns-revisiting-the-value-of-rapid-zone-update  [blocklist] "ten named blocklists"
     2024 PETS/connecting-the-dots-tracing-data-endpoints-in-iot-devices  [blocklist] "Disconnect + EasyList + DuckDuckGo Tracker Radar"
     2025 CCS/local-frames-exploiting-inherited-origins-to-bypass-content-blockers  [curated-database] "Disconnect entity list"
     2025 IMC/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th  [blocklist] "Disconnect"
     2025 IMC/cookieguard-characterizing-and-isolating-the-first-party-cookie-jar  [curated-database] "DuckDuckGo Tracker Radar"
     2025 PETS/johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on  [blocklist] "EasyList"
     2025 IMC/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog  [blocklist] "EasyList and EasyPrivacy"
     2025 PETS/referrer-policy-implementation-and-circumvention  [curated-database] "DuckDuckGo Tracker Radar entity-to-domains map"
     2025 PETS/empirically-measuring-data-localization-in-the-eu  [blocklist] "EasyList"
     2026 NDSS/cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews  [curated-database] "DuckDuckGo Tracker Radar"
     2025 WWW/before-after-the-effect-of-eus-2022-code-of-practice-on-disinformation  [curated-database] "DuckDuckGo Tracker Radar"
     2025 CCS/whispertest-a-voice-control-based-library-for-ios-ui-automation  [curated-database] "DuckDuckGo Tracker Radar"
     2025 CCS/exploiting-the-shared-storage-api  [curated-database] "Disconnect Tracker Protection list"
     2025 IEEE-SP/you-have-to-ignore-the-dangers-user-perceptions-of-the-security-and-privacy-bene  [blocklist] "uBlock Origin ad/tracker list"
     2025 PETS/tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we  [blocklist] "EasyList"
     2026 PETS/clicking-into-exposure-uncovering-privacy-risks-of-google-click-identifier-in-yo  [curated-database] "Disconnect tracking protection list"
     2026 PETS/from-syntactic-matching-to-taint-tracking-and-back-a-comparative-study-of-web-tr  [blocklist] "Disconnect"
     2026 PETS/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government  [curated-database] "DuckDuckGo Tracker Radar"
     2026 PETS/privacy-vs-profit-the-impact-of-googles-manifest-version-3-mv3-update-on-ad-bloc  [curated-database] "WhoTracks.me"
     2026 USENIX/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web  [curated-database] "Tracker Radar Entity Map"
     2024 IEEE-SP/to-auth-or-not-to-auth-a-comparative-analysis-of-the-pre-and-post-login-security  [blocklist] "Disconnect Tracker Protection List"
     2022 IEEE-SP/journey-to-the-center-of-the-cookie-ecosystem-unraveling-actors-roles-and-relati  [blocklist] "NextDNS blocklist"
     2023 IEEE-SP/detection-of-inconsistencies-in-privacy-practices-of-browser-extensions  [curated-database] "AdGuard Ad Filters and advertising/analytics provider lists"
   cookie:
     2014 CCS/your-online-interests-pwned-a-pollution-attack-against-targeted-advertising  [curated-database] "Ghostery"
     2019 PETS/4-years-of-eu-cookie-law-results-and-lessons-learned  [blocklist] "Ghostery and Disconnect intersection"
     2020 WWW/stop-tracking-me-bro-differential-tracking-of-user-demographics-on-hyper-partisa  [curated-database] "Disconnect.me"
     2022 WWW/et-tu-brute-privacy-analysis-of-government-websites-and-mobile-apps  [blocklist] "EasyList/EasyPrivacy"
     2023 IMC/thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web  [blocklist] "justdomains blocklist"
     2025 PETS/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and  [blocklist] "justdomains"
     2025 CCS/layered-overlapping-and-inconsistent-a-large-scale-analysis-of-the-multiple-priv  [blocklist] "EasyList"
     2025 PETS/unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie  [blocklist] "justdomains blocklist"
   website-category:
     2015 PETS/an-automated-approach-for-complementing-ad-blockers-blacklists  [blocklist] "Adblock Plus EasyList and EasyPrivacy"
     2014 USENIX/automatically-detecting-vulnerable-websites-before-they-turn-malicious  [curated-database] "hpHosts"
     2019 WWW/cookie-synchronization-everything-you-always-wanted-to-know-but-were-afraid-to-a  [blocklist] "EasyList"
     2023 CCS/you-call-this-archaeology-evaluating-web-archives-for-reproducible-web-security  [blocklist] "Disconnect"
     2024 PETS/generalizable-active-privacy-choice-designing-a-graphical-user-interface-for-glo  [curated-database] "Disconnect Tracker Protection lists"
     2025 IEEE-SP/only-as-strong-as-the-weakest-link-on-the-security-of-brokered-single-sign-on-on  [curated-database] "Tracker Radar Entity List"
     2025 WWW/welcome-to-the-dark-side-analyzing-the-revenue-flows-of-fraud-in-the-online-ad-e  [blocklist] "NextDNS Piracy Blocklist"
   javascript:
     2017 PETS/towards-seamless-tracking-free-web-improved-detection-of-trackers-via-one-class  [blocklist] "EasyList"
     2021 CCS/sugarcoat-programmatically-generating-privacy-preserving-web-compatible-resource  [blocklist] "Brave, EasyList, EasyPrivacy, uBlock Origin"
     2023 CCS/read-between-the-lines-detecting-tracking-javascript-with-bytecode-classificatio  [curated-database] "EasyList, EasyPrivacy, and Fanboy's Enhanced Tracking"
     2024 WWW/detecting-and-understanding-self-deleting-javascript-code  [blocklist] "EasyList"
     2021 IEEE-SP/detecting-filter-list-evasion-with-event-loop-turn-granularity-javascript-signat  [blocklist] "EasyList and EasyPrivacy"
   other:
     2019 WWW/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild  [blocklist] "CoinBlockerLists, NoCoin, and MinerBlock"
     2024 USENIX/purl-safe-and-effective-sanitization-of-link-decoration  [curated-database] "Brave, Firefox, AdGuard, and uBlock Origin lists"
     2024 IEEE-SP/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites  [heuristic-rules] "EasyList rules in custom AdCollector"
   fingerprinting-script:
     2021 WWW/cookie-swap-party-abusing-first-party-cookies-for-web-tracking  [curated-database] "Disconnect"
     2024 WWW/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting  [blocklist] "uBlock Origin Core"
     2025 PETS/unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie  [dynamic-analysis] "Disconnect tracker lists and JavaScript API calls"
   network-traffic:
     2022 IEEE-SP/measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clouds  [blocklist] "publicly-available blocklists"
     2023 PETS/everybodys-looking-for-ssomething-a-large-scale-evaluation-on-the-privacy-of-oau  [blocklist] "EasyPrivacy"
   consent-notice:
     2023 PETS/comparing-large-scale-privacy-and-security-notifications  [blocklist] "EasyList Cookie List"
     2024 USENIX/automated-large-scale-analysis-of-cookie-notice-compliance  [blocklist] "EasyList Cookie list"
   email-message:
     2025 PETS/gig-work-at-what-cost-exploring-privacy-risks-of-gig-work-platform-participation  [blocklist] "EasyList and EasyPrivacy"


=== 4. THE LIST AS GROUND TRUTH  (denominator: whole corpus — this is not restricted to the population) 
   papers whose classification.groundTruthSource names a filter list     96 
     ... as a share of the list-using population                88 of 198 = 44.4%

-- by target (papers)
   web-request                                                  45 46.9%
   domain                                                       36 37.5%
   javascript                                                    8 8.3%
   cookie                                                        6 6.3%
   other                                                         6 6.3%
   website-category                                              3 3.1%
   fingerprinting-script                                         2 2.1%
   ip-address                                                    1 1.0%
   privacy-policy                                                1 1.0%
   consent-notice                                                1 1.0%
   network-traffic                                               1 1.0%
   email-message                                                 1 1.0%

-- by list (papers)
   EasyList                                                     48 50.0%
   EasyPrivacy                                                  37 38.5%
   Disconnect                                                   20 20.8%
   hosts-file lists (hpHosts, AdAway, MoaAB, Pi-hole, NoTrack, …)     13 13.5%
   named generically, no list named                             13 13.5%
   Ghostery / WhoTracks.me                                       9 9.4%
   DuckDuckGo Tracker Radar (list)                               6 6.3%
   EasyList annoyance / anti-adblock variants                    4 4.2%
   uBlock Origin (lists)                                         4 4.2%
   unnamed / aggregated filter lists                             2 2.1%
   Adblock Plus (lists shipped with it)                          1 1.0%
   AdGuard                                                       1 1.0%
   Acceptable Ads exception list                                 1 1.0%

-- LEARNED classifiers (supervised-ml / unsupervised-ml / llm) whose ground truth is a filter list
   distinct papers                                              16 (22 tuples)
     2015 PETS/an-automated-approach-for-complementing-ad-blockers-blacklists  target=website-category  gt="Manual labels and Adblock Plus ABPexact labels"
     2017 IMC/the-ad-wars-retrospective-measurement-and-analysis-of-anti-adblock-filter-lists  target=javascript  gt="372 filter-list-matched anti-adblocking scripts plus remaining unmatched scripts"
     2018 IMC/characterizing-the-internet-host-population-using-deep-learning-a-universal-and  target=ip-address  gt="hpHosts, PhishTank, and MPDNS labels"
     2018 PETS/nomoads-effective-and-efficient-cross-app-mobile-ad-blocking  target=web-request  gt="EasyList and manually created mobile-ad rules"
     2019 CCS/adversarial-perceptual-ad-blocking-meets-adversarial-machine-learning  target=other  gt="filter-list-labeled screenshots"
     2020 IEEE-SP/adgraph-a-graph-based-approach-to-ad-and-tracker-blocking  target=web-request  gt="Labels derived from eight crowdsourced filter lists"
     2022 IEEE-SP/wtagraph-web-tracking-and-advertising-detection-using-graph-neural-networks  target=web-request  gt="Seven filter lists"
     2022 IEEE-SP/wtagraph-web-tracking-and-advertising-detection-using-graph-neural-networks  target=web-request  gt="Seven filter lists: EasyList, EasyPrivacy, Anti-Adblock Killer, Warning Removal List, Blockzilla, Peter Lowes's List, and Fanboy Annoyances List"
     2022 USENIX/khaleesi-breaker-of-advertising-and-tracking-request-chains  target=web-request  gt="EasyList and EasyPrivacy filter-list labels"
     2022 USENIX/webgraph-capturing-advertising-and-tracking-information-flows-for-robust-blockin  target=web-request  gt="filter-list labels"
     2023 CCS/cookiegraph-understanding-and-detecting-first-party-tracking-cookies  target=cookie  gt="EasyList, EasyPrivacy, Cookiepedia, and label propagation"
     2023 WWW/net-track-generic-web-tracking-detection-using-packet-metadata  target=network-traffic  gt="EasyList and EasyPrivacy labels"
     2024 CCS/blocking-tracking-javascript-at-the-function-granularity  target=javascript  gt="Function labels derived from EasyList/EasyPrivacy-labelled request call stacks"
     2024 USENIX/purl-safe-and-effective-sanitization-of-link-decoration  target=other  gt="Combined filter lists, Cookiepedia, and manually curated lists"
     2024 WWW/adflush-a-real-world-deployable-machine-learning-solution-for-effective-advertis  target=web-request  gt="eight aggregated filter lists"
     2025 NDSS/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector  target=web-request  gt="EasyList and EasyPrivacy; reconstructed exception-rule breakages"
     2025 NDSS/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector  target=web-request  gt="mixed tracker rules from uBlock Origin and AdGuard; functional fields"
     2025 PETS/beyond-the-request-harnessing-http-response-headers-for-cross-browser-web-tracke  target=web-request  gt="EasyList and EasyPrivacy labels"

-- denominator for that: papers running a LEARNED classifier, that also use a list
   list-using papers running any learned classifier             62 
     ... of which a filter list is the stated ground truth      15 24.2%
     ... of which some OTHER source is the stated ground truth     47 


=== 5. VALIDATION OF LIST-BACKED CLASSIFICATION  (denominator: papers with >=1 list-backed classification tuple) 
   denominator: 167 papers  (a paper with several tuples appears in several rows)
   not-applicable   [SENTINEL — not an answer]                  69 41.3%
   none-reported   [SENTINEL — not an answer]                   61 36.5%
   manual-validation                                            34 20.4%
   comparison-to-other-method                                   14 8.4%

-- paper-level, because the rows above overlap
   papers whose list-backed validation is ONLY sentinels       119 71.3%
   papers with at least one real validation value               48 28.7%
   papers appearing in more than one row above                  11 


=== 6. WHICH VERSION OF THE LIST  (denominator: papers naming a list in tools[], where a version field exists) 
   papers naming a filter list in tools[]                      178 
     ... with any non-null tools[].version                      53 29.8%
     ... silent                                                125 70.2%
     ... whose version identifies the RULES (a list version or commit, not a year)      4 2.2%

-- the version strings that identify the rules
     2020 IEEE-SP/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i  Disconnect list :: commit eb817fb1 (2019-12-10)
     2023 IMC/on-the-similarity-of-web-measurements-under-different-experimental-setups  EasyList :: 202203300945
     2023 PETS/not-your-average-app-a-large-scale-privacy-analysis-of-android-browsers  EasyList :: 202105250854
     2024 WWW/detecting-and-understanding-self-deleting-javascript-code  EasyList :: 202306271740 with EasyPrivacy

-- all version strings, for inspection
     2011 CCS/fashion-crimes-trending-term-exploitation-on-the-web  Easy List :: Jan. 12, 2011
     2017 PETS/towards-seamless-tracking-free-web-improved-detection-of-trackers-via-one-class  Ghostery :: 5.4.1
     2018 CCS/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea  EasyList :: 2018
     2018 WWW/the-cost-of-digital-advertisement-comparing-user-and-advertiser-views  Disconnect :: 2018
     2019 CCS/oh-the-places-youve-been-user-reactions-to-longitudinal-transparency-about-third  Disconnect's list of known trackers :: accessed November 2018
     2019 CCS/un-informed-consent-studying-gdpr-consent-notices-in-the-field  BlockAdBlock 3.2.1 :: 3.2.1
     2019 IMC/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem  EasyList and EasyPrivacy :: downloaded January 29, 2019
     2020 IEEE-SP/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i  Disconnect list :: commit eb817fb1 (2019-12-10)
     2020 PETS/inferring-tracker-advertiser-relationships-in-the-online-advertising-ecosystem-u  EasyList :: 2018
     2020 PETS/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix  Adblock :: 3.33.0
     2020 PETS/the-tv-is-smart-and-full-of-trackers-measuring-smart-tv-advertising-and-tracking  The Big Blocklist Collection (Firebog) :: 2019
     2020 USENIX/the-impact-of-ad-blockers-on-product-search-and-purchase-behavior-a-lab-experime  Ghostery :: 5.4.10
     2020 WWW/beyond-the-front-page-measuring-third-party-dynamics-in-the-field  WhoTracks.me :: 2018
     2020 WWW/stop-tracking-me-bro-differential-tracking-of-user-demographics-on-hyper-partisa  Disconnect.me :: 2019
     2020 WWW/the-representativeness-of-automated-web-crawls-as-a-surrogate-for-human-browsing  Disconnect Tracking Protection List :: 2019
     2021 IEEE-SP/detecting-filter-list-evasion-with-event-loop-turn-granularity-javascript-signat  EasyList :: 2019-11-02
     2021 NDSS/cv-inspector-towards-automating-detection-of-adblock-circumvention  Adblock Plus (ABP) :: 3.7
     2021 PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion  uBlock Origin :: 1.26
     2022 USENIX/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission  DuckDuckGo Tracker Blocklist :: v2.1
     2022 USENIX/ovrseen-auditing-network-traffic-and-privacy-policies-in-oculus-vr  Pi-hole's Default List :: 2021
     2022 WWW/et-tu-brute-privacy-analysis-of-government-websites-and-mobile-apps  EasyList :: 2020
     2022 WWW/reproducibility-and-replicability-of-web-measurement-studies  EasyList :: 2021-07-05
     2023 IEEE-SP/detection-of-inconsistencies-in-privacy-practices-of-browser-extensions  AdGuard Ad Filters :: 2022
     2023 IMC/on-the-similarity-of-web-measurements-under-different-experimental-setups  EasyList :: 202203300945
     2023 IMC/thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web  justdomains blocklist :: 2022
     2023 PETS/comparing-large-scale-privacy-and-security-notifications  WhoTracks.me :: 2022
     2023 PETS/not-your-average-app-a-large-scale-privacy-analysis-of-android-browsers  EasyList :: 202105250854
     2023 USENIX/a-study-of-multi-factor-and-risk-based-authentication-availability  Disconnect.me :: 2022
     2023 USENIX/rods-with-laser-beams-understanding-browser-fingerprinting-on-phishing-pages  EasyPrivacy :: 2021
     2023 WWW/who-funds-misinformation-a-systematic-analysis-of-the-ad-related-profit-routines  EasyList :: 2021
     2024 CCS/blocking-tracking-javascript-at-the-function-granularity  EasyList :: 2022
     2024 IMC/browsing-without-third-party-cookies-what-do-you-see  EasyList :: 2024
     2024 IMC/darkdns-revisiting-the-value-of-rapid-zone-update  QuidsUp NoTrack Block List :: 2024
     2024 IMC/diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc  DuckDuckGo Tracker Radar :: 2023
     2024 PETS/client-side-and-server-side-tracking-on-meta-effectiveness-and-accuracy  EasyList :: 2023
     2024 PETS/generalizable-active-privacy-choice-designing-a-graphical-user-interface-for-glo  Disconnect Tracker Protection lists :: 2023
     2024 PETS/the-devil-is-in-the-details-detection-measurement-and-lawfulness-of-server-side  Disconnect :: 2023
     2024 WWW/detecting-and-understanding-self-deleting-javascript-code  EasyList :: 202306271740 with EasyPrivacy
     2025 CCS/layered-overlapping-and-inconsistent-a-large-scale-analysis-of-the-multiple-priv  EasyList :: 2025
     2025 CCS/local-frames-exploiting-inherited-origins-to-bypass-content-blockers  EasyList :: 2024-08-17
     2025 CCS/whispertest-a-voice-control-based-library-for-ios-ui-automation  DuckDuckGo Tracker Radar :: 2020
     2025 IMC/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th  EasyList :: 2025
     2025 IMC/cookieguard-characterizing-and-isolating-the-first-party-cookie-jar  DuckDuckGo Tracker Radar :: 2022
     2025 IMC/fp-inconsistent-measurement-and-analysis-of-fingerprint-inconsistencies-in-evasi  uBlock Origin :: 1.59.0
     2025 PETS/empirically-measuring-data-localization-in-the-eu  EasyList :: 2022
     2025 PETS/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and  justdomains :: February 2025
     2025 PETS/understanding-regional-filter-lists-efficacy-and-impact  JustDomains :: 2024
     2025 PETS/unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie  justdomains :: updated August 2024
     2025 USENIX/websites-global-privacy-control-compliance-at-scale-and-over-time  Disconnect list :: September 15, 2023
     2025 WWW/before-after-the-effect-of-eus-2022-code-of-practice-on-disinformation  DuckDuckGo Tracker Radar :: 2024
     2026 PETS/from-syntactic-matching-to-taint-tracking-and-back-a-comparative-study-of-web-tr  Disconnect :: 2026
     2026 PETS/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government  EasyList :: June 2025
     2026 USENIX/network-level-prompt-and-trait-leakage-in-local-research-agents  EasyList :: 2025


=== 7. WHERE AND WHEN  (denominator: the population) ====================
   venue             corpus    pop  share of venue
   PETS                 510     55           10.8%
   IMC                  638     36            5.6%
   WWW                  843     31            3.7%
   USENIX              1410     24            1.7%
   CCS                  990     23            2.3%
   IEEE-SP              767     19            2.5%
   NDSS                 701     10            1.4%

-- by period (2025-2026 is provisional: CCS/IMC 2026 not held, IEEE S&P/WWW 2026 incompletely selected)
   period                      corpus    pop  per 1,000
   2010-2013                      511      6       11.7
   2014-2017                      769     25       32.5
   2018-2021                     1439     58       40.3
   2022-2024                     1955     70       35.8
   2025-2026 (provisional)       1185     39       32.9

-- per year, for the currency claim (same provisional caveat)
   2010  corpus  119  pop   1    0.8%   pop papers with any llm classification: 0
   2011  corpus  116  pop   2    1.7%   pop papers with any llm classification: 0
   2012  corpus  151  pop   1    0.7%   pop papers with any llm classification: 0
   2013  corpus  125  pop   2    1.6%   pop papers with any llm classification: 0
   2014  corpus  166  pop   4    2.4%   pop papers with any llm classification: 0
   2015  corpus  190  pop   4    2.1%   pop papers with any llm classification: 0
   2016  corpus  182  pop   7    3.8%   pop papers with any llm classification: 0
   2017  corpus  231  pop  10    4.3%   pop papers with any llm classification: 0
   2018  corpus  254  pop  13    5.1%   pop papers with any llm classification: 0
   2019  corpus  402  pop  13    3.2%   pop papers with any llm classification: 0
   2020  corpus  404  pop  18    4.5%   pop papers with any llm classification: 0
   2021  corpus  379  pop  14    3.7%   pop papers with any llm classification: 0
   2022  corpus  546  pop  22    4.0%   pop papers with any llm classification: 0
   2023  corpus  719  pop  26    3.6%   pop papers with any llm classification: 0
   2024  corpus  690  pop  22    3.2%   pop papers with any llm classification: 2
   2025  corpus  770  pop  31    4.0%   pop papers with any llm classification: 4
   2026  corpus  415  pop   8    1.9%   pop papers with any llm classification: 1


=== 8. REGIONAL AND NON-ENGLISH LISTS  (denominator: whole corpus) ======
   papers matching REGIONAL_RX anywhere                          2 
   every hit, with the string that matched, so over-catching is visible:
     2020 WWW/filter-list-generation-for-underserved-regions
        matched: "Underserved Region"  |  Filter List Generation for Underserved Regions.
     2025 PETS/understanding-regional-filter-lists-efficacy-and-impact
        matched: "Regional Filter Lists"  |  Understanding Regional Filter Lists: Efficacy and Impact
   in the list-using population: 2


=== 9. RESIDUE OF THE LIST-NAME FOLD ====================================
   distinct strings matching LIST_CANDIDATE_RX that fold to NO family     34 
       1  set of eight blacklisting services
       1  five public and one commercial blacklist
       1  30 additional IP blacklists
       1  external URL blacklists
       1  blacklisted URLs from bit.ly and tinyurl
       1  Google blacklist
       1  mobile blacklist (MBL)
       1  12 domain blacklists
       1  custom blacklist-reconstruction heuristics
       1  custom anonymization-service IP blacklist
       1  12 IP reputation blacklists
       1  custom ad-blocker name search lists
       1  combined domain blacklists
       1  eCrimeX blacklist
       1  VirusTotal blacklists
       1  combined public blacklists
       1  38 IP and domain reputation blacklists
       1  38 public and commercial IP and domain reputation blacklists
       1  custom IPV spyware and dual-use app blacklists
       1  custom manual blacklist
       1  publicly available adblocker lists
       1  union of four DNS blocklists
       1  aggregated domain and IP blacklists
       1  Custom blocklist filter
       1  authoritative blacklists
       1  eight public domain blacklists
       1  PassphraseGPT-generated blocklist
       1  adblockparser with nine crowd-sourced filter lists
       1  manually curated website-domain blocklists
       1  five blacklists
       1  regular expression blacklists (custom)
       1  Meituan fraudster blacklist and whitelist
       1  Google Safe Browsing blacklist
       1  Host BlackList

-- off-topic blocklist families, excluded on purpose (papers)
   off-topic: malware / phishing / fraud blocklist              10 
   off-topic: spam / email blocklist                             8 
   off-topic: IP / ASN / network reputation blocklist            7 
   off-topic: content-category blocklist (adult, piracy)         6 
   off-topic: censorship blocklist                               3 
   off-topic: certificate / key revocation blocklist             2 

-- groundTruthSource residue: strings that look like a blocklist and are NOT counted as one
   distinct groundTruthSource strings excluded                  68 
       6  Google Safe Browsing blacklist
       2  Spamhaus blacklist
       2  CleanMX blacklist
       1  public domain blacklists
       1  Zeus tracker domain and IP blacklist
       1  PhishTank blacklist
       1  Microsoft blacklist
       1  semi-manual labeling using search-term relevance, terminal-page visual analysis, reputation, scanning, and blacklisting
       1  manual labeling of browsing sessions using reputation and blacklist status
       1  labels from two malware feeds, public blacklists, DNSWL, and top 30 Alexa domains
       1  commercial blacklist, SpamAssassin, ClamAV, DNS resolution, and 30 additional IP blacklists
       1  URL-shortening-service blacklist warnings
       1  Public blacklist, phishing and drive-by-download, and known-malware evidence
       1  DMOZ and URLBlacklist.com
       1  malware URL blacklists
       1  blacklist membership during Q1 2013
       1  spam, phishing, malware, and scanning blacklists
       1  Project Honey Pot blacklist and graylist
       1  PhishTank historical blacklist
       1  DNS-BH blacklist
       1  Google SafeBrowsing blacklist
       1  PhishTank and search-redirection blacklist labels
       1  publicly available feeds, services, and blacklists; manual analysis by security experts
       1  VirusTotal participating blacklists
       1  Malsign blacklist of certificates
       1  blacklist reasons, labels, and enlistment timing
       1  Malwarebytes blacklist, manual content analysis, IP co-location, WHOIS, and complaints
       1  commercial blacklist
       1  VirusTotal blacklist/product reports
       1  over 60 security-vendor blacklists
       1  six blacklist snapshots
       1  blacklist snapshots taken four times daily
       1  Symantec DeepSight blacklist
       1  new binaries, blacklisted domains, and deviation from benign program profiles
       1  blacklist entries
       1  manually curated blacklists
       1  blacklist patterns and Wappalyzer family mapping
       1  3,006 blacklist-identified cryptojacking websites and randomly selected benign websites
       1  67 aggregated blocklists
       1  manual analysis of domains absent from four blocklists
       1  Citizen Lab Block List
       1  43 Firehol blocklists
       1  VirusTotal’s integrated antivirus tools and blocklists
       1  Palo Alto Networks blocklist and historical partner records
       1  GSB, authoritative blacklists, customized category websites, Alexa 1M, and manually filtered seed domains
       1  PhishTank, MalwareURL, malwaredomains.com, Zeustracker, malwaredomainlist.com, and UT1 blacklists
       1  semi-automated labeling using screenshot clustering, manual review, BlockList, Google Safe Browsing, and VirusTotal
       1  BlockList URL buckets
       1  Spamhaus IP blocklist
       1  Tranco domains versus Feodo and other blocklisted IP addresses
       1  Security-community-curated blacklists
       1  manual normalization to official ad-blocker names
       1  NextDNS Piracy Blocklist
       1  SneakyPrompt blacklist
       1  email spam traps, Twitter blacklists, and non-spam Twitter URLs
       1  urlblacklist.com
       1  badkeys blocklists
       1  Known compromised-key blocklists
       1  IP-address-based blacklists
       1  public malicious URL blocklists
       1  existing Meituan blacklists and whitelists
       1  DNSBL and FireHOL IP blocklists
       1  IPV spyware blocklist
       1  known tested ad-blocking options
       1  public domain-name blocklists
       1  combined popularity lists, public datasets, and public blocklists
       1  AlienVault, BadIPs, Blocklist.de, BotScout, and five additional blocklists
       1  BLAG proxy labels for IP blacklists; external repositories or domain experts for optional verification


=== 10. MEASURED RESULTS ABOUT LISTS, from detection[].prevalence in population papers 
   2016 CCS/online-tracking-a-1-million-site-measurement-and-analysis
      phenomenon: third-party tracking
      prevalence: over 81,000 third parties appeared on at least two first-party sites; 123 appeared on more than 1% of sites.   [metric: number and prevalence of third parties]
      quote (results): The total number of third parties present on at least two first parties is over 81,000. only 123 of these 81,000 are present on more than 1% of sites.
   2016 USENIX/towards-measuring-and-mitigating-social-engineering-software-download-attacks
      phenomenon: ad-driven benign downloads
      prevalence: around 7%   [metric: share of benign downloads]
      quote (results): We find that around 7% of all benign software downloads are ad-driven.
   2016 USENIX/tracing-information-flows-between-ad-exchanges-using-retargeted-ads
      phenomenon: Retargeted advertisements
      prevalence: 5,102 retargeted ads from 31,850 labeled images   [metric: share of crawled images]
      quote (methodology): In total, we and workers from AMT labeled 31,850 images, of which 7,563 are behavioral targeted ads and 5,102 are retargeted ads.
   2016 USENIX/tracing-information-flows-between-ad-exchanges-using-retargeted-ads
      phenomenon: Indirect and latent matching
      prevalence: indirect 7% and latent 15% before clustering; each 1% after clustering   [metric: share of publisher-side chains]
      quote (results): The percentage of indirect and latent matches drops to 1% when we cluster domains.
   2017 IMC/the-ad-wars-retrospective-measurement-and-analysis-of-anti-adblock-filter-lists
      phenomenon: Live anti-adblock prevalence
      prevalence: Anti-Adblock Killer List triggered on 5.0%; Combined EasyList triggered on 0.2%.   [metric: share of websites triggering filter rules]
      quote (introduction): We find that the Anti-Adblock Killer List triggers on 5.0% websites and the Combined EasyList only triggers on 0.2% websites.
   2017 PETS/detecting-anti-ad-blockers-in-the-wild
      phenomenon: non-CSS anti-adblock detection
      prevalence: 149 of 686 websites   [metric: websites still detecting ad blockers]
      quote (results): We find that 149 out of 686 websites can still detect ad-blockers.
   2017 PETS/towards-seamless-tracking-free-web-improved-detection-of-trackers-via-one-class
      phenomenon: Tracking versus functional JavaScript
      prevalence: 1,376 tracking and 1,236 functional programs among 2,612 labelled programs   [metric: accuracy, true-positive and false-positive rates]
      quote (dataset): In total, we collected 2,612 JavaScript programs, which consisted of 1,376 tracking and 1,236 functional JavaScript programs according to our labelling.
   2018 IMC/digging-into-browser-based-crypto-mining
      phenomenon: browser-based mining prevalence
      prevalence: less than 0.08% of probed sites   [metric: share of probed domains]
      quote (conclusion): We indeed find websites that utilize browser-mining. Yet, the prevalence of browser mining is currently low at < 0.08% of the probed sites.
   2018 IMC/digging-into-browser-based-crypto-mining
      phenomenon: WebAssembly mining
      prevalence: up to 82% not detected by block lists   [metric: share of detected mining websites missed by block lists]
      quote (conclusion): We thus present a new technique based on WebAssembly fingerprinting to identify miners, up to 82% of thereby identified mining websites are not detected by block lists.
   2018 PETS/i-never-signed-up-for-this-privacy-implications-of-email-tracking
      phenomenon: tracking protection effectiveness
      prevalence: tracking protection reduces email leaks by 87%   [metric: reduction in email leaks]
      quote (introduction): Tracking protection is helpful, but not perfect: it reduces the number of email leaks by 87%.
   2018 PETS/nomoads-effective-and-efficient-cross-app-mobile-ad-blocking
      phenomenon: EasyList-missed mobile ads
      prevalence: EasyList failed to detect 37% of ad requests   [metric: share of ad requests missed]
      quote (results): EasyList fails to detect more than one-third (37%) of ad requests in our dataset.
   2019 IMC/a-longitudinal-analysis-of-the-ads-txt-standard
      phenomenon: RTB advertisements
      prevalence: 135M RTB ad inclusion chains   [metric: number of RTB ad inclusion chains]
      quote (methodology): After applying all the filters above, we are left with 135M RTB ad inclusion chains.
   2019 NDSS/we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy
      phenomenon: web tracking
      prevalence: 3.5 third-party tracking services on average in January   [metric: average third-party tracking services per website]
      quote (results): In January, websites used on average 3.5 third-party tracking services that would be blocked by an off-the-shelf ad blocker.
   2020 IMC/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising
      phenomenon: ad-blocker effectiveness
      prevalence: All tested blockers blocked 0 Service Worker scripts   [metric: blocked Service Worker scripts and requests]
      quote (results): both ad blocking mechanisms failed to block the registration of Service Worker scripts related to ad networks that support WPN ads
   2020 PETS/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
      phenomenon: tracking behaviors
      prevalence: Tracking detected in 64.60% of full-dataset requests and 91.92% of domains   [metric: share of third-party requests and domains]
      quote (methodology): By analyzing these requests, we detected 6 tracking behaviors in 2,724,020 (64.60%) requests.
   2020 PETS/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix
      phenomenon: filter-list misses
      prevalence: EL&EP missed 25.22%; Disconnect missed 30.34%   [metric: share of detected trackers missed]
      quote (introduction): they respectively miss 25.22% and 30.34% of the trackers that we detect.
   2020 PETS/nomoats-towards-automatic-detection-of-mobile-tracking
      phenomenon: Previously undetected A&T requests
      prevalence: 2,963 requests destined to 162 distinct hosts   [metric: requests missed by all filter lists]
      quote (results): 2,963 (7.91%) positive samples were identified by our approach, but were undetected by any of the three filter lists.
   2020 PETS/the-tv-is-smart-and-full-of-trackers-measuring-smart-tv-advertising-and-tracking
      phenomenon: ATS domains
      prevalence: about 10% of Roku and Fire TV apps contact 20+ and 10+ ATS domains, respectively   [metric: share of domains or apps contacting ATSes]
      quote (results): about 10% of the Roku and Fire TV apps contact 20+ and 10+ ATS domains, respectively.
   2020 PETS/the-tv-is-smart-and-full-of-trackers-measuring-smart-tv-advertising-and-tracking
      phenomenon: DNS blocklist coverage
      prevalence: Firebog blocked 22% of Roku and 27% of Fire TV testbed FQDNs   [metric: block rate]
      quote (results): TF, closely followed by MoaAB and PD, blocks the highest fraction of domains across all of the platforms in both the in the wild and testbed datasets.
   2020 PETS/the-tv-is-smart-and-full-of-trackers-measuring-smart-tv-advertising-and-tracking
      phenomenon: Missed ads and app breakage
      prevalence: all blocklists produced non-trivial false positives and false negatives   [metric: ads missed and functionality breakage]
      quote (results): All blocklists suffer from a non-trivial amount of visually observable FPs and FNs.
   2020 WWW/apophanies-or-epiphanies-how-crawlers-impact-our-understanding-of-the-web
      phenomenon: third-party tracker prevalence and prominence
      prevalence: Rankings varied across crawlers; OpenWPM served as baseline   [metric: prevalence and prominence rankings]
      quote (results): These results showcase how the measured prevalence and prominence of different trackers vary when computed on data generated from different crawlers.
   2020 WWW/beyond-the-front-page-measuring-third-party-dynamics-in-the-field
      phenomenon: tracker presence
      prevalence: Trackers increased by approximately 6% on subsites; 2.5% of sites tracked only on subsites.   [metric: subsite-versus-landing-page increase]
      quote (results): trackers mostly occur on subsites in comparison to their respective landing pages (an increase of approx. 6 %). 2.5 % of the measured websites do not embed any trackers on the landing page but use trackers on subsites.
   2020 WWW/de-kodi-understanding-the-kodi-ecosystem
      phenomenon: Advertisement traffic
      prevalence: 5,247 addons   [metric: number of addons triggering EasyList]
      quote (results): We identify 5,247 add-ons that trigger EasyList (advertisement)
   2020 WWW/de-kodi-understanding-the-kodi-ecosystem
      phenomenon: Tracking traffic
      prevalence: 141 addons   [metric: number of addons triggering EasyPrivacy]
      quote (results): and 141 add-ons that trigger EasyPrivacy (tracking).
   2020 WWW/filter-list-generation-for-underserved-regions
      phenomenon: Generated regional filter rules
      prevalence: 1,310 new filter rules   [metric: number of new filter rules]
      quote (results): We used the rule generation methodology described in Section 3.6 to generate 1310 new filter rules.
   2020 WWW/the-representativeness-of-automated-web-crawls-as-a-surrogate-for-human-browsing
      phenomenon: tracking activity
      prevalence: Crawler median 6.1 tracking domains versus user median 1.9.   [metric: unique tracking domains per site visit]
      quote (results): The median number of tracking domains accessed by a user on visiting a Trexa list site is 1.9, whereas for the crawler it is 6.1.
   2021 CCS/sugarcoat-programmatically-generating-privacy-preserving-web-compatible-resource
      phenomenon: Resource replacement performance
      prevalence: rewritten condition improved standard metrics by 1–9% versus default   [metric: median page-load and memory metrics]
      quote (results): We noticed a small (1-9%) improvement in standard performance metrics when pages were loaded with filter lists configured to redirect target scripts
   2021 PETS/a-calculus-of-tracking-theory-and-practice
      phenomenon: mitigation effectiveness
      prevalence: Adblock Plus 54.9%, Disconnect 33.5%, Privacy Badger 44.8%, EasyList&EasyPrivacy 16.4%.   [metric: percentage of allowed connections]
      quote (results): Our work 54.9% 33.5% 44.8% 16.4%
   2021 WWW/towards-realistic-and-reproducibleweb-crawl-measurements
      phenomenon: Ad/tracker traffic bias
      prevalence: Nearly 20% of domains’ traffic strongly correlated to browser configuration.   [metric: share of contacted domains]
      quote (results): Request volume measurement bias becomes notably more pronounced among domains flagged by filter lists as serving ads and trackers, with nearly 20% of domains' traffic strongly correlated to choice of BC.
   2022 PETS/setting-the-bar-low-are-websites-complying-with-the-minimum-requirements-of-the
      phenomenon: third-party advertising and analytics resources
      prevalence: 76% embed at least one A&A resource   [metric: share of corpus websites]
      quote (results): Overall, 76% of the websites in our corpus embed at least one A&A resource
   2022 PETS/who-knows-i-like-jelly-beans-an-investigation-into-search-privacy
      phenomenon: privacy-policy search-term mentions
      prevalence: 13% explicitly mentioned search terms; about 75% mentioned generic information sharing   [metric: share of English privacy policies]
      quote (results): 10,914 of these policies (about 13%) did mention search terms explicitly
   2022 USENIX/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission
      phenomenon: previously unlisted tracker domains
      prevalence: 41 tracker domains; 13.4% EU and 4.2% US increase in leaky websites   [metric: number of domains and percentage increase]
      quote (methodology): we uncover 41 tracker domains that are not listed in any of the popular blocklists.
   2022 USENIX/ovrseen-auditing-network-traffic-and-privacy-policies-in-oculus-vr
      phenomenon: ATS domains
      prevalence: 36% of third-party exposures were identified by blocklists   [metric: share of third-party exposures blocked]
      quote (results): Third parties collect a number of PII data types ... 36% of which are labeled as ATS by blocklists.
   2022 WWW/et-tu-brute-privacy-analysis-of-government-websites-and-mobile-apps
      phenomenon: known web tracking
      prevalence: 29.9% (44,880/150,244) had one or more known trackers   [metric: share of crawled government websites]
      quote (results): We found 29.9% (44,880/150,244) of government websites had one or more known trackers on their landing pages
   2022 WWW/investigating-advertisers-domain-changing-behaviors-and-their-impacts-on-ad-bloc
      phenomenon: filter-list survival
      prevalence: 1,096 blocked RAD domains survived an average of 410.5 days   [metric: survival time]
      quote (results): Among all 1,096 blocked RAD domains, the average survival time was 410.5 days, and the median was 195.5 days.
   2022 WWW/reproducibility-and-replicability-of-web-measurement-studies
      phenomenon: tracking requests
      prevalence: Firefox profiles identified 12% more tracking requests than Chrome profiles   [metric: tracking requests per page and profile]
      quote (results): Overall, we identified for all Firefox profiles 12% more tracking requests than for the Chrome profiles.
   2023 CCS/you-call-this-archaeology-evaluating-web-archives-for-reproducible-web-security
      phenomenon: Web-tracker prevalence
      prevalence: The percentage without any tracker peaked at around 40% in 2022.   [metric: percentage of websites without trackers]
      quote (results): it shows the percentage of websites that do not include any tracker directly peaked at around 40% in 2022.
   2023 IMC/on-the-similarity-of-web-measurements-under-different-experimental-setups
      phenomenon: tracking requests
      prevalence: 22% of nodes are used for tracking purposes   [metric: share of tree nodes used for tracking]
      quote (results): Overall, we see that 22% of the nodes are used for tracking purposes, and we observed a mean similarity of .53 (SD: .27; min: .09; max: 1;) for these nodes.
   2023 IMC/understanding-the-privacy-risks-of-popular-search-engine-advertising-systems
      phenomenon: tracker requests
      prevalence: 93% of ad destination pages included tracker and privacy-harming resources   [metric: share of destination pages]
      quote (results): Specifically, we find that 93% of ads destination pages (across all five search engines) include tracker and privacy-harming resources.
   2023 CCS/read-between-the-lines-detecting-tracking-javascript-with-bytecode-classificatio
      phenomenon: allowlisted tracking scripts
      prevalence: models correctly classified more than 90% of 538 allowlisted samples   [metric: classification rate]
      quote (results): the models were able to correctly classify >90% of them.
   2023 CCS/read-between-the-lines-detecting-tracking-javascript-with-bytecode-classificatio
      phenomenon: previously undetected tracking scripts
      prevalence: all three models uncovered scripts absent from current lists   [metric: scripts later detected by filter lists]
      quote (results): All three models were able to uncover new scripts that had not been detected by the existing filter lists
   2023 PETS/not-your-average-app-a-large-scale-privacy-analysis-of-android-browsers
      phenomenon: tracking-content blocking
      prevalence: 276 browsers (65%) block content flagged by the blocklists   [metric: share of browsers]
      quote (results): We find that 276 browsers in our dataset (65%) block content flagged by these blocklists
   2023 IMC/thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web
      phenomenon: uBlock Origin bypass
      prevalence: 196 of 280 websites (70%)   [metric: share of websites without cookiewalls]
      quote (results): We find that 196 (70%) websites no longer display cookiewalls across all iterations
   2023 IMC/tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosystem
      phenomenon: Advertising and tracking traffic
      prevalence: 9.4% of all network traffic supported advertising and tracking functionality   [metric: share of network traffic]
      quote (results): We note that 9.4% of all network traffic, including 1.5% third party network traffic, supports advertising and tracking functionality.
   2023 PETS/everybodys-looking-for-ssomething-a-large-scale-evaluation-on-the-privacy-of-oau
      phenomenon: Third-party tracking
      prevalence: 68.0% of minimal-scope and 60.0% of non-minimal-scope websites.   [metric: share with at least one tracker]
      quote (results): We find that 1259 (68.0%) websites with minimal OAuth scopes include at least one third-party tracker and 222 (60.0%) websites with non-minimal scopes use third-party tracking.
   2023 WWW/net-track-generic-web-tracking-detection-using-packet-metadata
      phenomenon: New trackers missed by filter lists
      prevalence: 34.5% of the detection errors were trackers missed by existing filter lists.   [metric: share of 200 manually examined traces]
      quote (results): A considerable portion (34.5%) of those 'detection errors' were indeed trackers that have not yet been discovered.
   2023 WWW/online-advertising-in-ukraine-and-russia-during-the-2022-russian-invasion
      phenomenon: ad platform presence
      prevalence: Google appeared on 85.4% of Ukrainian websites and 78.2% of Russian websites   [metric: percentage of websites with platform presence]
      quote (results): Google was the largest ad platform supporting Ukrainian websites, with presence on 85.4% of the Ukrainian websites in Ukraine.
   2023 USENIX/is-your-wallet-snitching-on-you-an-analysis-on-the-privacy-implications-of-web3
      phenomenon: third-party blocklist coverage
      prevalence: 60 of 108 checked third parties (56%) blocked by all five combined   [metric: blocked third parties]
      quote (results): the combination of all five blocklists results in blocking 60 third-parties (56%)
   2024 IMC/analyzing-the-in-accessibility-of-online-advertisements
      phenomenon: inaccessible advertisement characteristics
      prevalence: 86.8% exhibited at least one inaccessible characteristic; 13.2% did not.   [metric: share of unique ads]
      quote (results): Overall, we fnd that only 13.2% of the ads in our data set (1,069 unique ads) do not exhibit any inaccessible characteristics.
   2024 IMC/browsing-without-third-party-cookies-what-do-you-see
      phenomenon: Advertisement-request prevalence
      prevalence: Positive correlation across categorized website types   [metric: average advertisement requests versus average BCE screenshot difference]
      quote (results): there is a positive correlation between the average number of advertisement requests and the average BCE screenshot difference across the categorized websites.
   2023 WWW/who-funds-misinformation-a-systematic-analysis-of-the-ad-related-profit-routines
      phenomenon: advertising URLs
      prevalence: 92% precision and 87% recall on 100 validation websites   [metric: precision and recall]
      quote (results): Our approach has both high Precision (92% of "ads" marked in the websites are actual ads), and Recall (87% of actual ads in the websites were correctly detected).
   2024 PETS/website-data-transparency-in-the-browser
      phenomenon: personal data collection
      prevalence: F1 scores from 0.97 to 1.00 for tested categories except IP address and tracking pixel   [metric: precision, recall, and F1]
      quote (results): Email Address 8 1.00 1.00 1.00 ... Phone Number 157 1.00 1.00 1.00 ... Street Address 16 0.94 1.00 0.97
   2024 IMC/darkdns-revisiting-the-value-of-rapid-zone-update
      phenomenon: blocklist detection
      prevalence: 5% of transient domains and 6.6% of newly registered domains   [metric: share flagged]
      quote (results): Of the 42358 transient domains, at least one blocklist flagged 5% (2123) as malicious.
   2024 USENIX/automated-large-scale-analysis-of-cookie-notice-compliance
      phenomenon: Cookie notice detection
      prevalence: 100.0% precision and 86.9% recall   [metric: precision and recall]
      quote (appendix): We achieve 100.0% precision and 86.9% recall.
   2024 PETS/a-large-scale-study-of-cookie-banner-interaction-tools-and-their-impact-on-users
      phenomenon: Tracking requests
      prevalence: Accepting all cookies increased tracking requests by up to 60%   [metric: tracking requests per page]
      quote (results): the average number of tracking requests per page increases by (60%) (from 16.6 to 26) after interacting with the cookie banner
   2024 WWW/adflush-a-real-world-deployable-machine-learning-solution-for-effective-advertis
      phenomenon: longitudinal detection stability
      prevalence: F1 score remained above 0.9789 from April 2 to September 17, 2023   [metric: F1 score over time]
      quote (evaluation): without retraining, AdFlush exhibited robust detection capabilities throughout, maintaining an F1 score above 0.9789.
   2024 WWW/detecting-and-understanding-self-deleting-javascript-code
      phenomenon: filter-list blocking
      prevalence: 39.94% of self-deleting versus 7.13% of normal scripts   [metric: share of scripts on block list]
      quote (results): 124,386 (39.94%) self-deleting scripts are among the block list, compared to 229,738 (7.13%) normal scripts.
   2024 WWW/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting
      phenomenon: tracking fingerprinting scripts
      prevalence: 50.50% on login pages and 55.65% on sign-up pages   [metric: share of fingerprinting scripts]
      quote (results): home pages have the highest rate of tracking at 61.46%, compared to login pages at 50.50% and sign-up pages at 55.65%.
   2025 CCS/local-frames-exploiting-inherited-origins-to-bypass-content-blockers
      phenomenon: privacy-suspect local-frame requests
      prevalence: 73.7% should be blocked by popular filter lists   [metric: share of local-frame requests]
      quote (introduction): 73.7% of the URLs requested by these local frames should be blocked by popular content blockers according to a combination of filter lists from EasyList, EasyPrivacy, and uBlock Origin.
   2025 CCS/local-frames-exploiting-inherited-origins-to-bypass-content-blockers
      phenomenon: website filter evasion
      prevalence: 14.3% of all crawled sites   [metric: share of crawled websites]
      quote (introduction): 14.3% of the websites we study are evading content blockers by making requests that would otherwise be blocked, but succeed because they are made inside of local frames.
   2025 IMC/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th
      phenomenon: blocklist coverage
      prevalence: 45% of top-20k and 37% of tail test canvases matched at least one list   [metric: share of test canvases]
      quote (results): Nearly half (45%) of test canvases in the top 20k sites and over one-third (37%) in the tail 20k sites are generated by a script that has been included in one of the three lists.
   2025 IMC/cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
      phenomenon: third-party main-frame scripts
      prevalence: 93.3% of successfully crawled websites   [metric: share of websites]
      quote (results): We find that 93.3% of the 14,917 successfully crawled websites in our dataset include at least one third-party script in their main frame
   2025 IMC/learning-as-to-organization-mappings-with-borges
      phenomenon: favicon-based sibling inference
      prevalence: 1,297 networks into 319 organizations   [metric: mapped networks and organizations]
      quote (results): This approach creates an AS-to-organization mapping for 1,297 networks into 319 organizations.
   2025 PETS/beyond-the-request-harnessing-http-response-headers-for-cross-browser-web-tracke
      phenomenon: Tracker versus non-tracker responses
      prevalence: Chrome22 ≈0.3 tracker; Firefox22 ≈0.37; Brave22 ≈0.5%; Chrome23 ≈0.26%   [metric: share of HTTP responses]
      quote (results): #Responses in % ≈ 0.3 ≈ 0.7 ... ≈ 0.37 ≈ 0.63 ... ≈ 0.5 ≈ 99.5 ... ≈ 0.26 ≈ 0.74
   2025 NDSS/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector
      phenomenon: mixed tracker prevalence
      prevalence: 83 occurrences of confirmed mixed request trackers   [metric: instances and unique trackers]
      quote (results): We observed a total of 83 occurrences in our evaluation dataset.
   2025 NDSS/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector
      phenomenon: filter-list-caused breakage
      prevalence: 2,308 reconstructed breakages from 13,921 exception rules   [metric: reconstructability]
      quote (methodology): Duumviri reconstructs a breakage by flipping an exception rule into a block rule.
   2025 NDSS/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector
      phenomenon: previously unreported trackers
      prevalence: 22 new trackers with 175 occurrences   [metric: confirmed trackers]
      quote (results): We identified 22 new trackers, with a total of 175 occurrences in our evaluation dataset
   2025 IMC/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
      phenomenon: tracker domains
      prevalence: 505 unique non-local ad/tracking domains, including 441 from lists and 64 manually identified.   [metric: unique non-local ad/tracking domains]
      quote (results): Using lists and manual inspection, we identified 505 (441 from lists, 64 manually) unique non-local ad/tracking based domains.
   2025 WWW/assessing-compliance-in-digital-advertising-a-deep-dive-into-acceptable-ads-stan
      phenomenon: exception-list improvement
      prevalence: 32.4% reduction, from 937 to 634 domains   [metric: reduction in violating domains]
      quote (results): Table 4 summarizes the changes, revealing a significant 32.4% reduction in violating domains.
   2025 CCS/layered-overlapping-and-inconsistent-a-large-scale-analysis-of-the-multiple-priv
      phenomenon: Third-party cookies
      prevalence: 1,454 banks (70.1%) allowed third-party cookies; 1,252 (60.4%) had marketing cookies   [metric: share of bank websites]
      quote (methodology): We found 1,454 banks (70.1%) allowing third-party cookies on their websites, 1,252 (60.4%) of which contained marketing cookies.
   2025 PETS/gig-work-at-what-cost-exploring-privacy-risks-of-gig-work-platform-participation
      phenomenon: email tracking
      prevalence: 8 platforms embedded trackers; 5 included third-party trackers   [metric: share of platforms]
      quote (results): We find that 8 platforms embed trackers in emails; 5 of these include third party trackers while the other 3 include first party trackers only.
   2025 PETS/unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie
      phenomenon: Third-party tracking
      prevalence: 95.58% across all locations   [metric: share of IMSS sites with at least one tracker]
      quote (results): We find that 95.58% of IMSS over all locations include at least one third-party tracking request.
   2025 IMC/fp-inconsistent-measurement-and-analysis-of-fingerprint-inconsistencies-in-evasi
      phenomenon: IP and ASN blocklist evasion
      prevalence: 82.54% originated from flagged ASNs; IP blocklists covered 15.86%   [metric: blocklist coverage]
      quote (results): We report that 82.54% of requests originated from flagged ASNs. ... IP block lists offer limited coverage (15.86%).
   2025 IMC/fp-inconsistent-measurement-and-analysis-of-fingerprint-inconsistencies-in-evasi
      phenomenon: false positives on real users
      prevalence: 96.84% on 2,206 requests   [metric: true negative rate]
      quote (evaluation): We report a true negative rate of 96.84% on the 2,206 requests received at this URL.
   2025 PETS/understanding-regional-filter-lists-efficacy-and-impact
      phenomenon: tracking requests
      prevalence: EasyList identified 47,817,273 trackers, 23% of requests   [metric: number and fraction of HTTP requests identified as trackers]
      quote (results): Across all profiles, the baseline list (i.e., standard EasyList) identified 47,817,273 (23%) trackers from 6,967 distinct eTLD+1s
   2025 PETS/understanding-regional-filter-lists-efficacy-and-impact
      phenomenon: unused filter-list rules
      prevalence: 93.3% of rules did not identify any tracking request   [metric: share of rules used]
      quote (results): Only 8,163 (6.6%) distinct rules identify at least one tracking request. Based on these high-level results, we see that most rules (93.3%) do not identify any tracking requests
   2025 PETS/understanding-regional-filter-lists-efficacy-and-impact
      phenomenon: filter-list runtime
      prevalence: Full 143,654-rule set averaged 14.94 seconds and 8.115 GB   [metric: runtime and memory usage over 300 rounds]
      quote (methodology): we tested the runtime and memory usage of each list in 300 rounds and used the average value for further analysis.
   2026 NDSS/mvpnalyzer-an-investigative-framework-for-auditing-the-security-privacy-of-mobile-vpns
      phenomenon: tracking and fingerprinting
      prevalence: 76 apps transmitted the Advertising ID   [metric: apps transmitting Advertising ID]
      quote (results): The Advertising ID, uniquely identifying on its own, was transmitted by 76 apps.
   2026 NDSS/mvpnalyzer-an-investigative-framework-for-auditing-the-security-privacy-of-mobile-vpns
      phenomenon: OpenVPN configuration weaknesses
      prevalence: 107 of 108 applications exhibited at least one potential security issue   [metric: apps with at least one configuration issue]
      quote (results): only one application complies with all evaluated security best practices. In contrast, 107 applications exhibit at least one potential security issue
   2023 IEEE-SP/when-and-why-do-people-want-ad-targeting-explanations-evidence-from-a-four-week
      phenomenon: online advertisements encountered during browsing
      prevalence: 1,281 (30%) of 4,251 ads   [metric: share of ads for which participants wanted explanations]
      quote (results): Overall, our participants wanted explanations for 1,281 (30%) of the ads that were brought to their attention during the study
   2024 IEEE-SP/understanding-the-privacy-practices-of-political-campaigns-a-perspective-from-th
      phenomenon: tracker presence
      prevalence: 1504/2060 (73.01%) used trackers   [metric: share of campaign websites]
      quote (results): Finding 18 - 1504 (73.01%) of campaign websites use trackers (F18 ).
   2023 IEEE-SP/detection-of-inconsistencies-in-privacy-practices-of-browser-extensions
      phenomenon: Privacy-policy contradictions
      prevalence: 525 contradictory pairs in 360 extensions   [metric: precision]
      quote (results): ExtPrivA detected 525 pairs of contradictory privacy statements in the privacy policies of 17.22% (360/2,091) extensions
   2023 IEEE-SP/detection-of-inconsistencies-in-privacy-practices-of-browser-extensions
      phenomenon: Data-type extraction
      prevalence: 99.37% overall precision on 330 samples   [metric: precision]
      quote (evaluation): We evaluated the extraction's precision on 330 randomly selected samples (30 samples per data type), showing a ≥93.3% precision.
   2023 IEEE-SP/detection-of-inconsistencies-in-privacy-practices-of-browser-extensions
      phenomenon: Privacy-statement extraction
      prevalence: 91.7% contradiction-detection precision   [metric: precision]
      quote (evaluation): The result shows that the detection achieves 91.7% precision. Of the 60 randomly selected statement pairs of 56 extensions, only 5 were false positives.
   2024 IEEE-SP/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites
      phenomenon: advertisements
      prevalence: 36% of pages contained one or more ads   [metric: share of crawled pages with ads]
      quote (results): An average of 36% of the pages contained one or more ads
   2024 IEEE-SP/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites
      phenomenon: tracking-related requests
      prevalence: around 90% of websites   [metric: share of sites with tracker domains]
      quote (results): We find that around 90% of the websites have at least one tracker domain, and over 93% embed at least one third-party domain.
   tuples printed: 86

Not re-implemented here on purpose: two pages that count EasyList must not be able to disagree about what EasyList is. The fold is an ordered table of 27 families — 14 lists, 6 engines, 6 off-topic blocklist kinds and 1 heuristic — each with a kind and a regular expression; the first match wins for kind resolution, and foldListNameAll returns every family a string names, so “EasyList, EasyPrivacy, and Fanboy's Enhanced Tracking” credits three families.

Residue: 34 distinct strings matched LIST_CANDIDATE_RX (the deliberately wide “looks like a blocklist” regex) but folded to no family. Printed in full — every one of them, not a sample:

set of eight blacklisting services          five public and one commercial blacklist
30 additional IP blacklists                 external URL blacklists
blacklisted URLs from bit.ly and tinyurl    Google blacklist
mobile blacklist (MBL)                      12 domain blacklists
custom blacklist-reconstruction heuristics  custom anonymization-service IP blacklist
12 IP reputation blacklists                 custom ad-blocker name search lists
combined domain blacklists                  eCrimeX blacklist
VirusTotal blacklists                       combined public blacklists
38 IP and domain reputation blacklists      38 public and commercial IP and domain reputation blacklists
custom IPV spyware and dual-use app blacklists   custom manual blacklist
publicly available adblocker lists          union of four DNS blocklists
aggregated domain and IP blacklists         Custom blocklist filter
authoritative blacklists                    eight public domain blacklists
PassphraseGPT-generated blocklist           adblockparser with nine crowd-sourced filter lists
manually curated website-domain blocklists  five blacklists
regular expression blacklists (custom)      Meituan fraudster blacklist and whitelist
Google Safe Browsing blacklist              Host BlackList

Each occurs in exactly one paper. Reading them: almost all are generic off-topic phrases (IP reputation, phishing, spam, fraud) that correctly do not belong in an advertising/tracking list count. Three are arguably losses and are noted here rather than fixed silently, because fixing them would change the fold that Requests also uses:

• publicly available adblocker lists — an unnamed ad-blocker list; the unnamed / aggregated filter lists family's regex requires the words “filter list” or “block list” and does not match “adblocker lists”. One paper undercounted.
• adblockparser with nine crowd-sourced filter lists — folds to nothing because the leading engine name breaks the anchored unnamed regex. The paper is nevertheless in the population through its other strings, so no paper is lost.
• union of four DNS blocklists — genuinely ambiguous; DNS blocklists in this corpus are as often malware as advertising.

So the population is at most one paper too small, in a direction that does not change any percentage on the page by more than 0.5 points.

Off-topic families, excluded by name and counted (papers, not tuples):

These belong on Website Classification, IP Classification and Phishing, not here.

Folding is load-bearing, measured. The unfolded column on the page is the paper count the single most common exact spelling of each family would have produced:

Not really a fold: classification.target is an enum, so no string normalisation is needed. What fl_fold.mjs adds is the grouping, which is an argument and therefore written down rather than left implicit:

• The list's own unit — web-request.
• Coarser than the list — domain, ip-address. A hostname match discards path, resource type and $third-party.
• Objects a filter list was not written to label — cookie, javascript, fingerprinting-script, consent-notice, website-category, network-traffic, privacy-policy, mobile-app, sdk-or-library, email-message, user-generated-text, malware, vulnerability, other.

Residue: none. The script prints granularity-fold residue (targets in no group): (none) — every target the query produced is in a group. If the extraction ever emits a new target value it will appear there rather than vanish.

The grouping is a judgement. website-category in the third group is the most arguable: a paper labelling a site as advertising-related from a blocklist is doing something between the second and third groups. Moving all 7 of those papers to “coarser than the list” would change 31.7% → 35.7% and 18.0% → 13.8%. The page's argument does not depend on which side they fall.

req_fold.mjs's unnamed / aggregated filter lists family is anchored (^…$). That is right for tools[] and classification[].resourceName, where a generically-named list is the whole string (“eight aggregated filter lists”). It is wrong for groundTruthSource, where papers write a sentence:

"Labels derived from eight crowdsourced filter lists"                 <- AdGraph
"filter-list membership; ATS if present in one or more filter lists"  <- WebGraph
"filter-list labels and exception rules"                              <- SugarCoat
"filter-list rules"                                                   <- Read Between the Lines
"Combined filter lists, Cookiepedia, and manually curated lists"      <- PURL
"nine crowd-sourced advertising and tracking filter lists"            <- CookieGuard
"Established filter lists"                                            <- client/server-side tracking on Meta
"372 filter-list-matched anti-adblocking scripts …"                   <- The Ad Wars

None of those matched, so the papers folded to nothing and dropped out of the ground-truth counts. The first published version of this page therefore said 88 papers where the answer is 96, and printed an eleven-paper “who's-who of the reference baselines” that omitted AdGraph and WebGraph — the two most famous filter-list-labelled classifiers in the field. It also silently disagreed with Requests, which names both.

The fix is a second, unanchored regex applied only to groundTruthSource:

/filter[ -]?lists?\b|ad-?block(?:er|ing)?[ -](?:filter[ -])?lists?\b|advertising and tracking[^.]{0,30}lists?\b|ad-?domain[ -]filter[ -]?lists?\b/i

Three deliberate choices:

• req_fold.mjs was not widened. It is shared with Requests and widening it would have silently moved that page's published figures without anyone editing that page.
• A bare “blacklist” or “blocklist” does not qualify. In this corpus those are overwhelmingly malware, phishing, spam, IP-reputation or censorship lists.
• An off-topic family always wins. If foldListNameAll returns a offtopic family, the string is excluded whatever else it says.

The residue is now printed for groundTruthSource too — it was not before, which is exactly why the miss was invisible: section 9 of the report surveyed only tools[] and resourceName. 68 distinct groundTruthSource strings look like a blocklist and are excluded; they are in the report output in full, and reading them, the exclusions are right (Google Safe Browsing, PhishTank, Spamhaus, CleanMX, Symantec DeepSight, Citizen Lab, Firehol, NextDNS Piracy). Two are arguable and are named here rather than quietly resolved:

• “manual analysis of domains absent from four blocklists” (Leaky Forms, USENIX Sec 2022) — the context is advertising and tracking, but the string names no list type, and admitting it would admit a dozen malware strings of the same shape.
• “manual normalization to official ad-blocker names” (Double-Edged Shield, USENIX Sec 2025) — an ad-blocker name list, not a filter list used as a label.

Lesson for the next page, stated plainly: a fold's residue must be surveyed over every field the fold is applied to. Surveying it over two of three fields produced a page that passed every mechanical check and was wrong about its central claim.

Matched against title, summary, tool names, classification resource names and otherToolsMentioned, joined. Two hits in 5,859 papers, both printed with the string that matched:

2020 WWW/filter-list-generation-for-underserved-regions
   matched: "Underserved Region"  |  Filter List Generation for Underserved Regions.
2025 PETS/understanding-regional-filter-lists-efficacy-and-impact
   matched: "Regional Filter Lists"  |  Understanding Regional Filter Lists: Efficacy and Impact

This regex is wide and still found two papers, which is the point. An earlier, wider draft that also matched fanboy and a bare polish returned nine hits, seven of them false — papers using Fanboy's Social Blocking list (not a regional list) or containing the word “polish” as a verb. Those alternatives were removed and the regex now names only region and language constructs. The page's claim is “two papers are about regional lists”, not “only two papers used one” — a paper that loaded EasyList Germany without discussing it would not be found by any query available here, and the page does not claim otherwise.

Every per-paper figure on the page was checked against data/fulltext/<year>/<venue>/<slug>/paper.cols.txt, not against the extraction's summary of it. Verbatim matches unless noted.

One extraction figure was rejected after reading the paper. detection[].prevalence for OVRseen (USENIX Sec 2022) reads “36% of third-party exposures were identified by blocklists”. The paper says “Half of the apps (70 out of 140) expose data flows to third-party FQDNs, 36% of which are labeled as ATS by blocklists” — that is a prevalence, not a miss rate, and it does not belong in a coverage-hole table. It was dropped, and OVRseen is not cited on the page. Its bibliography entry was generated and then not used.

Figures carried over from Requests rather than re-derived: Fouad et al. 25.22%/30.34%, Chen et al. 3,589 scripts / 12.48%, Lee et al. 34.5%, AdFlush 642 / 108 domains and 39.27% vs 39.92%, Duumviri 22 trackers, Snyder et al. 90.16%, TrackerSift, Lukić & Papadopoulos MV3. These were verified on that page against paper text in an earlier run and were not re-verified here. Anyone auditing them should treat requests as their provenance, not this page.

scripts/external_checks_filter_lists.sh, run 2026-08-29T12:01Z. Nothing on the page's status columns comes from a blog post, a vendor summary or a search result. Sources used, and why each is primary:

Corrections this pass made to material inherited from Requests (that page was checked 2026-08-12; seventeen days is enough):

Rejected, and why:

• Any “best ad blocker lists 2026” listing. None was consulted and none should be: they are SEO surfaces, they do not distinguish a list from an extension, and they carry no version or date.
• The GitHub Releases page for AdGuard filters as a version source — it is empty. The canonical version is the Version: header on filters.adtidy.org/<platform>/filters/<N>.txt.
• duckduckgo/tracker-blocklist (singular) — 404 on the API. The correct repository is tracker-blocklists.
• A numeric Safari content-blocker rule cap. Apple's Safari Web Extension content-blocking guide does name MAX_NUMBER_OF_STATIC_RULESETS — an earlier draft of this page wrongly said no primary Apple source existed — but it states no value for it. Verified by fetching Apple's own documentation JSON (developer.apple.com/tutorials/data/…) because the HTML page is script-rendered and returns no text to curl. The check is in the script; the page names the constant and states no number.
• The Chrome Web Store listing for uBlock Origin as a source for MV2 dates — it redirects to a Google consent wall. Google's own deprecation-timeline page was used instead.
• easylist.to/pages/policy.html as a dated source. It is the primary source for EasyPrivacy's four categories and it returns HTTP 200, but it carries no revision date, so the page says so in a footnote rather than implying the text is current.

external_checks_filter_lists-output.txt

run date: 2026-08-29T12:56:24Z

===== 1. list headers, rule counts and hashes (canonical download URLs) =====
easylist                 network=  54731 cosmetic=  24512 exception=   758 comment=   279 sha256=015a6f8f1310 bytes=2105930
                         Version: 202608291231 | Commit: 304d779d6e53153674a2de25a960b7cd51eea241 | Expires: 4 days (update frequency)
easyprivacy              network=  55100 cosmetic=     33 exception=   836 comment=   769 sha256=4942451b9c29 bytes=1499117
                         Version: 202608291231 | Commit: 304d779d6e53153674a2de25a960b7cd51eea241 | Expires: 4 days (update frequency)
easylist-cookie          network=   1674 cosmetic=  23057 exception=   428 comment=   790 sha256=2c39a370892c bytes=890095
                         Last modified: 2026-08-28 00:50 UTC | (no commit header) | Expires: 9 days (update frequency)
adguard-url-tracking     network=   2520 cosmetic=      2 exception=    91 comment=  1259 sha256=7578d8eb0e3e bytes=174327
                         Version: 2.0.14.1
 | (no commit header) | Expires: 12 hours (update frequency)
adguard-base             network=  79406 cosmetic=  51193 exception=  6251 comment= 16054 sha256=b9d483b545cb bytes=7111275
                         Version: 2.4.86.70
 | (no commit header) | Expires: 12 hours (update frequency)
peter-lowe               network=   3530 cosmetic=      0 exception=     0 comment=    17 sha256=f66a0e3b3bfb bytes=69866
                         (no version header) | (no commit header) | (no expires header)
easylist-china           network=  11377 cosmetic=   6935 exception=   986 comment=   106 sha256=56f54d6bdab8 bytes=552194
                         Version: 202608291241 | (no commit header) | Expires: 1 days (update frequency)
easylist-germany         network=   2149 cosmetic=   3650 exception=   164 comment=    54 sha256=1528a89f4222 bytes=276000
                         Version: 202608271302 | Commit: 54a56733e83fe6249cac42767fe442bb445b8d89 | Expires: 1 days (update frequency)
liste-fr                 network=   9892 cosmetic=   3545 exception=   157 comment=   115 sha256=126d2888a1c0 bytes=419938
                         Version: 202608291241 | (no commit header) | Expires: 1 days (fréquence des mises a jour automatiques)

===== 1a. EasyList drift: three fetches of the same URL, ten minutes apart =====
  fetch 1 at 12:56:27Z  Version=202608291231  commit=304d779d6e53  network=54731  sha256=015a6f8f1310
  fetch 2 at 13:06:27Z  Version=202608291255  commit=722b6a02c822  network=54733  sha256=a4c232235a24
  fetch 3 at 13:16:27Z  Version=202608291255  commit=722b6a02c822  network=54733  sha256=a4c232235a24

===== 1b. AdGuard CNAME disguised trackers (needs the DNS chain, not request logs) =====
  first line: ! Title: AdGuard CNAME disguised trackers list
  total lines: 224830

===== 2. repository state (GitHub API, primary source) =====
  rate limit: 60/60 remaining, resets in 3600s
easylist/easylist
  easylist/easylist                            pushed=2026-08-29T13:11:37Z archived=False open_issues=1381 license=None
disconnectme/disconnect-tracking-protection
  disconnectme/disconnect-tracking-protection  pushed=2026-08-28T17:45:10Z archived=False open_issues=0 license=NOASSERTION
mozilla-services/shavar-prod-lists
  mozilla-services/shavar-prod-lists           pushed=2026-08-27T16:35:04Z archived=False open_issues=19 license=NOASSERTION
duckduckgo/tracker-radar
  duckduckgo/tracker-radar                     pushed=2026-08-28T15:40:21Z archived=False open_issues=30 license=NOASSERTION
duckduckgo/tracker-blocklists
  duckduckgo/tracker-blocklists                pushed=2026-07-17T14:18:54Z archived=False open_issues=7 license=NOASSERTION
whotracksme/whotracks.me
  whotracksme/whotracks.me                     pushed=2026-08-04T16:22:25Z archived=False open_issues=34 license=MIT
AdguardTeam/AdguardFilters
  AdguardTeam/AdguardFilters                   pushed=2026-08-29T12:51:23Z archived=False open_issues=678 license=GPL-3.0
AdguardTeam/FiltersRegistry
  AdguardTeam/FiltersRegistry                  pushed=2026-08-29T12:41:47Z archived=False open_issues=23 license=LGPL-3.0
AdguardTeam/cname-trackers
  AdguardTeam/cname-trackers                   pushed=2026-08-17T15:56:27Z archived=False open_issues=6 license=MIT
OhMyGuus/I-Still-Dont-Care-About-Cookies
  OhMyGuus/I-Still-Dont-Care-About-Cookies     pushed=2026-08-29T12:13:28Z archived=False open_issues=14463 license=GPL-3.0
duckduckgo/autoconsent
  duckduckgo/autoconsent                       pushed=2026-08-29T07:27:11Z archived=False open_issues=66 license=MPL-2.0
cavi-au/Consent-O-Matic
  cavi-au/Consent-O-Matic                      pushed=2026-02-07T15:11:53Z archived=False open_issues=159 license=NOASSERTION
mozilla/cookie-banner-rules-list
  mozilla/cookie-banner-rules-list             pushed=2025-01-07T16:46:41Z archived=True open_issues=165 license=MPL-2.0
brave/adblock-rust
  brave/adblock-rust                           pushed=2026-08-26T20:04:29Z archived=False open_issues=92 license=MPL-2.0
ghostery/adblocker
  ghostery/adblocker                           pushed=2026-08-28T22:44:59Z archived=False open_issues=32 license=MPL-2.0
ArniDagur/python-adblock
  ArniDagur/python-adblock                     pushed=2023-03-28T13:40:39Z archived=False open_issues=12 license=Apache-2.0
englehardt/abp-blocklist-parser
  englehardt/abp-blocklist-parser              pushed=2020-11-02T16:26:33Z archived=False open_issues=6 license=NOASSERTION
scrapinghub/adblockparser
  scrapinghub/adblockparser                    pushed=2019-02-20T02:13:41Z archived=True open_issues=16 license=MIT
gorhill/uBlock
  gorhill/uBlock                               pushed=2026-08-25T16:06:29Z archived=False open_issues=15 license=GPL-3.0
uBlockOrigin/uBOL-home
  uBlockOrigin/uBOL-home                       pushed=2026-08-26T12:48:43Z archived=False open_issues=10 license=GPL-3.0

===== 2a2. AdGuard filters: is the GitHub Releases page really empty? (the page says the canonical version is the list header, not a release) =====
  releases returned: 0
  /releases/latest -> 404

===== 2b. does the singular duckduckgo/tracker-blocklist exist (the page claims it 404s) =====
  api.github.com/repos/duckduckgo/tracker-blocklist -> 404

===== 2c. easylist repo scale (contributors / commits / closed issues), for the crowd-sourcing claim =====
  contributors?per_page=1&anon=0 -> 326
  commits?per_page=1 -> 289674
  closed issues -> 9038

===== 3. package registries (npm / PyPI / crates.io) — engines the page recommends =====
  adblock-rs                   latest=0.13.3     published=2026-08-20T20:24:24.889Z deprecated=False
  @ghostery/adblocker          latest=2.18.2     published=2026-08-05T15:32:58.771Z deprecated=False
  @cliqz/adblocker             latest=1.34.0     published=2024-10-16T09:05:40.490Z deprecated=True
  adblock                      latest=0.6.0      uploaded=2022-07-17T23:08:22.593344Z yanked=False
  braveblock                   latest=0.5.1      uploaded=2024-02-14T14:36:28.332700Z yanked=False
  adblockparser                latest=0.7        uploaded=2016-10-17T08:34:27.842631Z yanked=False
  crates.io adblock -> 0.13.3 updated=2026-08-20T20:24:32.201745Z

===== 4. declarativeNetRequest rule caps — vendor documentation, verbatim =====
  https://developer.chrome.com/docs/extensions/reference/api/declarativeNetRequest
    GUARANTEED_MINIMUM_STATIC_RULES . Note: Prior to Chrome 120, extensions were limited to a total of 50 static rulesets, and only 10 of these could be enabled at the same t
    MAX_NUMBER_OF_REGEX_RULES . Additionally, each rule must be less than 2KB once compiled. This roughly correlates with the complexity of the rule. If you try to load a rul
    MAX_NUMBER_OF_ENABLED_STATIC_RULESETS . Collectively, those rulesets are guaranteed at least 30,000 rules. This is called the GUARANTEED_MINIMUM_STATIC_RULES . Note: Prio
    MAX_NUMBER_OF_UNSAFE_DYNAMIC_RULES . Starting in Chrome 121, there is a larger limit of 30,000 rules available for safe dynamic rules, exposed as the MAX_NUMBER_OF_DYNAMI
    VALUE: be enabled at a time. The latter is called the MAX_NUMBER_OF_ENABLED_STATIC_RULESETS . Collectively, those rulesets are guaranteed at least 30,000
    VALUE: ions All types of rules can use regular expressions; however, the total number of regular expression rules of each type cannot exceed 1000
    VALUE: ately and set runtime.lastError . Note: getMatchedRules calls associated with a user gesture are exempt from the quota. Value 10
    VALUE: ension across its enabled static rulesets. Any rules above this limit will count towards the global static rule limit . Value 30000
    VALUE: ALLS_PER_INTERVAL The number of times getMatchedRules can be called within a period of GETMATCHEDRULES_QUOTA_INTERVAL . Value 20
    VALUE: ES_QUOTA_INTERVAL . Value 20 MAX_NUMBER_OF_DYNAMIC_RULES The maximum number of dynamic rules that an extension can add. Value 30000
    VALUE: ER_OF_ENABLED_STATIC_RULESETS Chrome 94+ The maximum number of static Rulesets an extension can enable at any one time. Value 50
    VALUE: an add. This limit is evaluated separately for the set of dynamic rules and those specified in the rule resources file. Value 1000
    VALUE: alue 1000 MAX_NUMBER_OF_SESSION_RULES Chrome 120+ The maximum number of session scoped rules that an extension can add. Value 5000
    VALUE: C_RULESETS The maximum number of static Rulesets an extension can specify as part of the "rule_resources" manifest key. Value 100
    VALUE: MAX_NUMBER_OF_UNSAFE_DYNAMIC_RULES Chrome 120+ The maximum number of "unsafe" dynamic rules that an extension can add. Value 5000
    VALUE: MBER_OF_UNSAFE_SESSION_RULES Chrome 120+ The maximum number of "unsafe" session scoped rules that an extension can add. Value 5000
  https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/declarativeNetRequest
    GUARANTEED_MINIMUM_STATIC_RULES and the number of enable static rulesets doesn't exceed the value of MAX_NUMBER_OF_ENABLED_STATIC_RULESETS . Note: The number of rules in
    MAX_NUMBER_OF_REGEX_RULES The maximum number of regular expression rules that an extension can add. declarativeNetRequest.MAX_NUMBER_OF_SESSION_RULES The maximum number o
    MAX_NUMBER_OF_ENABLED_STATIC_RULESETS . Note: The number of rules in enabled static rulesets for all extensions must not exceed the global limit. Extensions shouldn't dep
    MAX_NUMBER_OF_DYNAMIC_AND_SESSION_RULES . From Chrome 120 and Firefox 128, the values of MAX_NUMBER_OF_DYNAMIC_RULES and MAX_NUMBER_OF_SESSION_RULES Matching precedence W

===== 4a2. brave/adblock-rust Request::new signature (the page's 'a rule needs context' claim) =====
201:    pub fn new(
202-        url: &str,
203-        source_url: &str,
204-        request_type: &str,
205-        method: &str,
206-    ) -> Result<Request, RequestError> {
207-        let parsed_url = url_parser::parse_url(url).ok_or(RequestError::HostnameParseError)?;
208-        let parsed_method = method.parse::<RequestMethod>().ok();
209-

===== 4a3. Web Almanac: which tracker source does each Privacy chapter use? =====
  --- 2025
    privacy: names WhoTracks
    third-parties: names Third-Party Web
  --- 2024
    privacy: names WhoTracks, AdGuard
    third-parties: names Third-Party Web

===== 4b. Safari: does Apple state a numeric content-blocker rule cap? =====
  constants named: ['MAX_NUMBER_OF_STATIC_RULESETS']
  numeric values stated alongside them: (none)

===== 5. lists the page calls DEAD or ARCHIVED — check they really are =====
  DNS hosts-file.net -> RESOLVES
  DNS www.hosts-file.net -> does not resolve
  http://hosts-file.net/ad_servers.txt -> curl: (28) Connection timed out after 60002 milliseconds
000 0B https://hosts-file.net/ad_servers.txt
(fetch failed)
     first 200 bytes: 
  easylist.to/pages/policy.html -> 200
  justdomains.github.io/blocklists/ -> 200
  easylist.to country-specific list index -> 200
  Chrome MV2 deprecation timeline page -> 
     Understand when Manifest V2 will stop working for extensions Aug 31st 2026: All remaining Manifest V2 extensions removed from the Chrome Web Store All remaining Manifest V2 extensions are removed from the Chrome Web Stor
     Manifest V2 extensions installed on Chrome 138 or earlier will remain installed, but will be unable to receive any updates and cannot be reinstalled from the Chrome Web Store once removed from Chrome.
     Jul 24th 2025: Manifest V2 is disabled everywhere With Chrome 138 all users on all channels of Chrome have now Manifest V2 extensions disabled.
     March 31st 2025: Manifest V2 is disabled with the option to re-enable extensions All users on all channels of Chrome now have Manifest V2 extensions disabled by default, but users continue to be able to turn their Manife
  whotracks.me redirect -> https://www.ghostery.com/whotracksme (200)

done: 2026-08-29T13:17:45Z

filterlist_provenance.py is published on the page as a <file python> block. The block is the committed file, not an abridgement: it is generated from pages/filterlist_provenance.NEW.py and the <code> block under it is that file's real stderr. It was inherited from Requests with one change — three regional lists added to LISTS — and re-run for this page.

Its real, unedited stderr — the <code> block on the page and the source of every rule count there:

filterlist_provenance-output.txt

easylist               202608291255             network=  54733 cosmetic=  24512 exception=   758 sha256=a4c232235a24
easyprivacy            202608291255             network=  55100 cosmetic=     33 exception=   836 sha256=3bb7a1cb0e5b
easylist-cookie        2026-08-29 12:50 UTC     network=   1674 cosmetic=  23057 exception=   428 sha256=e087b8c3dc50
adguard-url-tracking   2.0.14.1                 network=   2520 cosmetic=      2 exception=    91 sha256=7578d8eb0e3e
peter-lowe             Sat, 29 Aug 2026 11:35:42 GMT network=   3530 cosmetic=      0 exception=     0 sha256=f66a0e3b3bfb
easylist-china         202608291302             network=  11377 cosmetic=   6935 exception=   986 sha256=e2f9823d66a1
easylist-germany       202608271302             network=   2149 cosmetic=   3650 exception=   164 sha256=1528a89f4222
liste-fr               202608291302             network=   9892 cosmetic=   3545 exception=   157 sha256=cf54e8acec0f

Run alongside external_checks_filter_lists.sh, which counts rules the same way from a separate fetch. Where the two disagree about EasyList, that is the finding, not an error: the list changed between the fetches. The check script's section 1a exists to make that reproducible rather than anecdotal — three fetches of the same URL, ten minutes apart, with the Version:, the commit and the hash printed for each.

The page also states a 2026-08-12 EasyList figure (52,557 network rules) that no output here produces, because it predates this run. Its source is the <code> block that was on Requests before this page existed, measured the same way; it is now recorded in the corrections table above and nowhere else on the live wiki, which is why that footnote points here rather than there.

• Whether the extraction's tools[].version null means “the paper gave no version”. It means the extraction did not attach one to that tool entry. A paper that dates its lists in a crawl paragraph rather than beside the name may not be credited. The page states the 29.8% as an order of magnitude in both directions and leans instead on the 4 papers (2.2%) with a list Version: or commit, which is a string no extraction would invent.
• How many papers loaded a regional list without discussing it. No query available here can find that. The page's claim is scoped to papers about regional lists.
• Which smart-TV testbed row is Roku and which is Fire TV (see the quote table).
• Whether Cookiepedia's labels are accurate. It is load-bearing for the current cookie-labelling method and nobody in this corpus has audited it. Filed as an open question on the page rather than asserted either way.
• What rules the shipped MV3 blockers drop to fit the 30,000-rule cap. uBlock Origin Lite's rulesets are in its repository and could be diffed against upstream EasyList; nobody has published that, and it was out of scope here. This is the most tractable open question on the page — it needs a diff, not a crawl.
• Whether the 16%–19% false-positive estimate generalises. One paper, one taint-tracking browser, 7,614 sites. The page uses the number four times and now carries the caveat at all four — it carried it at two until the generic reviewer counted.
• Whether two papers belong in the 16-paper learned-classifier roster. A 2015 website-category classifier and a 2018 host-population classifier whose labels mix hpHosts with PhishTank and MPDNS are in the count because hpHosts is an ad/tracking hosts-file list. Neither is a tracker detector. The page names them rather than quietly dropping them, and the claim it makes is about the fourteen that are.

Two substantive corrections came out of review rather than out of writing, and both are worth recording because they are the kind a next run will make again:

1. The ground-truth fold was blind on one field (above). Every mechanical check passed. Only a reviewer who read the papers behind the roster noticed that the two most famous filter-list-labelled classifiers were missing from it.
2. Two sentinel rows were added together. The first draft said “roughly three quarters do not validate the labels” from 41.3% + 36.5%. Eleven papers carry both a sentinel and a real value, so the correct paper-level figure is 119 of 167 (71.3%). This was caught in self-review; the report script now computes it directly so it cannot be reconstructed by addition again.

The item this page was written for said “privacy:requests tells you to classify with a list; it does not tell you which list.” That was no longer true. By 2026-08-29 that page carried a 26 KB Block Lists section: the list inventory with status, the network/cosmetic split, the engine comparison, the Manifest V3 rule caps, the coverage-hole table and the filterlist_provenance.py script.

Three options, and the reasoning:

1. Write a parallel page and cross-link. Rejected: two pages with the same list-status table drift apart within months, and the reader cannot tell which is current.
2. Broaden privacy:requests instead of creating this page. Rejected: the filter list is used for far more than requests — this corpus shows it labelling cookies, scripts, domains, consent notices and email — and a page titled Classifying Web Requests is the wrong home for a cookie-labelling method.
3. Create this page and move the how-to into it, leaving a summary and a pointer. Chosen.

What moved: the whole ===== Block Lists ===== section of privacy:requests (lines 69–318 of revision 1787770407, 26,247 bytes, 8 subsections). What replaced it: a 9-line summary naming the three things a reader of that page cannot skip, plus a pointer. What stayed: everything else, including that page's own Use in Publications analysis, because it is scoped to its own request-classification population and removing it would break its S1/S2 narrative.

The cost of the choice, stated plainly: the “which lists the field actually uses” table now exists in two places with slightly different populations (197 vs 198). A note was added to the privacy:requests copy pointing at this page's as canonical. A cleaner outcome would have been to remove it there too; that was not done because it is woven into that page's population argument, and gutting a second section of someone else's best page in the same sitting is the kind of change that should be reviewed before it is made. This is a live inconsistency and it is recorded here so the next run can finish it.

The carve-out also left day-one drift, found by the generic reviewer and fixed. Four figures stayed behind on privacy:requests as literal numbers — the EasyList Cookie List rule counts, the EasyList Version 202608121614 and adblock 0.13.2 examples in What to Report, and the 52,557-rule MV3 comparison — all already stale within seventeen days. They were repointed at this page's sections rather than refreshed, because refreshing a copy just resets the clock on the same problem. That is the rule the split should follow everywhere: a number lives on one page and every other page links to it.

Four rows were also removed from Which Lists Exist after review: autoconsent, Consent-O-Matic and I Still Don't Care About Cookies are JavaScript rule sets that click a consent banner, not Adblock-syntax filter lists, and Consent already compares and dates them. One pointer row replaced four status rows — four fewer things to rot. Firefox's archived cookie-banner-rules-list is named in that row because Consent does not carry it.

One thing that was lost in the carve-out and has been put back. The removed section carried a paragraph on who maintains EasyList and what its crowd-sourced governance implies for coverage. It initially survived on neither page, while external_checks_filter_lists.sh went on verifying the repository scale for a claim no page made. It is now a subsection of Which Lists Exist — it is exactly the thing the fresh PhD student does not know, and it is the mechanism behind every row of the coverage-hole table.

Everything moved was re-verified on 2026-08-29 rather than copied: see the corrections table above, which changed nine facts.

bottger2025_regional and boettger2025_regional are the same paper under two keys in bibliography — same title, same authors, same venue, differing only in the umlaut transliteration and the presence of a DOI. This page uses bottger2025_regional, matching Requests. No third key was added and neither was deleted: de-duplicating a bibliography key means editing every page that cites the other one, which is its own task.

All three are PETS, whose corpus index carries no authors and no DOI (100% of PETS and USENIX records). fetch_authors.py could not parse the PETS landing pages, so the author lists were taken from the papers' own front matter in paper.cols.txt and entered by hand into out/authors.json; the DOIs are derived by bibgen.mjs from the landing URL and were then checked against Crossref, which returned the correct title for each. A key-string and DOI collision scan against the live bibliography found none. A fourth entry, trimananda2022_ovrseen, was generated and not appended, because the figure it was for was rejected (above).

The site's standing instruction is to date every method and say which are current. For filter lists the honest answer is that the instrument is not superseded and nothing in this corpus supports saying it is: list use per 1,000 corpus papers peaked at 40.3 in 2018–2021 and sits at 32.9 in the provisional 2025–2026 slice, and machine learning was added alongside rather than instead. What has moved is how labels are sourced — filter-list provenance combined with an independent label database (Cookiepedia in [1Munir, Shaoor; Siby, Sandra; Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair; Troncoso, Carmela (2023): "CookieGraph: Understanding and Detecting First-Party Tracking Cookies", pp. 3490–3504. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)]), and behavioural or differential references instead of list-versus-list scoring. LLM classification appears in the list-using population only in 2024 (2 papers), 2025 (4) and 2026 (1) — real, but resting on the corpus's thinnest and most provisional years, and the page says so rather than calling it current practice.

Comments belong on the content page. This sets the default for provenance: pages that follow.

Four review passes over the page, the report script and its output, and these notes. All four were told explicitly that the author's context might not be exhaustive. The three focused passes ran in parallel; the generic pass ran afterwards, on the fixed page.

Re-ran report_filter_lists.mjs and diffed against the committed output (byte-identical), then traced every figure, table cell and percentage on both pages back to it.

Everything else it checked passed: all 25 citekeys resolve to exactly one live entry; the bottger2025_regional / boettger2025_regional duplicate is real and the page uses only one of them; the three new entries' DOIs, titles and author lists check out against Crossref and against each paper's own front matter; and every per-paper figure in the coverage-hole, bypass, ground-truth and regional sections matches the paper's own number and denominator.

It also tried hard to falsify the page's claim that no maintained Python binding to a modern filter-list engine exists — searching PyPI, GitHub and the Brave and Ghostery organisations for a renamed successor — and could not. That is the check that claim needed, since a package's last release date is not its currency; the claim stands.

Given no checklist and told the other three had already run. It found the most serious defect on the page, which none of the mechanical passes could have found, because the page matched its script exactly and the bug was inside the script's fold.

• Filter Lists — the page these notes are for.
• corpus — how the extraction was built, what it covers, and the corpus-level caveats not repeated here.
• requests — provenance for the figures this page inherited rather than re-derived.

[1]

Munir, Shaoor; Siby, Sandra; Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair; Troncoso, Carmela (2023): "CookieGraph: Understanding and Detecting First-Party Tracking Cookies", pp. 3490–3504. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)