A hypothesis test asks whether two groups of sites differ. A regression asks by how much, holding other things constant — and that is almost always the question a web measurement actually has. Do sites with a consent banner set fewer third-party cookies once you account for site rank, category and country? Does the number of trackers go up after a policy deadline once you account for the fact that popular sites had more to begin with? Every one of those is a regression, and this page is about the four things that make one hard here rather than in a textbook: your outcome is a count or a binary flag per site, not a nice continuous number; your rows are not independent because the same site appears twice or shares a tag manager with two hundred others; your coefficient is not causal unless you did something specific to make it so; and often enough to matter the model in the paper is not doing inference at all, it is a classifier — 124 papers here use a regression only as a classifier, against 253 that use one as an estimator.

This page assumes you know what a regression coefficient and a standard error are. It does not explain the linear model. What it does is date the practice: which model families this literature actually fits, what it does about repeated crawls of the same site (essentially nothing), and what changed in 2025–2026.

• Gelman, Hill & Vehtari, Regression and Other Stories [3Gelman, Andrew; Hill, Jennifer; Vehtari, Aki (2020): "Regression and Other Stories". Cambridge University Press. (DOI)] — read this one first if you read only one. It is the 2020 successor to Gelman & Hill's 2007 Data Analysis Using Regression and Multilevel/Hierarchical Models [4Gelman, Andrew; Hill, Jennifer (2007): "Data Analysis Using Regression and Multilevel/Hierarchical Models". Cambridge University Press. (DOI)], and it is the one to buy now. The catch is that the multilevel material is not in it. Regression and Other Stories covers single-level modelling — what a logistic coefficient means, why you should plot the fitted model, how to think about prediction and causal inference — and Cambridge's own listing points readers to the 2007 volume for the multilevel/hierarchical half.¹⁾ For the random-effects material on this page you still want the 2007 book, chapters 11–13.
• Shmueli, “To Explain or to Predict?” [5Shmueli, Galit (2010): "To Explain or to Predict?", Statistical Science 25(3):289-310. (DOI)] (Statistical Science 2010) — read this before you decide whether your logistic regression is a model or a classifier. This is the distinction 124 papers in this corpus are on one side of and 253 on the other, and the two demand entirely different reporting. See Regression as Inference Is Not Regression as a Classifier.
• Cameron & Miller [6Colin Cameron, A.; Miller, Douglas L. (2015): "A Practitioner’s Guide to Cluster-Robust Inference", Journal of Human Resources 50(2):317-372. (DOI)] and MacKinnon, Nielsen & Webb [7MacKinnon, James G.; Nielsen, Morten Ørregaard; Webb, Matthew D. (2023): "Cluster-Robust Inference: A Guide to Empirical Practice", Journal of Econometrics 232(2):272-299. (DOI)] — cluster-robust inference, written for practitioners rather than econometricians. The direct fix for The Same Site, Crawled Twice, and the one that fits in a single cov_type=“cluster” argument. Cameron & Miller is the readable introduction; the 2023 guide is the current one and is where the awkward cases live — few clusters, wildly unequal cluster sizes, and the wild bootstrap that fixes both.
• Ver Hoef & Boveng [8Ver Hoef, Jay M.; Boveng, Peter L. (2007): "Quasi-Poisson vs. Negative Binomial Regression: How Should We Model Overdispersed Count Data?", Ecology 88(11):2766-2772. (DOI)] — quasi-Poisson against negative binomial for overdispersed counts, in seven pages. If your outcome is “number of third parties on the site”, this decides your model.
• Mood [9Mood, Carina (2010): "Logistic Regression: Why We Cannot Do What We Think We Can Do, and What We Can Do About It", European Sociological Review 26(1):67-82. (DOI)] (European Sociological Review 2010) — “Logistic Regression: Why We Cannot Do What We Think We Can Do”. Odds ratios are not comparable across models, across samples, or across groups, even when nothing about the effect changed. If you have ever added a control variable to a logistic model and read the change in the odds ratio as confounding, this is the paper.
• Barr et al. [10Barr, Dale J.; Levy, Roger; Scheepers, Christoph; Tily, Harry J. (2013): "Random Effects Structure for Confirmatory Hypothesis Testing: Keep It Maximal", Journal of Memory and Language 68(3):255-278. (DOI)] — “Keep it maximal”: which random effects to include, and why leaving one out is an anti-conservative choice rather than a neutral simplification. Read it with its rebuttal, Matuschek et al. [11Matuschek, Hannes; Kliegl, Reinhold; Vasishth, Shravan; Baayen, Harald; Bates, Douglas (2017): "Balancing Type I Error and Power in Linear Mixed Models", Journal of Memory and Language 94:305-315. (DOI)], in the same journal four years later: maximal structures buy type-I error control at a real cost in power, and a data-supported (“parsimonious”) structure is often the better trade. The two papers together are the argument; neither alone is.
• Bates et al. [12Bates, Douglas; Mächler, Martin; Bolker, Ben; Walker, Steve (2015): "Fitting Linear Mixed-Effects Models Using lme4", Journal of Statistical Software 67(1):1-48. (DOI)] — the lme4 paper. Read it as documentation of what (1 | site) actually estimates, not as an R advertisement.
• Tang, Bauer & Christin [13Tang, Jenny; Bauer, Lujo; Christin, Nicolas (2025): "Misuse, Misreporting, Misinterpretation of Statistical Methods in Usable Privacy and Security Papers", in: Proceedings of the Twenty-First Symposium on Usable Privacy and Security (SOUPS), pp. 475-493. USENIX Association. (Link)] (SOUPS 2025) — a systematic review of 121 SOUPS papers over twenty years, coding 479 statistical assertions. Its two headline numbers are the ones this page's corpus figures corroborate for models rather than tests: “tests in 23% of papers inadequately account for non-independence between samples” and “58% of papers lack information to verify whether an assertion is supported”. SOUPS is not one of this corpus's seven venues, which is why it is the external anchor rather than a corpus figure.
• Nenadić, Rodriguez & Calandrino [14Nenadić, Luka; Rodriguez, David; Calandrino, Joseph A. (2026): "Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law's Impact", Proceedings on Privacy Enhancing Technologies 2026(4):703-723. (DOI)] (PoPETs 2026) — the best worked example in this corpus of a repeated-crawl regression. A balanced panel of 11,800 websites observed twice, a binary per-site outcome, difference-in-differences, standard errors clustered on the website, a logistic robustness check and a false-discovery-rate correction on top. See What a good one looks like.

The single most confusing thing about this literature for a newcomer is that “logistic regression” names two unrelated activities that appear in the same papers.

• As inference, you fit a model to estimate a coefficient. You care about the coefficient, its standard error and its interval. Whether the model predicts well is almost beside the point.
• As a classifier, you fit a model to predict a label — is this script a tracker, is this cookie an identifier — and you care about precision, recall and how it does on held-out data. The coefficients are not interpreted at all.

The corpus separates them, and the split is stark. 155 papers name a regression model in tools[] rather than statistics[], and 148 of those tuples are categorised ml-model-or-algorithm. 253 papers name one in statistics[]. The two sets overlap in only 31 papers — so 124 papers use a regression purely as a classifier and never as an estimator. If you searched the literature for “logistic regression in web measurement” and read the first ten hits, you would probably read ten baselines and learn nothing about inference.

Say which one you are doing, in the sentence that introduces the model. “We fit a logistic regression of banner present on rank, category and country to estimate the association between …” and “we train a logistic-regression classifier as a baseline against our detector” are two different sentences, and a reader cannot tell them apart from a table of coefficients. Shmueli [5Shmueli, Galit (2010): "To Explain or to Predict?", Statistical Science 25(3):289-310. (DOI)] is the reference if a reviewer pushes back on doing one and reporting the other.

The rest of this page is about the first activity. Classifier evaluation belongs with Website classification and Javascript.

Nearly half the regressions in this corpus are linear (179 of 391, 45.8%). Some of those outcomes are genuinely continuous — page load time, price, latency. Many are not. Butkiewicz et al. [15Butkiewicz, Michael; Madhyastha, Harsha V.; Sekar, Vyas (2011): "Understanding website complexity: measurements, metrics, and implications", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (IMC 2011) is the archetype of the early pattern and still a useful read: a LASSO linear regression of page load time on a set of complexity metrics that are themselves counts — number of objects, number of servers, number of origins. The response there is a duration, so linear is right; the predictors are counts, which is a different and much less consequential problem.

The characteristic web-measurement outcome is a count with a long right tail: third parties per site, requests per page load, cookies set before consent, ads per video. Two properties matter and a linear model represents neither: counts cannot go below zero, and their variance grows with their mean.

The specific failure is overdispersion. A Poisson regression assumes variance equals mean. Real tracker counts have variance many times their mean, and when that assumption breaks the model does not merely fit badly — it reports standard errors that are far too small, and rejects true nulls at a rate nothing like its nominal α.

Compute your own variance-to-mean ratio before you choose the model, and put it in the paper. It is one line (y.var() / y.mean()), it decides the question, and no paper in this corpus reports one — which is why the ratio of 13 used below is a plausible guess rather than a measured fact about the web.

Part A of the script below measures it. Both groups of sites are drawn from the same distribution, so every rejection is a false positive:

counts_and_repeats.py

#!/usr/bin/env python3
"""Two things that change a regression's answer in a web measurement.
 
Both run on SYNTHETIC data with a fixed seed, because the point is a property
of the estimator rather than a fact about the web. Nothing here is a
measurement claim; every number is reproducible by running the file.
 
  A. TRACKER COUNTS ARE OVERDISPERSED. "Number of third parties on a site" is a
     count with variance many times its mean. A Poisson regression assumes
     variance == mean, so it reports standard errors that are far too small and
     rejects a true null far more often than its nominal alpha. This part
     measures that rate, and shows the fixes: a negative-binomial model, a
     quasi-Poisson scale correction, and heteroskedasticity-robust standard
     errors on the Poisson fit.
 
     The negative-binomial row is fitted TWICE on purpose. `sm.families.
     NegativeBinomial(alpha=...)` takes the dispersion as a FIXED input, so
     handing it the true simulated value is an oracle an analyst does not have.
     The second row estimates the dispersion jointly with the coefficients,
     which is what you actually do, and is the number to read.
 
  B. REPEATED CRAWLS OF THE SAME SITE CUT BOTH WAYS. When the same sites are
     crawled twice, the rows are not independent, and what that does to your
     test depends on WHERE the predictor varies:
 
       B1. A SITE-LEVEL predictor (category, rank bucket, CMP vendor) is
           constant within a site. Non-independence then inflates the
           false-positive rate, exactly as on Statistics:Hypothesis testing.
 
       B2. A WITHIN-SITE predictor (before/after, treatment/control applied to
           the same site) varies inside the site. Non-independence then makes
           the naive test CONSERVATIVE: the standard error is too LARGE and you
           lose power. Clustering on the site is still the right thing to do,
           but the direction of the error is the opposite one, and "clustering
           always inflates false positives" is the wrong rule to carry around.
 
     Both are measured against cluster-robust standard errors clustered on the
     site, which is the cheapest correct analysis and the one the corpus's own
     panel study uses.
 
Run:  python3 counts_and_repeats.py
Needs numpy, scipy and statsmodels.
"""
 
import warnings
 
import numpy as np
import statsmodels.api as sm
 
SEED = 20260819
ALPHA = 0.05
warnings.filterwarnings("ignore")  # convergence chatter from 1000s of tiny fits
 
 
# --------------------------------------------------------------------------- A
def part_a(n_sites=1000, mean_trackers=12.0, dispersion=1.0, iters=500):
    """False-positive rate of Poisson vs. count-aware models, under a TRUE null.
 
    Both groups of sites are drawn from the SAME negative-binomial
    distribution, so every rejection is a false positive. `dispersion` is the
    negative-binomial alpha: variance = mu + alpha * mu**2.
    """
    rng = np.random.default_rng(SEED)
    var = mean_trackers + dispersion * mean_trackers**2
    print(f"\nA. OVERDISPERSED COUNTS  ({iters} iterations, {n_sites} sites each)")
    print(f"   third parties per site ~ NegBin(mean={mean_trackers:.0f}, "
          f"var={var:.0f}), variance/mean = {var / mean_trackers:.1f}")
    print("   two groups drawn from that SAME distribution -> every rejection is false\n")
 
    # numpy parameterises NB by (n successes, p); convert from (mean, alpha).
    nb_n = 1.0 / dispersion
    nb_p = nb_n / (nb_n + mean_trackers)
 
    rejects = {"Poisson GLM": 0, "Poisson GLM + robust (HC0) SE": 0,
               "quasi-Poisson (Pearson scale)": 0,
               "negative binomial GLM, alpha KNOWN (oracle)": 0,
               "negative binomial, alpha ESTIMATED": 0}
    for _ in range(iters):
        y = rng.negative_binomial(nb_n, nb_p, size=n_sites)
        group = np.repeat([0, 1], n_sites // 2)
        X = sm.add_constant(group.astype(float))
 
        pois = sm.GLM(y, X, family=sm.families.Poisson()).fit()
        rejects["Poisson GLM"] += pois.pvalues[1] < ALPHA
 
        rob = sm.GLM(y, X, family=sm.families.Poisson()).fit(cov_type="HC0")
        rejects["Poisson GLM + robust (HC0) SE"] += rob.pvalues[1] < ALPHA
 
        qp = sm.GLM(y, X, family=sm.families.Poisson()).fit(scale="X2")
        rejects["quasi-Poisson (Pearson scale)"] += qp.pvalues[1] < ALPHA
 
        # alpha handed in: the analyst does not know it. Kept as an upper bound
        # on how well a count model can possibly do here.
        nb = sm.GLM(y, X, family=sm.families.NegativeBinomial(alpha=dispersion)).fit()
        rejects["negative binomial GLM, alpha KNOWN (oracle)"] += nb.pvalues[1] < ALPHA
 
        # alpha estimated jointly with the coefficients: what you actually run.
        try:
            nb2 = sm.NegativeBinomial(y, X).fit(disp=0)
            rejects["negative binomial, alpha ESTIMATED"] += nb2.pvalues[1] < ALPHA
        except Exception:      # a non-converged fit is a result, not a crash
            pass
 
    print(f"   {'model':44s} {'false positives':>16s}   (nominal {ALPHA:.0%})")
    for k, v in rejects.items():
        print(f"   {k:44s} {v / iters:>15.1%}")
    return {k: v / iters for k, v in rejects.items()}
 
 
# --------------------------------------------------------------------------- B
def _panel(rng, n_sites, icc_sd, beta, predictor, n_waves=2):
    """One panel: every site crawled `n_waves` times, binary outcome per row.
 
    `predictor` is 'site' (constant within a site) or 'within' (0 in the first
    half of the waves, 1 in the second). `beta` is its true log-odds effect; the
    caller passes 0 for a false-positive rate and something non-zero for power.
    """
    u = rng.normal(0.0, icc_sd, size=n_sites)          # site random intercept
    site = np.repeat(np.arange(n_sites), n_waves)
    wave = np.tile(np.arange(n_waves, dtype=float), n_sites)
    if predictor == "site":
        x = np.repeat(rng.integers(0, 2, size=n_sites).astype(float), n_waves)
    else:
        x = (wave >= n_waves / 2).astype(float)
    eta = -1.0 + u[site] + beta * x
    y = rng.random(n_sites * n_waves) < 1.0 / (1.0 + np.exp(-eta))
    return y.astype(float), sm.add_constant(x), site
 
 
def _fit_pair(y, X, site):
    """Naive p-value and site-clustered p-value for the same logistic model."""
    naive = sm.GLM(y, X, family=sm.families.Binomial()).fit()
    clust = sm.GLM(y, X, family=sm.families.Binomial()).fit(
        cov_type="cluster", cov_kwds={"groups": site}
    )
    return naive.pvalues[1], clust.pvalues[1], naive.bse[1], clust.bse[1]
 
 
def part_b(n_sites=500, icc_sd=1.5, iters=500, beta_power=0.4):
    rng = np.random.default_rng(SEED + 1)
    icc = icc_sd**2 / (icc_sd**2 + np.pi**2 / 3)  # latent-scale ICC for a logit
    print(f"\nB. THE SAME SITES, CRAWLED TWICE  ({iters} iterations, "
          f"{n_sites} sites x 2 waves)")
    print(f"   site random intercept SD = {icc_sd}, latent-scale ICC = {icc:.2f}\n")
 
    out = {}
    for label, predictor in [("B1  site-level predictor (constant within a site)", "site"),
                             ("B2  within-site predictor (wave 1 vs wave 2)", "within")]:
        nrej = crej = 0
        nbse = cbse = 0.0
        for _ in range(iters):
            y, X, site = _panel(rng, n_sites, icc_sd, 0.0, predictor)
            pn, pc, bn, bc = _fit_pair(y, X, site)
            nrej += pn < ALPHA
            crej += pc < ALPHA
            nbse += bn
            cbse += bc
        print(f"   {label}, TRUE NULL")
        print(f"      naive logistic, rows treated as independent  "
              f"{nrej / iters:>6.1%} false positives   mean SE {nbse / iters:.3f}")
        print(f"      same model, SEs clustered on the site        "
              f"{crej / iters:>6.1%} false positives   mean SE {cbse / iters:.3f}")
        out[predictor] = (nrej / iters, crej / iters, nbse / iters, cbse / iters)
 
    # How B1 scales with the number of crawls. The design effect grows with the
    # cluster size, so a monthly panel is much worse than a before/after pair.
    print("\n   B1 again, as the panel gets longer (site-level predictor, TRUE NULL)")
    print(f"      {'crawls per site':>16s}  {'rows':>7s}  {'naive':>8s}  {'clustered':>10s}")
    for n_waves in (2, 4, 8, 12):
        nrej = crej = 0
        for _ in range(iters):
            y, X, site = _panel(rng, n_sites, icc_sd, 0.0, "site", n_waves)
            pn, pc, _, _ = _fit_pair(y, X, site)
            nrej += pn < ALPHA
            crej += pc < ALPHA
        print(f"      {n_waves:>16d}  {n_sites * n_waves:>7d}  "
              f"{nrej / iters:>7.1%}  {crej / iters:>9.1%}")
        out[f"waves{n_waves}"] = (nrej / iters, crej / iters)
 
    # Power for the within-site case, where the naive test was conservative.
    nrej = crej = 0
    for _ in range(iters):
        y, X, site = _panel(rng, n_sites, icc_sd, beta_power, "within")
        pn, pc, _, _ = _fit_pair(y, X, site)
        nrej += pn < ALPHA
        crej += pc < ALPHA
    print(f"\n   B3  the same within-site predictor with a REAL effect "
          f"(log-odds {beta_power})")
    print(f"      naive logistic                               {nrej / iters:>6.1%} power")
    print(f"      SEs clustered on the site                    {crej / iters:>6.1%} power")
    out["power"] = (nrej / iters, crej / iters)
    return out
 
 
if __name__ == "__main__":
    print(__doc__.split("Run:")[0].rstrip())
    print(f"\nseed = {SEED}; numpy {np.__version__}; statsmodels {sm.__version__}")
    part_a()
    part_b()
    print("\nNothing above is a measurement. It is what these estimators do to data "
          "\nshaped like a crawl's.")

Its real output, on numpy 2.4.6 and statsmodels 0.14.6:

A. OVERDISPERSED COUNTS  (500 iterations, 1000 sites each)
   third parties per site ~ NegBin(mean=12, var=156), variance/mean = 13.0
   two groups drawn from that SAME distribution -> every rejection is false

   model                                         false positives   (nominal 5%)
   Poisson GLM                                            60.4%
   Poisson GLM + robust (HC0) SE                           5.2%
   quasi-Poisson (Pearson scale)                           5.0%
   negative binomial GLM, alpha KNOWN (oracle)             5.0%
   negative binomial, alpha ESTIMATED                      5.0%

A Poisson regression on counts with variance thirteen times their mean calls a null difference significant three times in five. Every fix works and each is one line: sm.GLM(…, family=Poisson()).fit(cov_type=“HC0”) for robust standard errors, .fit(scale=“X2”) for quasi-Poisson, or sm.NegativeBinomial(y, X).fit() for a negative binomial. Note which negative-binomial call that is. sm.families.NegativeBinomial(alpha=…) takes the dispersion as a fixed input, and handing it the true value is an oracle you do not have in a real analysis; sm.NegativeBinomial estimates the dispersion jointly with the coefficients, which is what you actually run. The script reports both, and here they agree at 5.0% — but the oracle row is an upper bound on how well a count model can do, not a result. Ver Hoef & Boveng [8Ver Hoef, Jay M.; Boveng, Peter L. (2007): "Quasi-Poisson vs. Negative Binomial Regression: How Should We Model Overdispersed Count Data?", Ecology 88(11):2766-2772. (DOI)] is the reference for choosing between the last two — quasi-Poisson weights observations proportionally to the mean, negative binomial proportionally to the mean squared, and which is right depends on how the variance actually grows in your data.

The corpus does this rarely and lately. 17 of the 391 (4.3%) fit a count model at all, and none before 2019. The papers that do state their reason plainly, which is why they are worth copying:

• Votipka et al. [16Votipka, Daniel; Fulton, Kelsey R.; Parker, James; Hou, Matthew; Mazurek, Michelle L.; Hicks, Michael (2020): "Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It", in: Proceedings of the USENIX Security Symposium. (Link)] (USENIX Sec 2020): “This trend was uncovered by a poisson regression (appropriate for count data) […] we performed for issues in the Mistakes type.” The elision is a citation marker in the original.
• Collier et al. [17Collier, Ben; Thomas, Daniel R.; Clayton, Richard; Hutchings, Alice (2019): "Booting the Booters: Evaluating the Effects of Police Interventions in the Market for Denial-of-Service Attacks", in: Proceedings of the ACM Internet Measurement Conference, pp. 50-64. (DOI)] (IMC 2019): “We use a negative binomial rather than poisson regression model, as the events (denial of service attacks) are not independent, rather there is a simple trend to the data”.
• Mai et al. [18Mai, Cat; Coelho, Bruno; Kieserman, Julia; Matsumoto, Lexie; Spinelli, Kyle; Yang, Eric; Andreou, Athanasios; Greenstadt, Rachel; Lauinger, Tobias; McCoy, Damon (2025): "More and Scammier Ads: The Perils of YouTube's Ad Privacy Settings", in: Proceedings on Privacy Enhancing Technologies. (DOI)] (PoPETs 2025) split the choice per outcome: “For analyses on ad load, we use Poisson regression, which is used to model count data” for one, “For analyses on predatory ads, we use negative binomial regression, which is the alternative to Poisson regression for data with high variances” for the other.
• Bashir et al. [19Bashir, Muhammad Ahmad; Farooq, Umar; Shahid, Maryam; Zaffar, Muhammad Fareed; Wilson, Christo (2019): "Quantity vs. Quality: Evaluating User Interest Profiles Using Ad Preference Managers", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (NDSS 2019) regress the number of inferred ad-interest profile entries per participant on participant features with a negative binomial model, one per ad-preference manager.
• Vu et al. [20Vu, Anh V.; Collier, Ben; Thomas, Daniel R.; Kristoff, John; Clayton, Richard; Hutchings, Alice (2025): "Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services", in: Proceedings of the USENIX Security Symposium. (Link)] (USENIX Sec 2025) combine the count model with a design: “we modelled the weekly attack counts … using negative binomial regression - a well-established statistical technique for interrupted time series analysis”. Weekly counts with a trend, seasonality and an intervention term is the shape of most “did the deadline change anything” questions in this field.

If your count is “how many X out of an opportunity that varies”, you need an offset, not a ratio. Regressing trackers per request or predatory ads as a share of ads on covariates throws away the fact that a site with 300 requests and a site with 12 give you very different amounts of information. The count model's answer is a log offset: put the exposure on the right-hand side with its coefficient fixed at 1. Mai et al. [18Mai, Cat; Coelho, Bruno; Kieserman, Julia; Matsumoto, Lexie; Spinelli, Kyle; Yang, Eric; Andreou, Athanasios; Greenstadt, Rachel; Lauinger, Tobias; McCoy, Damon (2025): "More and Scammier Ads: The Perils of YouTube's Ad Privacy Settings", in: Proceedings on Privacy Enhancing Technologies. (DOI)] do exactly this — “To normalize the count of predatory ads, we add an offset term that is the log of the total ad count” — and then report rate ratios rather than raw coefficients, which is the form a reader can act on. One paper in 5,859 does this.²⁾

“Sets a third-party cookie”, “shows a banner”, “honours Global Privacy Control”, “has a Meta Pixel configured for form collection” — a binary flag per site is probably the single most common thing a web measurement records, and 132 of the 391 papers (33.8%) fit a binary model, the second-largest family.

Three things to get right, none of which is about the link function.

Odds ratios are not comparable across models. This is the one that bites. Adding a control variable to a logistic regression changes the odds ratio on your variable of interest even when the control is unrelated to it, because the logistic scale is fixed and adding explanatory power rescales everything. Mood [9Mood, Carina (2010): "Logistic Regression: Why We Cannot Do What We Think We Can Do, and What We Can Do About It", European Sociological Review 26(1):67-82. (DOI)] is the standard citation and the recommendation is to report average marginal effects or predicted probabilities instead — quantities that live on the probability scale and mean the same thing across specifications. A full-text probe finds 20 papers in 5,869 that mention a marginal effect and 100 that report an odds ratio, so the field is doing the comparison-unsafe thing about five times as often as the safe one.

The linear probability model is a defensible choice and this literature almost never uses it. Fitting OLS to a 0/1 outcome gives you coefficients that read directly as percentage-point changes, which is usually what you want to say, and it composes with difference-in-differences without the incomparability problem above; Angrist & Pischke [21Angrist, Joshua D.; Pischke, Jörn-Steffen (2009): "Mostly Harmless Econometrics: An Empiricist's Companion". Princeton University Press. (DOI)] make the case. Its costs are real — predictions can leave [0,1], and the errors are heteroskedastic so you need robust standard errors — but they are costs a reviewer can evaluate. Two papers in 5,869 use the phrase “linear probability model”, and only one is a web crawl: Nenadić et al. [14Nenadić, Luka; Rodriguez, David; Calandrino, Joseph A. (2026): "Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law's Impact", Proceedings on Privacy Enhancing Technologies 2026(4):703-723. (DOI)], who note that with a binary outcome the OLS specification “operates in probability space”. (The other is a 2024 social-media study.)

Your sample size is the number of events, not the number of sites. A crawl of 100,000 sites where 400 show the behaviour you are modelling gives a logistic regression 400 events, and the usual guidance is on the order of ten events per predictor — relaxable, but knowingly [22Vittinghoff, Eric; McCulloch, Charles E. (2007): "Relaxing the Rule of Ten Events per Variable in Logistic and Cox Regression", American Journal of Epidemiology 165(6):710-718. (DOI)]. This is the failure mode of the rare-phenomenon paper: an enormous n and an unstable model.

A pseudo-R² of 0.07 is not a broken model, and saying so is not a weakness. Kieserman et al. [23Kieserman, Julia B.; Andreou, Athanasios; Geeng, Chris; Lauinger, Tobias; McCoy, Damon (2025): "Tracker Installations Are Not Created Equal: Understanding Tracker Configuration of Form Data Collection", in: Proceedings on Privacy Enhancing Technologies, pp. 679-695. (DOI)] fit logistic regressions on 40,150 websites to explain which ones configure Google and Meta trackers to harvest form data, and write: “It is important to acknowledge that our models are a relatively weak fit; the former has a pseudo R-squared of 0.0721” … “This means that their explanatory power is limited. However, we can still draw some useful insights from them”. They report odds ratios, p-values and confidence intervals per feature. That is the model to copy. An inferential regression is not primarily judged on fit — a low pseudo-R² says the outcome has other causes, not that the coefficient is wrong — and pretending otherwise is what leads people to report a classifier's AUC in place of a coefficient. (Fit still matters when a reviewer's objection is an omitted variable; that is an argument about which covariates are in the model, not about R².)

• A proportion bounded in (0,1) — share of a site's requests going to trackers, share of a page's cookies that are third-party — is not Gaussian and its variance shrinks at both ends. Beta regression [24Ferrari, Silvia; Cribari-Neto, Francisco (2004): "Beta Regression for Modelling Rates and Proportions", Journal of Applied Statistics 31(7):799-815. (DOI)] is the model for it; 3 papers in 5,859 use one, all of them on social-media outcomes rather than crawl outcomes. If the proportion is a count over a known denominator, a binomial or count-with-offset model is usually better than beta regression, because it keeps the denominator.
• An ordinal outcome — a severity band, a consent-banner “darkness” grade, a compliance level — is an ordered logit or a cumulative link model, and 46 papers (11.8%) do this. Almost all of them are user studies scoring Likert items, so the practice and its tooling live on User studies; what is worth carrying over is that a crawl's ordinal outcomes get treated as numbers far more casually than a survey's do.
• Time-to-event — how long until a domain is taken down, until a vulnerability is patched, until a tracker reappears — is a Cox model, used by 7 papers (1.8%). If your longitudinal crawl ends before some sites have had the event, that is right-censoring, and dropping those sites or coding them as “never” both bias the answer.

Every longitudinal crawl, every before/after policy study, every “we re-crawled the same list six months later” produces rows that are not independent, because the same site contributes more than one of them. So does a single-wave crawl, for a different reason: sites share tag managers, CMS templates, consent platforms and hosting, so a “sample of 100,000 sites” is a sample of far fewer independent units. The hypothesis-testing page covers the second case. This section is about the first, and about the fact that the two cases behave differently.

Very little, and what it does it does elsewhere.

Widen to the whole corpus and the shape is the same. 76 papers in 5,859 fit a random-effects model of any kind. 58 (76.3%) recruited human participants; 4 ran a crawl; 14 did neither (mostly social-media panel studies). The four crawl papers are worth listing individually, because none of them is what this section is about:

One paper in 5,859 fits the website as a random effect, and it is not a crawl. Zeng et al. [2Zeng, Eric; McAmis, Rachel; Kohno, Tadayoshi; Roesner, Franziska (2022): "What Factors Affect Targeting and Bids in Online Advertising? A Field Measurement Study", in: Proceedings of the ACM Internet Measurement Conference, pp. 210-229. (DOI)] (IMC 2022) recruited participants who browsed with an instrumented extension, and fitted “a linear mixed effects model to predict rendered winning bid values” with “random intercepts for website, participant, bidder, and ad category” — four crossed random effects, selected by REML AIC. It is the right model, and the website enters it because each participant saw many sites, not because the same site was crawled twice.

Not one paper fits the site as a random effect in a repeated crawl of the same sites. The sentence exists in this literature for people — Yuan et al. [1Yuan, Ying; Hao, Qingying; Apruzzese, Giovanni; Conti, Mauro; Wang, Gang (2024): ""Are Adversarial Phishing Webpages a Threat in Reality?" Understanding the Users' Perception of Adversarial Webpages", in: Proceedings of the ACM Web Conference, pp. 1712-1723. (DOI)] write “We treat each participant as a random effect because the same user has viewed 15 webpages (i.e., repeated measures)” — and it has never been written with “website crawled twice” in it. A full-text probe finds 61 papers using the words “random effect” and 29 using “random intercept” across all 5,869 stored texts; a second probe for any random-effects phrasing within 120 characters of a site/domain/page word returns 16 papers, of which fifteen are bibliography entries, “multilevel paging” and “multilevel traffic classification”. Zeng et al. is the sixteenth.³⁾

This is the part that is genuinely counterintuitive and the reason this section is not just a pointer to Hypothesis testing.

Part B of the script above simulates 500 sites crawled twice, with a binary per-site outcome and a site random intercept giving an intra-class correlation of 0.41 on the latent scale. Under a true null in both cases:

B. THE SAME SITES, CRAWLED TWICE  (500 iterations, 500 sites x 2 waves)
   site random intercept SD = 1.5, latent-scale ICC = 0.41

   B1  site-level predictor (constant within a site), TRUE NULL
      naive logistic, rows treated as independent    7.8% false positives   mean SE 0.135
      same model, SEs clustered on the site          5.2% false positives   mean SE 0.152
   B2  within-site predictor (wave 1 vs wave 2), TRUE NULL
      naive logistic, rows treated as independent    3.0% false positives   mean SE 0.135
      same model, SEs clustered on the site          4.8% false positives   mean SE 0.114

• B1, a site-level predictor — category, rank bucket, country, CMP vendor, anything constant within a site. Ignoring the repetition inflates the false-positive rate: 7.8% against a nominal 5%, and the naive standard error is too small. This is the familiar failure.
• B2, a within-site predictor — before/after, treated/control applied to the same site. Ignoring the repetition makes the test conservative: 3.0% against 5%, and the naive standard error is too large. The site's own baseline is a nuisance the naive model cannot subtract out, so it charges you for variation that the paired structure already cancels.

The B1 error grows with the number of crawls, which is exactly the regime a longitudinal study is in:

   B1 again, as the panel gets longer (site-level predictor, TRUE NULL)
       crawls per site     rows     naive   clustered
                     2     1000     8.6%       4.4%
                     4     2000    11.4%       3.6%
                     8     4000    25.2%       6.2%
                    12     6000    32.4%       4.2%

A monthly panel of 500 sites over a year, analysed as 6,000 independent rows, rejects a true null about a third of the time. Adding crawl waves feels like adding data; for a site-level predictor it adds almost no information and a great deal of false confidence.

And B2 is the reason not to shrug at all this even when your design is the safe one:

   B3  the same within-site predictor with a REAL effect (log-odds 0.4)
      naive logistic                               61.6% power
      SEs clustered on the site                    75.2% power

Clustering on the site gains you 13 percentage points of power here. Handling the dependence is not a penance that costs significance; for the before/after question — which is most of what longitudinal web measurement asks — it is the thing that finds the effect.

The panel case has an obvious clustering unit: the site. A single-wave crawl does not, and it is the commonest design in this corpus — which makes “what do I cluster on?” the question this page is most likely to be asked and the one the literature gives least help with. No paper in the corpus answers it: the one crawl paper whose method string names a clustering unit clusters on the product, not on anything web-structural [29Becerril-Arreola, Rafael (2023): "A Method to Assess and Explain Disparate Impact in Online Retailing", in: Proceedings of the ACM Web Conference. (DOI)].

What you have to choose between, in rough order of how much dependence each induces and how easily you can observe it:

Three practical points, none of which the corpus can settle for you:

• Cluster on the coarsest level you think the dependence lives at, not on the one that is easiest to compute. Clustering too finely leaves the dependence in; clustering too coarsely costs precision but is not wrong.
• You cannot cluster on two crossed dimensions with cov_type=“cluster”. If you believe both the CMP and the hosting provider matter, that is two-way clustering, and statsmodels does not do it — MacKinnon et al. [7MacKinnon, James G.; Nielsen, Morten Ørregaard; Webb, Matthew D. (2023): "Cluster-Robust Inference: A Guide to Empirical Practice", Journal of Econometrics 232(2):272-299. (DOI)] cover the estimator, and in practice people fall back to the coarser of the two.
• Say which one you chose and why, even if the choice is arguable. A stated clustering unit a reviewer disagrees with is a conversation; an unstated one is the 79.5%.

For a crawl the honest default is cluster-robust standard errors clustered on the site, because it is one argument, it does not change the estimand, and thousands of clusters is exactly the regime where it works. Say which correction you used: statsmodels's cov_type=“cluster” gives you the CR0 sandwich, which is the one that degrades under unequal cluster sizes [30Huang, Francis L. (2026): "When Cluster-Robust Inferences Fail", Educational and Psychological Measurement 86(3):579-601. Published online 2025-12-19; issue dated 2026-06 (DOI)]. Reach for a mixed model when the between-site variance is itself the result — “how much of the variation in tracker count is between sites rather than within them” is a mixed model's question and nothing else's. Barr et al. [10Barr, Dale J.; Levy, Roger; Scheepers, Christoph; Tily, Harry J. (2013): "Random Effects Structure for Confirmatory Hypothesis Testing: Keep It Maximal", Journal of Memory and Language 68(3):255-278. (DOI)] on which random effects to include; Moineddin et al. [31Moineddin, Rahim; Matheson, Flora I.; Glazier, Richard H. (2007): "A Simulation Study of Sample Size for Multilevel Logistic Regression Models", BMC Medical Research Methodology 7:34. (DOI)] on why a mixed model with few observations per group is less well-behaved than its output suggests.

Nenadić, Rodriguez & Calandrino [14Nenadić, Luka; Rodriguez, David; Calandrino, Joseph A. (2026): "Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law's Impact", Proceedings on Privacy Enhancing Technologies 2026(4):703-723. (DOI)] (PoPETs 2026) crawled privacy policies before and after the Swiss privacy law took effect in September 2023, and analysed them as what they are — a panel. The specification, in their words: a “difference-in-differences model on the balanced panel using Ordinary Least Squares (OLS)”; “Given the binary disclosure outcome, this specification operates in probability space”; and, decisively, “Standard errors are clustered at the website level to account for repeated observations of the same policy across snapshots.” The tables report the panel size in both units that matter — “11,800 websites (23,600 policy-snapshot observations)” — re-estimate everything as a logistic difference-in-differences as a robustness check, and apply a Benjamini–Hochberg false-discovery correction across obligations.

That is five decisions a crawl paper has to make, made explicitly. It is also, as far as this corpus goes, the only one that makes all five.

Note the word balanced. Nenadić et al. analyse the 11,800 sites present in both snapshots, which is the clean case and not the usual one: a re-crawl six months later loses sites to expiry, blocking, redirection and rewritten pages. Dropping the lost sites silently turns your panel into a survivorship sample of the sites that stayed reachable, which is precisely the ones least likely to have changed. Report the attrition — how many sites entered, how many survived, and whether the survivors differ on the covariates you care about — before reporting the model. The hypothesis-testing page treats attrition for paired tests and the argument is the same one; an unbalanced panel additionally means a mixed model and a fixed-effects model no longer answer quite the same question, because the fixed-effects fit discards every site seen once.

Two 2026 near-neighbours are worth reading alongside it, both on platform data rather than crawls: Chuai et al. [32Chuai, Yuwei; Lenzini, Gabriele; Pröllochs, Nicolas (2026): "Consensus Stability of Community Notes on X", in: Proceedings of the ACM Web Conference, pp. 8885-8896. (DOI)] fit a “multilevel mixed-effects logistic regression” with author- and post-level random effects and separately “cluster robust standard errors at the note level to account for potential within-note correlations over time”; Bobek et al. [33Bobek, Michelle; Pröllochs, Nicolas (2026): "Community Fact-Checks Do Not Break Follower Loyalty", in: Proceedings of the ACM Web Conference. (DOI)] run a staggered difference-in-differences with Callaway–Sant'Anna group-time treatment effects [34Callaway, Brantly; Sant'Anna, Pedro H. C. (2021): "Difference-in-Differences with Multiple Time Periods", Journal of Econometrics 225(2):200-230. (DOI)], propensity-score weighting, a pre-trends test and bootstrap simultaneous confidence bands.

A regression's output is not a p-value. Three habits separate a usable regression section from an unusable one.

• Report the quantity on the scale a reader can act on. A rate ratio (“2.1× as many trackers”), a marginal effect (“+4.3 percentage points”), a predicted probability at a stated covariate profile. A raw logistic coefficient of 0.74 is not a finding. Of the 391 papers, the detail field records a coefficient value for 130, a p-value for 76 and a confidence interval for 23.⁴⁾
• Report an interval, not a star. The single most common defect in this literature's regression tables is significance markers with no uncertainty. Kieserman et al. [23Kieserman, Julia B.; Andreou, Athanasios; Geeng, Chris; Lauinger, Tobias; McCoy, Damon (2025): "Tracker Installations Are Not Created Equal: Understanding Tracker Configuration of Form Data Collection", in: Proceedings on Privacy Enhancing Technologies, pp. 679-695. (DOI)] print odds ratio, p-value and 95% CI per feature; Nenadić et al. [14Nenadić, Luka; Rodriguez, David; Calandrino, Joseph A. (2026): "Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law's Impact", Proceedings on Privacy Enhancing Technologies 2026(4):703-723. (DOI)] print coefficient and CI. That is the bar.
• Do not upgrade the coefficient to a cause. 365 of the 391 papers (93.4%) fit an associational model, which is fine; what is not fine is a discussion section that reads it as an intervention. If you want the causal reading you need a design that supports it, and the corpus now has ten examples of what those look like — see below.

391 papers contribute 530 regression tuples carrying 315 distinct method strings. A broader query — any statistics[] tuple under any kind whose method reads as a regression — returns 380 papers, and the union with the 391 is 400, so the kind enum is not leaking meaningfully and the 391 is the right denominator.

Shares do not sum to 100%: a paper fitting a linear and a logistic model appears in both rows.

37 papers are excluded from those counts because the extractor scored something as a regression tuple that is not a model: model-selection criteria (AIC, BIC), collinearity diagnostics (VIF) and pseudo-R² for 18 of them, and other multivariate methods — structural equation modelling, PLS-SEM, latent class analysis, path and mediation analysis, decision trees — for 19. Counting those as regressions would inflate every family.

statistics[].method agrees run-to-run on roughly a fifth of exact strings, so it cannot be ranked as written. But the deeper problem is that ranking it at all is the wrong operation. “Mixed-effects logistic regression” is not a sibling of “logistic regression” and a cousin of “OLS”; it is binary outcome + random effects + associational, and each of those three answers a different question a reader has. A single ranked list of names cannot show that 79.5% of papers handle dependence in no way at all, because that fact is spread across every name in the list.

The fold therefore assigns each method string a value on three independent axes — outcome family, dependence handling, identification strategy — with first-match-wins rules whose order is load-bearing. “Ordinal logistic” must beat “logistic”, “quasi-Poisson” must beat “Poisson”, “generalized least squares” must not be swallowed by “least squares”, and the not-a-regression rules must fire before everything. The unmapped residue is 0 strings, but only because a catch-all rule collects regression-shaped strings that name no outcome family; those 42 papers are reported as their own row above and printed in full on regression rather than being folded into “continuous”. Getting that boundary right took a review: an earlier version of the fold matched \blinear\b, which quietly swallowed every bare “generalized linear mixed model” into the Gaussian family — including one whose own reported detail was “binary Decision outcome” and one that reports odds ratios.

The dependence table is above and is not repeated here. Two notes on how to read it.

cluster-robust and robust are separated on purpose. Heteroskedasticity-consistent (HC / White / Huber) standard errors fix a variance assumption; they do nothing whatever about correlated rows. Merging the two rows would let three papers that hardened against heteroskedasticity read as papers that handled dependence.

The fold reads the method string, so this row is a floor: Chuai et al. [32Chuai, Yuwei; Lenzini, Gabriele; Pröllochs, Nicolas (2026): "Consensus Stability of Community Notes on X", in: Proceedings of the ACM Web Conference, pp. 8885-8896. (DOI)] appear here under “robust” because that is what their regression tuples say, while the paper separately states that it clusters at the note level. The full-text probe below is the check on that, and it finds four clustering papers where the fold finds one.

Rows in both tables below overlap and neither sums to 391: 19 of the 391 have no tuple the fold could place as a model at all, so they get no dependence or identification value, and a paper fitting two models can appear in two rows. The 372 papers that do have a placeable model produce 396 axis-2 and 377 axis-3 row memberships.

62 papers ran both a crawl and a regression — 5.5% of the 1,120 crawl papers in the corpus. Every share below is out of those 62, which is a small denominator; treat them as a shape, not as rates.

The dependence rows sum to 61, not 62: two of the 62 have no placeable model and one of those has no dependence value either.

Crawl papers are more likely to fit a count model than the regression population as a whole (11.3% against 4.3%), which is what you would expect given what they measure, and less likely to do anything about dependence (87.1% silent against 79.5%), which is the opposite of what the data structure warrants. Two crawl papers in 1,120 cluster their standard errors — Becerril-Arreola [29Becerril-Arreola, Rafael (2023): "A Method to Assess and Explain Disparate Impact in Online Retailing", in: Proceedings of the ACM Web Conference. (DOI)], who says so in the method the extraction captured, and Nenadić et al. [14Nenadić, Luka; Rodriguez, David; Calandrino, Joseph A. (2026): "Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law's Impact", Proceedings on Privacy Enhancing Technologies 2026(4):703-723. (DOI)], who say so only in prose, which is why this table counts one and the full-text probe below counts two.

• 42 of the 391 (10.7%) name a regression without naming its outcome family — “multivariate regression”, “regression analysis”, “hierarchical multiple regression”, “elastic net”, and every bare “generalized linear mixed model”, which names a framework and not a distribution. A reader cannot tell whether the outcome was continuous or binary.
• 99 of the 391 (25.3%) use a bare “regression” or “regression analysis” as at least one of their method strings, whether or not they are more specific elsewhere.
• 19 papers (4.9%) have regression tuples that name no model this fold could place at all — the tuple names an AIC criterion, a path analysis or “regression test” and nothing else.
• 311 of the 391 (79.5%) say nothing about dependence in the method name. This is a bound, not a rate: the extraction records the method string, and a paper could describe clustering in prose that never reached a tuple. The full-text probe is the check on that, and it agrees — 4 papers cluster, 61 use the words “random effect”.

Every probe is a lower bound: a paper can describe the same thing in different words and the probe will miss it. They are here because they are an independent check on the tuple-based counts, computed from the same text the extractor read, with whitespace collapsed first — a PDF line break falls inside a two-word phrase often enough to matter, and collapsing it moved four of these counts.

• The fold is a three-axis rule list with a printed residue of 0, and the catch-all that makes it 0 is itself reported as a row (42 papers) and printed in full on the provenance page. Reading a catch-all as an answer is the failure mode this avoids.
• Non-regressions are excluded, not silently dropped. 37 papers whose regression tuples name AIC, VIF, SEM, latent class analysis or a decision tree are counted separately.
• A paper counts once, never once per mention. 530 tuples across 391 papers.
• statistics.kind is a mid-band extraction field. Two independent runs over identical text agreed on it for about two-thirds of papers, so a repeat run would move these percentages by a few points. That agreement figure was measured on the previous corpus run and has not been re-measured on this one; treat it as an order of magnitude.
• Quotes were checked in bulk and by hand. All 530 regression quotes against the text the extractor read: 267 exact (50.4%) after whitespace normalisation, 170 partial (32.1%) at ≥60% of five-word windows, 93 (17.5%) below that. Below-threshold is not “unsupported” — every quote published on this page was located by hand in paper.cols.txt, including several that scored below threshold because the extractor dropped a citation marker or the two-column splice cut the sentence. Details, including which ones, on regression.
• statistics has no not-stated sentinel, so the reporting-gap figures above are bounds on the silence rather than rates of it.
• The detail field is not a measurement of reporting practice. It is a capped free-text field the extractor filled when a value happened to be in the quoted sentence. Counts of R², CIs and p-values inside it establish an ordering and nothing more.
• The simulation is synthetic and its numbers are properties of the estimators, not facts about the web. The intra-class correlation and the overdispersion used were chosen to be plausible, and no paper in this corpus reports either quantity for a real crawl — which is itself an open question below.
• Venue coverage. Seven venues. EuroS&P, ACSAC, RAID, AsiaCCS, WPES, CHI and SOUPS are absent. SOUPS matters most here for the same reason as on Hypothesis testing: it is where the most careful modelling in this community appears, and it is out of scope. Tang et al. [13Tang, Jenny; Bauer, Lujo; Christin, Nicolas (2025): "Misuse, Misreporting, Misinterpretation of Statistical Methods in Usable Privacy and Security Papers", in: Proceedings of the Twenty-First Symposium on Usable Privacy and Security (SOUPS), pp. 475-493. USENIX Association. (Link)] audit exactly that venue and find 23% of papers mishandling non-independence — a figure this corpus cannot produce for its own seven venues, because the extraction records what a paper says it did and not whether the model was right. Every claim on this page is a claim about those seven venues.
• 2025 and 2026 are provisional. See the currency box.
• Every external reference was verified against a primary record on 2026-08-19, not recalled: fifteen methodological works and every corpus DOI through the Crossref API, plus the Project Euclid record for the Shmueli pagination and the Cambridge Core listing for Regression and Other Stories. The full query log, the fold's residue and the rejected sources are on regression; corpus-level caveats are on Corpus.

1. The outcome variable and its type, in the sentence that introduces the model. “We fit a negative binomial regression of the number of distinct third-party domains per site” tells a reader everything; “we ran a regression” tells them nothing, and 25.3% of papers here do the second.
2. Which model family and why, decided from the outcome. One clause is enough: “negative binomial rather than Poisson, because the counts are overdispersed”.
3. What your independent unit is, and what you did about rows that are not independent. For a repeated crawl name the clustering unit explicitly — “standard errors clustered on the website” — and say what the repeated observations are. This is the highest-value sentence on the list and 79.5% of papers here do not have it.
4. The panel in both units. “11,800 websites, 23,600 site-snapshot observations” [14Nenadić, Luka; Rodriguez, David; Calandrino, Joseph A. (2026): "Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law's Impact", Proceedings on Privacy Enhancing Technologies 2026(4):703-723. (DOI)]. A single n hides which one the model used.
5. The exposure or offset if your count is out of a varying opportunity, and the fact that you used one.
6. Coefficients on an interpretable scale with an interval — rate ratios, marginal effects or predicted probabilities, each with a CI. Not a table of stars.
7. Whether you are estimating or predicting [5Shmueli, Galit (2010): "To Explain or to Predict?", Statistical Science 25(3):289-310. (DOI)], and report accordingly: coefficients and intervals for the first, held-out performance for the second.
8. Model fit, honestly and without apology [23Kieserman, Julia B.; Andreou, Athanasios; Geeng, Chris; Lauinger, Tobias; McCoy, Damon (2025): "Tracker Installations Are Not Created Equal: Understanding Tracker Configuration of Form Data Collection", in: Proceedings on Privacy Enhancing Technologies, pp. 679-695. (DOI)]. A low pseudo-R² is information about the world, not a defect to hide.
9. Whether the coefficient is causal, and if you claim it is, the design that makes it so. 93.4% of the papers here are associational; say so rather than letting the discussion section drift.
10. The software and version. statsmodels, lme4, ordinal::clmm and Stata do not all give the same standard errors for the same nominal model, and the mixed-model fits differ most.

• Nobody has estimated the intra-class correlation of a web-measurement outcome. The simulation on this page shows the entire size of the error depends on it, and no paper in this corpus reports one. “What is the ICC of sets a third-party cookie before consent by consent platform, by CMS, by hosting provider, and by the same site across monthly crawls?” is a small, self-contained study that would tell every crawl paper how wrong its standard errors are. The same gap is open on Hypothesis testing and it is one study away from being closed for both.
• No crawl paper models the site as a random effect. One non-crawl field study does [2Zeng, Eric; McAmis, Rachel; Kohno, Tadayoshi; Roesner, Franziska (2022): "What Factors Affect Targeting and Bids in Online Advertising? A Field Measurement Study", in: Proceedings of the ACM Internet Measurement Conference, pp. 210-229. (DOI)], so the technique is not unknown in this community — it has just never been pointed at a repeated crawl. Whether that is because cluster-robust standard errors are the better tool anyway (they usually are), or because nobody has tried, is not answerable from text. Somebody should re-analyse a published longitudinal crawl both ways and report how much moves.
• Nobody has published the overdispersion of a tracker count. Six papers in 5,869 use the word. The variance-to-mean ratio of “third parties per site” on a Tranco sample is a number that would settle the Poisson-versus-negative-binomial question for the whole field, and it fits in a footnote.
• Zero-inflated and hurdle models have no presence at all, despite the tracker-count distribution being the textbook motivating example — a large mass at zero and a long tail. Four papers in 5,869 contain the phrase and only two fit one; neither of the two is a crawl.
• The 2022-onward arrival of causal designs is ten papers. Whether it is a durable turn or a handful of authors with economics training is not decidable yet, and the 2025–2026 evidence for it sits in the provisional years.
• None of the seven venues asks for any of this. As on Hypothesis testing, the calls for papers contain no statistical-reporting requirement, so the only thing holding a regression section to a standard is an individual reviewer.

• Hypothesis testing — the same dependence problem in its more familiar form, and the simulation for a single test rather than a model. A correction there does not fix a model here and vice versa.
• P-value corrections — what to do with a regression table full of coefficients, which is a multiplicity problem on top of everything on this page.
• Study preregistration — the mechanism that makes “we chose this specification in advance” checkable rather than assertable. A regression has far more researcher degrees of freedom than a test does.
• Biases — what your sample is before any model is fitted.
• Archives — longitudinal panels, which is where the repeated-crawl problem comes from.
• Automated measurements and Stateful stateless — a before/after crawl is a crawl-configuration decision before it is a modelling one.
• Representative sampling methods and Website selection — where your rows, and the dependence between them, come from.
• IP classification and Website classification — where the covariates on the right-hand side usually come from, and how much measurement error they carry into the model.
• User studies — where almost all of this corpus's careful modelling of repeated measures actually happens.
• Artifacts — releasing per-site outcomes is what makes a dependence-aware re-analysis of a published result possible.
• Provenance of this page's figures.

[1]

Yuan, Ying; Hao, Qingying; Apruzzese, Giovanni; Conti, Mauro; Wang, Gang (2024): ""Are Adversarial Phishing Webpages a Threat in Reality?" Understanding the Users' Perception of Adversarial Webpages", in: Proceedings of the ACM Web Conference, pp. 1712-1723. (DOI)

[2]

Zeng, Eric; McAmis, Rachel; Kohno, Tadayoshi; Roesner, Franziska (2022): "What Factors Affect Targeting and Bids in Online Advertising? A Field Measurement Study", in: Proceedings of the ACM Internet Measurement Conference, pp. 210-229. (DOI)

[3]

Gelman, Andrew; Hill, Jennifer; Vehtari, Aki (2020): "Regression and Other Stories". Cambridge University Press. (DOI)

[4]

Gelman, Andrew; Hill, Jennifer (2007): "Data Analysis Using Regression and Multilevel/Hierarchical Models". Cambridge University Press. (DOI)

[5]

Shmueli, Galit (2010): "To Explain or to Predict?", Statistical Science 25(3):289-310. (DOI)

[6]

Colin Cameron, A.; Miller, Douglas L. (2015): "A Practitioner’s Guide to Cluster-Robust Inference", Journal of Human Resources 50(2):317-372. (DOI)

[7]

MacKinnon, James G.; Nielsen, Morten Ørregaard; Webb, Matthew D. (2023): "Cluster-Robust Inference: A Guide to Empirical Practice", Journal of Econometrics 232(2):272-299. (DOI)

[8]

Ver Hoef, Jay M.; Boveng, Peter L. (2007): "Quasi-Poisson vs. Negative Binomial Regression: How Should We Model Overdispersed Count Data?", Ecology 88(11):2766-2772. (DOI)

[9]

Mood, Carina (2010): "Logistic Regression: Why We Cannot Do What We Think We Can Do, and What We Can Do About It", European Sociological Review 26(1):67-82. (DOI)

[10]

Barr, Dale J.; Levy, Roger; Scheepers, Christoph; Tily, Harry J. (2013): "Random Effects Structure for Confirmatory Hypothesis Testing: Keep It Maximal", Journal of Memory and Language 68(3):255-278. (DOI)

[11]

Matuschek, Hannes; Kliegl, Reinhold; Vasishth, Shravan; Baayen, Harald; Bates, Douglas (2017): "Balancing Type I Error and Power in Linear Mixed Models", Journal of Memory and Language 94:305-315. (DOI)

[12]

Bates, Douglas; Mächler, Martin; Bolker, Ben; Walker, Steve (2015): "Fitting Linear Mixed-Effects Models Using lme4", Journal of Statistical Software 67(1):1-48. (DOI)

[13]

Tang, Jenny; Bauer, Lujo; Christin, Nicolas (2025): "Misuse, Misreporting, Misinterpretation of Statistical Methods in Usable Privacy and Security Papers", in: Proceedings of the Twenty-First Symposium on Usable Privacy and Security (SOUPS), pp. 475-493. USENIX Association. (Link)

[14]

Nenadić, Luka; Rodriguez, David; Calandrino, Joseph A. (2026): "Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law's Impact", Proceedings on Privacy Enhancing Technologies 2026(4):703-723. (DOI)

[15]

Butkiewicz, Michael; Madhyastha, Harsha V.; Sekar, Vyas (2011): "Understanding website complexity: measurements, metrics, and implications", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[16]

Votipka, Daniel; Fulton, Kelsey R.; Parker, James; Hou, Matthew; Mazurek, Michelle L.; Hicks, Michael (2020): "Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It", in: Proceedings of the USENIX Security Symposium. (Link)

[17]

Collier, Ben; Thomas, Daniel R.; Clayton, Richard; Hutchings, Alice (2019): "Booting the Booters: Evaluating the Effects of Police Interventions in the Market for Denial-of-Service Attacks", in: Proceedings of the ACM Internet Measurement Conference, pp. 50-64. (DOI)

[18]

Mai, Cat; Coelho, Bruno; Kieserman, Julia; Matsumoto, Lexie; Spinelli, Kyle; Yang, Eric; Andreou, Athanasios; Greenstadt, Rachel; Lauinger, Tobias; McCoy, Damon (2025): "More and Scammier Ads: The Perils of YouTube's Ad Privacy Settings", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[19]

Bashir, Muhammad Ahmad; Farooq, Umar; Shahid, Maryam; Zaffar, Muhammad Fareed; Wilson, Christo (2019): "Quantity vs. Quality: Evaluating User Interest Profiles Using Ad Preference Managers", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[20]

Vu, Anh V.; Collier, Ben; Thomas, Daniel R.; Kristoff, John; Clayton, Richard; Hutchings, Alice (2025): "Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services", in: Proceedings of the USENIX Security Symposium. (Link)

[21]

Angrist, Joshua D.; Pischke, Jörn-Steffen (2009): "Mostly Harmless Econometrics: An Empiricist's Companion". Princeton University Press. (DOI)

[22]

Vittinghoff, Eric; McCulloch, Charles E. (2007): "Relaxing the Rule of Ten Events per Variable in Logistic and Cox Regression", American Journal of Epidemiology 165(6):710-718. (DOI)

[23]

Kieserman, Julia B.; Andreou, Athanasios; Geeng, Chris; Lauinger, Tobias; McCoy, Damon (2025): "Tracker Installations Are Not Created Equal: Understanding Tracker Configuration of Form Data Collection", in: Proceedings on Privacy Enhancing Technologies, pp. 679-695. (DOI)

[24]

Ferrari, Silvia; Cribari-Neto, Francisco (2004): "Beta Regression for Modelling Rates and Proportions", Journal of Applied Statistics 31(7):799-815. (DOI)

[25]

Nguyen, Duc Cuong; Derr, Erik; Backes, Michael; Bugiel, Sven (2019): "Short Text, Large Effect: Measuring the Impact of User Reviews on Android App Security & Privacy", in: Proceedings of the IEEE Symposium on Security and Privacy, pp. 555-569. (DOI)

[26]

Zeng, Eric; Wei, Miranda; Gregersen, Theo; Kohno, Tadayoshi; Roesner, Franziska (2021): "Polls, Clickbait, and Commemorative \$2 Bills: Problematic Political Advertising on News and Media Websites Around the 2020 U.S. Elections", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[27]

Campobasso, Michele; Allodi, Luca (2023): "Know Your Cybercriminal: Evaluating Attacker Preferences by Measuring Profile Sales on an Active, Leading Criminal Market for User Impersonation at Scale", in: Proceedings of the USENIX Security Symposium. (Link)

[28]

Vetrivel, Swaathi; Bouwmeester, Brennen; Eeten, Michel van; Gañán, Carlos H. (2024): "IoT Market Dynamics: An Analysis of Device Sales, Security and Privacy Signals, and their Interactions", in: Proceedings of the USENIX Security Symposium. (Link)

[29]

Becerril-Arreola, Rafael (2023): "A Method to Assess and Explain Disparate Impact in Online Retailing", in: Proceedings of the ACM Web Conference. (DOI)

[30]

Huang, Francis L. (2026): "When Cluster-Robust Inferences Fail", Educational and Psychological Measurement 86(3):579-601. Published online 2025-12-19; issue dated 2026-06 (DOI)

[31]

Moineddin, Rahim; Matheson, Flora I.; Glazier, Richard H. (2007): "A Simulation Study of Sample Size for Multilevel Logistic Regression Models", BMC Medical Research Methodology 7:34. (DOI)

[32]

Chuai, Yuwei; Lenzini, Gabriele; Pröllochs, Nicolas (2026): "Consensus Stability of Community Notes on X", in: Proceedings of the ACM Web Conference, pp. 8885-8896. (DOI)

[33]

Bobek, Michelle; Pröllochs, Nicolas (2026): "Community Fact-Checks Do Not Break Follower Loyalty", in: Proceedings of the ACM Web Conference. (DOI)

[34]

Callaway, Brantly; Sant'Anna, Pedro H. C. (2021): "Difference-in-Differences with Multiple Time Periods", Journal of Econometrics 225(2):200-230. (DOI)

[35]

Abdullah, Muhammad; Qazi, Zafar Ayyub; Qazi, Ihsan Ayyub (2022): "Causal impact of Android go on mobile web performance", in: Proceedings of the ACM Internet Measurement Conference, pp. 113-129. (DOI)

[36]

Kumarswamy, Nihal; Singhal, Mohit; Nilizadeh, Shirin (2025): "Causal Insights into Parler's Content Moderation Shift: Effects on Toxicity and Factuality", in: Proceedings of the ACM Web Conference, pp. 3762-3771. (DOI)