| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| design:platforms [2026/08/27 20:36] – Citation review fixes: the '1% streaming API' quote was attributed to the wrong NDSS 2021 paper (hagen2021_numbers contains no occurrence of Twitter) — now kaleli2021_human; and the cross-platform blocking range omitted TikTok, which is at the top of it ( karel.kubicek.claude | design:platforms [2026/09/27 12:02] (current) – Add the messaging-groups route: route-table row, currency row, a paragraph in the per-company section and a Related Pages entry pointing to the new child page Design:Platforms:Messaging channels. Authored by Claude. karel.kubicek.claude |
|---|
| **The access route is the design decision, and the routes changed under the field.** In the [[literature:corpus|publication corpus]] (seven venues, 2010–2026, **5,859** extracted papers), **897** papers name a large platform as the subject of measurement — **15.7%** of the **5,712** that drew any study population. Of those 897, **383 (42.7%)** name an **existing dataset** as a source of their data, and **208 (23.2%)** name one and no primary collection of their own at all. | **The access route is the design decision, and the routes changed under the field.** In the [[literature:corpus|publication corpus]] (seven venues, 2010–2026, **5,859** extracted papers), **897** papers name a large platform as the subject of measurement — **15.7%** of the **5,712** that drew any study population. Of those 897, **383 (42.7%)** name an **existing dataset** as a source of their data, and **208 (23.2%)** name one and no primary collection of their own at all. |
| |
| Meanwhile the official researcher routes that replaced the open APIs are **almost entirely absent from this literature**. Across the **5,855** papers with full text: the **Meta Content Library** appears **once**, and that once is a parenthetical noting that CrowdTangle "//now replaced by the Meta Content Library//" {[roy2025_darkgram]}. The **TikTok Research API** appears in **zero** papers. The **YouTube Researcher Program** appears in **two**. The X/Twitter **Academic Research track** appears in **eight**. By contrast **Pushshift** — a third-party Reddit archive — appears in **35**, and **Ad Library** in **69**. | Meanwhile the official researcher routes that replaced the open APIs are **almost entirely absent from this literature**. Across the **5,855** papers with full text: the **Meta Content Library** appears **once**, and that once is a parenthetical noting that CrowdTangle "//now replaced by the Meta Content Library//" {[roy2025_darkgram]}. The **TikTok Research API** appears in **zero** papers. The **YouTube Researcher Program** appears in **two**. The X/Twitter **Academic Research track** appears in **eight**. By contrast **Pushshift** — a third-party Reddit archive — appears in **35**. A probe for "Ad Library" returns **69**, but that probe is defeated by a homonym — in mobile-security writing an "ad library" is an advertising SDK — and the hand-audited figure is **11**; see [[Design:Platforms:Ad archives]]. |
| |
| If you plan a platform study in 2026 through an official research programme, assume you are an early adopter: there is no methods section in these venues to copy, and the application lead time is weeks, not days. | Part of that absence is **mechanical**, and the page says so rather than letting you infer otherwise: these programmes are 2023-and-later launches read through a corpus whose 2025–2026 slice is under-covered by construction, and the venues that publish most platform work of this kind — ICWSM, CHI, FAccT, the communications journals — are **not in the corpus at all**. The right reading is "there is no worked example //in these seven venues//", not "the programmes do not work". |
| | |
| | Either way the consequence for you is the same. If you plan a platform study in 2026 through an official research programme, assume you are an early adopter: there is no methods section in these venues to copy, and the application lead time is weeks, not days. |
| </WRAP> | </WRAP> |
| |
| * {[vombatkere2024_tiktok]} (TheWebConf 2024) — **sock-puppet accounts** on a feed you cannot query. Five bot accounts plus a donated dataset of 347 real users; concludes that TikTok "//exploits real users' interests in between 30% and 50% of all recommended videos in the first thousand videos//". Read it for how you measure a recommender with no API at all. | * {[vombatkere2024_tiktok]} (TheWebConf 2024) — **sock-puppet accounts** on a feed you cannot query. Five bot accounts plus a donated dataset of 347 real users; concludes that TikTok "//exploits real users' interests in between 30% and 50% of all recommended videos in the first thousand videos//". Read it for how you measure a recommender with no API at all. |
| * {[karnam2026_setting]} (IEEE S&P 2026) — the **data subject's right of access** as the instrument. Sock-puppet accounts on Instagram, TikTok and YouTube, then GDPR Art. 15 requests, then a comparison of the returned data package against the ground truth the authors themselves generated. All three platforms failed to report purpose, recipients and retention period. | * {[karnam2026_setting]} (IEEE S&P 2026) — the **data subject's right of access** as the instrument. Sock-puppet accounts on Instagram, TikTok and YouTube, then GDPR Art. 15 requests, then a comparison of the returned data package against the ground truth the authors themselves generated. All three platforms failed to report purpose, recipients and retention period. |
| * {[gegenhuber2026_there]} (NDSS 2026) — **enumeration at platform scale**, and the ethics that go with it. Probes 63 billion candidate phone numbers and discovers **3,546,479,731** WhatsApp accounts across 245 countries, **57%** of them with a public profile picture. Read it for what a platform-scale study has to say about disclosure and harm before a programme committee will accept it. | * {[gegenhuber2026_there]} (NDSS 2026) — **enumeration at platform scale**, and the ethics that go with it. Probes 63,170,000,000 candidate phone numbers and discovers **3,546,479,731** WhatsApp accounts across 245 countries, **57%** of them with a public profile picture. Read it for what a platform-scale study has to say about disclosure and harm before a programme committee will accept it. |
| |
| If you only read one thing about the **rules**, read the Commission's December 2025 decision fining X €120 million: it is the first DSA non-compliance decision, and one of the three grounds is research data access.((European Commission, //Commission fines X €120 million under the Digital Services Act//, press release, 5 December 2025, https://digital-strategy.ec.europa.eu/en/news/commission-fines-x-eu120-million-under-digital-services-act — page fetched 2026-08-27, "Last update 16 January 2026".)) | If you only read one thing about the **rules**, read the Commission's December 2025 decision fining X €120 million: it is the first DSA non-compliance decision, and one of the three grounds is research data access.((European Commission, //Commission fines X €120 million under the Digital Services Act//, press release, 5 December 2025, https://digital-strategy.ec.europa.eu/en/news/commission-fines-x-eu120-million-under-digital-services-act — page fetched 2026-08-27, "Last update 16 January 2026".)) |
| Every route below is real and in use somewhere. What differs is whether it is current, what it costs, and what population it yields. Dates are as of **2026-08-27** and verified against primary sources; the [[provenance:design:platforms|provenance page]] lists each URL, quote and fetch date, and names the claims that could not be verified. | Every route below is real and in use somewhere. What differs is whether it is current, what it costs, and what population it yields. Dates are as of **2026-08-27** and verified against primary sources; the [[provenance:design:platforms|provenance page]] lists each URL, quote and fetch date, and names the claims that could not be verified. |
| |
| ^ Route ^ Status in 2026 ^ What it gets you ^ Papers in our corpus that name it ^ | The **Status** column is one word; the dated evidence for each verdict is in [[#Which Methods Are Current]] at the foot of the page. |
| | **Open public API, free** | **historical** for the platforms this page is about | the population the platform chose to expose | 91 papers name a Twitter/X streaming or search API, peaking 2022 | | |
| | **Paid metered API** | **current** — X moved to pay-per-usage | whatever you can afford | see the arithmetic below | | ^ Route ^ Status ^ What it gets you ^ Papers in our corpus that name it ^ |
| | **Platform research programme** | **current, and unused in this literature** | a curated, filtered archive inside a controlled environment | Meta Content Library **1**, TikTok Research API **0**, YouTube Researcher Program **2** | | | **Open public API, free** | **historical** | the population the platform chose to expose | 91 papers name a Twitter/X streaming or search API, peaking 2022 | |
| | **Regulator route (DSA Art. 40 vetted researcher)** | **current, newly operational** | in principle non-public data from a designated VLOP | effectively **zero** papers; see the audit below | | | **Paid metered API** | **current** | whatever you can afford | X moved to pay-per-usage; see the arithmetic below | |
| | **Transparency / ad archive** | **current** | only what the archive covers — usually ads that actually ran | **69** papers name an Ad Library or ad archive | | | **Platform research programme** | **current** | a curated, filtered archive inside a controlled environment | Meta Content Library **1**, TikTok Research API **0**, YouTube Researcher Program **2** | |
| | **Third-party archive of platform data** | **historical for researchers, but its dumps still circulate** | someone else's crawl, with their gaps | **35** papers name Pushshift | | | **Regulator route (DSA Art. 40 vetted researcher)** | **current** | in principle non-public data from a designated VLOP | effectively **zero** papers; see the audit below | |
| | **Reuse of a published platform dataset** | **current, and very common** | a frozen snapshot you did not design | **383 of 897** name an existing dataset; **208** name one //and no primary collection// | | | **Transparency / ad archive** | **current** | only what the archive covers — usually ads that actually ran | **11** hand-audited papers; own page: [[Design:Platforms:Ad archives]] | |
| | **Logged-out scraping** | **current, legally contested — and now the subject of a DSA fine against a platform that forbade it** | the public surface, as a bot sees it | **157** papers name a scraping or automation tool | | | **Joining public groups, channels or servers** (Telegram, WhatsApp, Discord) | **current, contested** | the groups your seed could find, from your joining date or back-filled, as a member sees them | **26** hand-audited papers, 21 of them on Telegram; own page: [[Design:Platforms:Messaging channels]] | |
| | **Accounts you created (sock puppets)** | **current, highest-risk** | the logged-in surface, and anything personalised | **14** papers use the term "sock puppet"; **22** state `account-registration` | | | **Third-party archive of platform data** | **historical** | someone else's crawl, with their gaps — the dumps circulate, the live service does not | **35** papers name Pushshift | |
| | **Data donation** | **current and rising** | real users' own data, with consent | **25** papers mention data donation, **11** of them in 2025 | | | **Reuse of a published platform dataset** | **current** | a frozen snapshot you did not design | **383 of 897** name an existing dataset; **208** name one //and no primary collection// | |
| | **Right of access / DSAR** | **current and rising** | what the platform says it holds about a subject | **52** papers, rising from 2022 | | | **Logged-out scraping** | **current, contested** | the public surface, as a bot sees it | **157** papers name a scraping or automation tool | |
| | **On-device or client-side extraction** | **niche, powerful** | the model or logic actually shipped to users | {[west2024_picture]} extracted the on-device ML models from the Instagram and TikTok apps | | | **Accounts you created (sock puppets)** | **current** | the logged-in surface, and anything personalised | **14** papers use the term "sock puppet"; **22** are labelled `account-registration` | |
| | **Operator collaboration** | **current, not replicable** | everything, and no reproducibility | {[cohn2020_delf]}, {[schlinker2019_internet]} | | | **Data donation** | **current** | real users' own data, with consent | **25** papers mention data donation, **11** of them in 2025 | |
| | | **Right of access / DSAR** | **current** | what the platform says it holds about a subject | **52** papers, rising from 2022 | |
| | | **On-device or client-side extraction** | **niche** | the model or logic actually shipped to users | {[west2024_picture]} extracted the on-device ML models from the Instagram and TikTok apps | |
| | | **Operator collaboration** | **not replicable** | everything, and no reproducibility | {[cohn2020_delf]}, {[schlinker2019_internet]} | |
| |
| ==== The metered API changes the study design, not just the budget ==== | ==== The metered API changes the study design, not just the budget ==== |
| |
| X's API is now **pay-per-usage with no subscription**: %%$0.005%% per Post read, %%$0.010%% per User read, and "//Pay-per-usage plans are capped at 3 million Post reads per monthly billing cycle//" with Enterprise above that.((https://docs.x.com/x-api/getting-started/pricing — fetched 2026-08-27; the page carries no date. There is no free tier and no academic tier in the current documentation tree.)) One million posts is therefore **%%$5,000%%** and the monthly ceiling on the self-serve route is **3 million posts**. A study that used to be "collect the 1% stream for six months" is now a budget line and a cap. | X's API is now **pay-per-usage with no subscription**: %%$0.005%% per Post read, %%$0.010%% per User read, and "//Pay-per-usage plans are capped at 3 million Post reads per monthly billing cycle//" with Enterprise above that.((https://docs.x.com/x-api/getting-started/pricing — fetched 2026-08-27; the page carries no date. On the same fetch, the //About the X API// page lists only v2 (pay-per-usage) and v1.1 ("limited support"), and neither it nor the pricing page mentions a free or academic tier; we did not exhaustively search the whole documentation tree, so read that as "not offered on the pages a new applicant is sent to" rather than as a proof of absence.)) One million posts is therefore **%%$5,000%%** and the monthly ceiling on the self-serve route is **3 million posts**. A study that used to be "collect the 1% stream for six months" is now a budget line and a cap. |
| |
| This is not hypothetical, and the field has already adapted. {[nguyen2025_please]} (USENIX Security 2025) built its collection pipeline around the read cap: it polls a **counts** endpoint, which "//does not add to our monthly tweet read limit//", and only fetches actual posts when the count is non-zero — because "//the total number of tweets that can be downloaded is very small for the Basic tier//". That is still a sound pattern, but the tier it names is no longer what a new project gets: X's own changelog records that pay-per-usage "//officially launched//" on **6 February 2026** as the self-serve model, with the older Basic and Pro plans "//remain[ing] available//" only to existing subscribers, and then a further price change on **20 April 2026** introducing "//Owned Reads//" at %%$0.001%% per resource for a developer's own account data.((https://docs.x.com/changelog — fetched 2026-08-27; entries dated 6 February 2026 ("Launch of X API Pay-Per-Use pricing") and 16 April 2026 ("X API pricing update: Owned Reads now %%$0.001%%").)) The pricing model of the single most-measured platform in this corpus changed **twice inside 2026**. Date it, and re-check it before you submit. | This is not hypothetical, and the field has already adapted. {[nguyen2025_please]} (USENIX Security 2025) built its collection pipeline around the read cap: it polls a **counts** endpoint, which "//does not add to our monthly tweet read limit//", and only fetches actual posts when the count is non-zero — because "//the total number of tweets that can be downloaded is very small for the Basic tier//". That is still a sound pattern, but the tier it names is no longer what a new project gets: X's own changelog records that pay-per-usage "//officially launched//" on **6 February 2026** as the self-serve model, with the older Basic and Pro plans "//remain[ing] available//" only to existing subscribers, and then a further price change on **20 April 2026** introducing "//Owned Reads//" at %%$0.001%% per resource for a developer's own account data.((https://docs.x.com/changelog — fetched 2026-08-27; entries dated 6 February 2026 ("Launch of X API Pay-Per-Use pricing") and 16 April 2026 ("X API pricing update: Owned Reads now %%$0.001%%").)) The pricing model of the single most-measured platform in this corpus changed **twice inside 2026**. Date it, and re-check it before you submit. |
| * **An ad archive contains ads that ran.** It cannot tell you what was rejected, and it can be wrong in both directions about what is political — which is exactly {[bouchaud2024_beyond]}'s finding, on both sides at once. | * **An ad archive contains ads that ran.** It cannot tell you what was rejected, and it can be wrong in both directions about what is political — which is exactly {[bouchaud2024_beyond]}'s finding, on both sides at once. |
| * **A sampled stream is a sample.** {[kaleli2021_human]} is explicit that its dataset came from "//the 1% streaming API that Twitter provides to vetted researchers//" and that consequently "//all the numbers that we presented in this paper are lower bounds//". Say which stream and which sampling rate, and say which direction the bias runs. | * **A sampled stream is a sample.** {[kaleli2021_human]} is explicit that its dataset came from "//the 1% streaming API that Twitter provides to vetted researchers//" and that consequently "//all the numbers that we presented in this paper are lower bounds//". Say which stream and which sampling rate, and say which direction the bias runs. |
| | * **We could not establish what Reddit currently offers a researcher.** Every Reddit-owned domain refused our fetches, so this page makes **no claim** about Reddit's API pricing, rate limits or researcher terms — only about what the corpus shows (63 papers measuring Reddit, 14 naming a Reddit API or PRAW, 35 naming Pushshift). Check it yourself before planning around it, and see [[provenance:design:platforms]] for exactly what failed. |
| * **A third-party archive has the archiver's gaps, not yours.** Pushshift is still the most-named Reddit source in this corpus (**35** papers, e.g. {[zannettou2018_origins]}), and its coverage window and completeness are properties of Pushshift, not of Reddit. It is also **no longer a route you can open**: Reddit's own moderator help page says Pushshift API access "//will be reinstated for verified Reddit moderators//", that each one "//need[s] explicit approval from Reddit//", and that "//the use of Pushshift will be limited to moderation use cases only//".((https://support.reddithelp.com/hc/en-us/articles/16470271632404-Pushshift-Access-Request — fetched 2026-08-27 with a headless browser (the page is Cloudflare-walled to ''%%curl%%''); the page is stamped "Updated 1 year ago". A paper citing Pushshift today is citing a historical dump, and should say which one and when it was obtained.)) | * **A third-party archive has the archiver's gaps, not yours.** Pushshift is still the most-named Reddit source in this corpus (**35** papers, e.g. {[zannettou2018_origins]}), and its coverage window and completeness are properties of Pushshift, not of Reddit. It is also **no longer a route you can open**: Reddit's own moderator help page says Pushshift API access "//will be reinstated for verified Reddit moderators//", that each one "//need[s] explicit approval from Reddit//", and that "//the use of Pushshift will be limited to moderation use cases only//".((https://support.reddithelp.com/hc/en-us/articles/16470271632404-Pushshift-Access-Request — fetched 2026-08-27 with a headless browser (the page is Cloudflare-walled to ''%%curl%%''); the page is stamped "Updated 1 year ago". A paper citing Pushshift today is citing a historical dump, and should say which one and when it was obtained.)) |
| * **A reused dataset freezes a platform that has since changed.** **383 of the 897** platform-subject papers name an existing dataset (''temporal.mode'' is multi-valued, so 175 of those also collected something themselves; **208** collected nothing). If that is you, date the snapshot and say what changed on the platform since — the four false positives in our Twitter/X audit were all papers using Twitter-derived benchmark corpora with no relationship to the platform at collection time. | * **A reused dataset freezes a platform that has since changed.** **383 of the 897** platform-subject papers name an existing dataset (''temporal.mode'' is multi-valued, so 175 of those also collected something themselves; **208** collected nothing). If that is you, date the snapshot and say what changed on the platform since — the four false positives in our Twitter/X audit were all papers using Twitter-derived benchmark corpora with no relationship to the platform at collection time. |
| * **A cross-platform study has one denominator per platform, and they are not comparable.** {[acharya2024_imitation]} looked for brand-impersonation accounts targeting the top 10K Tranco brands on X, Instagram, Telegram and YouTube at once; {[beluri2025_exploration]} tracked accounts advertised for sale across five platforms and found blocking efficacy ranging from **5.02%** (YouTube) up to **48%** — its own summary is that "//TikTok and Instagram demonstrated the highest detection efficacy at 48%, whereas YouTube and Facebook showed the lowest efficacy at just 5%//". A cross-platform rate is only meaningful if you say what you could see on each platform, because the routes in differ and so does the visible surface. A gap between two platforms may be a gap between two access routes. | * **A cross-platform study has one denominator per platform, and they are not comparable.** {[acharya2024_imitation]} looked for brand-impersonation accounts targeting the top 10K Tranco brands on X, Instagram, Telegram and YouTube at once; {[beluri2025_exploration]} tracked accounts advertised for sale across five platforms and found blocking efficacy ranging from **5.02%** (YouTube) up to **48%** — its own summary is that "//TikTok and Instagram demonstrated the highest detection efficacy at 48%, whereas YouTube and Facebook showed the lowest efficacy at just 5%//". A cross-platform rate is only meaningful if you say what you could see on each platform, because the routes in differ and so does the visible surface. A gap between two platforms may be a gap between two access routes. |
| * **The logged-out surface is not the platform either.** Of the **260** platform-subject papers that report a crawl configuration, **145 (55.8%)** state that they used **no authentication at all**, only **22** registered an account, **4** logged in manually, and **none** used automated login or SSO. Whatever those studies measured, it is what an anonymous visitor sees. | * **The logged-out surface is not the platform either — and the label that says so is mostly an inference.** Of the **260** platform-subject papers that report a crawl configuration, **145 (55.8%)** are labelled as using **no authentication at all**, **22** as registering an account, **4** as logging in manually, and **none** as using automated login or SSO. **Those 145 have now been audited** (2026-09-22), by reading each paper's own text rather than its evidence quote — ''%%crawlConfig%%'' carries **one evidence quote for the whole object**, so the ''%%authentication%%'' label cannot be checked against it ([[Programming:Registration]]). Of the 145: **12 (8.3%)** state in the paper that the collection was unauthenticated; **6 (4.1%)** are **contradicted by the paper's own text**; **8 (5.5%)** are ambiguous, where the study registered or used accounts but the specific crawl the evidence quote describes plausibly did not; and **119 (82.1%)** are **silent** — the paper never states its authentication posture either way, and ''%%not-stated%%'' was equally available in the schema. So read the 55.8% as an inference, not a measurement: **at most 12 of the 145 papers say what their label says**. Two of the contradicted six: {[kumar2022_investigation]} set up ten Android phones, //"one Google account per country"//, and an apk scraper that //"requires the device's ID and Google account credentials"//, while its ''%%crawlConfig%%'' quote describes only the unauthenticated Selenium privacy-policy sub-crawl; {[yan2025_sign]} //"registered around 300 accounts in total throughout the study"//. The starkest case is //Experimental Analyses of the Physical Surveillance Risks in Client-Side Content Scanning// (NDSS 2024), whose ''%%crawlConfig%%'' evidence quote **itself** reads //"we scrape user photographs from Instagram using an alias account"// under a ''%%none%%'' label. All six, and the 12 affirmed and 8 ambiguous, are listed with their deciding sentence on [[provenance:design:platforms]]. The sibling field ''%%consentAction%%'' was audited the same way and found **279 of 313 no-interaction labels unsupported (89.1%)**, alongside **7 of 36 (19.4%)** false positives among labels claiming interaction ([[Privacy:consent]]); that result is not evidence about authentication, and was not used as any. |
| |
| ===== Rate Limits, Quotas, Bans and the Login Wall ===== | ===== Rate Limits, Quotas, Bans and the Login Wall ===== |
| | sock puppet | 14 (**1.6%**) | 26 (0.4%) | 3 of 108 (2.8%) | | | sock puppet | 14 (**1.6%**) | 26 (0.4%) | 3 of 108 (2.8%) | |
| |
| Read the ToS row as the headline: a platform paper is roughly **twice as likely** as an average paper in these venues to discuss terms of service, and in 2025 more than one in five did. That is the direction the reviewing is moving. | Read the ToS row as the headline: at **14.9%**, a platform paper is roughly **twice as likely as the average paper in these seven venues** (7.8%) to discuss terms of service, and in 2025 more than one in five did. Against a narrower and fairer baseline — papers that ran a crawl, where [[Programming:Registration]] reports 11.5% — the ratio is about 1.3×. Either way the direction is the same, and it is the direction the reviewing is moving. |
| |
| Three practical consequences: | Four practical consequences: |
| |
| * **Design for the limit, not around it.** {[nguyen2025_please]}'s counts-endpoint trigger is the pattern: find the cheap query that tells you whether the expensive query is worth making. Report the limit you worked under, because it bounds your recall. | * **Design for the limit, not around it.** {[nguyen2025_please]}'s counts-endpoint trigger is the pattern: find the cheap query that tells you whether the expensive query is worth making. Report the limit you worked under, because it bounds your recall. |
| * **The limit can be the finding.** {[xue2021_throttling]} measured Russian ISPs throttling Twitter and showed the mechanism was SNI-based: "//throttling is triggered upon observing Twitter-related domains (*.twimg.com, twitter.com, t.co) in the SNI//". If you are being throttled and can characterise by what, that is a result. | * **The limit can be the finding.** {[xue2021_throttling]} measured Russian ISPs throttling Twitter and showed the mechanism was SNI-based: "//throttling is triggered upon observing Twitter-related domains (*.twimg.com, twitter.com, t.co) in the SNI//". If you are being throttled and can characterise by what, that is a result. |
| * **Expect the platform to fight your crawler, and say whether it did.** Only **14 of 260** platform-subject papers with a crawl configuration (**5.4%**) say anything about robots.txt — barely above the **4.7%** baseline for all papers with a crawl configuration. If the platform served you a bot challenge, that is a measurement result about the platform, not an embarrassment. | * **Expect the platform to fight your crawler, and say whether it did.** Only **14 of 260** platform-subject papers with a crawl configuration (**5.4%**) say anything about robots.txt — barely above the **4.7%** baseline for all papers with a crawl configuration. If the platform served you a bot challenge, that is a measurement result about the platform, not an embarrassment. |
| * **Sock puppets are the highest-risk route.** They get you the personalised surface — {[vombatkere2024_tiktok]} and {[karnam2026_setting]} both need them — and they are the fact pattern most likely to breach terms of service and, in the US, to have been litigated. Get ethics review first (see [[Practices:Ethics]]), keep the accounts minimal, and write down what you did: **only 32.5%** of the **841** empirical platform-subject papers state an ethics-review outcome, statistically indistinguishable from the **33.8%** corpus baseline. That is not good enough for a study whose method is creating fake accounts on someone else's service. | * **Sock puppets are the highest-risk route.** They get you the personalised surface — {[vombatkere2024_tiktok]} and {[karnam2026_setting]} both need them — and they are the fact pattern most likely to breach terms of service and, in the US, to have been litigated. Get ethics review first (see [[Practices:Ethics]]), keep the accounts minimal, and write down what you did: **only 32.5%** of the **841** empirical platform-subject papers state an ethics-review outcome — essentially at the **33.8%** corpus baseline (no test was run, and the platform papers are inside that baseline). That is not good enough for a study whose method is creating fake accounts on someone else's service. |
| |
| ==== Terms of service are no longer only the platform's weapon ==== | ==== Terms of service are no longer only the platform's weapon ==== |
| | Amazon | 72 | 11 (every 7th) | 4 | **36%** | Amazon Reviews benchmarks, devices //bought on// Amazon, a hosted speech service | | | Amazon | 72 | 11 (every 7th) | 4 | **36%** | Amazon Reviews benchmarks, devices //bought on// Amazon, a hosted speech service | |
| |
| Treat the ranking below as a ranking. Do not quote a family's count as a precise number of papers without the precision above attached to it. | Treat the ranking below as a ranking. Do not quote a family's count as a precise number of papers without the precision above attached to it — and note that these samples are **small**: at //n// = 15 the 95% interval around 73% is roughly ±20 points. They are coarse corrections, not measurements. |
| |
| ==== Which platforms the field measures ==== | ==== Which platforms the field measures ==== |
| | 19 | eBay | 6 | 0.1% | | | 19 | eBay | 6 | 0.1% | |
| |
| The top two rows are largely **app-store** work, which belongs to [[Design:Mobile and app measurement]] rather than here. Note the last rows: **TikTok is 7 papers**, of which 4 survived a full audit. There is no body of TikTok measurement in these seven venues to systematise. | Rows 1 and 7 — Google and the Apple App Store — are largely **app-store** work, which is closer to [[Design:Mobile and app measurement]] than to this page. Note also what this page does **not** cover: search-engine result auditing and the Google ads ecosystem are a real body of work inside these venues; the **experimental design** they share — paired profiles, a control arm, carry-over, and a noise floor — is [[Design:Algorithm audits]], added 2026-09-11. The platform-specific instruments are still out of scope here. Note the last rows: **TikTok is 7 papers**, of which 4 survived a full audit. There is no body of TikTok measurement in these seven venues to systematise. |
| |
| ==== Amazon means five different things, and mostly not the shop ==== | ==== Amazon means five different things, and mostly not the shop ==== |
| |
| A substring match on "Amazon" therefore over-counts Amazon platform measurement by roughly **sixteen to one**. An earlier iteration of our own script did exactly this and reported 176 Amazon papers. | A substring match on "Amazon" therefore over-counts Amazon platform measurement by roughly **sixteen to one**. An earlier iteration of our own script did exactly this and reported 176 Amazon papers. |
| | |
| | <WRAP tip> |
| | **Two other pages count these same names and get different numbers. Both are right; they answer different questions.** [[Design:Website selection]] reports **463** papers for Alexa, folded over the 1,143 that drew a **web-unit** population. The **412** above is the subset our role rule assigns to the ranking list, over all 5,492 papers with a stated population source. Reconciling them: **486** papers name "Alexa" in a stated population source at all, **464** of those also have a web-unit population tuple — which is the figure [[Design:Website selection]] is reporting — and 412 is what survives after Alexa-as-skill-store strings are diverted to the ''%%subject%%'' role. Likewise our **179** Mechanical Turk papers is a count of ''%%population.sourceList%%'' strings; [[Design:User studies]] publishes three //different// bounds on the same thing — 139 by the schema enum, 92 by quote, 279 by full text — and warns against reading any of them as usage. Neither fold has been reconciled with the other, and this page does not claim its number is the better one. |
| | </WRAP> |
| |
| ==== The Twitter/X curve, and what it does and does not show ==== | ==== The Twitter/X curve, and what it does and does not show ==== |
| | Meta / Facebook Ad Library | 5 | 0.6% | | | Meta / Facebook Ad Library | 5 | 0.6% | |
| | CrowdTangle | 5 | 0.6% | | | CrowdTangle | 5 | 0.6% | |
| | TikTok API / TikTok-Api | 1 | 0.1% | | | ''%%TikTok-Api%%'' — the **unofficial** scraper library, not the Research API | 1 | 0.1% | |
| | **named no tool for it at all** | **552** | **61.5%** | | | **named no tool for it at all** | **552** | **61.5%** | |
| |
| That last row is the reporting gap on this page: **61.5%** of platform-subject papers name no instrument by which they reached the platform. The route is the design decision, and three papers in five do not state it. | That last row is the reporting gap on this page: for **61.5%** of platform-subject papers, **no named instrument survives into this corpus's tool lists**. Read that as an upper bound on the gap rather than as "three in five do not state it": extraction recall on free-text tool names is imperfect, and we did not hand-audit the 552. Even as an upper bound it is the largest single reporting hole the page found, because the route is the design decision. |
| |
| ==== The reproducibility cost ==== | ==== The reproducibility cost ==== |
| ^ Finding ^ Denominator the paper used ^ | ^ Finding ^ Denominator the paper used ^ |
| | Only **7.7%** of undeclared political ads were moderated as political by Meta; **60.4%** of the ads Meta did moderate did not match its own criteria {[bouchaud2024_beyond]} | 29.5 M ads from the Meta Ad Library API, 16 EU countries | | | Only **7.7%** of undeclared political ads were moderated as political by Meta; **60.4%** of the ads Meta did moderate did not match its own criteria {[bouchaud2024_beyond]} | 29.5 M ads from the Meta Ad Library API, 16 EU countries | |
| | **3,546,479,731** WhatsApp accounts discovered; **57%** with a public profile picture, **66%** of a 500,000-image sample containing a detectable face {[gegenhuber2026_there]} | 63.2 bn candidate phone numbers enumerated | | | **3,546,479,731** WhatsApp accounts discovered; **57%** with a public profile picture, **66%** of a 500,000-image sample containing a detectable face {[gegenhuber2026_there]} | 63,170,000,000 candidate phone numbers enumerated | |
| | TikTok "//exploits real users' interests in between 30% and 50% of all recommended videos in the first thousand videos//" {[vombatkere2024_tiktok]} | 347 donating users, 4.9 M videos, plus 5 bot accounts | | | TikTok "//exploits real users' interests in between 30% and 50% of all recommended videos in the first thousand videos//" {[vombatkere2024_tiktok]} | 347 donating users, 4.9 M videos, plus 5 bot accounts | |
| | **17,842** Amazon products restricted from shipping to at least one world region; **1.1%** of 796,081 sampled books restricted to at least one of four Middle Eastern countries {[knockel2026_banned]} | Common Crawl-derived Amazon product set | | | **17,842** Amazon products restricted from shipping to at least one world region; **1.1%** of 796,081 sampled books restricted to at least one of four Middle Eastern countries {[knockel2026_banned]} | Common Crawl-derived Amazon product set | |
| | Platform blocking of accounts advertised for sale worked on **19.71%** of them overall, and very unevenly: YouTube 5.02%, Facebook 5.70%, X 18.67%, Instagram 46.41%, TikTok 816 of 1,700 — the paper's own summary is "//TikTok and Instagram demonstrated the highest detection efficacy at 48%, whereas YouTube and Facebook showed the lowest efficacy at just 5%//" {[beluri2025_exploration]} | 11,457 visible accounts from 11 marketplaces | | | Platform blocking of accounts advertised for sale worked on **19.71%** of them overall, and very unevenly: YouTube 5.02%, Facebook 5.70%, X 18.67%, Instagram 46.41%, TikTok 816 of 1,700 — the paper's own summary is "//TikTok and Instagram demonstrated the highest detection efficacy at 48%, whereas YouTube and Facebook showed the lowest efficacy at just 5%//" {[beluri2025_exploration]} | 11,457 visible accounts from 11 marketplaces | |
| | **136,009** Twitter users' Mastodon accounts identified across 2,879 instances; **96%** of migrants joined the largest quartile of instances {[he2023_flocking]} | 15,886 Mastodon instances, 1.02 M crawled accounts | | | **136,009** Twitter users' Mastodon accounts identified across 2,879 instances, and "//the top 25% most populous instances contain 96% of the users//" {[he2023_flocking]} | 15,886 Mastodon instances, 1.02 M crawled accounts | |
| | Over **90%** of targetable Facebook identities in the US had at least one data-broker-provided attribute (Australia 81.3%, UK 74.4%) {[venkatadri2019_auditing]} | the Facebook advertising interface, 7 countries | | | Over **90%** of targetable Facebook identities in the US had at least one data-broker-provided attribute (Australia 81.3%, UK 74.4%) {[venkatadri2019_auditing]} | the Facebook advertising interface, 7 countries | |
| | On X, posts containing external links had a median visibility score an **order of magnitude** below those without ("//0.0069 vs. 0.084//" for two named accounts) {[galeazzi2026_revealing]} | 17 M + 35 M tweets from two published datasets | | | On X, posts containing external links had a median visibility score an **order of magnitude** below those without ("//0.0069 vs. 0.084//" for two named accounts) {[galeazzi2026_revealing]} | 17 M + 35 M tweets from two published datasets | |
| | Platform research programmes (Meta Content Library via CASD, TikTok Research Tools, YouTube Researcher Program) | **current, but you will be first** | 1, 0 and 2 papers respectively in 5,855 | | | Platform research programmes (Meta Content Library via CASD, TikTok Research Tools, YouTube Researcher Program) | **current, but you will be first** | 1, 0 and 2 papers respectively in 5,855 | |
| | DSA Art. 40 vetted-researcher route | **current, newly operational, untested here** | Delegated Reg. (EU) 2025/2050; 1 on-point mention in 5,855 papers | | | DSA Art. 40 vetted-researcher route | **current, newly operational, untested here** | Delegated Reg. (EU) 2025/2050; 1 on-point mention in 5,855 papers | |
| | Ad-transparency archives | **current and productive** | 69 papers; {[bouchaud2024_beyond]}, {[benzaamia2026_year]}, {[capozzi2023_thin]} | | | Joining public messaging groups and channels | **current; terms forbid most of it; almost all Telegram since 2022** | **26** hand-audited papers, none before 2019; own page: [[Design:Platforms:Messaging channels]] | |
| | | Ad-transparency archives | **current and productive** | **11** hand-audited papers; {[bouchaud2024_beyond]}, {[benzaamia2026_year]}, {[capozzi2023_thin]}. Own page: [[Design:Platforms:Ad archives]] | |
| | Data donation | **current and rising** | 25 papers, 11 of them 2025; {[mccrosky2026_does]}, {[benzaamia2026_year]} | | | Data donation | **current and rising** | 25 papers, 11 of them 2025; {[mccrosky2026_does]}, {[benzaamia2026_year]} | |
| | Right of access / DSAR as an instrument | **current and rising** | 52 papers; {[karnam2026_setting]} | | | Right of access / DSAR as an instrument | **current and rising** | 52 papers; {[karnam2026_setting]} | |
| | Sock-puppet accounts for personalised surfaces | **current, high-risk, unavoidable for feed studies** | 14 papers use the term; {[vombatkere2024_tiktok]}, {[karnam2026_setting]} | | | Sock-puppet accounts for personalised surfaces | **current, high-risk, unavoidable for feed studies** | 14 papers use the term; {[vombatkere2024_tiktok]}, {[karnam2026_setting]}. The experimental design is [[Design:Algorithm audits]] | |
| | Logged-out scraping | **current, contested; a designated VLOP was fined for forbidding it** | 157 papers name a scraper; EC decision 5 December 2025 | | | Logged-out scraping | **current, contested; a designated VLOP was fined for forbidding it** | 157 papers name a scraper; EC decision 5 December 2025 | |
| | Third-party archives (Pushshift) | **the live service is closed to researchers; the historical dumps are what the field is actually using** | 35 papers, still 9 in 2025 | | | Third-party archives (Pushshift) | **the live service is closed to researchers; the historical dumps are what the field is actually using** | 35 papers, still 9 in 2025 | |
| |
| ^ Promised page ^ Corpus support ^ Decision ^ | ^ Promised page ^ Corpus support ^ Decision ^ |
| | **TikTok** | 7 candidate papers, **4** genuine after a full audit, none before 2023 | **No page.** Four papers is a paragraph, and it is above. | | | **TikTok** | 7 candidate papers, **4** genuine after a full audit, none before 2023 | **No page.** Not because TikTok is unimportant — because the TikTok measurement literature is mostly //outside these seven venues//, so a page built from this corpus would be four papers and would misrepresent the field. The four are named above. | |
| | **Amazon** | 72 candidates, **36%** precision; the genuine ones split between the Alexa voice/skill ecosystem ({[cheng2020_dangerous]}, {[liao2024_gdpr]}) and the retail storefront ({[knockel2026_banned]}) | **No page.** "Amazon" is not one measurement object, and the skill-store work belongs with [[Design:Mobile and app measurement]]. | | | **Amazon** | 72 candidates, **36%** precision; the genuine ones split between the Alexa voice/skill ecosystem ({[cheng2020_dangerous]}, {[liao2024_gdpr]}) and the retail storefront ({[knockel2026_banned]}) | **No page.** "Amazon" is not one measurement object, and the Alexa skill-store work is closer to app-store measurement than to this page, though [[Design:Mobile and app measurement]] does not cover skill stores yet. | |
| | **Twitter / X** | 142 candidates, **73%** precision — the largest coherent body | **No page.** The access route that produced nearly all of it no longer exists, so a page would be a history of a closed API. What survives is the access-route material above. | | | **Twitter / X** | 142 candidates, **73%** precision — the largest coherent body | **No page.** The access route that produced nearly all of it no longer exists, so a page would be a history of a closed API. What survives is the access-route material above. | |
| | **Facebook / Meta** | 151 candidates, **69%** precision | **No page.** The method-bearing parts are already elsewhere: the pixel and server-side flows on [[Privacy:Server side tracking]] and [[Privacy:Requests]], the SDKs on [[Design:Mobile and app measurement]], consent on [[Privacy:consent]]. The ad archive is the one genuinely distinct instrument, and it is not Facebook-specific. | | | **Facebook / Meta** | 151 candidates, **69%** precision | **No page.** The method-bearing parts are already elsewhere: the pixel and server-side flows on [[Privacy:Server side tracking]] and [[Privacy:Requests]], the SDKs on [[Design:Mobile and app measurement]], consent on [[Privacy:consent]]. The ad archive is the one genuinely distinct instrument, and it is not Facebook-specific; it now has its own page, [[Design:Platforms:Ad archives]]. | |
| |
| A per-company page is the wrong axis anyway. What a platform study reuses across companies is the **route in** and the **denominator that route implies**; what does not transfer is the company's current API surface, which is precisely the part that goes stale fastest. This page is organised by route for that reason. | A per-company page is the wrong axis anyway. What a platform study reuses across companies is the **route in** and the **denominator that route implies**; what does not transfer is the company's current API surface, which is precisely the part that goes stale fastest. This page is organised by route for that reason. |
| |
| The one page that the evidence //does// support is not on the promised list: **ad-transparency archives as a measurement instrument** — 69 papers, a live regulatory driver, real double-sided error characteristics {[bouchaud2024_beyond]}, and a 2026 cross-platform comparison {[benzaamia2026_year]}. It is recorded as a candidate rather than linked, so this page does not create the very problem it just cleaned up. | A second route page followed on 2026-09-27: **[[Design:Platforms:Messaging channels]]**, on joining Telegram, WhatsApp and Discord groups and channels — a route none of the rows above covers, organised by the route rather than by the three companies. Its hand audit found **26** papers in these venues that collect from inside groups, against **76** that name one of the three messengers ten or more times. |
| | |
| | The one page that the evidence //does// support was not on the promised list, and it has now been written: **[[Design:Platforms:Ad archives]]** — ad-transparency archives as a measurement instrument, with a live regulatory driver, real double-sided error characteristics {[bouchaud2024_beyond]}, and a 2026 cross-platform comparison {[benzaamia2026_year]}. |
| | |
| | <WRAP tip> |
| | **Writing it corrected the count on this page.** The **69** above came from a full-text probe for %%/Ad Library|Ads? Archive API/i%%. That probe cannot separate Meta's **Ad Library** from an Android **advertising SDK**, which is what "ad library" means throughout the mobile-security literature: **44** of the 69 contain only the lowercase SDK sense, and the pattern also matches the substring inside "uplo[ad librar]ies", so one of the 69 is a paper about Node.js file uploads. Hand-auditing every candidate gives **11** papers that use an ad-transparency archive or measure one — precision **14.5%** for the old probe. The corrected figure is carried in the tables above; the audit, with its full residue, is on [[provenance:design:platforms:ad_archives]]. Only this figure was re-derived: the rest of this page's numbers were not re-run in that sitting. |
| | </WRAP> |
| |
| ===== Open Questions ===== | ===== Open Questions ===== |
| * **What is the real cost of a metered-API study?** Nobody has published the arithmetic. A short note with a worked budget — reads, cap, and what you had to drop — would be worth more than another dataset. | * **What is the real cost of a metered-API study?** Nobody has published the arithmetic. A short note with a worked budget — reads, cap, and what you had to drop — would be worth more than another dataset. |
| * **Does the field's move to reused corpora change its findings?** 383 of 897 platform papers name an existing dataset and 208 collected nothing of their own. Whether the conclusions drawn from a 2019 Twitter corpus still describe X in 2026 is an answerable question nobody in this corpus asks. | * **Does the field's move to reused corpora change its findings?** 383 of 897 platform papers name an existing dataset and 208 collected nothing of their own. Whether the conclusions drawn from a 2019 Twitter corpus still describe X in 2026 is an answerable question nobody in this corpus asks. |
| * **Ad-transparency archives** deserve their own page (see above). It needs the archive-by-archive coverage comparison that {[benzaamia2026_year]} starts. | * **Search-engine and ads-ecosystem auditing** is the largest measured family here — Google is rank 1 with 323 papers. The **design** those studies share is now [[Design:Algorithm audits]] (34 hand-adjudicated papers, 2026-09-11); what remains open is the platform-specific instrumentation — SERP parsing, ad-creative capture, and the ad-buying side — which neither page covers. |
| | * **Ad-transparency archives** now have their own page, [[Design:Platforms:Ad archives]], with the archive-by-archive coverage comparison that {[benzaamia2026_year]} starts. Two findings from it belong here: **nine of the thirteen DSA ad repositories have never been used in these seven venues** — TikTok's, LinkedIn's, Bing's, Snapchat's, Amazon's free API and every retail one — and the ad-repository ground of the December 2025 X decision is a second reason to read that decision, alongside the researcher-access ground above. |
| </WRAP> | </WRAP> |
| |
| * **[[Design:User studies]]** — because "Amazon" on this page is 179 papers using **Mechanical Turk**. Crowdworkers labelling your platform data are annotation, not a user study. | * **[[Design:User studies]]** — because "Amazon" on this page is 179 papers using **Mechanical Turk**. Crowdworkers labelling your platform data are annotation, not a user study. |
| * **[[Design:Crawling location]]** — the vantage point, and why a datacenter IP gets a different platform than a residential one. | * **[[Design:Crawling location]]** — the vantage point, and why a datacenter IP gets a different platform than a residential one. |
| * **[[Design:Mobile and app measurement]]** — app stores, SDKs, and the on-device route {[west2024_picture]} used. | * **[[Design:Mobile and app measurement]]** — app stores, SDKs, static versus dynamic analysis, and certificate pinning. It does **not** currently cover voice-assistant skill stores or the on-device model-extraction route {[west2024_picture]} used; those are described here instead. |
| * **[[Design:Longitudinal]]** — repeating a platform measurement when the platform, not just the web, moved between waves. | * **[[Design:Longitudinal]]** — repeating a platform measurement when the platform, not just the web, moved between waves. |
| | * **[[Design:Algorithm audits]]** — once you have the sock puppets, the experiment: what a control arm is, carry-over between arms, and sizing the noise floor before claiming a difference. |
| * **[[Programming:Registration]]** — the mechanics of the accounts a sock-puppet study needs. | * **[[Programming:Registration]]** — the mechanics of the accounts a sock-puppet study needs. |
| * **[[Programming:Interaction]]** — driving a feed once you are in. | * **[[Programming:Interaction]]** — driving a feed once you are in. |
| * **[[:Artifacts]]** — depositing data from a channel that may not outlive the paper. | * **[[:Artifacts]]** — depositing data from a channel that may not outlive the paper. |
| * **[[Statistics:Biases]]** — donation panels, follower thresholds, and convenience samples. | * **[[Statistics:Biases]]** — donation panels, follower thresholds, and convenience samples. |
| | * **[[Design:Platforms:Messaging channels]]** — joining public groups, channels and servers: how they are found, what joining shows you, the denominator, client tooling and terms, and the ethics of recording groups whose members did not join a study. |
| | * **[[Design:Platforms:Ad archives]]** — an access route on this page with its own instrument page: what each of the thirteen DSA ad repositories covers, what an archive structurally cannot contain, and the two-sided error problem. |
| | * **[[Security:Online scams]]** — scam campaigns followed off the platform to the scam website or wallet. Scam accounts, comments and posts as the object stay on this page. |
| * **[[provenance:design:platforms]]** — every query, fold, audit and external check behind this page. | * **[[provenance:design:platforms]]** — every query, fold, audit and external check behind this page. |
| |
