You are about to point a browser at a hundred thousand websites you do not own. Nobody consented, and most of the operators will never know you were there. Your institution's review board deals with interviews and blood samples, and when you ask them they will probably tell you this is not human-subjects research and to go away. That answer is usually correct, it takes ten minutes to obtain, and it settles almost none of the questions your reviewers will actually ask you.

This page is about the questions that are left. Who can be harmed by an automated measurement and how; what the field actually does about it, measured rather than asserted; where your review board's remit ends and your own judgement starts; and what has to be in the paper so that a reviewer does not send it back. It is deliberately not a summary of the Menlo Report or of 45 CFR 46 — those are short, and you should read them yourself; the links are below. What is not written down anywhere is the operational part: that the ethics apparatus of computer science was built for studies with participants, that a crawl has none, and that crawling papers are more than a decade behind participant studies in saying what they did instead — a gap this page measures rather than asserts.

The figures below come from the publication corpus behind this site: 5,859 papers, seven venues (CCS, IMC, NDSS, PoPETs, USENIX Security, TheWebConf, IEEE S&P), 2010–2026, with a structured extraction over each one. Every claim here is a claim about *those seven venues*: EuroS&P, ACSAC, RAID, AsiaCCS, CHI and SOUPS are absent, and so, importantly, is the entire ethics and STS literature that writes about this from the outside.

The population for this section is the 5,118 empirical papers — the ones that measured the world as it is. A proofs-only paper has nothing to review, and including it would manufacture silence.

One empirical paper in three (1,728, 33.8%) says anything checkable about ethics review at all. Of those 1,728, two thirds (1,151) report an approval or an exemption; the rest say a review was not required, was sought with no outcome given, or was explicitly discussed and not obtained.

The headline above is an average over two populations that behave completely differently, and the difference is the single most useful thing on this page.

“Silent” is none-mentioned plus papers where the extraction found no ethics record at all.

Four out of five papers that ran a crawl and recruited nobody say nothing about review. Recruit a single participant and the rate inverts: 69.1% of the crawls that also ran a study state an outcome. The norm did not arrive for web measurement; it arrived for human subjects and stopped at the boundary of the Common Rule. And it is not a fossil of the early corpus — the gap is roughly stable while both series rise:

* 2025–2026 is provisional: CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and TheWebConf 2026 abstracts are not in OpenAlex, so those venue-years are under-represented by construction. See Corpus.

In the last complete window, 85.2% of participant studies and 28.8% of participant-free crawls state an outcome. Put the two series on the same axis and the lag is measurable: participant-free crawls reach in 2025–2026 (30.1%) a reporting rate participant studies had already passed before 2014 (28.6% in 2010–2013, 58.7% in 2014–2017). If you are writing a crawl paper, you are in the second column, and the second column is where the reviewers' patience is currently running out.

PoPETs states an outcome more than three times as often as TheWebConf. Part of that is subject matter and part is venue policy, but the practical reading is: the further your target venue is from the privacy community, the more of the ethics argument you have to make from scratch in the paper, because the reviewer has not seen the template.

Reporting a *review* is not the same as reporting *care*, and the corpus separates them. Of the 1,120 papers that ran a crawl, 697 (62.2%) describe at least one concrete step they took to limit harm. On the like-for-like population — the 971 that crawled and recruited nobody — it is 585 (60.2%) describing a mitigation against 207 (21.3%) stating a review outcome, so almost three times as many papers say what they did as say who checked it. The field is not careless; it is silent about the institutional half and reasonably articulate about the practical half. What is missing is almost always the sentence “we asked X and they said Y”.

This is not an artefact of one extraction. Ramulu et al. [2Ramulu, Harshini Sri; Schmitt, Helen; Rerich, Bogdan; Rodriguez, Rachel Gonzalez; Kohno, Tadayoshi; Acar, Yasemin (2025): "Ethics in Computer Security Research: A Data-Driven Assessment of the Past, the Present, and the Possible Future", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] hand-read all 1,154 papers published at CCS, IEEE S&P, NDSS and USENIX Security in 2024 and found 839 with no discussion of ethics at all, 315 with some discussion, and 270 with a dedicated section. Of the 116 papers that involved human subjects, 102 discussed ethics and “all but 17” named a review board — while only 52 of the ~1,038 papers without human subjects mentioned one. (Their sentence does not restate its base, so “all but 17” is 99 of 116 or 85 of 102; either way the contrast with 52 holds.) Different corpus, different method, same shape: the apparatus tracks participants, not harm.

Their interview study with 24 researchers (several of them ethics-committee members and program chairs) is the best single account of why: ethical reasoning in this field happens in private conversations inside research groups and inside program committees, and almost none of it reaches the written record that a new PhD student can learn from. If you have read nothing else on this topic, read that paper.

Under the revised Common Rule (45 CFR 46), a *human subject* is a living individual about whom an investigator obtains information through intervention or interaction with the individual, or obtains identifiable private information.¹⁾ A crawl of public pages typically involves neither, which is why the sentence “our IRB determined this is not human subjects research” appears so often — the literal phrasing shows up in a full-text sweep of 79 of the 5,118 empirical papers, and IRB appears anywhere in 987 (19.3%).

Read the good examples and notice what they do beyond the determination. ICLab [3Niaki, Arian Akhavan; Cho, Shinyoung; Weinberg, Zachary; Hoang, Nguyen Phong; Razaghpanah, Abbas; Christin, Nicolas; Gill, Phillipa (2020): "ICLab: A Global, Longitudinal Internet Censorship Measurement Platform", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] states the determination and the reason it holds — no personally identifiable information about the volunteers — and then keeps going. Censored Planet [4Raman, Ram Sundara; Shenoy, Prerana; Kohls, Katharina; Ensafi, Roya (2020): "Censored Planet: An Internet-wide, Longitudinal Censorship Observatory", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] states that boards “typically consider network measurement studies to be outside of their purview when they do not involve human subjects or their personally identifiable data” and then devotes the section to the harm the measurement could do to people in the measured countries, which no board was ever going to assess. That is the correct shape: the determination is the first sentence of the ethics section, not the whole of it.

What the determination explicitly does not cover, and what you therefore have to argue yourself:

• Harm to site operators: load, cost, corrupted analytics, on-call pages, wasted staff time.
• Harm to third parties who did not consent to be in your vantage point — the people whose devices your residential proxy resolves through.
• Harm to users of the sites you touch, if your interaction has any side effect at all.
• Harm from publication: naming a vulnerable site, a country, a small operator, or a demographically identifiable group.
• Legal exposure — yours and your institution's. A board that has declared you out of scope has also declared it is not advising you on this.

The determination costs you an email and gives you a citable sentence. It also occasionally comes back the other way, as it did for Snyder et al. [1Snyder, Peter; Doerfler, Periwinkle; Kanich, Chris; McCoy, Damon (2017): "Fifteen minutes of unwanted fame: detecting and characterizing doxing", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — and it comes back the other way most often for exactly the studies that feel safest, because “public data” is a description of access, not of identifiability. Ask early enough that the answer can still change the design.

Where the board declines, the corpus shows three substitutes that reviewers have accepted:

• An ad-hoc committee of colleagues. Bennett et al. [5Bennett, Nathaniel; Sowards, Rebekah; Deccio, Casey T. (2022): "SPFail: Discovering, Measuring, and Remediating Vulnerabilities in Email Sender Validation", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]: “While our institution has an IRB, our research did not involve human subjects, so it did not fall under the purview the IRB. In lieu of formal IRB approval, we consulted an ad-hoc ethics committee consisting of subject-matter experts within our same department. They approved our experiment plan as described herein.” This is the cheapest credible answer and the one most likely to survive review. Note the last sentence: they did not just consult, they got a decision and reported it.
• A named external board. The Tor Research Safety Board gives “feedback to researchers who use our guidelines to assess the safety of their planned research” on the Tor network (read 2026-08-18), and is named in 7 papers in the corpus. It is the only standing domain-specific ethics board this literature names — and PoPETs' call for papers names it explicitly as an acceptable external panel alongside an IRB. There is no equivalent for the open web; the nearest proposals are the pre-registration board in [6Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] and the “federated ethics boards” of Dirksen et al.²⁾ Neither exists yet.
• Legal counsel or the data protection officer, where the risk is legal rather than to participants — 25 papers name a legal department or general counsel, 28 name a data protection officer or office.

Twenty papers in the corpus say so outright: “Our university located in central Europe unfortunately does not have an ethics board but has a set of guidelines that we followed in our research” [7Krombholz, Katharina; Mayer, Wilfried; Schmiedecker, Martin; Weippl, Edgar (2017): ""I Have No Idea What I'm Doing" - On the Usability of Deploying HTTPS", in: Proceedings of the USENIX Security Symposium. (Link)]. The sentence recurs from 2013 to 2026, and 16 of the 20 recruited participants — so this is not a crawling-specific gap at all; it is a gap in the institutions, and it bites hardest on exactly the studies a board would normally review. US-style IRB review is an obligation attached to US federal research funding; most of the world has no equivalent standing body for computer science, and a good number of departments that do have one exclude CS from its remit.

It is not a reason to write nothing. What those twenty papers put in place instead is exactly the list a reviewer will accept, and each of these is a real sentence from the corpus:

• A named alternative body. “we sought authorization and supervision from our network ma[nagement department]”; “the study protocols were cleared with the projects ethics officer”; “a dedicated team whose focus is privacy and human protection”.
• A named external standard, followed and cited. “Our institution does not have an IRB, but we refer to and strictly follow the Menlo Report and the best practices of netw[ork measurement]”. Half of the twenty name the Menlo Report, and it is the strongest of the substitutes because it is checkable.
• A documented internal process. “we had extensive ethics-related discussions within our interdisci[plinary team]” — weakest of the three, but still better than silence if you say who was in the room and what they objected to.
• The applicable law, where the study is in the EU. “Our institution is in the EU and has no formal IRB process. However, we followed the strict rules of our national and European privacy regulations.”

1,347 empirical papers name a review body, in 595 distinct strings. Folded by kind of institution:

The vocabulary of this literature is overwhelmingly American, and that matters when you read it: “we obtained IRB approval” from a European group usually means a departmental ethics committee with a different remit and no federal backing. Say which yours is.

This changes every cycle, and it changed a lot between 2024 and 2026. Every row below was read from the venue's own call for papers on 2026-08-18; check yours before you submit, because two of these moved within the last twelve months.

* Six of the seven rows are the currently open cycle. TheWebConf is not: www2027.thewebconf.org does not resolve and thewebconf.org lists WWW 2027 (Dublin) with no call for papers yet, so that row is the last published cycle, WWW 2026, which was held in April 2026.

Four things to take from it.

The requirement is not monotonic. USENIX Security '26 required “a dedicated appendix after the main body of the paper (but before any references) called 'Ethical Considerations'”; '27 lists among its main changes “Ethics appendix is no longer mandatory (but is strongly encouraged)”.³⁾ Do not learn the rule from a paper published two years ago.

“My IRB said no review needed” is explicitly not enough, at three venues. CCS: “institutional (IRB/ERB) approval is neither strictly necessary nor always sufficient to demonstrate ethical conduct”.⁴⁾ NDSS: “IRB exemptions may not be sufficient grounds for proper mitigation of ethical concerns”.⁵⁾ USENIX Security asks the question and answers it in one word — “Is IRB approval a sufficient alternative? No! IRBs are not expected to understand computer security research well or to know about best practices and community norms in our field, and so IRB approval does not absolve researchers from considering ethical aspects of their work.”

Two venues tell you what to do if you have no board. IMC: “If the submission describes research involving human subjects and none of the authors are at an institution with an IRB (or equivalent), the authors are nonetheless expected to follow a research protocol that adheres to ethical principles, as stated in the ACM policy on research involving human subjects”.⁶⁾ USENIX Security: “If authors do not have access to an IRB … please clearly state that you do not have access to an IRB.” Say it; do not leave the reader to infer it.

The ACM baseline applies at CCS, IMC and TheWebConf whatever the CFP says. ACM's Publications Policy on Research Involving Human Participants and Subjects (approved 15 August 2021, grounded explicitly in the Belmont Report) covers every ACM venue and answers the no-local-law case directly: “Where such research is conducted in countries where no such local governing laws and regulations related to human participant and subject research exist, Authors must at a bare minimum be prepared to show compliance with the above detailed principles.”⁷⁾

USENIX Security's ethics guidelines are the most explicit statement anywhere of what an ethics section should contain, and they are worth following whatever venue you submit to. They ask for a stakeholder-based ethics analysis in five parts:⁸⁾

1. Stakeholders — “all possible stakeholders (people, including the research team and society at large, and entities including companies) that may be impacted”, and how each is affected both by the procedure and by the publication.
2. Ethical principles — which you considered, per stakeholder. The Menlo Report's four are the suggested starting point.
3. Harms — both “tangible harms” and “violations of human rights even if there are no directly tangible harms”.
4. Mitigations — “both mitigated and unmitigated (potential) harms”, and the steps taken. Note that they want the *unmitigated* ones written down too.
5. Decision — why you proceeded, and separately why you published.

For a crawl, that structure fills itself in: operators, end users, third parties in your vantage point, other researchers who will be blocked after you, and your own team. For the moral-reasoning frameworks behind it, the guidelines point at [8Kohno, Tadayoshi; Acar, Yasemin; Loh, Wulf (2023): "Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversations", in: Proceedings of the USENIX Security Symposium. (Link)], which builds security-specific trolley problems to show where consequentialist and deontological reasoning give different answers — useful precisely when your co-authors disagree and neither can say why.

The Menlo Report (Ethical Principles Guiding Information and Communication Technology Research, August 2012, funded by the US Department of Homeland Security) adapts the Belmont Report's three principles — Respect for Persons, Beneficence, Justice — and adds a fourth, Respect for Law and Public Interest. Its 2013 companion, Applying Ethical Principles to Information and Communication Technology Research, is the one with the worked examples, and is the more useful of the two for a measurement study.

The string Menlo Report appears in 225 of the 5,118 empirical papers (4.4%), and the rate is climbing sharply — 0% in 2010–2013, 5.1% in 2022–2024, 10.0% in the provisional 2025–2026 slice. (That is a full-text sweep, so it is an upper bound on real use and a lower bound on nothing: a paper can follow the report without naming it.) It is named in the calls for papers of IEEE S&P, USENIX Security and NDSS.

Two caveats a student should know before leaning on it. It is archived: DHS marks both pages “Archived Content — In an effort to keep DHS.gov current, the archive contains outdated information that may not reflect current policy or programs”, last updated 2023-01-12, and no successor or revision exists.⁹⁾ And it is not a manual: Hantke et al. [6Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] report that their interviewees “highlighted the absence of practical ethical guidelines”, summarising the Menlo Report as “largely theoretical” and lacking “practical examples” — the authors' characterisation of what they heard, not a quotation from an interviewee. Which is why the stakeholder template above, and not the report itself, is what you actually write from.

Distinct from the ethics section, and newer: every one of the seven venues now has a policy on generative-AI use by authors, and four of them require a disclosure. This is where the security and privacy venues diverge sharply from the AI venues, and it catches people who have moved between the two.

• PoPETs '27 makes AI use one of three mandatory template sections — “NEW FOR 2027: Updated LaTeX 2027 PoPETs template with mandatory sections, mandatory use or desk reject” — and treats “Hallucinations, fabrication, omissions, plagiarism, and falsification” as research misconduct, with “Hallucinated references … grounds for desk rejection”.
• IEEE S&P '27 requires a “Generative AI usage considerations” field on HotCRP, adopts IEEE's organisation-wide policy plus a local one, and — unlike the others — covers generative AI as an object of study as well as a writing aid. The LLM policy and the ethics-considerations section were both newly added in the 2026 cycle.
• USENIX Security '27 attaches a specific desk-reject trigger: a violation “which results in fabrications or hallucinations, including non-existing references or incorrect authors, invented claims, and falsified results is considered academic misconduct and might lead to the paper being desk rejected or other sanctions”.
• NDSS '27 permits it under a three-part test — no plagiarism or falsification, the work is “not primarily the result of the tools' generative capabilities”, and the authors accept responsibility for “the veracity and correctness of all material” — and requires disclosure at submission.
• CCS '26, IMC '26 and TheWebConf defer to the ACM Policy on Authorship: AI cannot be an author, and CCS requires a dedicated “Generative AI Usage” section if AI generated or substantially rewrote substantive content. CCS and IMC also bar reviewers from uploading submissions to public AI tools; at CCS that is referable to the ACM Publications Board as misconduct.

All read 2026-08-18 from the calls for papers already cited above.

Two things this means for a measurement paper specifically. If you used an LLM as an instrument — to classify cookies, label banners, read privacy policies, decide whether a site is in scope — that is a methods decision and a disclosure, not a writing aid, and IEEE S&P's phrasing (“as an object of study”) is the only one that clearly covers it. And if the model touched anything you collected, the ethics section and the AI section now interact: sending crawled content, participant text or vulnerability details to a hosted model is a disclosure of that data to a third party, and none of these policies says so for you.

The corpus cannot yet say how often LLM-based measurement pipelines disclose this: tools[] has an llm category, but there is no schema field for “was AI use disclosed”, and the venue requirements are newer than most of the corpus. A full-text sweep would be the way in.

Of the 1,120 crawling papers, 697 describe a concrete mitigation. Folded into families — the fold is multi-label, because one sentence routinely names three steps, so the shares do not sum to 100%:

Read this as a menu, not as a ranking of importance. The top four are what the field says most often; the bottom four are where the gap between what the field says and what a 2026 reviewer expects is widest.

Rate limiting is the second most common step and the one most often stated as a bare adjective (“we crawled politely”). It is worth a number. Five real ones from the corpus, each verified in the paper:

Any of these is publishable; “we rate-limited our crawler” is not, because it does not let a reader tell your crawl apart from a scraper that took a site down. Note what the last one adds: a reactive rule. A fixed rate is a guess about the smallest server in your sample; backing off on 429 and 503 is a rule that adapts to it.

One framing worth knowing, because it comes from the affected parties rather than from researchers: the operators interviewed by Hantke et al. [6Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] said their logs already show scans of this kind continuously, and that they did not expect additional harm from a researcher's — “if researchers run non-invasive and well-pre-tested scans likely to get lost in the Internet's noise, the operators in our study might be willing to accept them”. That is a defensible argument in a paper, and it has two conditions attached: non-invasive, and pre-tested.

53 of 1,120 crawling papers (4.7%) say anything at all about robots.txt, and a full-text sweep for the literal string finds only 55 (4.9%) — so this is not an extraction artefact. It is the lowest reporting rate of any field in the extraction behind this site, below the next four:

The reason it is unresolved rather than merely unreported is that the file does not answer the question a researcher has. `robots.txt` is a directive to *automated indexers*; a research crawl that loads a page once, in the way a browser would, and never republishes the content is not obviously the addressee, and a strict reading excludes exactly the pages a measurement is about (a `Disallow: /` on a site's tracking-heavy subpages removes the finding). There is no consensus in this literature, and inventing one here would be dishonest. What is not defensible is silence: decide, do the same thing throughout the crawl, and write the sentence. If you honour it, say what share of your sample it removed, because that is a bias in your denominator, not a footnote. If you do not, say why and what you did instead — most commonly a rate limit strict enough that the file's purpose (protecting the server) is served by other means.

Two different documents, both routinely skipped.

• The site's terms of service may prohibit automated access. Whether breaching them is unlawful is jurisdiction-dependent and has moved — see What the law says, and does not for what Van Buren and hiQ did and did not settle. The short version is that in the US the computer-crime exposure narrowed and the contract exposure did not. The corpus contains 129 crawling papers (11.5%) that mention terms of service at all, which is the more telling number: the document that most directly governs the legality of a crawl is discussed in one paper in nine.
• Your own network's acceptable-use policy is the one that will actually stop you, and it is the one nobody reads. Five crawling papers in the corpus mention an acceptable-use policy at all. What those policies say varies enormously — one national research network requires a day's notice before you scan, another has no scanning clause whatever (both quoted just below) — so the answer is genuinely local. Talk to your network operations team before the crawl, not after the abuse ticket. Seven papers in the corpus name a network operations, network services or network management department among the bodies that reviewed the study — which is a perfectly good thing to be able to write when no ethics board will.

Only five crawling papers in the corpus mention one, and the policies are not uniform. Three worth knowing about, all read on 2026-08-18:

• SURF (NL) has the only genuinely scan-specific national-research-network policy found, and it reads like the Red Lines checklist: the scanning host must have “a PTR record (reverse DNS) with a meaningful name … indicating this is an intentional scan host and who is responsible for it”, and “A webserver runs on the host … which serves a web page that makes explicit what the goals of the scans are and who can be contacted.”¹⁰⁾ If your NREN has a policy at all, this is what a good one looks like.
• Jisc/JANET (UK) requires notice: “Security Contacts must notify Jisc if undertaking penetration testing or scanning on the Janet Network from outside of the Janet Network at least 1 working day in advance.”¹¹⁾
• Internet2 (US) has, in full: “The Internet2 Network can be used for any legal purpose, so long as it does not interfere with or adversely affect the operation of the Internet2 Network or any network user, as may be determined by Internet2.”¹²⁾ No scanning clause at all. Silence is not permission — it means the decision sits with your institution.

Two more that catch people out. WHOIS and RDAP are contractually rate-limited: Verisign's terms prohibit “electronic processes that are high-volume and automated except as reasonably necessary to register domain names or modify existing registrations”, which describes most bulk WHOIS enrichment in this literature.¹³⁾ And cloud providers differ: Azure dropped pre-approval for penetration testing of your own resources in June 2017 and lists port scanning of your own endpoints as permitted, while AWS permits testing of listed services without approval and prohibits DoS simulation and request flooding under that policy (it runs a separate opt-in programme for DDoS simulation) — in both cases only against resources you own, which is not what a measurement crawl does.¹⁴⁾

A read-only crawl is the easy case. As soon as you click, submit, register or purchase, the calculus changes, and the corpus's own mitigations show what the field considers the boundary:

• Ad clicks cost someone money. The corpus's answers are: never click, click each ad exactly once, or click and then estimate and publish the cost you imposed. Two worked estimates to copy the form of — Datta et al. [14Datta, Amit; Tschantz, Michael Carl; Datta, Anupam (2015): "Automated Experiments on Ad Privacy Settings", in: Proceedings on Privacy Enhancing Technologies. (DOI)] avoided per-click fees entirely and priced their per-impression footprint at “about $400” across the whole study; Subramani et al. [15Subramani, Karthika; Yuan, Xingzi; Setayeshfar, Omid; Vadrevu, Phani; Lee, Kyu Hyung; Perdisci, Roberto (2020): "When Push Comes to Ads: Measuring the Rise of (Malicious) Push Advertising", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] priced theirs from the standard CPM at “USD 1.12” for the worst-hit landing domain and USD 0.04 on average. Publishing the estimate is now the expected form, and it is a two-line calculation.
• Registrations, purchases and orders are where “measurement” becomes “transaction”. The reported practice is fictitious identities, no real payment instruments, closing the accounts afterwards, and — where a purchase is unavoidable — the smallest possible number, disclosed.
• Form submission on a live site can create records a human then has to clean up. The corpus's answer is syntactically valid but obviously invalid data, or not submitting at all.
• Consent banners are an interaction, and clicking “accept” on 100,000 sites is a state change on 100,000 sites. See Consent; the relevant point here is that the choice is a design decision with an ethics component, not a default.

Ten of the 697 papers that state a mitigation describe doing this — the rarest thing on the table, and the cheapest credible thing on it. (Ten and not seventeen: a bare “we offered an opt-out” in a paper is as often an opt-out for a study participant or for the recipient of a notification email as it is for a site operator, so this row is decided by reading the paper, not by matching the string. The twenty-one candidates and the verdict on each are on the provenance page.) The version this literature has converged on, set out most fully by Hantke et al. [6Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] for server-side scanning and directly transferable to crawling:

1. Put up a study web page explaining who you are, what you are doing, over what period, and how to make you stop.
2. Link it from a custom HTTP header on every request, and from your User-Agent.
3. Make the reverse DNS of your source addresses resolve to that page.
4. Keep the source addresses fixed for the whole study, so an operator can allow-list or block you.
5. Provide an explicit opt-out — ideally a form, not an email address you will stop reading.

This trades some measurement realism for a large amount of goodwill, and it interacts with the vantage-point choices on Crawling location: an identifiable crawler is a crawler that bot-management systems can treat differently, so say what you did and treat unexplained blocks as a possible artefact.

It is worth knowing that the industrial scanners are not a model here. Wu et al. [16Wu, Mengying; Hong, Geng; Chen, Jinsong; Liu, Qi; Tang, Shujun; Li, Youhao; Liu, Baojun; Duan, Haixin; Yang, Min (2025): "Revealing the Black Box of Device Search Engine: Scanning Assets, Strategies, and Ethical Consideration", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] traced 1,407 scanner IP addresses belonging to commercial device search engines and watched them against 28 honeypots for a year; they report that the engines “often fail to provide transparency and do not allow users to opt out of scans”, send malformed requests, and publish personally identifiable information and screenshots in their results. The bar this section describes is one academic measurement can clear and commercial scanning does not, which is a useful thing to be able to say in an ethics section.

• US. 45 CFR 46.102(e) defines a human subject; 46.104(d)(4)(i) is the separate exemption for “secondary research uses of identifiable private information … [where] the identifiable private information … [is] publicly available”. These are two different questions — the first is whether the Common Rule applies at all, the second is a carve-out if it does — and papers routinely conflate them. Note also that Part 46 nowhere defines “publicly available”, so an argument that rests on that exemption rests on an undefined term.¹⁵⁾
• EU. There is no GDPR requirement for an ethics board. Article 89 requires “appropriate safeguards” for research processing — naming pseudonymisation and data minimisation — and permits member states to derogate from data-subject rights “in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes”. That derogation is a national-law question, not a self-certification.¹⁶⁾ Horizon Europe separately makes an ethics self-assessment part of the grant agreement — “The ethics self-assessment will become part of your Grant Agreement … and may thus give rise to binding obligations” — so EU-funded projects carry an obligation their national law may not impose.¹⁷⁾
• National research-ethics statutes are mostly biomedical. The Swiss Human Research Act is scoped to “research concerning human diseases and concerning the structure and function of the human body”; the Dutch WMO covers medical-scientific research and explicitly excludes file research. Neither reaches web measurement.¹⁸⁾ If your supervisor tells you “there's a law about this”, check whether the law is a health-research law — it usually is.
• The EU AI Act does not reach research-only systems. Art. 2(6) excludes systems “specifically developed and put into service for the sole purpose of scientific research and development”, and Art. 2(8) excludes pre-market R&D — but explicitly not “testing in real world conditions”. If you deploy a classifier against live sites and act on its output, read Art. 2(8) carefully.¹⁹⁾
• The three older theories the field worries about are rarely the ones that bite. Trespass to chattels requires actual impairment of the system, which a rate-limited crawl does not cause and which is exactly what your load number is evidence about. Fraud theories attach to what you say, not to what you fetch — creating an account with a false identity, or misrepresenting who you are to a support agent, is where a measurement crosses into that territory, and several papers in the corpus do both. Breach of contract is the live one, and it is the one below. This page is not legal advice, and none of these has a settled answer for research crawling; the point of naming them is that they are three different questions with three different mitigations, and “we crawled public pages” answers only the first.
• Who owns what you collected. Copyright and database rights do not disappear because a page was served to you, and a licence question that is invisible while the data sits on your disk becomes the reviewers' question the moment you release a dataset or train on it. The corpus's own practice, where papers say anything, is to release derived measurements and withhold the crawled content; where a paper reuses somebody else's crawl it names the licence it is operating under — Common Crawl's Terms of Use is the one that recurs. Note the asymmetry with the rest of this page: the ethics of collecting are discussed far more often than the ethics of redistributing. If you did not collect the data yourself, the provenance question is sharper still, and [17Thomas, Daniel R.; Pastrana, Sergio; Hutchings, Alice; Clayton, Richard; Beresford, Alastair R. (2017): "Ethical issues in research using datasets of illicit origin", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] is the framework to reach for.
• US scraping law moved, and is narrower than it is often quoted as being. Van Buren v. United States (2021) held that the CFAA's “exceeds authorized access” clause reaches only information a person's access does not extend to at all, not misuse of access they legitimately have.²⁰⁾ hiQ Labs v. LinkedIn (9th Cir., 18 April 2022) is cited far more loosely than it should be: on remand the panel affirmed a preliminary injunction, concluding that hiQ had “raised a serious question as to whether the CFAA 'without authorization' [clause]” reaches scraping of public profiles.²¹⁾ That is a preliminary-injunction standard on one claim in one circuit, not a merits holding that scraping is lawful. And the case did not end there. Eight months later, on 8 December 2022, the district court entered a consent judgment and permanent injunction: judgment of “$500,000 USD … against hiQ and in favor of LinkedIn”, and hiQ permanently enjoined from “using automated means to access and/or copy data from the LinkedIn platform, whether logged in to a LinkedIn account or not, without express written permission” and from “creating or using accounts with fake identities”. The case was terminated the next day.²²⁾ The CFAA claim narrowed; the contract claim is what the final judgment rests on. That is the sentence to remember, and note that “creating or using accounts with fake identities” is a technique this page describes several papers using.

Taking a finding to a regulator is Legal enforcement's territory. The legality of the crawl itself is this page's, and the point is that “it's public, so it's fine” was never a complete answer, and that the part of it that survived is the part nobody reads: the contract.

If your measurement sends anything a server might act on — probing for a vulnerability, testing access control, fuzzing a parameter — you are in the one corner of this topic where the community has done the empirical work and produced concrete guidance.

Hantke et al. [6Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] conducted 23 interviews — 9 legal experts, 10 website and server operators, 5 members of conference research-ethics committees, “based in Germany, the UK, the US, and Switzerland” — and surveyed 119 operators, about five concrete scanning scenarios. (German law is the paper's case study for the legal analysis; the interviewees are not all German.) Three findings a student should carry:

• There is no agreed red line, and that is the finding. One interviewee named “fuzzing random stuff”, intentionally damaging someone's business, and extracting personal information; the paper's next sentence reports another saying “the red lines are not clear”. What the operators were closer to agreeing on is the remedy: most would not consider legal action, treating it as a last resort after direct communication fails.
• Asking every operator for consent is not practical at measurement scale, and the paper says so plainly: it would introduce observer effects and select for security-aware operators. This is a rare, citable statement that a *desirable* ethical step is infeasible, which is exactly what you need when a reviewer asks why you did not obtain consent.
• Ethics review at these venues is a post-mortem. A conference committee reviews the paper after the experiment ran; if it went wrong, the harm is done. Their proposal is a pre-registration board — a trusted third party that reviews scanning proposals ex-ante, assigns time slots, and publishes a list of ongoing scans with contact points. It does not exist yet. Until it does, the ex-ante review is you.

Their operational best practices — laboratory pre-study first, data minimisation, minimal data manipulation, resource minimisation, monitoring that the scanned sites are still up and pausing if one is not, transparency via a study page and matching reverse DNS, fixed source addresses, explicit opt-out — are the closest thing this field has to a checklist, and they generalise to any measurement that touches live infrastructure.

For a worked example of the same reasoning applied end to end, read El Hajj Chehade et al. [18Chehade, Saiid El Hajj; Hantke, Florian; Stock, Ben (2025): "403 Forbidden? Ethically Evaluating Broken Access Control in the Wild", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)], who test broken access control on 100 live web applications. Their ethics section is a stakeholder analysis in the Menlo sense — end users, operators, the research team — with the risks and benefits enumerated per stakeholder and each design decision traced to one of them (two accounts per site, both created by the researchers, swapping identifiers between them, so no third party's data is ever accessible). Copy the structure.

A residential proxy resolves your requests through someone else's home connection. Whether that person knowingly agreed is the question, and the academic answer is not reassuring: Mi et al. [19Mi, Xianghang; Feng, Xuan; Liao, Xiaojing; Liu, Baojun; Wang, XiaoFeng; Qian, Feng; Li, Zhou; Alrwais, Sumayah A.; Sun, Limin; Liu, Ying (2019): "Resident Evil: Understanding Residential IP Proxy as a Dark Service", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] characterised residential IP proxy networks as a “dark service” with hosts enrolled without meaningful consent, and the follow-up work on mobile proxy networks [20Mi, Xianghang; Tang, Siyuan; Li, Zhengyi; Liao, Xiaojing; Qian, Feng; Wang, XiaoFeng (2021): "Your Phone is My Proxy: Detecting and Understanding Mobile Proxy Networks", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] found the same pattern on phones. This is a human-subjects problem wearing a procurement invoice. Twenty-five papers in the corpus mention residential proxies at all, and the best known of them — including both of the papers just cited — are studies of these networks rather than uses of them, which is a fair summary of where the literature's attention has gone.

Crawling location carries the current state of the market and the July 2026 enforcement action against one major provider. The ethics-side rules of thumb:

• Put the provider in the paper by name, with what it claims about consent and where that claim is published.
• Take the consent claim to your ethics board specifically — not the study in general, the provider. If the board has declined jurisdiction over the study, this is still the question to put in front of them, because it is the one part that genuinely involves people.
• Ask whether you need one. Singh et al. [21Singh, Sachin Kumar; Ricci, Robert; Gamero-Garrido, Alexander (2025): "Where in the World Are My Trackers? Mapping Web Tracking Flow Across Diverse Geographic Regions", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], measuring web tracking across 23 countries in 2025, rejected residential proxies explicitly — partly because the business is “gray” and may run on compromised IoT devices, partly for measurement reasons — and recruited volunteers instead.
• Note the practical hierarchy: datacentre IPs from a proxy vendor are not residential IPs from the same vendor, and the ethics question is mostly about the second.

Two things to know before you take a vendor's consent claim to a board. No provider publishes an independently auditable consent framework. The closest thing on the market is accreditation by the Ethical Web Data Collection Initiative, whose members include Oxylabs and Decodo — but the accrediting body and the auditor are the same trade association, the audited companies are its paying members, and no audit report, sampling methodology or enrolment evidence is published. Bright Data, NetNut/Alarum and IPRoyal are not members. Vendors' own claims are strong and unverifiable in the same way: Bright Data states that “Residential IP addresses are linked to 100% real people who opted in to the Bright Data network” and, for zones created after 7 July 2026, gates residential access behind human KYC review; Oxylabs describes a self-defined tier system in which “a majority of Oxylabs' proxy network is composed of Tier A+ model proxies” — its top tier, consented and paid — with no published breakdown behind “a majority”.²³⁾ Read those as claims to be assessed, not as findings.

And no published checklist exists for how a board should assess such a claim. A full-text search of the USENIX Security, IEEE S&P and PoPETs ethics guidance on 2026-08-18 returns zero occurrences of “proxy”, “residential” or “VPN” — the three venues whose guidance is detailed enough to have contained one — and nothing was found in the regulatory literature either. That absence is itself the finding, and it matches what researchers report doing: an interview study of sixteen EU internet-measurement researchers found that vendor due diligence is largely delegated to the vendor, and that “researchers reported that formal ethical frameworks and oversight bodies play only a limited role in their decision-making. Many felt that IRBs lacked the technical expertise to identify hidden risks.”²⁴⁾ If you cannot state a defensible basis for the consent claim yourself, nobody downstream of you will.

The moment you ship code to a volunteer's machine, you are back inside the Common Rule and inside the GDPR, and the “not human subjects” shortcut is gone. That is the cost. The benefit is realism no crawl can buy: real profiles, real geography, real network conditions [22Zeber, David; Bird, Sarah; Oliveira, Camila; Rudametkin, Walter; Segall, Ilana; Wolls´en, Fredrik; Lopatka, Martin (2020): "The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing", in: Proceedings of The Web Conference 2020, pp. 167–178. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)].

Singh et al. [21Singh, Sachin Kumar; Ricci, Robert; Gamero-Garrido, Alexander (2025): "Where in the World Are My Trackers? Mapping Web Tracking Flow Across Diverse Geographic Regions", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] is the current worked example, and its ethics section is a good template: volunteers' machines are used only as vantage points with no access to pre-existing data on them; browser instances are isolated from the volunteer's own profile and history; a consent document explains what is recorded and how it is stored; participation is voluntary with withdrawal at any time; volunteers may opt out of individual websites in the target list; the only identifier collected is the IP address, and it is anonymised after analysis. Twenty-two volunteers covered 23 countries.

Note two things a reviewer will ask. First, your country coverage is your volunteers' countries — a volunteer panel is a convenience sample, and the paper says so. Second, running the measurement on someone's own machine means their bandwidth, their electricity and their risk: if the target list contains anything that could get a person in trouble in their jurisdiction, the per-site opt-out is not a nicety.

For infrastructure rather than a bespoke panel, ICLab [3Niaki, Arian Akhavan; Cho, Shinyoung; Weinberg, Zachary; Hoang, Nguyen Phong; Razaghpanah, Abbas; Christin, Nicolas; Gill, Phillipa (2020): "ICLab: A Global, Longitudinal Internet Censorship Measurement Platform", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] is the long-running example of a volunteer-operated measurement platform designed so that the operator's identity is not collected; the same design question — what can the volunteer be blamed for? — governs any deployment of this kind. See also Crawling location for the platforms available and User studies for recruitment, compensation and consent mechanics.

Do not plan around a platform that no longer exists. Checked on 2026-08-18: Mozilla Rally is dead — its GitHub organisation was “archived by an administrator on Jul 29, 2024” and `rally.mozilla.org` now redirects to `mozilla.org`, and we found no shutdown announcement on any Mozilla channel. The Markup's Citizen Browser panel has published nothing since October 2022. AlgorithmWatch's DataSkop shows no activity after its 2022–2023 TikTok campaign and has not been formally closed. Tracking Exposed ended at the start of 2023 and became AI Forensics, which is alive and running algorithmic audits. Neither Prolific nor Mechanical Turk has a policy that squarely addresses installing research software on a participant's own device — Prolific requires you to disclose “anything unusual the participant might have to do, such as downloading software”, and MTurk's acceptable-use policy bans only software “that contains harmful content (e.g., spyware, keyloggers, rootkits, or similar malware)”. That is a gap in both directions: nobody has said yes, and nobody has said no. And MTurk itself is closing to new work: its own site now carries the banner “Amazon Mechanical Turk is no longer accepting new customers. We recommend existing customers migrate to a third-party solution.”²⁵⁾

The one route that got better is regulatory. The EU's DSA Article 40 researcher data access delegated act was adopted on 2 July 2025 and the Data Access Portal is operating: by 19 May 2026 the national Digital Services Coordinators had received 49 applications, mostly for social-media platform data.²⁶⁾ If your target is a very large platform rather than the open web, that is now a real alternative to building a panel — and one with no volunteer to put at risk. Two constraints before you plan around it: the route is only open to vetted researchers, accredited through the Digital Services Coordinator of an EU member state, and it reaches only designated very large platforms and search engines, not the web at large.

Notifying the affected operators is the post-measurement half of research ethics, and it has its own methodology: how to obtain a contact at scale, what response rate to expect, how long to embargo, and what reviewers now require. See Notifying websites.

Two numbers to place it. Of the 4,472 empirical papers carrying an ethics record, 1,636 (36.6%) report notifying affected parties and a further 524 (11.7%) did so partially — so nearly half the field reports something here, against a third that reports a review outcome. Ramulu et al. [2Ramulu, Harshini Sri; Schmitt, Helen; Rerich, Bogdan; Rodriguez, Rachel Gonzalez; Kohno, Tadayoshi; Acar, Yasemin (2025): "Ethics in Computer Security Research: A Data-Driven Assessment of the Past, the Present, and the Possible Future", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] found the same ordering by hand: vulnerability disclosure is the ethical topic security papers discuss most, named in 257 of their 1,154 papers. Contacting a regulator, by contrast, is reported by 147 (3.3%); that route is Legal enforcement.

What to put in the paper. Every item here is something the corpus shows a large share of papers omitting.

1. Which body you asked, its name and kind, and what it said — including “it declined jurisdiction” and including “we have none, so we did X instead”. Not just “IRB approved”.
2. Why the determination is right, in one sentence: what data you collect, from whom, and why it is not identifiable private information.
3. Who can be harmed, by group: operators, end users, third parties in your infrastructure, people named in your results. A stakeholder analysis in the Menlo sense — [18Chehade, Saiid El Hajj; Hantke, Florian; Stock, Ben (2025): "403 Forbidden? Ethically Evaluating Broken Access Control in the Wild", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] is the model.
4. Your load, as a number. Requests per second, per site, per day; total requests; the pause rule on errors.
5. Your robots.txt decision and what it cost your sample.
6. Your terms-of-service and acceptable-use position, and whether your network operations team knew.
7. How you identified the crawler, and how an operator could have made you stop.
8. Any interaction with a side effect: clicks, registrations, submissions, purchases, and their estimated cost.
9. Your vantage point's provenance — and for a residential proxy, the provider, its consent claim, and your board's view of that claim.
10. Data handling: what you collected, what you deleted, when, and who could read it.
11. Disclosure: to whom, when, what came back, and whether you embargoed.
12. Where the data came from, if you did not collect it. Provenance, licence, and — for anything of illicit origin — the reasoning in [17Thomas, Daniel R.; Pastrana, Sergio; Hutchings, Alice; Clayton, Richard; Beresford, Alastair R. (2017): "Ethical issues in research using datasets of illicit origin", in: Proceedings of the ACM Internet Measurement Conference. (DOI)].
13. What you are releasing, and what that enables. Not only “is there personal data in it”: a scanner, an evasion technique or an attack tool is a dual-use release, and the harm question is about the capability, not the dataset.
14. Any generative AI in the pipeline, separately from any in the writing. Which model, what it decided, whether your data left your machine to reach it.
15. What went wrong. An incident reported in the paper — a site you took down, a scan you had to pause — is a stronger ethics section than a clean one, and Hantke et al. [6Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] recommend it explicitly.

If you read three: [2Ramulu, Harshini Sri; Schmitt, Helen; Rerich, Bogdan; Rodriguez, Rachel Gonzalez; Kohno, Tadayoshi; Acar, Yasemin (2025): "Ethics in Computer Security Research: A Data-Driven Assessment of the Past, the Present, and the Possible Future", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] for what the field actually does and why so little of it is written down; [6Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] for the only concrete, empirically grounded checklist this literature has, and for the operators' and ethics committees' own words; and [18Chehade, Saiid El Hajj; Hantke, Florian; Stock, Ben (2025): "403 Forbidden? Ethically Evaluating Broken Access Control in the Wild", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] for a worked stakeholder analysis you can copy the structure of.

Then [17Thomas, Daniel R.; Pastrana, Sergio; Hutchings, Alice; Clayton, Richard; Beresford, Alastair R. (2017): "Ethical issues in research using datasets of illicit origin", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] for the question of working with data you did not collect and might not lawfully hold — the framework there is the one to reach for whenever the dataset came from a leak, a breach or a scrape someone else did; [1Snyder, Peter; Doerfler, Periwinkle; Kanich, Chris; McCoy, Damon (2017): "Fifteen minutes of unwanted fame: detecting and characterizing doxing", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] for the two-sentence cautionary tale about “public” data; [21Singh, Sachin Kumar; Ricci, Robert; Gamero-Garrido, Alexander (2025): "Where in the World Are My Trackers? Mapping Web Tracking Flow Across Diverse Geographic Regions", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] for a current volunteer-panel design done carefully; [23Bowser, Anne; Tsai, Janice Y. (2015): "Supporting Ethical Web Research: A New Research Ethics Review", in: Proceedings of the ACM Web Conference. (DOI)] for an early proposal for a web-specific ethics review, which is worth reading mainly to see how long this gap has been visible; and [16Wu, Mengying; Hong, Geng; Chen, Jinsong; Liu, Qi; Tang, Shujun; Li, Youhao; Liu, Baojun; Duan, Haixin; Yang, Min (2025): "Revealing the Black Box of Device Search Engine: Scanning Assets, Strategies, and Ethical Consideration", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] for what large-scale scanning looks like when nobody applies these norms — a year of honeypot observation of commercial device search engines.

• Notifying websites — the operator-facing channel: contact discovery, response rates, embargoes, control groups.
• Legal enforcement — taking a finding to a regulator, and the regulator opening a file on you.
• Crawling location — vantage points, residential proxies and volunteer devices from the measurement side.
• User studies — once there are participants, the apparatus on this page is the least of it.
• Crawler — where the rate limit and the User-Agent actually get set.
• Consent — interacting with a banner is an interaction.
• Website selection — a robots.txt exclusion is a change to your sampling frame.
• Artifacts — what you can release once the data has people in it.
• Interrater agreement — hired annotators and crowdworkers are participants; 5.1% of the corpus's hand-coding papers use them.

Every corpus figure above comes from scripts/report_ethics.mjs over data/extract/run1 (5,859 papers, 2010–2026). Five limits carry directly:

• Seven venues only. EuroS&P, ACSAC, RAID, AsiaCCS, CHI and SOUPS are absent. CHI and SOUPS in particular are where the human-subjects methodology literature lives, so the picture here understates the field's ethics discourse and reports only what the security and measurement venues put in print.
• “States a review outcome” is a low bar and a proxy. It counts a paper that says a review was not required exactly as it counts one that reports approval. It is a measure of *disclosure*, not of *conduct* — a silent paper may have done everything right, and this page never counts silence as misconduct.
• Sentinels are values, not answers. none-mentioned and an absent ethics record are reported as their own rows everywhere and are never merged into a stated outcome. Merging them is the single easiest way to turn “how often the field reports this” into a much rosier number.
• Posters and short records bias the silence figures upward, because a four-page record has its methodology compressed out. Dropping the 198 posters and ≤4-page records moves the empirical reporting rate from 33.8% to 34.8% and the crawl-only rate from 21.3% to 21.6%. The gap this page is about survives the check.
• Free-text fields are folded, not counted verbatim. ethics.reviewBody and ethics.harmMitigation are unstable strings; the folds, their rules and their full unmapped residue are on the provenance page. The harm-mitigation fold is multi-label by construction.

The complete query log, the report script with its unedited output, both folds with their residue printed in full, every quote with its verification verdict, and every external source with how it was verified are on ethics. Corpus-wide caveats are on Corpus.

[1]

Snyder, Peter; Doerfler, Periwinkle; Kanich, Chris; McCoy, Damon (2017): "Fifteen minutes of unwanted fame: detecting and characterizing doxing", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[2]

Ramulu, Harshini Sri; Schmitt, Helen; Rerich, Bogdan; Rodriguez, Rachel Gonzalez; Kohno, Tadayoshi; Acar, Yasemin (2025): "Ethics in Computer Security Research: A Data-Driven Assessment of the Past, the Present, and the Possible Future", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[3]

Niaki, Arian Akhavan; Cho, Shinyoung; Weinberg, Zachary; Hoang, Nguyen Phong; Razaghpanah, Abbas; Christin, Nicolas; Gill, Phillipa (2020): "ICLab: A Global, Longitudinal Internet Censorship Measurement Platform", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[4]

Raman, Ram Sundara; Shenoy, Prerana; Kohls, Katharina; Ensafi, Roya (2020): "Censored Planet: An Internet-wide, Longitudinal Censorship Observatory", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[5]

Bennett, Nathaniel; Sowards, Rebekah; Deccio, Casey T. (2022): "SPFail: Discovering, Measuring, and Remediating Vulnerabilities in Email Sender Validation", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[6]

Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[7]

Krombholz, Katharina; Mayer, Wilfried; Schmiedecker, Martin; Weippl, Edgar (2017): ""I Have No Idea What I'm Doing" - On the Usability of Deploying HTTPS", in: Proceedings of the USENIX Security Symposium. (Link)

[8]

Kohno, Tadayoshi; Acar, Yasemin; Loh, Wulf (2023): "Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversations", in: Proceedings of the USENIX Security Symposium. (Link)

[9]

Zhang, Qing; Wang, David Y.; Voelker, Geoffrey M. (2014): "DSpin: Detecting Automatically Spun Content on the Web", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[10]

Bashir, Muhammad Ahmad; Arshad, Sajjad; Robertson, William; Wilson, Christo (2016): "Tracing information flows between ad exchanges using retargeted ads", in: 25th USENIX Security Symposium (USENIX Security 16), pp. 481-496. (Link)

[11]

Almansoori, Majed; Gallardo, Andrea; Poveda, Julio; Ahmed, Adil; Chatterjee, Rahul (2022): "A Global Survey of Android Dual-Use Applications Used in Intimate Partner Surveillance", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[12]

Zeng, Eric; Wei, Miranda; Gregersen, Theo; Kohno, Tadayoshi; Roesner, Franziska (2021): "Polls, Clickbait, and Commemorative \$2 Bills: Problematic Political Advertising on News and Media Websites Around the 2020 U.S. Elections", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[13]

Amos, Ryan; Acar, Gunes; Lucherini, Eli; Kshirsagar, Mihir; Narayanan, Arvind; Mayer, Jonathan (2021): "Privacy Policies over Time: Curation and Analysis of a Million-Document Dataset", in: Proceedings of the Web Conference 2021, pp. 2165–2176. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[14]

Datta, Amit; Tschantz, Michael Carl; Datta, Anupam (2015): "Automated Experiments on Ad Privacy Settings", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[15]

Subramani, Karthika; Yuan, Xingzi; Setayeshfar, Omid; Vadrevu, Phani; Lee, Kyu Hyung; Perdisci, Roberto (2020): "When Push Comes to Ads: Measuring the Rise of (Malicious) Push Advertising", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[16]

Wu, Mengying; Hong, Geng; Chen, Jinsong; Liu, Qi; Tang, Shujun; Li, Youhao; Liu, Baojun; Duan, Haixin; Yang, Min (2025): "Revealing the Black Box of Device Search Engine: Scanning Assets, Strategies, and Ethical Consideration", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[17]

Thomas, Daniel R.; Pastrana, Sergio; Hutchings, Alice; Clayton, Richard; Beresford, Alastair R. (2017): "Ethical issues in research using datasets of illicit origin", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[18]

Chehade, Saiid El Hajj; Hantke, Florian; Stock, Ben (2025): "403 Forbidden? Ethically Evaluating Broken Access Control in the Wild", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[19]

Mi, Xianghang; Feng, Xuan; Liao, Xiaojing; Liu, Baojun; Wang, XiaoFeng; Qian, Feng; Li, Zhou; Alrwais, Sumayah A.; Sun, Limin; Liu, Ying (2019): "Resident Evil: Understanding Residential IP Proxy as a Dark Service", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[20]

Mi, Xianghang; Tang, Siyuan; Li, Zhengyi; Liao, Xiaojing; Qian, Feng; Wang, XiaoFeng (2021): "Your Phone is My Proxy: Detecting and Understanding Mobile Proxy Networks", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[21]

Singh, Sachin Kumar; Ricci, Robert; Gamero-Garrido, Alexander (2025): "Where in the World Are My Trackers? Mapping Web Tracking Flow Across Diverse Geographic Regions", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[22]

Zeber, David; Bird, Sarah; Oliveira, Camila; Rudametkin, Walter; Segall, Ilana; Wolls´en, Fredrik; Lopatka, Martin (2020): "The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing", in: Proceedings of The Web Conference 2020, pp. 167–178. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[23]

Bowser, Anne; Tsai, Janice Y. (2015): "Supporting Ethical Web Research: A New Research Ethics Review", in: Proceedings of the ACM Web Conference. (DOI)