You want to know how many sites in your sample ask the visitor how old they are. The literature will not tell you, and this page is mostly about why, and about what you have to build and write down yourself.

Of the 5,855 papers in the publication corpus whose full text is on disk, 38 contain any of the phrases age verification, age assurance, age gate, age estimation or age check at all. Reading all 38: one has age assurance as its research question, four more measure it in a section, six hit it as an obstacle to a measurement about something else, and the rest are background, regulation text or a de-columning artefact. One of the five is about the web; the other four are about Android and iOS apps.

Meanwhile the UK requires “highly effective age assurance” on pornography services since July 2025, the European Commission has shipped a reference age-verification app and told Member States to deploy it by the end of 2026, the US Supreme Court upheld the Texas age-verification statute in June 2025, and Google Play has been returning per-jurisdiction age signals to Android apps since March 2026. The deployment surface is moving several years ahead of the published measurement, and if you are reading this because you want to measure it, you are not late — you are early.

The single biggest source of incomparable numbers here is that the term spans a range from a button to a government identity credential. The ordering below is the one the field and the regulators both use — cost to the subject, and resistance to a determined minor, rise together.

Three consequences for a measurement:

• The first three are the ones that exist at scale, and the last five are the ones that regulators call age assurance. Ofcom's January 2025 guidance names “open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation” as capable of being highly effective, and states that “methods including self-declaration of age and online payments which don't require a person to be 18 are not highly effective”.¹⁾ A 2019 prevalence figure for “sites with an age gate” is therefore a figure for a category the current rules explicitly exclude. Do not present it as a compliance rate.
• The last row is invisible to a network measurement. Apple ships a DeclaredAgeRange framework in iOS, iPadOS and macOS 26.0 that hands an app an age range without a server ever seeing a request.²⁾ Google Play's Age Signals API “started returning age signals for users in Brazil” on 17 March 2026 and for Texas accounts created after 28 May 2026.³⁾ On the web the equivalent is the W3C Digital Credentials API: Chrome has had presentation support in origin trial since Chrome 141 and lists issuance support against Chrome 155, with Chrome 153 the stable release on 8 September 2026.⁴⁾ A crawler that instruments navigator.credentials.get can see that one; nothing on the network sees the two mobile ones.
• The privacy properties differ as much as the strength does. A PoPETs 2026 framework paper working through digital identification systems gives age verification as its worked example of unlinkability — “An age verification app generates one-time use credentials so that a user's sessions can not be linked” [1Woodruff, Allison; Balfanz, Dirk; Drewry, Will; Raykova, Mariana (2026): "A Risk Assessment Framework for Digital Identification Systems", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — which is what the EU blueprint is building and what a document upload is not. If you are classifying mechanisms, classify them on what the verifier learns and what the issuer learns, not only on how hard they are to fool.
• Nobody has measured the mix. The one paper that classified mechanisms at scale did it on Android, not the web, and it is from 2025.

There is no enum in the extraction schema for age assurance, so the population is a full-text probe followed by a hand audit of every candidate. The probe is deliberately phrase-level, and its width matters: an earlier version without a word boundary before age matched voltage signal and image signal and returned a candidate set of 233 papers, nine tenths of it electromagnetic side-channel work.

That gives 5 papers out of the 38 candidates — 13.2% precision, and 0.1% of the corpus. Two of them are inside the 1,120 papers that ran a crawl.

Read these as five separate studies of five different populations, not as a series.

• 3.67% of adult-only Android apps implement any age verification at all — 1,165 of 31,750 apps carrying Google Play's “17+” tag, themselves drawn from 693,334 apps [2Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)]. Of the 1,165, the weakest mechanism is the most common: the age gate is “the most widely implemented method (31.84%)”, and biometric verification “the least utilized (8.48%)”. The store rating is not the age the app enforces either: “Despite being rated as 17+, 152 apps actually enforce an age limit of 21 years”, and 309 set it at 16.
• 20% of pornographic websites showed any age-verification mechanism in 2019, measured from vantage points in the USA, the UK and Spain, and 14% from Russia [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]. The mechanism was a warning and a button, and the paper's own assessment of it is the sentence to quote in your related work: “if our automatic crawler manages to bypass the mechanism, a child could do it as well”.
• Deployment is conditioned on where you appear to be, and not monotonically. In the same study, 8% of the sites that did not verify from the other vantage points did verify from Russia, and 12% verified everywhere except Russia [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]. A single-vantage crawl gets neither number.
• A deployed facial age-estimation model is not uniformly accurate. Extracting the local vision models from the TikTok and Instagram Android apps, “we evaluate the effectiveness of age verification. We find that age verification, if done using the model deployed by TikTok, is less effective for younger demographics” [4West, Jack; Thiemt, Lea; Ahmed, Shimaa; Bartig, Maggie; Fawaz, Kassem; Banerjee, Suman (2024): "A Picture is Worth 500 Labels: A Case Study of Demographic Disparities in Local Machine Learning Models for Instagram and TikTok", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]. This is the only paper in the corpus that measures how well an age-assurance mechanism works, as opposed to whether it is present.
• Self-report is not deployment. 16% of 50 surveyed child-directed-app developers said they use age gates to obtain parental consent, and 6% said their own gate could be “trivially bypassed by providing a birth year” — and when the same authors tested those organisations' apps from Californian IP addresses they “did not observe any mechanisms for obtaining verifiable parental consent” at all [5Alomar, Noura; Egelman, Serge (2022): "Developers Say the Darnedest Things: Privacy Compliance Processes Followed by Developers of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. If your design is a developer survey, you need the crawl too.
• Where a measurement did classify mechanisms, it found many. 137 expert-approved children's apps used “a total of 13 different methods” for age assurance, most commonly asking for a year of birth (12 apps) [6Ekambaranathan, Anirudh; Zhao, Jun; Van Kleek, Max (2022): "Poster: An Analysis of Privacy Features in 'Expert-Approved' Kids' Apps", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]. A poster, n=137 — but it is the only mechanism taxonomy derived from observation rather than from regulation.

Candidates by year, with the verdict split. The point of the table is the last two columns, not the first.

* 2025 and 2026 are provisional venue-years: CCS 2026 and IMC 2026 have not been held, and IEEE S&P and WWW 2026 abstracts are not in the selection source. See Corpus.

PoPETs carries 17 of the 38 candidates and every other venue is in single figures. The shape worth noticing is that the mentions are growing and the measurements are not: 17 of the 38 candidates are from 2025–2026, and one of them measures anything.

Six of the 38 papers are not about age assurance at all. They ran into it. This is currently the most common way age assurance appears in the corpus, it is the thing least likely to be in anyone's related-work section, and it is probably why your own crawl will care.

• It removes categories from your population. An app-store study across Google Play and the App Store reports that “some potentially interesting app categories, such as dating apps, require age verification to install them. We could not provide any of the available verification measures at the required scale” [7Breuer, David; Becker, Lucas; Hollick, Matthias (2026): "Ad Personalization and Transparency in Mobile Ecosystems: A Comparative Analysis of Google's and Apple's EU App Stores", Proceedings on Privacy Enhancing Technologies 2026(1):604-630. (DOI)]. That is a sampling frame silently cut down by a deployment decision.
• It stops the crawler before the thing you wanted to measure. A large-scale SSO study lists the artefacts that prevented its crawler from finding a login page: “These include age-verification prompts from adult websites” and sales banners, “which often must be dismissed before any other interaction is possible” [8Ardi, Calvin; Calder, Matt (2023): "The Prevalence of Single Sign-On on the Web: Towards the Next Generation of Web Content Measurement", in: Proceedings of the ACM Internet Measurement Conference. (DOI)].
• It hides the content you are counting. An iOS automation study interacting with children's apps by hand found that in “seven out of 20 apps, we observed at least one ad, typically after bypassing challenging flows such as parental gates”, age verification or gameplay progression [9Moti, Zahra; Janssen-Groesbeek, Tom; Monteiro, Steven; Continella, Andrea; Acar, Gunes (2025): "WhisperTest: A Voice-Control-based Library for iOS UI Automation", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]. An automated crawl that stops at the gate reports zero ads for those apps.
• It becomes a research-conduct decision. A YouTube advertising study verified its own experiment accounts: “we used a mobile VPN and selfie verification in Australia, Ireland, and the UK, while in the US and Canada, it was enough to confirm the age by clicking on a button” [10Mai, Cat; Coelho, Bruno; Kieserman, Julia; Matsumoto, Lexie; Spinelli, Kyle; Yang, Eric; Andreou, Athanasios; Greenstadt, Rachel; Lauinger, Tobias; McCoy, Damon (2025): "More and Scammier Ads: The Perils of YouTube's Ad Privacy Settings", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. Those researchers submitted real faces to a platform to obtain an experimental condition, and the requirement varied by country.
• It is chosen around. A study of AI “nudification” services collected its data “from a region in the U.S. that does not have an age verification law for explicit content” [11Gibson, Cassidy; Olszewski, Daniel; Brigham, Natalie Grace; Crowder, Anna; Butler, Kevin R. B.; Traynor, Patrick; Redmiles, Elissa M.; Kohno, Tadayoshi (2025): "Analyzing the AI Nudification Application Ecosystem", in: Proceedings of the USENIX Security Symposium. (Link)], and required its own researchers to be over 18 where such a law applied.
• It is excluded from adjacent datasets by construction. The closest thing to a web-forms census of age screening says explicitly that “Many websites use standalone age verification forms that only ask for age but no other identifiers. These web forms are not included in the dataset” [12Cui, Hao; Trimananda, Rahmadi; Markopoulou, Athina (2025): "Understanding Privacy Norms through Web Forms", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. A study of what web forms collect cannot be cited as evidence about age screening.

Only two published methods exist, they are six years apart, and they work on different platforms. Both are worth reading before you write a third.

Neither is a general detector, and the gaps are where the work is:

• The gate is not an HTTP status. It is a DOM overlay served with a 200, exactly like the block pages Blocking and geodifference deals with, and the same three habits apply: record the status, the final URL, the body hash and the first couple of kilobytes of every response, so a later pass can find the interstitial you did not know to look for.
• It can be a redirect chain instead. Some deployments send the visitor to a separate verification origin and back. If your pipeline keeps only the final URL, the hop is the only trace, and if it keeps only the initial URL the gate is invisible.
• It sets state before consent. A gate that remembers you clicked “I am 18” is a cookie or a localStorage entry written before any consent interaction, and often on the first load. It is therefore a confounder for Consent and for anything in Cookies that counts pre-consent storage — and, separately, a signal you can detect: a first-party cookie written at the moment an overlay was dismissed.
• It defeats stateless crawling. Stateful and stateless crawls disagree here by construction, because the whole point of the gate's cookie is to not show it twice; see Stateful stateless.
• Language. The 2019 keyword list is English. Any prevalence claim over a multilingual sample inherits the language coverage of its keyword list, which is the problem Multilingual support is about.

“Sites with an age gate” is not a quantity. Three things have to be fixed before it becomes one, and the corpus shows what happens when they are not.

1. Which population. The two web-side figures that exist are over 6,843 self-identified pornographic websites [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] and over an app store's “17+” tag [2Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)]. Neither is a sample of the web, and neither generalises to a Tranco slice. If your population is a ranking list, say what fraction of it could plausibly be in scope of any age rule at all — most of it cannot — or your denominator will swamp your numerator.
2. Which jurisdiction you appeared to be in. Not where your VPS is: where the site thought you were. The 20%-vs-14% and the 8%/12% asymmetry in [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] are the whole finding, and they come from re-running the same crawl from six vantage points. Since 2025 this has become sharper, not softer: the UK duty applies to services likely to be accessed by UK children, Texas's statute to Texas visitors, and Google Play returns age signals for Brazil and for Texas accounts specifically. Read Crawling location before choosing, and verify the vantage rather than assuming it.
3. What you counted as a gate. Per the table at the top of this page, a click-through and a document upload are both “an age gate” in ordinary speech and are different measurements. Publish the mechanism breakdown or publish a rule, and expect a reviewer to ask which of the eight rows you included.

One more denominator trap, specific to this topic: the app-store rating is not the gate. A “17+” or PEGI rating is a self-declared label about content, not a mechanism that checks anybody. Two papers measure the label rather than the gate — a 2013 comparison of Android and iOS maturity ratings found them inconsistent with the platforms' own policies [13Chen, Ying; Xu, Heng; Zhou, Yilu; Zhu, Sencun (2013): "Is This App Safe for Children? A Comparison Study of Maturity Ratings on Android and iOS Applications", in: Proceedings of the ACM Web Conference. (DOI)], and a 2023 study collected 11,270 ad views across 25,000 apps and identified 1,289 ad violations from 775 apps, “with roughly half of the app promotions not in compliance with host apps' content ratings” [14Zhao, Yanjie; Liu, Tianming; Wang, Haoyu; Liu, Yepang; Grundy, John; Li, Li (2023): "Are Mobile Advertisements in Compliance with App's Age Group?", in: Proceedings of the ACM Web Conference. (DOI)]. Useful work; not age assurance.

Ethics covers the ordinary web-measurement case: crawl politely, do not harm the site, get the review, consider the people behind the data. None of that answers the four questions this topic raises, and a methods section that cites a generic IRB approval has not addressed them.

This is a real gap on this wiki. Ethics should grow a section on it, and until it does, treat the four bullets above as the checklist a reviewer will apply.

Most of the literature a search for “age” returns is not about age assurance. It is about whether services aimed at children handle data lawfully — COPPA in the US, the GDPR's Article 8 and the age-appropriate design codes in Europe. 36 papers in the corpus name COPPA in their legal assessment, out of the 402 that assessed any law at all; exactly one of those 36 is also in the age-assurance population above.

The distinction is worth stating in your own paper, because reviewers conflate them:

• Age assurance asks does the service establish how old this visitor is. The unit is a mechanism. The denominator is services in scope of an age rule.
• Children's-privacy compliance asks given that this service is for children, what does it do with their data. The unit is a data flow. The denominator is child-directed services, and establishing that a service is child-directed is itself a classification problem with its own ground truth.

That second denominator is where the methodological interest is, and the corpus has four good constructions of it:

• The platform's own programme. [15Reyes, Irwin; Wijesekera, Primal; Reardon, Joel; Elazari Bar On, Amit; Razaghpanah, Abbas; Vallina-Rodriguez, Narseo; Egelman, Serge (2018): "“Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale", in: Proceedings on Privacy Enhancing Technologies. (DOI)] analysed 5,855 Android apps enrolled in Google Play's Designed for Families programme — apps that had agreed to COPPA compliance as a condition of listing — and observed 235 of them (4.0%) actually reaching GPS coordinates, with 28% touching permission-protected sensitive data. The denominator is exact and checkable, and it is emphatically not “children's apps”.
• A trained classifier over a general crawl. [16Moti, Zahra; Senol, Asuman; Bostani, Hamid; Zuiderveen Borgesius, Frederik J.; Moonsamy, Veelasha; Mathur, Arunesh; Acar, Gunes (2024): "Targeted and Troublesome: Tracking and Advertising on Children's Websites", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] fine-tuned a multilingual model on page <title> and <description> metadata, ran it over Common Crawl, and hand-verified 2,004 child-directed websites in 48 languages; crawling them from five vantage points, about 90% embedded at least one tracker and about 27% carried targeted advertising.
• Store metadata plus a rating scheme. [17Sun, Ruoxi; Xue, Minhui; Tyson, Gareth; Wang, Shuo; Camtepe, Seyit; Nepal, Surya (2023): "Not Seen, Not Heard in the Digital World! Measuring Privacy Practices in Children's Apps", in: Proceedings of the ACM Web Conference. (DOI)] and [18Alomar, Noura; Reardon, Joel; Girish, Aniketh; Vallina-Rodriguez, Narseo; Egelman, Serge (2025): "The Effect of Platform Policies on App Privacy Compliance: A Study of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)] key on store categories, PEGI and Teacher Approved badges — cheap, and it inherits the label's error, which is the thing [13Chen, Ying; Xu, Heng; Zhou, Yilu; Zhu, Sencun (2013): "Is This App Safe for Children? A Comparison Study of Maturity Ratings on Android and iOS Applications", in: Proceedings of the ACM Web Conference. (DOI)] measured and found unreliable.
• The service's own age-tiered accounts. [19Figueira, Olivia; Trimananda, Rahmadi; Markopoulou, Athina; Jordan, Scott (2024): "DiffAudit: Auditing Privacy Practices of Online Services for Children and Adolescents", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] audits what an online service sends when the account is registered as a child versus an adolescent versus an adult — a differential design that needs no child-directedness classifier at all, because the service's own age tier is the treatment.

Also here: [20Medjkoune, Tinhinane; Goga, Oana; Senechal, Juliette (2023): "Marketing to Children Through Online Targeted Advertising: Targeting Mechanisms and Legal Aspects", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] on ad targeting that reaches children, and [18Alomar, Noura; Reardon, Joel; Girish, Aniketh; Vallina-Rodriguez, Narseo; Egelman, Serge (2025): "The Effect of Platform Policies on App Privacy Compliance: A Study of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)] on what changed when the platforms tightened their policies. If you are writing about children's privacy rather than about age gates, start from those and from Mobile and app measurement, because two thirds of this literature is Android.

Given how fast this is moving, everything below is stated with the date it was verified rather than in the present tense. None of it is a finding; it is the reason the measurement gap matters.

The measurement consequence of the whole table is one sentence: since 2025, the same URL fetched from two countries is two different experiments, and since March 2026 the same Android app on two devices may be as well.

A reviewer should be able to reconstruct your gate count from the methods section alone. That needs:

1. The population, and why it is in scope of any age rule. Not “the Tranco top 10k” — say what fraction of it plausibly hosts age-restricted content and how you decided.
2. Which of the eight mechanisms you counted, and the rule that separates a gate from a cookie banner, a paywall and a login wall. All four are dismissable overlays.
3. Your vantage points, plural, and the verification that each one presented as the country you intended — Crawling location has the methods.
4. Statefulness. Whether the crawler carried the gate's own cookie between loads, and what it did to your counts.
5. The detector's recall, measured against a hand-labelled sample. Both published detectors are keyword- or taint-based and neither reports recall on an independent sample; be the first.
6. What you did at the gate — clicked through, entered a date, or stopped — stated as an experimental condition in the same way Consent treats the banner. “We crawled the landing page” is the no-interaction condition, not the post-gate web.
7. The ethics decisions in the four bullets above, individually, not as “our institution approved this”.

Every corpus figure on this page comes from scripts/report_age_assurance.mjs, which prints the probe, the hand verdict for all 38 candidates, and a verbatim-quote check of every per-paper number against the source PDFs. The script, its unedited output, the full verdict map, the discarded probe variants and the external sources that were rejected are on age_assurance. Corpus-level caveats — venue scope, the selection funnel, the provisional 2025–2026 years, extraction stability — are on Corpus.

Five limitations belong on the page itself:

1. Five papers is not a literature. Every number in the What has actually been measured section is a single study's result about a single population, and none of them has been replicated. Treat them as existence proofs and as related work, not as base rates.
2. The candidate set is a phrase probe, so it under-recalls by construction. A paper that measured age gates without ever using any of the five phrases is invisible to it. Widening the probe to mechanism words — date of birth, identity verification, facial age, parental gate — added no new measurement papers, but that is a bounded negative, not a proof.
3. The corpus is seven venues. CCS, IMC, NDSS, PoPETs, USENIX Security, TheWebConf and IEEE S&P, 2010–2026. Age assurance is published heavily at CHI, SOUPS, ACM FAccT and in law reviews, and none of those is in the corpus. The absence measured here is an absence from the security and measurement venues, which is the claim worth making and the only one supported.
4. The regulatory table is not a legal analysis and is not exhaustive. It names, for each row, one primary source read on 2026-09-15.
5. One candidate was judged from its title and summary only, because its full text is not in the mount; it is named on the provenance page.

1. [2Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)] — the only paper whose research question is age assurance. Read §2.2 for the mechanism taxonomy and §7 for the bypasses.
2. [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — §7.2 is the web case, the multi-vantage design, and the honest assessment of what the detector could and could not see.
3. [4West, Jack; Thiemt, Lea; Ahmed, Shimaa; Bartig, Maggie; Fawaz, Kassem; Banerjee, Suman (2024): "A Picture is Worth 500 Labels: A Case Study of Demographic Disparities in Local Machine Learning Models for Instagram and TikTok", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] — the only measurement of whether a deployed mechanism works, and a clean template for the ethics of measuring an age model without measuring children.
4. [5Alomar, Noura; Egelman, Serge (2022): "Developers Say the Darnedest Things: Privacy Compliance Processes Followed by Developers of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — read it for the self-report-versus-observation gap, which will bite any survey design here.
5. [15Reyes, Irwin; Wijesekera, Primal; Reardon, Joel; Elazari Bar On, Amit; Razaghpanah, Abbas; Vallina-Rodriguez, Narseo; Egelman, Serge (2018): "“Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — the reference construction for a children's-privacy denominator, and the paper most of the 11 title-probe candidates turned out to be about.

[1]

Woodruff, Allison; Balfanz, Dirk; Drewry, Will; Raykova, Mariana (2026): "A Risk Assessment Framework for Digital Identification Systems", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[2]

Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)

[3]

Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[4]

West, Jack; Thiemt, Lea; Ahmed, Shimaa; Bartig, Maggie; Fawaz, Kassem; Banerjee, Suman (2024): "A Picture is Worth 500 Labels: A Case Study of Demographic Disparities in Local Machine Learning Models for Instagram and TikTok", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[5]

Alomar, Noura; Egelman, Serge (2022): "Developers Say the Darnedest Things: Privacy Compliance Processes Followed by Developers of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[6]

Ekambaranathan, Anirudh; Zhao, Jun; Van Kleek, Max (2022): "Poster: An Analysis of Privacy Features in 'Expert-Approved' Kids' Apps", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[7]

Breuer, David; Becker, Lucas; Hollick, Matthias (2026): "Ad Personalization and Transparency in Mobile Ecosystems: A Comparative Analysis of Google's and Apple's EU App Stores", Proceedings on Privacy Enhancing Technologies 2026(1):604-630. (DOI)

[8]

Ardi, Calvin; Calder, Matt (2023): "The Prevalence of Single Sign-On on the Web: Towards the Next Generation of Web Content Measurement", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[9]

Moti, Zahra; Janssen-Groesbeek, Tom; Monteiro, Steven; Continella, Andrea; Acar, Gunes (2025): "WhisperTest: A Voice-Control-based Library for iOS UI Automation", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[10]

Mai, Cat; Coelho, Bruno; Kieserman, Julia; Matsumoto, Lexie; Spinelli, Kyle; Yang, Eric; Andreou, Athanasios; Greenstadt, Rachel; Lauinger, Tobias; McCoy, Damon (2025): "More and Scammier Ads: The Perils of YouTube's Ad Privacy Settings", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[11]

Gibson, Cassidy; Olszewski, Daniel; Brigham, Natalie Grace; Crowder, Anna; Butler, Kevin R. B.; Traynor, Patrick; Redmiles, Elissa M.; Kohno, Tadayoshi (2025): "Analyzing the AI Nudification Application Ecosystem", in: Proceedings of the USENIX Security Symposium. (Link)

[12]

Cui, Hao; Trimananda, Rahmadi; Markopoulou, Athina (2025): "Understanding Privacy Norms through Web Forms", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[13]

Chen, Ying; Xu, Heng; Zhou, Yilu; Zhu, Sencun (2013): "Is This App Safe for Children? A Comparison Study of Maturity Ratings on Android and iOS Applications", in: Proceedings of the ACM Web Conference. (DOI)

[14]

Zhao, Yanjie; Liu, Tianming; Wang, Haoyu; Liu, Yepang; Grundy, John; Li, Li (2023): "Are Mobile Advertisements in Compliance with App's Age Group?", in: Proceedings of the ACM Web Conference. (DOI)

[15]

Reyes, Irwin; Wijesekera, Primal; Reardon, Joel; Elazari Bar On, Amit; Razaghpanah, Abbas; Vallina-Rodriguez, Narseo; Egelman, Serge (2018): "“Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[16]

Moti, Zahra; Senol, Asuman; Bostani, Hamid; Zuiderveen Borgesius, Frederik J.; Moonsamy, Veelasha; Mathur, Arunesh; Acar, Gunes (2024): "Targeted and Troublesome: Tracking and Advertising on Children's Websites", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[17]

Sun, Ruoxi; Xue, Minhui; Tyson, Gareth; Wang, Shuo; Camtepe, Seyit; Nepal, Surya (2023): "Not Seen, Not Heard in the Digital World! Measuring Privacy Practices in Children's Apps", in: Proceedings of the ACM Web Conference. (DOI)

[18]

Alomar, Noura; Reardon, Joel; Girish, Aniketh; Vallina-Rodriguez, Narseo; Egelman, Serge (2025): "The Effect of Platform Policies on App Privacy Compliance: A Study of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[19]

Figueira, Olivia; Trimananda, Rahmadi; Markopoulou, Athina; Jordan, Scott (2024): "DiffAudit: Auditing Privacy Practices of Online Services for Children and Adolescents", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[20]

Medjkoune, Tinhinane; Goga, Oana; Senechal, Juliette (2023): "Marketing to Children Through Online Targeted Advertising: Targeting Mechanisms and Legal Aspects", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)