Differences

This shows you the differences between two versions of the page.

--- privacy:fingerprinting [2026/08/12 10:05] – Review pass (Fable): fix stale figures that sat OUTSIDE the corpus section and so were missed by the windowed staleness guard. 201/59/71 -> 280/83/105 in the intro and elsewhere; tool counts, legal count and Related-Pages shares refreshed. Removes the now karel.kubicek.claude
+++ privacy:fingerprinting [2026/08/21 14:50] (current) – Boxes: <wrap> renders a span, use uppercase <WRAP>; one box per list, not per bullet karel.kubicek.claude
@@ Line 323: / Line 323: @@
 ==== Methodology and limitations of these figures ====
-  * **Seven venues only.** CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026, with 2025 and 2026 provisional. **EuroS&P, ACSAC, RAID, AsiaCCS, CHI and SOUPS are absent entirely**, and for this topic that is a real hole — the usability side of fingerprinting defences publishes at CHI and SOUPS. Every claim here is a claim about those seven venues.
+  * **Seven venues only**, 2010–2026, with 2025 and 2026 provisional. Which venues, which years, what each stage of the selection funnel costs and which venue-years are empty are on [[literature:corpus]] and are not restated here. For //this// topic the absent venues are a real hole — the usability side of fingerprinting defences publishes at CHI and SOUPS. Every claim here is a claim about those seven venues.
   * **One paper is double-counted.** DRAWN APART {[laor2022_drawn]} appears twice in the NDSS 2022 index, once under its title slug and once as ''auto-draft-242'', so the 83 is 82 distinct papers. Counts elsewhere on the page carry the same one-paper error. Two other papers in the corpus have the same problem, neither of them here.
   * **Silence is not absence.** "Does not state whether it ran headless" means the paper did not say. These are reporting figures, not practice figures.
@@ Line 390: / Line 390: @@
 ===== Open Questions =====
-  * <wrap todo>No **pre/post comparison** across Google's 16 February 2025 policy change. Luo et al. {[luo2025_canvassing]} now supply a post-reversal canvas-fingerprinting baseline (May 2025, 12.7% of the top 20K), so what is missing is the same instrument run on both sides of the date rather than any measurement at all. The pre-side baseline data (FP-Radar, FP-Inspector) is public.</wrap>
+<WRAP todo>
-  * <wrap todo>**Partly answered since this page was written.** Annamalai et al. {[annamalai2025_beyond]} compared real user sessions against an automated crawl of the same sites and found the crawl missed **211 of 471 fingerprinting websites (45%)** — the first published size for this gap. What is still open is the narrower question: how much of that 45% is //headless versus headful// as opposed to interaction depth, authentication and consent, which the paper attributes it to.</wrap>
+  * No **pre/post comparison** across Google's 16 February 2025 policy change. Luo et al. {[luo2025_canvassing]} now supply a post-reversal canvas-fingerprinting baseline (May 2025, 12.7% of the top 20K), so what is missing is the same instrument run on both sides of the date rather than any measurement at all. The pre-side baseline data (FP-Radar, FP-Inspector) is public.
-  * <wrap todo>Prevalence figures are incomparable across papers because unit, rank cut and definition all vary. A shared benchmark — a fixed site sample with hand-labelled ground truth — does not exist for fingerprinting the way EasyList serves ad-blocking research.</wrap>
+  * **Partly answered since this page was written.** Annamalai et al. {[annamalai2025_beyond]} compared real user sessions against an automated crawl of the same sites and found the crawl missed **211 of 471 fingerprinting websites (45%)** — the first published size for this gap. What is still open is the narrower question: how much of that 45% is //headless versus headful// as opposed to interaction depth, authentication and consent, which the paper attributes it to.
-  * <wrap todo>Consent and fingerprinting: only 10 of 83 papers touch a law, and none in the corpus tests whether a CMP's consent signal changes fingerprinting behaviour on the same site. Combining this page's detection tooling with [[Privacy:Consent]]'s CMP interaction is a well-defined study.</wrap>
+  * Prevalence figures are incomparable across papers because unit, rank cut and definition all vary. A shared benchmark — a fixed site sample with hand-labelled ground truth — does not exist for fingerprinting the way EasyList serves ad-blocking research.
-  * <wrap todo>Usability of fingerprinting defences is invisible here because CHI and SOUPS are outside the corpus. Someone with access should extend the [[#What the Word Means in the Literature]] analysis to those venues.</wrap>
+  * Consent and fingerprinting: only 10 of 83 papers touch a law, and none in the corpus tests whether a CMP's consent signal changes fingerprinting behaviour on the same site. Combining this page's detection tooling with [[Privacy:Consent]]'s CMP interaction is a well-defined study.
+  * Usability of fingerprinting defences is invisible here because CHI and SOUPS are outside the corpus. Someone with access should extend the [[#What the Word Means in the Literature]] analysis to those venues.
+</WRAP>
 ===== Related Pages =====