| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| privacy:fingerprinting [2026/09/03 03:33] – Fable generic review (step 9): fix refuted consent open question (Papadogiannakis 2021 ran it: 27,180 CMP sites, 279/285/330 by consent action); attribute the crawl-gap size to FP-Fed's top-300 pilot as well as Annamalai 2025; date the measurement surface karel.kubicek.claude | privacy:fingerprinting [2026/09/21 13:30] (current) – Spot-check bullet: quote_check.mjs now falls back to a pypdf rendering; 544 quotes = 312 exact / 140 partial / 50 rescued / 42 below in both. Authored by Claude karel.kubicek.claude |
|---|
| ==== Legal framing is rare ==== | ==== Legal framing is rare ==== |
| |
| Only **10 of 83** papers (12.0%) assess a law, against 6.9% corpus-wide (402 of 5,859) — so not quite twice the corpus rate, and still an outlier practice. Folded, the laws are GDPR (9 papers) and the ePrivacy Directive (4 papers, appearing under three different spellings including "European directives 2002/58/CE and 2009/136/CE"), then CCPA (3), plus one each of the UK Digital Economy Act, Brazil's LGPD, COPPA and the DSA. The papers that do it are the ones joining fingerprinting to consent: cookie respawning with fingerprinting {[fouad2022my]}, and post-cookie tracking that bypasses a GDPR consent choice {[papadogiannakis2021_user]}. | Only **10 of 83** papers (12.0%) assess a law, against 6.9% corpus-wide (402 of 5,859) — so not quite twice the corpus rate, and still an outlier practice. Folded, the laws are GDPR (9 papers) and the ePrivacy Directive (4 papers, appearing under three different spellings including "European directives 2002/58/CE and 2009/136/CE"), then CCPA (3), plus one each of the UK Digital Economy Act, Brazil's LGPD, COPPA and the DSA. The papers that do it are the ones joining fingerprinting to consent: cookie respawning with fingerprinting {[fouad2022_cookie]}, and post-cookie tracking that bypasses a GDPR consent choice {[papadogiannakis2021_user]}. |
| |
| This is a gap, not a finding about the law. Fingerprinting has no consent API, so the compliance question — can a technique that cannot be refused ever rest on consent? — is squarely open, and became sharper in 2025 (see below). See [[Privacy:Consent]] and [[Practices:Legal enforcement]]. | This is a gap, not a finding about the law. Fingerprinting has no consent API, so the compliance question — can a technique that cannot be refused ever rest on consent? — is squarely open, and became sharper in 2025 (see below). See [[Privacy:Consent]] and [[Practices:Legal enforcement]]. |
| * **Field stability.** Enum fields (''platforms'', ''crawlConfig.*'', ''legal.law'') reproduce to within a few points on a repeat extraction and carry percentages here. ''detection.phenomenon'' does not, which is what the whole folding exercise is for — the family table is a set of rankings with an honest residue, not a measurement. | * **Field stability.** Enum fields (''platforms'', ''crawlConfig.*'', ''legal.law'') reproduce to within a few points on a repeat extraction and carry percentages here. ''detection.phenomenon'' does not, which is what the whole folding exercise is for — the family table is a set of rankings with an honest residue, not a measurement. |
| * **The 83 is a floor.** A paper that studies fingerprinting without the extractor recording a fingerprint-named phenomenon is missing from it. 103 further papers name a fingerprint only in the ''technique'' field and were deliberately excluded, since "we detected X by fingerprinting the TLS stack" is a paper about X. | * **The 83 is a floor.** A paper that studies fingerprinting without the extractor recording a fingerprint-named phenomenon is missing from it. 103 further papers name a fingerprint only in the ''technique'' field and were deliberately excluded, since "we detected X by fingerprinting the TLS stack" is a paper about X. |
| * **Quotes were spot-checked.** ''%%scripts/quote_check.mjs --detection fingerprint%%'' verifies the evidence quotes behind this page in bulk against ''paper.cols.txt''; the results, and the ones that had to be read by hand, are on [[provenance:privacy:fingerprinting]]. The dataset's own "0.9% of quotes could not be located" figure was measured on the earlier 4,322-paper run and has not been re-measured. | * **Quotes were spot-checked.** ''%%scripts/quote_check.mjs --detection fingerprint%%'' verifies the evidence quotes behind this page in bulk — against the rendering the extractor read, and then, for anything below threshold, against an independent ''pypdf'' rendering of the same ''paper.pdf''. Of **544** quotes, 312 match exactly and 140 on at least 60% of their five-word windows; **50** are located only in the second rendering, which is a defect in the stored text rather than in the extraction, and **42** are below threshold in both. The results, and the ones that had to be read by hand, are on [[provenance:privacy:fingerprinting]]. The dataset's own "0.9% of quotes could not be located" figure was measured on the earlier 4,322-paper run and has not been re-measured. |
| * **Every query behind this section, the report script and its unedited output** are on [[provenance:privacy:fingerprinting]]; corpus-level caveats are on [[literature:corpus]]. | * **Every query behind this section, the report script and its unedited output** are on [[provenance:privacy:fingerprinting]]; corpus-level caveats are on [[literature:corpus]]. |
| |
| ===== Related Pages ===== | ===== Related Pages ===== |
| |
| * [[Privacy:Cookies]] — the stateful counterpart; fingerprinting and cookies are used together, and respawning links them directly {[fouad2022my]}. | * [[Privacy:Cookies]] — the stateful counterpart; fingerprinting and cookies are used together, and respawning links them directly {[fouad2022_cookie]}. |
| * [[Privacy:JavaScript]] — classifying the scripts that 39.8% of these papers are actually detecting. | * [[Privacy:JavaScript]] — classifying the scripts that 39.8% of these papers are actually detecting. |
| * [[Privacy:Requests]] — the filter lists that most of this literature uses as ground truth, and why that is a compromise. | * [[Privacy:Requests]] — the filter lists that most of this literature uses as ground truth, and why that is a compromise. |
