A common task in web privacy measurements is to determine which web requests correspond to the benign loading of required web resources and which are used to track users. There are two main methods for such classification: matching requests against crowd-sourced lists (typically used in ad-blocking or tracking protection extensions) or using machine learning (ML) to classify the requests based on their context and request URL.

This page is dedicated to the classification of web requests and partially DOM elements on the loaded page. For classification of other resources, such as cookies, JavaScript code, or fingerprinting, navigate to the specific pages. What you drive the browser with is a separate decision, and it constrains this one: a classifier that needs the initiator chain or the script call stack needs a crawler that records them.

• SoK: Advances and Open Problems in Web Tracking [2Vekaria, Yash; Beugin, Yohan; Munir, Shaoor; Acar, Gunes; Bielova, Nataliia; Englehardt, Steven; Iqbal, Umar; Kapravelos, Alexandros; Laperdrix, Pierre; Nikiforakis, Nick; Polakis, Jason; Roesner, Franziska; Shafiq, Zubair; Zimmeck, Sebastian (2025): "SoK: Advances and Open Problems in Web Tracking". arXiv preprint arXiv:2506.14057. (Link)] — a systematisation by fourteen of the field's authors, and the fastest orientation to where request classification sits in the wider tracking literature. Its §V-C1 gives the same three-limitation account of filter lists this page gives (small maintainer community, accumulated dead rules, static so evadable) and then names the ML lineage: AutoFR, AdGraph, WebGraph, WTAGraph, and PageGraph as the shipped implementation. It is still a preprint: only v1 exists (16 June 2025), and the version exhibited as a poster at IEEE S&P 2026 labels itself “Preprint”.¹⁾ Check for a venue version before you cite it as published.
• SoK: After Decades of Web Tracker Detection, What's Next? [3Rieder, Wolf; Raschke, Philip; Cory, Thomas; Sechting, Christian René; Kumar, Aditya; Küpper, Axel (2026): "SoK: After Decades of Web Tracker Detection, What's Next?", in: Proceedings of the IEEE Symposium on Security and Privacy. (Link)], IEEE S&P 2026 — a meta-study specifically of tracker detectors, which is the classifier lineage this page is about.
• Then read in this order, because each one answers the previous one's complaint: filter lists as measured dead weight [4Snyder, Peter; Vastel, Antoine; Livshits, Ben (2020): "Who Filters the Filters: Understanding the Growth, Usefulness and Efficiency of Crowdsourced Ad Blocking", Proc. ACM Meas. Anal. Comput. Syst. 4(2). (DOI) (Link)] → what they miss [5Fouad, Imane; Bielova, Nataliia; Legout, Arnaud; Sarafijanovic-Djukic, Natasa (2020): "Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels", in: Proceedings on Privacy Enhancing Technologies, pp. 499-518. (DOI)] → the graph lineage [6Iqbal, Umar; Snyder, Peter; Zhu, Shitong; Livshits, Benjamin; Qian, Zhiyun; Shafiq, Zubair (2020): "AdGraph: A Graph-Based Approach to Ad and Tracker Blocking", in: 2020 IEEE Symposium on Security and Privacy (SP), pp. 763-776. (DOI)], [7Siby, Sandra; Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair; Troncoso, Carmela (2022): "WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2875-2892. USENIX Association, Boston, MA. (Link)] → mixed resources [8Amjad, Abdul Haddi; Saleem, Danial; Gulzar, Muhammad Ali; Shafiq, Zubair; Zaffar, Fareed (2021): "TrackerSift: untangling mixed tracking and functional web resources", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] → the deployable classifier [9Lee, Kiho; Lim, Chaejin; Jin, Beomjin; Kim, Taeyoung; Kim, Hyoungshick (2024): "AdFlush: A Real-World Deployable Machine Learning Solution for Effective Advertisement and Web Tracker Prevention", in: Proceedings of the ACM Web Conference. (DOI)] → labels that at least come with a breakage check [10Shuang, He; Zhao, Lianying; Lie, David (2025): "Duumviri: Detecting Trackers and Mixed Trackers with a Breakage Detector", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] → how wrong the list was all along [1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)].

“Which requests are tracking” hides a choice of unit, and the units are not interchangeable. Papers that appear to disagree about tracking prevalence are often measuring different rows of this table.

Mixed resources are the normal case, not the tail. TrackerSift [8Amjad, Abdul Haddi; Saleem, Danial; Gulzar, Muhammad Ali; Shafiq, Zubair; Zaffar, Fareed (2021): "TrackerSift: untangling mixed tracking and functional web resources", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] measured how far up the granularity ladder you have to go before a resource is purely one or the other: more than 17% of domains, 48% of hostnames, 6% of scripts and 9% of methods in their crawls combine tracking and functional behaviour. Blocking at the hostname level therefore breaks things, and 9 of their 10 manually inspected sites showed major or minor breakage when mixed scripts were blocked. Whatever unit you pick, say what you did with the mixed cases; “we blocked the domain” is a decision with a measurable cost.

• Matching on the third-party hostname alone. CNAME cloaking [11Dimova, Yana; Acar, Gunes; Olejnik, Lukasz; Joosen, Wouter; Van Goethem, Tom (2021): "The CNAME of the game: Large-scale analysis of DNS-based tracking evasion", Proceedings on Privacy Enhancing Technologies 2021:394–412. (DOI) (Link)], first-party subdomains and CDN hosting all defeat it, and Lin et al. [25Lin, Su-Chin; Chou, Kai-Hsiang; Chen, Yen; Hsiao, Hsu-Chun; Cassel, Darion; Bauer, Lujo; Jia, Limin (2022): "Investigating Advertisers' Domain-changing Behaviors and Their Impacts on Ad-blocker Filter Lists", in: Proceedings of the ACM Web Conference. (DOI)] quantified the churn: among 252,601 domains seen while crawling 50,000 sites they found 1,748 replica ad domains, of which 35.9% worked by changing subdomains and 17.4% by moving to first-party subdomains. The 1,096 that lists did eventually block survived a mean 410.5 days (median 195.5) before a rule appeared.
• URL and page-content features in a learned classifier. WebGraph [7Siby, Sandra; Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair; Troncoso, Carmela (2022): "WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2875-2892. USENIX Association, Boston, MA. (Link)] showed the point directly: a URL-mutating adversary succeeded against AdGraph 96.62% of the time once first-party collusion was allowed, and against WebGraph's content-free features only 8.34%.
• Perceptual ad blocking as a robust method. Tramèr et al. [26Tramèr, Florian; Dupré, Pascal; Rusak, Gili; Pellegrino, Giancarlo; Boneh, Dan (2019): "AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] broke every perceptual ad blocker they examined; it is worth reading as the reason nobody builds on it.
• Treating a filter-list hit as the definition of tracking. See the box at the top.

LLM classification of web requests is, as of 2026-08-12, essentially absent from the peer-reviewed literature. One paper in these seven venues, TGNN [24Xiong, Shenping; Wang, Xutong; Jin, Ze; Liu, Xinyu; Wang, Haoqiang; Chen, Zhen; Tan, Ru; Liu, Qixu (2026): "TGNN: Enhancing Pixel Tracking Detection via LLM-driven Annotation and GAT-powered Structural Representation", in: Proceedings of the ACM Web Conference. (DOI)] (TheWebConf 2026), carries an llm method on a web-request classification tuple, and it uses the model to annotate training data rather than to classify at inference. A targeted search outside the corpus — arXiv, EuroS&P, ACSAC, RAID, AsiaCCS and WPES, 2025–2026 — found no peer-reviewed paper that prompts or fine-tunes a language model to decide whether an HTTP request is tracking. Industry is ahead of the literature here and says so: AdGuard demonstrated a prototype at the Ad-Filtering Dev Summit in October 2025 that asks a model per resource instead of consulting a list, and reported latency and cost as the blockers.³⁾ If you are planning an LLM-based request classifier you are not late — but you have no baseline to cite, so budget for building one, and for the reviewer question about cost, reproducibility and prompt drift that this page cannot answer for you.

And one 2026 paper is missing from the tables below by construction. AdVersa [27Lim, Chaejin; Lee, Kiho; Jin, Beomjin; Baek, Heewon; Kim, Hyoungshick (2026): "AdVersa: Adversarially-Robust and Practical Ad and Tracker Blocking in the Wild", in: Proceedings of the ACM Web Conference, pp. 3519-3530. (DOI)] (TheWebConf 2026) reports F1 98.23%, generalisation to unseen domains at 91.47% F1, and robustness where prior systems were evaded 57–92% of the time. TheWebConf 2026 is one of the incompletely-selected venue-years, so it is absent from every corpus figure on this page even though it is squarely in scope. Its own abstract frames it as embedding-based rather than LLM-based; treat it as the likeliest successor to the AdGraph/WebGraph line and not as the missing LLM baseline. Its figures here are the paper's own, taken from its abstract and Crossref record; nobody on this page has read it critically.

Matching a request against an Adblock-syntax filter list is what 57.0% of the papers below do, and it is still the default. What it means to do that well — which lists exist and which are dead, how to record the exact version and commit you matched against, which engine to use, what a rule needs from your crawl in order to be evaluated at all, what the list misses and where, and why “on the list” is a definition rather than a finding — is one topic and it now has its own page:

• Filter lists — the list as instrument and as ground truth.

The three things from it you cannot skip while reading this page:

• A rule is evaluated against a request in context. $third-party, $domain=, the resource-type options and @@ exception rules all need the initiator URL, the resource type and the redirect chain. A crawl that logged only request URLs cannot be post-processed with a list, and it fails silently rather than erroring.
• The list is a moving target. EasyList publishes a Version: and a Commit: in its own header and changes several times an hour; of the corpus papers naming a list as a tool, four record something that identifies the rules they matched against (the count and its denominator).
• A filter-list hit is a noisy label, estimated at 16%–19% false positives [1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)], with the false negatives measured repeatedly and separately — 25.22% [5Fouad, Imane; Bielova, Nataliia; Legout, Arnaud; Sarafijanovic-Djukic, Natasa (2020): "Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels", in: Proceedings on Privacy Enhancing Technologies, pp. 499-518. (DOI)], 34.5% [28Lee, Dongkeun; Joo, Minwoo; Lee, Wonjun (2023): "Net-track: Generic Web Tracking Detection Using Packet Metadata", in: Proceedings of the ACM Web Conference. (DOI)], and much worse off the desktop web.

Filter lists ship to users; learned classifiers, with one partial exception, do not. Three reasons, and all three matter for how you read the results below:

• A model that decides at runtime is a fingerprinting surface. Privacy Badger's “local learning” was removed for exactly this reason.⁴⁾
• Evasion is not hypothetical. Tramèr et al. [26Tramèr, Florian; Dupré, Pascal; Rusak, Gili; Pellegrino, Giancarlo; Boneh, Dan (2019): "AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] broke perceptual ad blocking outright, and AdGraph, WebGraph, Khaleesi and WTAGRAPH all report their own evasion rates — one of them, AdGraph, at 96.62%.
• Breaking a site in a way nobody can reproduce is worse than missing a tracker, and a model gives you no rule to point at when a user complains.

None of that stops you using a learned classifier as a measurement instrument, which is what this section is for. But read the three subsections below as the field's historical baselines, not as recommendations: the systems this page calls current are in What Came After, and Why It Matters.

AdGraph: A Graph-Based Approach to Ad and Tracker Blocking [6Iqbal, Umar; Snyder, Peter; Zhu, Shitong; Livshits, Benjamin; Qian, Zhiyun; Shafiq, Zubair (2020): "AdGraph: A Graph-Based Approach to Ad and Tracker Blocking", in: 2020 IEEE Symposium on Security and Privacy (SP), pp. 763-776. (DOI)] uses ML classification based on EasyList lists. It constructs a graph structure of web elements, network requests, and JavaScript execution for feature extraction. Example features include graph size, node degree, request length, domain party, and the presence of advertising keywords in requests. A random forest model achieves 95.33% accuracy, 89.1% precision and 86.6% recall against labels derived from eight crowdsourced filter lists, as shown below. Its breakage was on par with the lists themselves: no breakage on 85.0% of sites against the lists' 88.6%, major breakage on 5.9% against 6.4%.

Repository with instrumented crawler. Its production successor is Brave's PageGraph, which is the practical way to get this representation today.

WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking [7Siby, Sandra; Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair; Troncoso, Carmela (2022): "WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2875-2892. USENIX Association, Boston, MA. (Link)] is a follow-up to AdGraph. It improves feature processing to address adversarial ML methods, removes dependency on modifiable content features, and enhances overall performance: 94.32 ± 0.27% accuracy with content features removed, and the robustness result that justifies the design — a URL-mutating adversary with first-party collusion succeeded 96.62 ± 0.37% of the time against AdGraph and 8.34 ± 0.66% against WebGraph.

Repository with trained model and pipeline

Khaleesi: Breaker of Advertising and Tracking Request Chains [13Iqbal, Umar; Wolfe, Charlie; Nguyen, Charles; Englehardt, Steven; Shafiq, Zubair (2022): "Khaleesi: Breaker of Advertising and Tracking Request Chains", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2911-2928. USENIX Association, Boston, MA. (Link)] also extends AdGraph, but changes the unit: it classifies request chains, which accounted for about one third of all requests in its crawls, reaching 94.07% accuracy on a later dataset than it was trained on. Here is a repository with trained model and pipeline.

Additionally, it offers a Firefox extension that blocks advertising chains. While not directly suitable for crawls (the current implementation blocks requests), you can disable the functionality by removing the return { cancel: true } at background.js lines 51–54 (checked 2026-08-12: line 52 is the log, 53 is the cancel) and collect logs to classify ads instead.

As third-party cookies disappear, identifiers move into the URL. Link decoration is the practice of appending information to a link — ?fbclid=…, ?gclid=…, ?utm_source=… — so that the destination site, or a script on it, can recover an identifier without any cross-site storage. Classifying decorations is a different problem from classifying requests: the request may be entirely legitimate and only one query parameter privacy-relevant, so blocking is the wrong response and sanitising is the right one.

PURL (Privacy-preserving URL) [22Munir, Shaoor; Lee, Patrick; Iqbal, Umar; Shafiq, Zubair; Siby, Sandra (2024): "PURL: Safe and Effective Sanitization of Link Decoration", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 4103-4120. USENIX Association, Philadelphia, PA. (Link)], USENIX Security 2024, is the reference work.

• Method. It builds a page-execution graph that also has decoration nodes, so a decoration can be linked to the storage value it came from and the script that put it there. Encoded values are matched by monitoring Base64, MD5, SHA-1 and SHA-256 encodings of storage values, which is how a hashed cookie in a URL is caught. A random forest is then trained on labels combining filter lists, Cookiepedia and manually curated tracking-parameter lists.
• Prevalence. 73.02% of tested sites use link decoration for tracking, with an average of 10.75 tracking decorations per site. Those are the numbers to cite for “how common is this”.
• Performance and cost. 98.74% accuracy, 98.62% precision, 98.87% recall. Sanitising rather than blocking keeps breakage low: minor breakage on 5 of 100 sites and major breakage on 1 (a CSS load failure).
• The result that connects this page to fingerprinting. Fingerprinting scripts initiated requests carrying 1,800 unique decorations, of which 200 were labelled as advertising or tracking — decoration is one of the ways a fingerprint leaves the page.
• The experiment worth copying. They ran crawls with and without entering deterministic identifiers (email addresses, names) and found 538 decorations present only in the identifier crawls, 62 of them tracking. That differential design isolates identifier exfiltration from ordinary parameters far better than any static list, and it is cheap.

The lists, if you do not want to train a classifier. Parameter-stripping rules are maintained by browser vendors rather than by the filter-list community, and they are not equally accessible. Checked 2026-08-12:

Finding the notice and labelling its buttons is a classification problem on DOM elements, and it is on this page because the methods are the same ones — a CSS-selector list, then a heuristic, then a small language model. What the notice means legally, and what to do about consent, is on Granting Consent to Websites; the crawler-side mechanics of clicking are on Interaction.

The pipeline everyone converges on has three stages, and each has a measured cost.

1. Find the notice. Start with the EasyList Cookie List CSS selectors (current rule counts here — it is overwhelmingly cosmetic, which is what you want for finding a banner) and add DOM/text heuristics: high z-index, position: fixed, a privacy-related keyword pool, a container that overlaps the viewport bottom or centre.
2. Label the interactive elements. Accept / reject / close / save / settings / other. Button text is short, multilingual and adversarially designed, which is why this is the stage that moved from keyword lists to learned models.
3. Decide what to click, and verify it happened. A click that silently fails is worse than no click, because the crawl continues and reports pre-consent behaviour as post-consent. The consent-interaction crawlers the field shares for this — BannerClick, Priv-Accept and the autoconsent integration built into Tracker Radar Collector — are compared on the crawler page.

Outside these seven venues, the WPES workshop at CCS is where a good deal of this work lands: Intumwayase et al. [37Intumwayase, Jean Luc; Fouad, Imane; Laperdrix, Pierre; Rouvoy, Romain (2025): "Exploring the Enforcement of Cookie Notices across Continents: An Empirical Study", in: Proceedings of the 24th Workshop on Privacy in the Electronic Society. (DOI)] (WPES 2025) is a cross-continental study of cookie-notice enforcement and is not in any corpus figure on this page.

Everything in this section comes from a structured extraction over 5,859 full-text papers from CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, one record per paper with a verbatim evidence quote per claim. The 2025 and 2026 venue-years are provisional — CCS and IMC 2026 have not been held, and IEEE S&P and WWW 2026 are incompletely selected — so any per-year row reaching them is under-represented by construction. Methodology and limitations are at the end of this section.

There is no single field called “request classification”, and if you search for one you will find half of it. The population for this section is built from two independent signals:

Only 42% of the population fires both signals. That is the practical finding: the filter list has become a general-purpose third-party labelling instrument, reached for by papers on consent, passkeys, WebViews and satellite connectivity that would never describe themselves as tracker-detection work — while a large minority of request classification is done with bespoke heuristics that name no public list at all.

The second signal needs narrowing, and the narrowing is itself informative. The raw enum value classification.target == “web-request” fires on 258 papers, and 94 of them are not about advertising or tracking at all — infrastructure and CDN measurement, web-application security, spam and social-network abuse, bot detection, censorship, browser-extension security. The same over-catching happens on the list side: the regular expression that finds “a blocklist” also finds 35 papers using spam, malware, IP-reputation, content-category, censorship or certificate-revocation blocklists, which belong on Website classification and IP classification. Every exclusion is named, counted and itemised on the provenance page rather than dropped.

PETS is more than six times more likely than NDSS to publish this work (12.7% of its papers against 1.9%), and PETS plus IMC together carry 43% of it on 20% of the corpus. Read that as venue scope, not as receptiveness: PETS is a privacy-only venue, so of course this work is a larger share of it, and nothing here says anything about acceptance odds. As a reading-list ranking, though, it is the one to follow.

The peak is 2018–2021 — GDPR, the AdGraph lineage and the cookie-notice literature all landing at once — and the field has settled since at roughly 4% of these venues.

Of the 197 papers that used or produced an advertising-or-tracking filter list. A paper naming several lists is counted under each, so the shares do not sum to 100%. Names were folded into families, because they are free text: the Spellings folded column is how many distinct strings the corpus uses for each. The filter-lists page computes the same table over a slightly wider population (198 papers, because it does not intersect with this page's request-classification task fold) and is the canonical version; the two differ by one or two papers per row, which is itself a useful illustration of how much a population definition moves a count.

Folding is not cosmetic here. Counting exact strings undercounts EasyList by 18.2% (90 papers against 110), EasyPrivacy by 19.7%, Ghostery/WhoTracks.me by 11.8% — and Disconnect by 45.8% (26 against 48), because it appears as Disconnect list, Disconnect.me, Disconnect blacklist, Disconnect Entity List, Disconnect Tracker Protection lists and twenty-two other spellings. Any table of list adoption built on exact strings is wrong by tens of percent.

Separately, the engines: tracker-radar-collector 10 papers (which is a crawler, not a list — a distinction the raw names do not make), adblockparser 9, adblock-rust 7, uBlock Origin Core 2, abp-blocklist-parser 1, the Adblock Plus Android library 1.

By value, and a paper can appear in more than one row: 196 used, 13 named only in an “other tools mentioned” field, 11 compared against as a baseline, 2 mentioned, 2 produced. The compared rows are the dangerous ones — a paper that beats EasyList is not a paper that adopted it.

Of the 172 population papers carrying at least one web-request classification tuple they used or produced. classification.method agrees run-to-run on 58% of papers, so read this as a ranking, not as precise shares.

Machine learning never displaced the filter list; it peaked at 11.3% of papers. The visible drop in blocklist in the provisional last bucket sits on 32 papers and two incomplete venue-years, so do not read a trend into it. The one thing the last row does establish is that LLM classification of requests has exactly one instance in these venues, in 2026.

Of the 14 population papers with a learned web-request classification tuple (supervised-ml, unsupervised-ml or llm):

The eight are NoMoAds, AdGraph, Khaleesi, WebGraph, WTAGRAPH, AdFlush, Beyond the Request and Duumviri — that is, every system this page recommends as a baseline, without exception. Duumviri is the closest thing to a break in the pattern and it is not one: it takes its tracking-detector labels from EasyList and EasyPrivacy like the rest (12,936 tracker and 14,785 non-tracker cases from the Alexa top 5K), and what is independent is its features and its separately-trained breakage detector, whose positive samples are reconstructed from exception rules and user reports rather than from tracking labels. Nobody in this corpus has trained a request classifier without a filter list somewhere in the loop.

Validation, over the same 172 papers as above:

One paper in three reports no validation of its request classification at all. The not-applicable row is mostly papers that applied a list as-is and reasonably consider the list itself the definition — 45 of those 58 papers carry that not-applicable verdict on a blocklist tuple — which is exactly the assumption Calzavara et al. [1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)] measured at 16%–19% false positives. Manual validation of a sample is an afternoon's work and it is the single cheapest thing you can add.

Of the 177 papers naming a filter list as a tool they used or produced, 52 (29.4%) attach any version or date to it. Read that as an order of magnitude in both directions: the extraction fills the version field only when the paper puts a version next to the name, so a paper that dates its lists in a crawl paragraph may not be credited — and several of the 52 give an extension version (Ghostery 5.4.1, Adblock Plus 2.6.7) rather than a list version, which does not identify the rules. Precise datings do exist and are the model to copy: EasyList and EasyPrivacy, downloaded January 29, 2019; EasyList (EL), March 13, 2020; whotracks.me, 2019-09-25.

Given that EasyList publishes both a Version: and the exact Commit: in its own header, and that it changed twice within thirteen minutes on the day this page was written, a 70% silence rate is the largest single reproducibility gap on this page.

201 of the 254 ran an automated web crawl; 197 have a recorded crawl configuration. Of those, 52.3% state a consent action, 46.2% state whether the crawl was stateful, 23.4% state headless or headful, and 95.4% state an interaction depth. Consent action matters more here than on most pages: a crawl that accepted everything and a crawl that never touched the banner are measuring different webs, and nearly half the papers do not say which they did. See the crawler page for the corpus-wide comparison.

• How they were produced. One structured record per paper was extracted from full text, each tuple carrying a verbatim evidence quote and its section. The script that produces every number in this section, with its denominators, is report_requests.mjs; the folding rules are in req_fold.mjs; verify_requests_figures.mjs re-checks every per-paper figure on this page against the paper's own text. Every query, the scripts' unedited output and the full residue are on the provenance page for this one; corpus-level caveats are on corpus.
• The population is a judgement, not an enum. No field in the extraction means “classifies requests as tracking”. S1 and S2 above are proxies, both are folded free text or a hand-written task rule, and both are stated in full on the provenance page so you can disagree with them.
• A paper counts once, never once per tuple, and shares do not sum to 100% because the fields are multi-valued.
• Sentinels are counted as what they are. not-stated, none-reported and not-applicable are never folded into a stated value; where they are the largest row, that is the finding.
• Free-text names were folded before counting. The residue is printed rather than dropped: 34 distinct strings across 35 tuples matched no list family, and almost all are generic off-topic phrases (12 IP reputation blacklists, combined public blacklists, eCrimeX blacklist). The full list is on the provenance page.
• Every per-paper figure on this page was checked against the paper's own full text, not against the extraction's summary of it: of 143 literal figures, 141 were found verbatim in paper.cols.txt and 2 as a listed spelling variant (Matte et al. write 1 426 and 22 949 with a thin space). That pass caught a real error: the extraction's summary of Rasaii et al. [30Rasaii, Ali; Gosain, Devashish; Gasser, Oliver (2023): "Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] gives a denominator of “45,222 websites”, and that number is nowhere in the paper, which says “we crawled 45k websites and found cookiewalls on 280 of them”. The page says ~45k. Snyder et al. is a SIGMETRICS paper outside these seven venues, so its 90.16% was verified against the paper directly rather than through the corpus.
• Venue coverage. Seven venues only. EuroS&P, ACSAC, RAID, AsiaCCS, WPES, CHI and SOUPS are absent, and several works this page relies on were published outside the seven — Snyder et al. at SIGMETRICS, Intumwayase et al. at WPES, and the Vekaria et al. SoK on arXiv. Any count here is a lower bound on a system's standing.
• Stability. classification.method agrees with an independent extraction run on 58% of papers and free-text names on about 20% of exact strings; enum fields such as classification.validation are considerably more stable. That is why methods are given as rankings and validation as percentages.

1. The list, its version and its commit, and the archived .txt — not “EasyList”. 70% of papers give no version at all and 98% give nothing that identifies the rules. How, and a script that does it.
2. The engine and its version, separately from the list, because two parsers of the same list do not match the same rules and the older ones silently ignore options they do not know. Which engines are maintained.
3. Which rule kinds you evaluated. Network only, or cosmetic too? Nearly a third of EasyList is cosmetic and answers a different question.
4. The unit, and how you decided “party”. Domain, eTLD+1, URL, chain or parameter — and whether party is by public suffix list (name which one) or by entity map (name which one). The two give different third-party rates for the same crawl.
5. What you did with mixed resources, given that 48% of hostnames are mixed [8Amjad, Abdul Haddi; Saleem, Danial; Gulzar, Muhammad Ali; Shafiq, Zubair; Zaffar, Fareed (2021): "TrackerSift: untangling mixed tracking and functional web resources", in: Proceedings of the ACM Internet Measurement Conference. (DOI)].
6. Validation on your own sample. Hand-label a few hundred requests and report precision against the list. One paper in three reports nothing here.
7. If you trained a classifier: what supplied the labels, and what you think the label noise is. “Filter lists” is an answer with a known error rate now [1Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)] — quote it.
8. Your consent action and statefulness, because tracking requests are conditional on both.
9. If you used a banner-clicking tool: its success rate on your sample, not its authors' [34Demir, Nurullah; Urban, Tobias; Pohlmann, Norbert; Wressnegger, Christian (2024): "A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy", in: Proceedings on Privacy Enhancing Technologies, pp. 5-20. (DOI)].

• Comparison of crawling libraries — what records the initiator chain, the call stack and the response headers these methods need.
• Tracker Radar Collector — the lowest-effort crawler for this task, and where the Tracker Radar data comes from.
• Brave PageGraph — AdGraph's production successor, and the practical way to get a page-execution graph.
• webXray and domain-to-company ownership — once a request is flagged, this is how to answer whose it is, and why webXray, Tracker Radar and Disconnect give three different answers.
• Analysing and classifying JavaScript — the script-level and function-level end of the granularity ladder.
• Cookies and Fingerprinting — the other two things a “tracking” label is often about.
• Measuring cookie and ID syncing — the exchange that makes those identifiers joinable across parties, and the reason the link-decoration section above exists.
• Granting consent to websites — what the cookie notice means, once you have found it.
• Website classification — and the measured reason not to use a categorisation service to find trackers.
• Stateful vs stateless crawling and Interaction.
• Provenance of this page's figures.

[1]

Calzavara, Stefano; Casarin, Samuele; Squarcina, Marco; Maffei, Matteo (2026): "From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques", in: Proceedings on Privacy Enhancing Technologies. (Link)

[2]

Vekaria, Yash; Beugin, Yohan; Munir, Shaoor; Acar, Gunes; Bielova, Nataliia; Englehardt, Steven; Iqbal, Umar; Kapravelos, Alexandros; Laperdrix, Pierre; Nikiforakis, Nick; Polakis, Jason; Roesner, Franziska; Shafiq, Zubair; Zimmeck, Sebastian (2025): "SoK: Advances and Open Problems in Web Tracking". arXiv preprint arXiv:2506.14057. (Link)

[3]

Rieder, Wolf; Raschke, Philip; Cory, Thomas; Sechting, Christian René; Kumar, Aditya; Küpper, Axel (2026): "SoK: After Decades of Web Tracker Detection, What's Next?", in: Proceedings of the IEEE Symposium on Security and Privacy. (Link)

[4]

Snyder, Peter; Vastel, Antoine; Livshits, Ben (2020): "Who Filters the Filters: Understanding the Growth, Usefulness and Efficiency of Crowdsourced Ad Blocking", Proc. ACM Meas. Anal. Comput. Syst. 4(2). (DOI) (Link)

[5]

Fouad, Imane; Bielova, Nataliia; Legout, Arnaud; Sarafijanovic-Djukic, Natasa (2020): "Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels", in: Proceedings on Privacy Enhancing Technologies, pp. 499-518. (DOI)

[6]

Iqbal, Umar; Snyder, Peter; Zhu, Shitong; Livshits, Benjamin; Qian, Zhiyun; Shafiq, Zubair (2020): "AdGraph: A Graph-Based Approach to Ad and Tracker Blocking", in: 2020 IEEE Symposium on Security and Privacy (SP), pp. 763-776. (DOI)

[7]

Siby, Sandra; Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair; Troncoso, Carmela (2022): "WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2875-2892. USENIX Association, Boston, MA. (Link)

[8]

Amjad, Abdul Haddi; Saleem, Danial; Gulzar, Muhammad Ali; Shafiq, Zubair; Zaffar, Fareed (2021): "TrackerSift: untangling mixed tracking and functional web resources", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[9]

Lee, Kiho; Lim, Chaejin; Jin, Beomjin; Kim, Taeyoung; Kim, Hyoungshick (2024): "AdFlush: A Real-World Deployable Machine Learning Solution for Effective Advertisement and Web Tracker Prevention", in: Proceedings of the ACM Web Conference. (DOI)

[10]

Shuang, He; Zhao, Lianying; Lie, David (2025): "Duumviri: Detecting Trackers and Mixed Trackers with a Breakage Detector", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[11]

Dimova, Yana; Acar, Gunes; Olejnik, Lukasz; Joosen, Wouter; Van Goethem, Tom (2021): "The CNAME of the game: Large-scale analysis of DNS-based tracking evasion", Proceedings on Privacy Enhancing Technologies 2021:394–412. (DOI) (Link)

[12]

Amjad, Abdul Haddi; Munir, Shaoor; Shafiq, Zubair; Gulzar, Muhammad Ali (2024): "Blocking Tracking JavaScript at the Function Granularity", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[13]

Iqbal, Umar; Wolfe, Charlie; Nguyen, Charles; Englehardt, Steven; Shafiq, Zubair (2022): "Khaleesi: Breaker of Advertising and Tracking Request Chains", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2911-2928. USENIX Association, Boston, MA. (Link)

[14]

Ikram, Muhammad; Asghar, Hassan Jameel; Kaafar, Mohamed Ali; Mahanti, Anirban; Krishnamurthy, Balachander (2017): "Towards Seamless Tracking-Free Web: Improved Detection of Trackers via One-class Learning", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[15]

Iqbal, Umar; Shafiq, Zubair; Qian, Zhiyun (2017): "The ad wars: retrospective measurement and analysis of anti-adblock filter lists", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[16]

Mughees, Muhammad Haris; Qian, Zhiyun; Shafiq, Zubair (2017): "Detecting Anti Ad-blockers in the Wild", in: Proceedings on Privacy Enhancing Technologies, pp. 130-146. (DOI)

[17]

Le, Hieu; Markopoulou, Athina; Shafiq, Zubair (2021): "CV-Inspector: Towards Automating Detection of Adblock Circumvention", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[18]

Yang, Zhiju; Pei, Weiping; Chen, Monchu; Yue, Chuan (2022): "WTAGRAPH: Web Tracking and Advertising Detection using Graph Neural Networks", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[19]

Le, Hieu; Elmalaki, Salma; Markopoulou, Athina; Shafiq, Zubair (2023): "AutoFR: Automated Filter Rule Generation for Adblocking", in: Proceedings of the USENIX Security Symposium. (Link)

[20]

Sjösten, Alexander; Snyder, Peter; Pastor, Antonio; Papadopoulos, Panagiotis; Livshits, Benjamin (2020): "Filter List Generation for Underserved Regions", in: Proceedings of the ACM Web Conference. (DOI)

[21]

Smith, Michael; Snyder, Peter; Livshits, Benjamin; Stefan, Deian (2021): "SugarCoat: Programmatically Generating Privacy-Preserving, Web-Compatible Resource Replacements for Content Blocking", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[22]

Munir, Shaoor; Lee, Patrick; Iqbal, Umar; Shafiq, Zubair; Siby, Sandra (2024): "PURL: Safe and Effective Sanitization of Link Decoration", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 4103-4120. USENIX Association, Philadelphia, PA. (Link)

[23]

Rieder, Wolf; Raschke, Philip; Cory, Thomas (2025): "Beyond the Request: Harnessing HTTP Response Headers for Cross-Browser Web Tracker Detection in an Imbalanced Setting", in: Proceedings on Privacy Enhancing Technologies, pp. 100-117. (DOI)

[24]

Xiong, Shenping; Wang, Xutong; Jin, Ze; Liu, Xinyu; Wang, Haoqiang; Chen, Zhen; Tan, Ru; Liu, Qixu (2026): "TGNN: Enhancing Pixel Tracking Detection via LLM-driven Annotation and GAT-powered Structural Representation", in: Proceedings of the ACM Web Conference. (DOI)

[25]

Lin, Su-Chin; Chou, Kai-Hsiang; Chen, Yen; Hsiao, Hsu-Chun; Cassel, Darion; Bauer, Lujo; Jia, Limin (2022): "Investigating Advertisers' Domain-changing Behaviors and Their Impacts on Ad-blocker Filter Lists", in: Proceedings of the ACM Web Conference. (DOI)

[26]

Tramèr, Florian; Dupré, Pascal; Rusak, Gili; Pellegrino, Giancarlo; Boneh, Dan (2019): "AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[27]

Lim, Chaejin; Lee, Kiho; Jin, Beomjin; Baek, Heewon; Kim, Hyoungshick (2026): "AdVersa: Adversarially-Robust and Practical Ad and Tracker Blocking in the Wild", in: Proceedings of the ACM Web Conference, pp. 3519-3530. (DOI)

[28]

Lee, Dongkeun; Joo, Minwoo; Lee, Wonjun (2023): "Net-track: Generic Web Tracking Detection Using Packet Metadata", in: Proceedings of the ACM Web Conference. (DOI)

[29]

Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[30]

Rasaii, Ali; Gosain, Devashish; Gasser, Oliver (2023): "Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[31]

Khandelwal, Rishabh; Nayak, Asmit; Harkous, Hamza; Fawaz, Kassem (2023): "Automated Cookie Notice Analysis and Enforcement", in: 32nd USENIX Security Symposium (USENIX Security 23), pp. 1109-1126. USENIX Association, Anaheim, CA. (Link)

[32]

Ogut, Aysun; Turanlioglu, Berke; Metiner, Doruk Can; Levi, Albert; Yilmaz, Cemal; Cetin, Orcun; Uluagac, Selcuk (2024): "Dissecting Privacy Perspectives of Websites Around the World: "Aceptar Todo, Alle Akzeptieren, Accept All..."", in: Proceedings of the USENIX Security Symposium. (Link)

[33]

Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: 33rd USENIX Security Symposium (USENIX Security 24), pp. 1723-1739. USENIX Association, Philadelphia, PA. (Link)

[34]

Demir, Nurullah; Urban, Tobias; Pohlmann, Norbert; Wressnegger, Christian (2024): "A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy", in: Proceedings on Privacy Enhancing Technologies, pp. 5-20. (DOI)

[35]

Tang, Brian; Bui, Duc; Shin, Kang G. (2025): "Navigating Cookie Consent Violations Across the Globe", in: Proceedings of the USENIX Security Symposium. (Link)

[36]

Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)

[37]

Intumwayase, Jean Luc; Fouad, Imane; Laperdrix, Pierre; Rouvoy, Romain (2025): "Exploring the Enforcement of Cookie Notices across Continents: An Empirical Study", in: Proceedings of the 24th Workshop on Privacy in the Electronic Society. (DOI)

[38]

Lukić, Karlo; Papadopoulos, Lazaros (2026): "Privacy vs. Profit: The Impact of Google's Manifest Version 3 (MV3) Update on Ad Blocker Effectiveness", in: Proceedings on Privacy Enhancing Technologies. (Link)