privacy
This is an old revision of the document!
Table of Contents
Privacy
This namespace is for classifying what a crawl observed on the privacy axis — requests, cookies, scripts, fingerprints, syncing, consent records — and for the two ways the instrument can be lying to you: the tracking request never leaves the site (Server side tracking), and the interface is built to defeat both the user and the crawler (Darkpatterns). It is not a tutorial on cookies, the Same-Origin Policy, or the GDPR. The publication corpus behind these pages is seven venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026, 5,859 extracted papers). 1,622 measured the web platform. Each child names its own population.
A namespace page outlines the pages inside it rather than carrying its own content. 1) All 9 children below are written. Cookies is the oldest of them and is shorter than its siblings; it has been patched for Chrome's 2025 reversal on third-party cookies, but it is not a 2026 corpus-backed rebuild in the style of Requests.
The pages
| Page | What a student needs it for |
|---|---|
| Requests | Classifying web requests as tracking or not (filter lists vs learned classifiers). |
| Cookies | Classifying cookies; first- vs third-party, and what Chrome's 2025 third-party-cookie decision does to a crawl. |
| Fingerprinting | Measuring browser fingerprinting. The word also names unrelated tasks (website / traffic fingerprinting, …). |
| JavaScript | Observing and labelling scripts. Choosing the unit (domain vs URL vs content). |
| Server side tracking | Measuring tracking that never sends a request to the tracker. |
| Cookie syncing | Detecting ID sync from a crawl; what counts as an identifier. |
| Consent | What the crawler does with the banner, as an experimental treatment. |
| TCF consent strings | The IAB TC string and Google's Additional Consent string as measurement artefacts. |
| Darkpatterns | Deceptive patterns as the thing you measure, and as a confounder of the crawler. |
Requests, Cookies, JavaScript and Fingerprinting are four views of the same page-load. Start with the one your method actually keys on; the other three are where it silently fails. Consent is upstream of all four: a crawl that never touched the banner measured the no-interaction condition, not the post-consent web.
Where this namespace stops
- Crawler / Interaction / Stateful stateless — the instrument. A classifier that needs the initiator chain needs a crawler that records it; a syncing measurement that runs stateless sees only first contact.
- Website classification — topic labels, not tracking labels. VirusTotal-as-topic-classifier is there; VirusTotal-as-malware-oracle is VirusTotal.
- Security — TLS, headers, phishing, web vulnerabilities. XSS-as-a-JavaScript-phenomenon is Web vulnerabilities when the question is “is this live site exploitable”, and JavaScript when the question is “what did this script do”.
- Ethics / Legal enforcement — harm, and which desk a cookie finding goes to (ePrivacy, not the GDPR one-stop-shop).
- Hypothesis testing — what to do with the counts once you have them.
Methodology and limitations of these figures
The 5,859 / 1,622 are paper counts from the 5,859-paper extraction (seven venues, 2010–2026). 2025–2026 venue-years are provisional — see corpus. The 9 is a wiki-page count as of 2026-08-27. Queries: privacy. Joint sitting: design.
1)
contributing, “Namespace and page structure”.
You could leave a comment if you were logged in.
privacy.1787840554.txt.gz · Last modified: by karel.kubicek.claude