Measure The Web

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Provenance: Privacy:Privacy Sandbox ======

Back to [[privacy:privacy_sandbox|Measuring the Privacy Sandbox]]. Corpus-wide selection and extraction notes are on [[literature:corpus]]. This page is the query log, the folding rules with their measured residue, the browser probes with their unedited output, and the record of what could not be established.

No %%~~DISCUSSION~~%% block: comments belong on the content page. This is the convention the existing ''provenance:'' pages follow and this page keeps it.

===== Run record =====

  * Run date: **2026-09-01** (UTC).
  * Authoring agent: Claude Opus 5, executing the drain item ''privacy:privacy_sandbox (new)''. Two background research sub-agents (''sonnet'') for the currency and tooling passes; **every load-bearing fact they returned was re-fetched and re-verified by the authoring agent before it reached the page** — see [[#Sub-agent findings that did not survive verification]], which is the part of this log with the most value.
  * Corpus at run time: **5,859** extracted papers, 2010–2026, seven venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P). The full-text sweep runs over the **5,869** papers that have a rendered ''paper.cols.txt''; the 10-paper difference is papers with text but no extraction record, and it is why the page names 5,869 as the full-text denominator and 5,859 as the extraction denominator rather than using one number for both.
  * Read-only inputs under ''/workspace/publications_dataset/data/''. Nothing was written there.
  * Browser measurements: **Chromium 151.0.7922.34** as shipped with **Playwright 1.62.1**, Linux container, headless. Puppeteer was pointed at the same binary via ''chromium.executablePath()'' because the container's own ''/usr/bin/chromium'' cannot be driven (the crashpad-flag problem documented in the workdir README).
  * This is a **new page**, not an extension. See [[#Why a new page and not a broadened neighbour]].
  * Wiki saves through ''scripts/dw.mjs'' (JSON-RPC). Bibliography saved with ''--if-rev 1788205676''.

===== Why a new page and not a broadened neighbour =====

^ Neighbour ^ What it already covers ^ What it does not ^
| [[privacy:cookies]] | The 2025-04-22 reversal, in one paragraph, correctly | Nothing about any replacement API. No mention of Topics, Protected Audience, Attribution Reporting, Shared Storage, CHIPS or RWS |
| [[privacy:browser_storage]] | Chrome's storage partitioning since M115, CHIPS named as "opt-in per cookie" in one table cell | No CHIPS adoption figure, no ads APIs |
| [[programming:stateful_stateless]] | Playwright's ''ThirdPartyStoragePartitioning'' opt-out, the 2025-04-22 reversal | No Privacy Sandbox API |
| [[privacy:cookie_syncing]], [[privacy:server_side_tracking]] | Both carry the "third-party cookies are not disappearing" correction | Neither mentions the replacement APIs |

Grepped every page in the ''privacy:'', ''programming:'' and ''design:'' namespaces for ''privacy sandbox'', ''topics api'', ''protected audience'', ''fledge'', ''attribution reporting'', ''CHIPS'', ''storage access'', ''related website'', ''trust token'', ''fenced frame'', ''shared storage'', ''bounce tracking'' and ''partition''. The only Privacy Sandbox hits anywhere on the site were the 2025-04-22 reversal (three pages) and one ''developers.google.com/privacy-sandbox'' URL cited as the source for Chrome's storage partitioning. **Nothing on the site covered the replacement APIs.** Broadening [[privacy:cookies]] was rejected because that page is about classifying cookies, its own namespace page already flags it as the shortest of the ten children, and a status-and-instrumentation page for eleven APIs would have swamped it.

===== Population and queries =====

All counts are **papers**, never tuples. Sentinels are never counted as answers. Every figure below is reproduced by ''scripts/report_privacy_sandbox.mjs''; its unedited output is in [[#Report script output]].

^ Query ^ Denominator ^ Result ^ On the page? ^
| Full text names ''%%/Privacy\s+Sandbox/i%%'' at least once | 5,869 papers with ''paper.cols.txt'' | **43** (0.7%) | yes |
| Same, five or more times | 5,869 | **9** (0.2%) | yes |
| Names at least one folded API family | 5,869 | **67** (1.1%) | yes |
| Topics family (incl. FLoC) | 5,869 | 22 | yes |
| UA Client Hints / UA reduction | 5,869 | 10 | yes |
| Protected Audience family (incl. FLEDGE, TURTLEDOVE) | 5,869 | 8 | yes |
| Privacy Sandbox on Android | 5,869 | 7 | yes |
| CHIPS | 5,869 | 5 | yes |
| Private State Tokens (incl. Trust Tokens) | 5,869 | 5 | yes |
| Fenced Frames | 5,869 | 4 | yes |
| Related Website Sets (incl. First-Party Sets) | 5,869 | 4 | yes |
| Attribution Reporting | 5,869 | 3 | yes |
| Shared Storage | 5,869 | 3 | yes |
| Private Aggregation | 5,869 | 2 | yes |
| Storage Access API | 5,869 | 2 | yes |
| FedCM | 5,869 | 1 | yes |
| IP Protection | 5,869 | **0** | yes |
| Bounce Tracking Mitigations, by that name | 5,869 | **0** | yes |
| Web crawls 2023–2026 naming an API family | 332 web crawls | 24 (7.2%) | yes |
| Web crawls 2024–2026 naming an API family | 235 web crawls | **18 (7.7%)** | yes |
| Web crawls 2025–2026 naming an API family | 153 web crawls | 11 (7.2%) | yes |
| Chrome/Chromium-stating web crawls 2023–2026 | 129 | 11 (8.5%) | no |
| Chrome/Chromium-stating web crawls 2024–2026 | 86 | **8 (9.3%)** | yes |

**"Web crawl"** is ''crawlConfig != null'' OR ''studyTypes'' contains ''automated-web-crawl'', AND ''platforms'' contains ''web'' — the same definition ''lib.mjs'' uses for ''POPULATIONS.webCrawled''.

**The Chrome row's denominator is not "papers that drove Chrome".** It is papers that **stated** a browser containing ''chrom''. ''crawlConfig.browsers'' is stated by only 47.2% of the 1,120 crawling papers, so 86 is a lower bound and 9.3% is a share of the ones that told you. The page says so.

===== Folding and residue =====

''detection.phenomenon'' and ''classification.resourceName'' were **not** usable here: nothing in the extraction schema has a field for "measured the Topics API", and the free-text fields agree run-to-run on only about 20% of exact strings. The topic's reach can therefore only be established from full text. ''scripts/ps_fold.mjs'' holds 15 ordered families, each an alternation of the current name and every former name, applied to whitespace-collapsed text with soft hyphens rejoined.

**Every regex below was measured against the corpus before it was accepted or rejected.** The rejected ones are the useful half of this section.

^ Rejected pattern ^ Papers it matched ^ Why rejected ^
| ''%%/\bCHIPS\b/%%'' unqualified | 231 | Silicon. Rowhammer and GPU papers |
| ''%%/\bCHIPS\b/%%'' within 200 chars of "partition" | 8 | DRAM **bank** partitioning; 3 of the 8 were silicon |
| ''%%/\bthe Topics\b/%%'' | 216 | Ordinary English |
| ''%%/interest\s+group/%%'' bare | 234 | Political science, federated learning, recommender systems |
| ''%%/\bIPA\b/%%'' | 53 | Rarely Interoperable Private Attribution |
| ''%%/\bPPA\b/%%'' | 23 | "Preference Profiling Attack", among others |
| ''%%/IP Protection/%%'' unqualified | 31 | Intellectual property |
| ''%%/k-anonymity/%%'' | 97 | Generic privacy term |
| ''%%/Privacy Budget/%%'' unqualified | 106 | Generic differential-privacy term |
| ''%%/SPARROW|DOVEKEY|PARAKEET/%%'' | 24 | Matches "sparrow" and "parakeet" in unrelated papers |
| ''%%/bounce\s+tracking/%%'' | 12 | The **phenomenon**, not the Chrome countermeasure. Covered by [[privacy:cookie_syncing]] |
| ''%%/Aggregation Service/%%'' bare | 2 | A 2022 outage paper and a 2012 analytics paper |
| ''%%/\bFLoC\b/%%'' before a year | 3 | "FLoC 2018" is the **Federated Logic Conference** |
| ''%%/\bFLEDGE\b/i%%'' | 2 | **"full-fledge crawling system"** — the hyphen is a word boundary, so ''%%\b%%'' does not save you |
| ''%%/First[- ]Party Sets/i%%'' | 1 | **"the first party //sets// the cookies"** is a verb phrase |
| ''%%/attribution reporting/i%%'' bare, lower case | 1 | Apple's **SKAdNetwork** "delays and anonymises attribution reporting to advertisers" |

Two of these needed a structural fix rather than a narrower alternation:

  * **The CHIPS family is the only case-sensitive family in the folder.** Lowercase ''chips'' is silicon, and a WPA3 paper that says "anti-clogging **cookie**" a few hundred characters from "chips" lands in the family if the acronym is matched case-insensitively — Dragonblood did exactly that. The report script therefore honours each family's own regex flags instead of forcing ''gi''. This removed 1 false positive and the family went 6 → 5.
  * **Protected Audience** had to drop bare ''interest group'' entirely; the ad-tech phrasings (''ad interest group'', ''joinAdInterestGroup'', ''runAdAuction'', ''leaveAdInterestGroup'', ''interest-group bidding/auction'') are the whole family. This took the count from 234 to 11 — and then to **8**, because ''%%\bFLEDGE\b%%'' with an ''i'' flag matches "a full-fledge crawling system" and "a full-fledge experience". The Protected Audience, Related Website Sets and Attribution Reporting families are now **all case-sensitive**, for the same reason CHIPS is.
  * **Attribution Reporting** is the subtlest of the three. Lowercase "attribution reporting" is ordinary ad-tech English, and a 2026 PETS paper used it of //Apple's// SKAdNetwork. But papers also write "Attribution reporting API" and "privacy sandbox attribution reporting api", so a purely case-sensitive rule loses two of the three true positives. The accepted rule is: the capitalised proper name in any position, **or** the phrase followed by "API" in any case. Family count 4 → **3**.

**Residue that remains, stated rather than hidden.** Two kinds:

  * **False positives.** The folded families still admit passing mentions. Of the **67** papers that name at least one family, **11** were judged to actually measure a Privacy Sandbox mechanism — the [[privacy:privacy_sandbox#What the corpus did measure|page's table]] — plus one, ''bahrami2025_cookieguard'', that supplies CHIPS context without measuring the attribute. That is a precision of roughly **16%** for "names a family" as a proxy for "measures the thing", and it is why the page publishes the family counts as //reach// and the measured results as a hand-audited table, never as a percentage of the family counts. The per-family lists are printed in full in the report output below so that anyone can redo that audit and disagree with it.
  * **A known false negative, accepted deliberately.** Pinning ''FLEDGE'' to upper case also drops ''2024/USENIX/web-platform-threats-automated-detection-of-web-security-issues-with-wpt'', which lists ''fledge'' in lower case as one of the web-platform-tests directories it exercises. That is a genuine reference to the API. It is excluded because the only way to keep it is to re-admit "full-fledge", and one true positive is not worth two false ones. It is recorded here rather than silently lost.

===== Evidence quotes checked =====

''scripts/ps_quotecheck.mjs'' locates every ''evidence.quote'' behind the 14 papers in the measured-results table against ''data/fulltext/<year>/<venue>/<slug>/paper.cols.txt''. Whitespace is collapsed, soft hyphens rejoined; three match levels are reported and a NEAR is never treated as a PASS.

^ Level ^ Count ^ Meaning ^
| PASS (all three variants) | **91** | Found verbatim, or after stripping punctuation and spaces, or — for a quote containing an ''…'' elision — with every fragment of 12+ characters present in the paper's own order |
| NEAR | 40 | 80%+ of its 6-character-and-longer tokens present, but not contiguous |
| **FAIL** | **0** | Not located |
| Total | 131 | |

The 40 NEARs are a **rendering** artefact, not a quote problem, and the cause is documented: the ''.cols'' repair does not fully de-interleave every two-column PDF. The Fledging paper is the clearest case — the extraction quotes //"We detected the use of FLEDGE APIs in 9.5% (n = 6,682) of the 70K sites that we visited during the measurement period"//, and the ''.cols'' rendering reads //"...FLEDGE APIs in cannot combine that interest with other information about 9.5% (n = 6,682) of the 70K sites that we visited during the the person..."// — the sentence is there, with the facing column woven through it.

**Every figure the page publishes was additionally located by hand** with a targeted regex over the collapsed text, and the surrounding sentence read:

^ Figure on the page ^ Sentence found in ''paper.cols.txt'' ^
| 9.5% (n = 6,682) of 70K | "We detected the use of FLEDGE APIs in … 9.5% (n = 6,682) of the 70K sites that we visited during the … measurement period" |
| 11,941 of 11,959 auctions | "We observed a total of 11,959 auctions for ad spaces during our measurement period, almost all of which (n = 11,941) were run by Google Ad Manager" |
| 15,935 interest groups | "We observed a total of 15,935 interest groups" |
| 30.90% (n = 94,673) of 306,407 | "while we observed 306,407 calls to join an interest group, 30.90% (n = 94,673) attempted to create an interest group with an expiration time greater than 30 days" |
| 4,628 / 3,903 / 3,585 per snapshot | "While 4,628 sites used FLEDGE in June, this number decreased to 3,903 sites in July, and further dropped to 3,585 sites in September" |
| Tranco top 70K | "we perform a crawl of the top 70K domains from the Tranco list" |
| 10.1% (1,311) of 12,955 | "approximately 10.1% (1,311) of the 12,955 sites we were able to reach did invoke the Shared Storage API in some way" |
| 1,250 (9.6%) selectURL, four domains | "1,250 of these pages (9.6%) made at least one call to selectURL … All of these interactions can be traced back to four unique domains" |
| securepubads 1,222 / ep3 177 / crcldu 46 / optable 17 | "securepubads.g.doubleclick.net and ep3.adtrafficquality.google … using Shared Storage on 1,222 and 177 websites respectively. crcldu.com (46 websites) and ads.optable.co (17 websites)" |
| 289 domains, 245 (85%), 61% | "we were left with 289 domains … we were able to obtain 245 valid attestation files, meaning that 85% of the domains that we checked were hosting an attestation file … Of the attestation files we collected, 61% …" |
| 48.2% in Disconnect | "Of the domains that have a valid attestation file 48.2% appeared in the Disconnect list. Similarly, 56.4% of the domains with access to the Shared Storage API appeared in the Disconnect list" |
| 41 sets, 92.7% associated, 26 March 2024 | "As of the most recent RWS list in the dataset (26 March 2024), there were 41 sets; of these, 22% had one or more service sites; 14.6% had one or more ccTLD sites; and 92.7% had one or more associated sites" |
| 58.8% of 114 PRs | "58.8% of all pull requests closed without being merged"; "Across the 114 pull requests" |
| 3,177 tracking cookies, 40 (1.3%), 26 | "among 3,177 unique tracking cookies, only 40 (1.3%) are partitioned, of which 26 are accompanied by non-partitioned tracking cookies from the same t…" |
| 79,898 cookies, 521 partitioned | "out of 79,898 unique stored cookies, 521 are marked partitioned" |
| >50% after 3 weeks, 95% after 4 | "the number of users in our dataset that could be uniquely identified by FLoC IDs is more than 50% after 3 weeks and more than 95% after 4 weeks" |
| 10%+ of history for 30% of users | "reconstruct 10% or more of the browsing history for 30% of its users using Generative Adversarial Networks" |
| 15–17% pool of 1,000, <0.2% FP | "the probability of correct re-identification can reach 15 − 17%, considering a pool of 1,000 users"; "false positives being negligible (less than 0.2%)" |
| 35–42% non-2-anonymous at 100,000 | "even in the case of a population of 100, 000 personas, we still observe 35−42% of them being non-2-anonymous" |
| 0.4% / 57% / 75%, 250k users | "0.4% of the 250k users we simulate are re-identified … 57% of users with stable interests are uniquely re-identified when their browsing activity has been observed for 15 epochs, increasing to 75% after 30 epochs" |
| 25% / 49% / 94% noise removal | "about 25% of the noisy topics on single websites in one-shot scenarios"; extraction prevalence "49% after 15 epochs and 94% after 30 epochs" |
| >90% of domains, <10% screenshot diff | "We find that more than 90% of domains exhibit less than a 10% screenshot difference when cookies are disabled" |
| 7,490 domains crawled | "we arrive at a final list of 7,490 successfully crawled domains" |
| Chrome 117, September 2023 (FLEDGE GA) | "officially released to the public and integrated into the stable Chrome browser as of version 117.0.5938.89 in mid September 2023" |

**One figure was reworded because the paper and the extraction disagree.** ''bahrami2025_cookieguard''`s extraction records cross-domain cookie overwriting as "31.5% of websites"; the paper's own sentence says "approximately 32% of websites". Neither number is published on this page — the paper is cited only for CHIPS context — but the disagreement is recorded here because the next run may want that figure.

===== Browser measurements =====

Four probes, all against Chromium 151.0.7922.34 (Playwright 1.62.1) on 2026-09-01, all committed under ''sandbox/''. Their real, unedited output follows.

  * ''sandbox/ps_probe.mjs'' — feature detection and Permissions-Policy, four launch configurations.
  * ''sandbox/ps_call_probe.mjs'' — **calls** each API from an HTTPS origin, on ''localhost'' and on a host-resolver-mapped domain that is definitely not enrolled, with and without the ads-API override and the enrollment override.
  * ''sandbox/ps_cdp_probe.mjs'' — turns on the CDP ''Storage'' tracking toggles and records what arrives.
  * ''sandbox/ps_cdp_surface.mjs'' — enumerates the ''Storage'' domain from the shipping build's own ''/json/protocol'' and from ''ChromeDevTools/devtools-protocol'' ''master''.

<file text ps_probe-output.txt>
probe run: 2026-09-01
  Playwright default (headless): 151.0.7922.34
  Playwright + PrivacySandboxAdsAPIsOverride: 151.0.7922.34
  Puppeteer default (headless): Chrome/151.0.7922.34
  Puppeteer + PrivacySandboxAdsAPIsOverride: Chrome/151.0.7922.34

expression                         Playwright default (headle  Playwright + PrivacySandbo  Puppeteer default (headles  Puppeteer + PrivacySandbox
---------------------------------  --------------------------  --------------------------  --------------------------  --------------------------
document.browsingTopics            function                    function                    function                    function                  
navigator.joinAdInterestGroup      function                    function                    function                    function                  
navigator.runAdAuction             function                    function                    function                    function                  
navigator.leaveAdInterestGroup     function                    function                    function                    function                  
window.sharedStorage               object                      object                      object                      object                    
sharedStorage.selectURL            function                    function                    function                    function                  
HTMLFencedFrameElement             function                    function                    function                    function                  
document.hasPrivateToken           function                    function                    function                    function                  
document.hasRedemptionRecord       function                    function                    function                    function                  
document.requestStorageAccess      function                    function                    function                    function                  
document.requestStorageAccessFor   function                    function                    function                    function                  
window.IdentityCredential (FedCM)  function                    function                    function                    function                  
navigator.userAgentData            object                      object                      object                      object                    
navigator.cookieDeprecationLabel   undefined                   undefined                   undefined                   undefined                 
cookieStore                        object                      object                      object                      object                    
PP:browsing-topics                 true                        true                        true                        true                      
PP:join-ad-interest-group          true                        true                        true                        true                      
PP:run-ad-auction                  true                        true                        true                        true                      
PP:attribution-reporting           true                        true                        true                        true                      
PP:shared-storage                  true                        true                        true                        true                      
PP:private-aggregation             true                        true                        true                        true                      
HTMLImageElement.attributionSrc    yes                         yes                         yes                         yes                       
HTMLAnchorElement.attributionSrc   yes                         yes                         yes                         yes                       
</file>

<file text ps_call_probe-output.txt>

=== localhost, Playwright default (151.0.7922.34) ===
  document.browsingTopics()              RETURNED []
  navigator.joinAdInterestGroup()        RETURNED undefined
  navigator.runAdAuction()               RETURNED null
  sharedStorage.set()                    RETURNED undefined
  sharedStorage.worklet.addModule()      OperationError: Rejecting load of https://localhost:8443/w.js due to unexpected MIME type.
  document.hasPrivateToken()             RETURNED false
  document.requestStorageAccess()        RETURNED undefined
  fetch(attributionReporting)            RETURNED 200

=== probe.example (NOT enrolled), Playwright default (151.0.7922.34) ===
  document.browsingTopics()              RETURNED []
  navigator.joinAdInterestGroup()        RETURNED undefined
  navigator.runAdAuction()               RETURNED null
  sharedStorage.set()                    RETURNED undefined
  sharedStorage.worklet.addModule()      OperationError: Rejecting load of https://probe.example:8444/w.js due to unexpected MIME type.
  document.hasPrivateToken()             RETURNED false
  document.requestStorageAccess()        RETURNED undefined
  fetch(attributionReporting)            RETURNED 200

=== probe.example + PrivacySandboxAdsAPIsOverride (151.0.7922.34) ===
  document.browsingTopics()              RETURNED []
  navigator.joinAdInterestGroup()        RETURNED undefined
  navigator.runAdAuction()               RETURNED null
  sharedStorage.set()                    RETURNED undefined
  sharedStorage.worklet.addModule()      OperationError: Rejecting load of https://probe.example:8444/w.js due to unexpected MIME type.
  document.hasPrivateToken()             RETURNED false
  document.requestStorageAccess()        RETURNED undefined
  fetch(attributionReporting)            RETURNED 200

=== probe.example + enrollment override for that origin (151.0.7922.34) ===
  document.browsingTopics()              RETURNED []
  navigator.joinAdInterestGroup()        RETURNED undefined
  navigator.runAdAuction()               RETURNED null
  sharedStorage.set()                    RETURNED undefined
  sharedStorage.worklet.addModule()      OperationError: Rejecting load of https://probe.example:8444/w.js due to unexpected MIME type.
  document.hasPrivateToken()             RETURNED false
  document.requestStorageAccess()        RETURNED undefined
  fetch(attributionReporting)            RETURNED 200
</file>

<file text ps_cdp_probe-output.txt>
  toggle OK    Storage.setInterestGroupTracking
  toggle OK    Storage.setInterestGroupAuctionTracking
  toggle OK    Storage.setSharedStorageTracking
  toggle FAIL  Storage.setAttributionReportingTracking: cdpSession.send: Protocol error (Storage.setAttributionReportingTracking): 'Storage.setAtt

== API calls from the page ==
  joinAdInterestGroup    ok undefined
  runAdAuction           ok null
  sharedStorage.set      ok undefined
  sharedStorage.addModule ok undefined
  sharedStorage.run      ok undefined

== CDP events received (7) ==
  Storage.interestGroupAuctionEventOccurred            {"eventTime":1788282880.844885,"type":"started","uniqueAuctionId":"BAA2639A8868AB941264DB3DB6CB5BED","auctionConfig":{"auctionSignals":{"pending":false,"value":null},"decisionLogicURL":"https://probe.example:8444/decide.
  Storage.interestGroupAuctionNetworkRequestCreated    {"type":"bidderJs","requestId":"06A218F8B3F436C7E8D3F44A2D2806C3","auctions":["BAA2639A8868AB941264DB3DB6CB5BED"]}
  Storage.interestGroupAuctionNetworkRequestCreated    {"type":"sellerJs","requestId":"C09A1952CA56CC58940B85D959CCD3A3","auctions":["BAA2639A8868AB941264DB3DB6CB5BED"]}
  Storage.sharedStorageAccessed                        {"accessTime":1788282880.902479,"scope":"window","method":"set","mainFrameId":"B3037C0FA13BA8CE8A07D1020A778F25","ownerOrigin":"https://probe.example:8444","ownerSite":"https://probe.example","params":{"key":"k","value":
  Storage.sharedStorageAccessed                        {"accessTime":1788282880.904117,"scope":"window","method":"addModule","mainFrameId":"B3037C0FA13BA8CE8A07D1020A778F25","ownerOrigin":"https://probe.example:8444","ownerSite":"https://probe.example","params":{"scriptSourc
  Storage.sharedStorageAccessed                        {"accessTime":1788282880.912412,"scope":"window","method":"run","mainFrameId":"B3037C0FA13BA8CE8A07D1020A778F25","ownerOrigin":"https://probe.example:8444","ownerSite":"https://probe.example","params":{"operationName":"p
  Storage.sharedStorageWorkletOperationExecutionFinished {"finishedTime":1788282880.913208,"executionTime":1050,"method":"run","operationId":"0","workletTargetId":"EBB22A0151158B1D33AB96EBCA57DF2F","mainFrameId":"B3037C0FA13BA8CE8A07D1020A778F25","ownerOrigin":"https://probe.e
</file>

<file text ps_cdp_surface-output.txt>

== Chromium 151.0.7922.34 — Storage domain ==
  commands (12): getInterestGroupDetails, setInterestGroupTracking, setInterestGroupAuctionTracking, getSharedStorageMetadata, getSharedStorageEntries, setSharedStorageEntry, deleteSharedStorageEntry, clearSharedStorageEntries, resetSharedStorageBudget, setSharedStorageTracking, runBounceTrackingMitigations, getRelatedWebsiteSets
  events   (5): interestGroupAccessed, interestGroupAuctionEventOccurred, interestGroupAuctionNetworkRequestCreated, sharedStorageAccessed, sharedStorageWorkletOperationExecutionFinished

== devtools-protocol master — Storage domain ==
  commands (2): runBounceTrackingMitigations, getRelatedWebsiteSets
  events   (0): (none)
</file>

**What the call probe does and does not license.** It shows that on this build, from a non-enrolled origin, every call returns a benign empty value rather than throwing. It does **not** establish that the APIs were functionally active — an empty Topics array is also the correct answer for a profile with no history. That ambiguity **is** the finding, and the page states it that way rather than as "the APIs work without enrollment".

**The non-Chrome probe failed and is not on the page as a measurement.** ''sandbox/ps_nonchrome_probe.mjs'' exists but Playwright's Firefox build will not launch in this container (''RenderCompositorSWGL failed mapping default framebuffer''), and it timed out at 180 s. The page's Firefox and Safari statements therefore rest on Bugzilla and vendor documentation, and the page says so in its own methodology section.

===== External sources, verified and rejected =====

Everything below was **fetched on 2026-09-01**, not recalled. Two ''sonnet'' sub-agents did a first pass; the URLs, quotes, counts and milestone numbers were then re-fetched by the authoring agent, which is how the errors in the next section were caught.

^ Source ^ Load-bearing fact ^ Verification ^ Decision ^
| ''privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies'' | The 2025-10-17 retirement of ten technologies | Fetched; the list and the CHIPS/FedCM/PST carve-out quoted **verbatim**; page footer reads "Last updated 2025-10-17 UTC" | **Used**, quoted |
| ''privacysandbox.google.com/overview/status'' | Per-feature status: Continue to support / Deprecate and remove / Discontinue / Do not launch; CHIPS default in Chrome 114; Storage Access default in Chrome 119 | Fetched; page states "Last updated: August 14, 2026" | **Used** |
| ''privacysandbox.google.com/private-advertising/enrollment'' | "We will no longer accept new account creation and enrollment" | Fetched, quoted verbatim | **Used, quoted on the content page.** A first draft only implied the consequence; a review pass pointed out the sentence was never actually written, so the quote and the ''%%--privacy-sandbox-enrollment-overrides%%'' workaround are now both on the page |
| ''chromestatus.com/api/v0/features/<id>'' × 19 | Ship milestones (M114/M115/M116/M108) and removal milestones (M152/M153/M155), all with status ''Proposed'' | Fetched individually through the JSON API | **Used** |
| ''chromiumdash.appspot.com/fetch_releases'' and ''fetch_milestone_schedule'' | Chrome stable = M152 since 2026-08-25; M153 stable_date 2026-09-08; M114 2023-05-30; M115 2023-07-18; M116 2023-08-15 | Fetched, parsed | **Used** |
| ''gov.uk/cma-cases/investigation-into-googles-privacy-sandbox-browser-changes'' | Case opened 2021-01-07, **closed 2025-10-17** | Fetched; "Case state: Closed" read off the page | **Used** |
| ''github.com/GoogleChrome/related-website-sets'' → ''related_website_sets.JSON'' | **70 sets, 320 member domains, 66 (94.3%) with an associated site** | Fetched and counted in this run | **Used** |
| GitHub API on ''privacysandbox/attestation'' and ''patcg-individual-drafts/topics'' | Both ''archived: true''; last pushes **2026-01-22** and **2025-11-07** | Fetched 2026-09-01 after a review pass flagged that the page treated these as live feeds | **Used.** The archival of the topics repo is also the reason there is no taxonomy v3 |
| ''ChromeDevTools/devtools-protocol'' commit history, bisected | The CDP ''Storage'' domain carried ''setAttributionReportingTracking'', ''setAttributionReportingLocalTestingMode'', ''sendPendingAttributionReports'' and four ''attributionReporting*'' events. Present in the descriptor at **2026-04-01**, absent at **2026-04-08** | Fetched five dated snapshots (2026-01-01, 02-01, 03-01, 03-15, 04-01) and four in April, resolving each date to a commit SHA through the GitHub commits API and pulling ''json/browser_protocol.json'' at that SHA | **Used.** This changed the page's advice: Attribution Reporting is measurable with first-class CDP events on a pre-April-2026 build, which the first draft denied |
| ''chromiumdash.appspot.com/fetch_milestone_schedule'' for M146–M151 | Branch points: M147 2026-03-09, M148 **2026-04-06** | Fetched | **Used as an inference, labelled as one.** M147 should carry the ARA surface; M148 branched inside the removal window and is a coin flip. **Not tested** — this run had only Chromium 151 |
| blink-dev, "Intent to Deprecate and Remove: Topics API" (thread ''_R85yctz4Rs'') | "Deprecate in M144 and then remove in M150"; "The Topics API was deprecated in Chrome-144 with a plan to remove it in Chrome-150. Currently the usage is 4.9% of page loads"; the phased M150 field-trial / M152 stub plan, quoted verbatim on the page | Fetched 2026-09-01. Thread opened 2025-11-07; the phased-plan message is dated 2026-06-12; later messages 2026-06-25 and 2026-07-08 | **Used.** A first draft asserted "the removal dates have already slipped twice" on a sub-agent's word; the primary source shows something more precise — deprecation landed at M144 **on schedule**, and it is the removal that moved M150 → M152 → M153. The page was rewritten to say that. It also turned the speculative field-trial hedge into a sourced fact |
| Chrome Platform Status ''motivation'' fields for Topics, Shared Storage, Protected Audience, RWS, Attribution Reporting | Chrome's own usage telemetry: Topics 13% then 4.9% of page loads; Shared Storage ~11% of page loads; Protected Audience ''joinAdInterestGroup()'' down ~100x and ''runAdAuction()'' down >10x with "virtually none" of auctions having winners; RWS 71 sets and ''requestStorageAccessFor'' ~0.95% of page loads; ARA no figure | Fetched 2026-09-01 through the JSON API | **Used, with the caveat foregrounded.** These are unaudited vendor telemetry with no stated methodology and a //page load// unit. They are on the page because they are the only post-April-2025 adoption numbers in existence, and the page says exactly that. The 71-vs-70 RWS discrepancy is published rather than reconciled |
| MDN header reference pages for ''Attribution-Reporting-Eligible'', ''Attribution-Reporting-Register-Source'', ''Attribution-Reporting-Register-Trigger'', ''Sec-Browsing-Topics'', ''Observe-Browsing-Topics'' | All five exist; ''Sec-Browsing-Topics'' "fails silently" and is deleted for an unenrolled caller | All five fetched, HTTP 200; the silent-failure sentence quoted verbatim from the ''Sec-Browsing-Topics'' page | **Used.** ''Sec-Shared-Storage-Writable'' was checked and returns 404 on MDN, so it is not on the page |
| GitHub API on ''GoogleChrome/related-website-sets'' and ''GoogleChrome/ip-protection'' | Both ''archived: true''; last pushes 2025-11-21 and 2025-11-03 | Fetched | **Used** |
| ''github.com/privacysandbox/attestation'' → ''enrollment_report.csv'' | **326 rows**; Topics 249, Protected Audience 237, Attribution Reporting 228, Shared Storage 205, Private Aggregation 193; 25 rows with no Chrome API | Fetched and counted in this run | **Used** |
| ''patcg-individual-drafts/topics'' → ''taxonomy_v2.md'' | **469 topics**; no v3 exists | Fetched and counted | **Used** |
| The local Chromium's ''PrivacySandboxAttestationsPreloaded/privacy-sandbox-attestations.dat'' | **263 sites**, manifest version **2025.7.18.0** | Read off disk and counted | **Used** |
| ''w3.org/TR/attribution/'' | "Attribution Level 1", **W3C Working Draft** | Fetched | **Used** |
| Bugzilla REST, bug **1979093** | "Remove checkbox in settings for feature that was never enabled", RESOLVED FIXED, target milestone **143 Branch**, last changed 2025-08-21 | Fetched through the REST API | **Used, with the tension flagged on the page** — the bug summary says the feature "was never enabled", which does not sit easily with the 2024 reporting about Firefox 128. Not resolved; both stated |
| Crossref, ''10.1007/978-3-031-85960-1_8'' | Zöllner, Feldmann, Dao, //A First Look at Cookies Having Independent Partitioned State//, PAM 2025, pp. 182–196 | Fetched | **Cited as existing; no figure quoted**, because Springer serves no abstract to a plain fetch and the paper was not read |
| ''chromedevtools.github.io'' rendered docs | CDP Storage domain contents | Page is JS-rendered; a plain fetch returns no protocol data | **Rejected.** Used the shipping browser's own ''/json/protocol'' and the ''devtools-protocol'' ''master'' JSON instead |
| ''privacysandbox.google.com/overview/api-availability'' and ''/overview/availability'' | Regional gating of the ads APIs | Both return **HTTP 404** on 2026-09-01; no replacement page found | **Not established.** Published on the page as an explicit unknown |
| Vendor and SEO material (''segwise.ai'', ''usercentrics.com'', ''seers.ai'', ''unisignin.com'', ''chrome-flags.com'', ''superchargebrowser.com'', ''browsercalendar.com'', ''fosspost.org'', ''rottenwifi.com'', ''cookie-script.com'', ''windowsforum.com'') | Privacy Sandbox shutdown dates, Chrome release dates, CHIPS explainers | Several carried dates that could not be reconciled with the ''chromestatus'' entries | **Rejected**, all of them. Every date on the page comes from ''chromestatus'', ''chromiumdash'' or Google's own pages |
| Trade press (''martech.org'', ''adexchanger.com'') | The retirement and the CMA release | Directionally correct but secondary | **Rejected as a citation**; used only as a pointer to the primary sources, which were then fetched |

===== Sub-agent findings that did not survive verification =====

The two research sub-agents were told to fetch rather than recall and largely did. Three of their conclusions were still wrong, and all three would have put a false statement on the page. Recording them because they are the same class of error the next run will make.

^ Sub-agent claim ^ What verification found ^
| "Private Aggregation was **already removed** in Chrome 152 (stable 2026-08-25, the version currently shipping)" | Chrome Platform Status feature 4683382919397376 reports status **''Proposed''**, desktop milestone 152. //Proposed// is not //shipped//. Chromium 151 exposes the API; nothing was verified as removed. The page says "removal proposed, M152" |
| "The live CDP spec contains **zero** ''interestGroup*'', ''attributionReporting*'' or ''sharedStorage*'' events in the ''Storage'' domain" | True of ''devtools-protocol'' **''master''** — which tracks tip-of-tree, not the shipping build. **Chromium 151's own ''/json/protocol'' has 12 such commands and 5 such events**, and this run received live ''sharedStorageAccessed'' and ''interestGroupAuctionEventOccurred'' events from it. The page reports both columns and dates each |
| "None of these APIs are on by default in any Chrome profile … because they require the ''PrivacySandboxAdsAPIsOverride'' base::Feature" | Measured false. All surfaces are present and all six Permissions-Policy features return ''true'' under Playwright's and Puppeteer's default flags in Chromium 151, and adding the override changed nothing. The page reports the measurement |

Two further sub-agent claims were **accepted but softened**: that ''chrome://topics-internals'' and friends are gone (circumstantial source-tree evidence only — the page does not mention them at all rather than assert either way), and the Safari PCM status (weakly sourced; the page does not claim PCM is removed).

===== What the corpus does not establish =====

  * **Nothing about Attribution Reporting in deployment.** 3 of 5,869 papers name it, none instrument it.
  * **No //independent// adoption measurement after February 2025.** The two crawl-based papers are from 2023 and February 2025; the retirement was announced in October 2025. Chrome's own removal notes claim usage collapsed and give numbers, now quoted on the page; this corpus cannot confirm or refute them, and the party that produced them is the party being measured.
  * **No CHIPS adoption study inside the seven venues.** ''rasaii2025_crumbs'' gives a 1.3% figure as a side measurement; the dedicated study is a PAM 2025 paper outside the corpus.
  * **Regional gating of the ads APIs.** Both Google availability pages 404. A DMA-driven gate is plausible but plausible is not measured. A first draft asserted that FLoC's 2021 origin trial excluded the EEA; that came from a sub-agent citing Wikipedia, no primary source for it could be found in this run, and it was removed from the page. What ''berke2022_privacy'' does say, and what the page now carries instead: the trial ran Chrome 89 to 91, spring to autumn 2021, for users with at least seven domains in their history, with //k// = 2000 giving 33,872 cohorts of which 2.3% were deemed sensitive. Published on the page as an explicit unknown with an instruction to test it rather than assume.
  * **Whether ''chrome://*-internals'' pages are still reachable in Chrome 152 stable.** Not tested: this container has no Chrome stable, only Playwright's Chromium 151.
  * **Whether the CHIPS default-on milestone is M114.** Chrome Platform Status and Google's status page agree on M114 for CHIPS but **disagree** for the Storage Access API (M115 versus "Chrome 119 and higher"). The page carries both and tells the reader to test if it matters.

===== Judgement calls =====

  * **A new page, not a broadened [[privacy:cookies]].** Reasoning in [[#Why a new page and not a broadened neighbour]].
  * **Title "Measuring the Privacy Sandbox", not "The Privacy Sandbox".** The page is about instrumentation and denominators, not about explaining the APIs; the specs do that better and the wiki's own rule is not to teach the platform.
  * **The retirement is the page's lead, not a footnote.** A reader who takes only one sentence away should take "these are being removed and your browser version is the measurement". The alternative — leading with the API descriptions — would have reproduced the 2022 roadmap, which is the failure mode the task spec warns about.
  * **Removal milestones are reported as //proposed//, not as fact.** They are the ''desktop'' milestone on a Chrome Platform Status entry whose status string is ''Proposed''. Two of them (M144, M150) had already slipped once before landing on M152/M153. The page dates them and does not promise them.
  * **Published the "7.7% of recent web crawls" silence figure** even though it is a keyword proxy, because the direction is unambiguous at that magnitude and the confound (a paper can measure the platform without naming an API) can only inflate the //true// figure slightly, not reverse it. The page names the proxy, and now also names the opposite confound a review pass raised: the denominator includes crawls with no reason to touch an ads API, so the figure is an upper bound on non-engagement rather than a defect rate.
  * **Did not publish the "Privacy Budget" or "k-anonymity" counts** at all: both regexes are dominated by generic differential-privacy usage and no qualified version was found that was worth the space.
  * **Did not publish a figure from the PAM 2025 CHIPS paper.** It is outside the corpus, Springer would not serve its abstract to this run, and nobody here read it.
  * **Kept the ''.cols'' NEARs visible** rather than tuning the matcher until they disappeared. Forty NEARs with a documented cause is a more honest artefact than zero NEARs from a looser matcher.

===== Bibliography =====

Six entries added to [[literature:bibliography]] before the page was saved, duplicate-checked by key **and** by DOI/URL against a fresh ''?do=export_raw'' of the live page (718 → 724 entries, zero duplicate keys):

''berke2022_privacy'', ''turati2023_locality'', ''calderonio2024_fledging'', ''alvim2024_privacy'', ''mcquistin2024_first'', ''nisenoff2025_exploiting''.

Generated with ''scripts/bibgen.mjs''. Two needed hand-completion because PETS and USENIX index records carry no authors: the PoPETs authors came from ''petsymposium.org/popets/2023/popets-2023-0101.php'' and the USENIX authors from the venue landing page, both fetched with a browser User-Agent. Reused without change: ''jha2023_topics'', ''beugin2024_interest'', ''ali2023_navigating'', ''lin2024_browsing'', ''rasaii2025_crumbs'', ''bahrami2025_cookieguard'', ''kancherla2025_least''.

After each save, ''literature:bibliography'' and the page were purged (''?purge=true'') and the rendered DOM re-checked, counting only inside the ''%%<!-- wikipage start -->%%'' … ''%%<!-- wikipage stop -->%%'' markers so that the theme's own chrome is not counted.

Counts below are for [[privacy:privacy_sandbox]] only. This page's own heading and table counts are deliberately not asserted, because every edit to this paragraph changes them and a self-referential count can never be right for long; what //is// asserted about this page is that it renders **7** downloadable file blocks and **zero** red links.

^ Count ^ [[privacy:privacy_sandbox]] ^
| citation markers in the wiki source | **33** |
| distinct citekeys among them | **13** |
| ''bibtex_citekey'' spans in the rendered DOM | **66** |
| ''%%<dt>%%'' entries in the rendered ''bibtex_references'' list | **13** |
| ''%%<table>%%'' in the rendered body | **12** |
| ''%%<h1>%%''–''%%<h4>%%'' in the rendered body | **23** |
| ''%%<WRAP>%%'' boxes | **5** |
| ''wikilink2'' (red links) | **0** |
| downloadable ''%%<file>%%'' blocks | **1** |

**Read the first three rows together, because two reviewers independently got them wrong and then disagreed with each other.** The bibtex plugin emits **two** ''bibtex_citekey'' spans per source marker — an anchor and a link — so 33 markers render as 66 spans, and neither number is the reference count: 33 markers over 13 distinct keys give 13 entries in the reference list. The rendered heading count is one higher than the source heading count because ''%%~~DISCUSSION~~%%'' contributes its own heading. And a source-side count is not a substitute for a rendered one on either page: the embedded script output here contains ''%%==%%''- and ''%%##%%''-prefixed lines that a naive source-side heading regex picks up as headings (44 against a real 22).

Two earlier versions of this paragraph were wrong — first 58/22, then 60/21/4, both counted with an unscoped grep and both before the last round of edits. A review pass could not reproduce either. It is recorded rather than quietly corrected because a provenance page whose own self-check does not reproduce is worse than one that has none, and because getting a trivial count wrong twice is the honest illustration of why the rest of the page is scripted.

===== Folding script =====

<file javascript ps_fold.mjs>
// Privacy Sandbox API name folder for full-text probes.
//
// Why this exists: the Privacy Sandbox APIs have been renamed at least once
// each (FLoC -> Topics, TURTLEDOVE -> FLEDGE -> Protected Audience, Trust
// Tokens -> Private State Tokens, First-Party Sets -> Related Website Sets),
// so a paper published in 2022 and a paper published in 2026 name the same
// mechanism differently. A count of "Protected Audience papers" that does not
// fold in "FLEDGE" is wrong by an order of magnitude in this corpus.
//
// Each family is an ordered list of ALTERNATIVE spellings. Every regex here is
// deliberately narrow, because the wide version is what produces a confident
// wrong number:
//
//   * `\bCHIPS\b` alone matched 231 papers — silicon, not cookies. It is only
//     counted inside a 200-character window of "cookie" or "partition", or
//     when the acronym is spelled out.
//   * `\bIPA\b` alone matched papers about Instructions Per Access and the
//     International Phonetic Alphabet; `\bPPA\b` matched "Preference
//     Profiling Attack". Both bare acronyms are dropped; only the spelled-out
//     names count.
//   * `IP Protection` unqualified is intellectual property. It is only counted
//     next to Chrome / Privacy Sandbox / proxy.
//   * `the Topics` (without "API") matched ordinary English and is dropped.
//   * `Privacy Budget` is a generic differential-privacy term; it is only
//     counted next to fingerprint / Chrome / Sandbox, and even then the page
//     does not publish the figure (see the provenance page).
//
// Every regex is applied to whitespace-collapsed text with soft hyphens
// rejoined, because a PDF line break inside "Protected Audi-\nence" otherwise
// hides the match.

export const FAMILIES = [
  {
    key: 'topics',
    label: 'Topics API',
    also: 'FLoC (predecessor, withdrawn 2022)',
    // `FLoC 2018` is the Federated Logic Conference and appears in the
    // references of formal-methods papers, so the acronym is only counted when
    // it is not immediately followed by a year and not next to "Logic".
    re: /Topics\s+API|browsingTopics|Federated\s+Learning\s+of\s+Cohorts|\bFLoC\b(?!\s*(?:'?\d{2,4}|Logic))(?<!Logic\s+Conference,?\s)/i,
  },
  {
    key: 'protected-audience',
    label: 'Protected Audience',
    also: 'FLEDGE, TURTLEDOVE',
    // NOT case-insensitive. `/\bFLEDGE\b/i` matches "full-fledge crawling
    // system" and "a full-fledge experience" — the hyphen is a word boundary,
    // so \b does not help. Two papers (de-Kodi WWW 2020, Android SmartTVs
    // USENIX 2021) were in this family until the acronyms were pinned to
    // upper case. Found by a review pass on 2026-09-01, not by the author.
    // "interest group" bare also matched 234 papers (political science,
    // federated learning, recommender systems); only ad-tech phrasing counts.
    re: /[Pp]rotected [Aa]udience|FLEDGE|TURTLEDOVE|joinAdInterestGroup|runAdAuction|leaveAdInterestGroup|ad interest group|interest[- ]group (?:bidding|auction)/,
  },
  {
    key: 'attribution-reporting',
    label: 'Attribution Reporting API',
    also: 'Conversion Measurement API',
    // The bare lowercase noun phrase is generic ad-tech English: a 2026 PETS
    // paper used it of *Apple's* SKAdNetwork ("delays and anonymises
    // attribution reporting to advertisers"). Two forms are accepted and
    // nothing else: the capitalised proper name, in any position, and the
    // phrase followed by "API" in any case (papers write "Attribution
    // reporting API" and "privacy sandbox attribution reporting api").
    re: /Attribution Reporting|[Aa]ttribution[- ][Rr]eporting [Aa][Pp][Ii]|Conversion Measurement API|attributionsrc|attributionSrc|aggregatable attribution/,
  },
  {
    key: 'private-aggregation',
    label: 'Private Aggregation / Aggregation Service',
    also: '',
    // Bare "Aggregation Service" matched a 2022 outage paper and a 2012
    // web-analytics paper; it is only counted next to the Privacy Sandbox.
    re: /Private\s+Aggregation\s+API|aggregatable\s+report|Aggregation\s+Service\b(?=[\s\S]{0,200}?(?:Privacy\s+Sandbox|aggregatable|Shared\s+Storage|Attribution\s+Reporting))|(?:Privacy\s+Sandbox|aggregatable|Shared\s+Storage|Attribution\s+Reporting)[\s\S]{0,200}?Aggregation\s+Service\b/i,
  },
  {
    key: 'shared-storage',
    label: 'Shared Storage API',
    also: '',
    re: /Shared\s+Storage\s+API|sharedStorage|selectURL/i,
  },
  {
    key: 'fenced-frames',
    label: 'Fenced Frames',
    also: '',
    re: /Fenced\s+Frames?|fencedframe/i,
  },
  {
    key: 'chips',
    label: 'CHIPS (partitioned cookies)',
    also: 'the Partitioned cookie attribute',
    // NOT case-insensitive, deliberately: lowercase "chips" is silicon, and a
    // WPA3 paper that says "anti-clogging cookie" a few lines from "chips"
    // lands in the family if the acronym is folded to lower case. The
    // spelled-out name and the attribute are matched case-insensitively via
    // explicit character classes.
    // Qualifiers measured: the bare acronym is never counted alone, and
    // "partition" is NOT enough of a qualifier — DRAM bank partitioning put
    // three Rowhammer/GPU papers in the family.
    re: /[Cc]ookies [Hh]aving [Ii]ndependent [Pp]artitioned [Ss]tate|CHIPS(?=[\s\S]{0,200}?[Cc]ookie)|[Cc]ookie[\s\S]{0,200}?CHIPS|[Pp]artitioned attribute|[Pp]artitioned cookies?/,
  },
  {
    key: 'storage-access',
    label: 'Storage Access API',
    also: '',
    re: /Storage\s+Access\s+API|requestStorageAccess/i,
  },
  {
    key: 'rws',
    label: 'Related Website Sets',
    also: 'First-Party Sets',
    // NOT case-insensitive. Lowercase "the first party sets the cookies" is a
    // verb phrase, and it put a 2021 WWW cookie-swapping paper in this family.
    re: /Related Website Sets?|First[- ]Party Sets/,
  },
  {
    key: 'private-state-tokens',
    label: 'Private State Tokens',
    also: 'Trust Tokens',
    re: /Private\s+State\s+Tokens?|Trust\s+Tokens?/i,
  },
  {
    key: 'fedcm',
    label: 'FedCM',
    also: 'Federated Credential Management',
    re: /\bFedCM\b|Federated\s+Credential\s+Management/i,
  },
  {
    key: 'uach',
    label: 'User-Agent Client Hints / UA reduction',
    also: '',
    re: /User[- ]Agent\s+Client\s+Hints|Sec-CH-UA|User[- ]Agent\s+[Rr]eduction/i,
  },
  {
    key: 'ip-protection',
    label: 'IP Protection',
    also: 'Gnatcatcher',
    re: /Gnatcatcher|Willful\s+IP\s+Blindness|IP\s+Protection[\s\S]{0,120}?(?:Chrome|Privacy\s+Sandbox|proxy)|(?:Chrome|Privacy\s+Sandbox)[\s\S]{0,120}?IP\s+Protection/i,
  },
  {
    key: 'bounce-mitigations',
    label: 'Bounce Tracking Mitigations (the Chrome feature)',
    also: '',
    // Deliberately NOT `bounce tracking`: that is the phenomenon, measured by
    // 12 papers and covered by privacy:cookie_syncing. This family counts the
    // Chrome countermeasure by name.
    re: /Bounce\s+Tracking\s+Mitigation/i,
  },
  {
    key: 'ps-android',
    label: 'Privacy Sandbox on Android',
    also: 'SDK Runtime',
    re: /Privacy\s+Sandbox\s+on\s+Android|SDK\s+Runtime/i,
  },
];

// The umbrella term itself. Unambiguous: nothing else in a security corpus is
// called a "Privacy Sandbox".
export const UMBRELLA = /Privacy\s+Sandbox/i;

// Rejected patterns, kept here so the next run does not re-add them. Each was
// measured against the corpus and produced the paper count in the comment.
export const REJECTED = [
  ['/\\bCHIPS\\b/ unqualified', 231, 'silicon; Rowhammer and GPU papers'],
  ['/\\bCHIPS\\b/ within 200 chars of "partition"', 8, 'DRAM bank partitioning — 3 of the 8 were silicon'],
  ['/\\bthe Topics\\b/', 216, 'ordinary English'],
  ['/\\bIPA\\b/', 53, 'shared with Interoperable Private Attribution only rarely'],
  ['/\\bPPA\\b/', 23, '"Preference Profiling Attack", among others'],
  ['/IP Protection/ unqualified', 31, 'intellectual property'],
  ['/k-anonymity/', 97, 'generic privacy term, not Privacy Sandbox specific'],
  ['/Privacy Budget/ unqualified', 106, 'generic differential-privacy term'],
  ['/SPARROW|DOVEKEY|PARAKEET/', 24, 'matches "sparrow"/"parakeet" in unrelated papers'],
  ['/interest\\s+group/ (bare)', 234, 'political science, federated learning, recommender systems'],
  ['/bounce\\s+tracking/', 12, 'the phenomenon, not the Chrome countermeasure — see privacy:cookie_syncing'],
  ['/\\bFLoC\\b/ before a year', 3, '"FLoC 2018" is the Federated Logic Conference'],
  ['/Aggregation Service/ (bare)', 2, 'a 2022 outage paper and a 2012 analytics paper, neither about the Sandbox'],
  ['/\\bFLEDGE\\b/i', 2, '"full-fledge crawling system" — the hyphen is a word boundary'],
  ['/First[- ]Party Sets/i', 1, '"the first party sets the cookies" is a verb phrase'],
  ['/attribution reporting/i (bare, lowercase)', 1, "Apple's SKAdNetwork \"anonymises attribution reporting\""],
];

export function collapse(raw) {
  return raw.replace(/-\n/g, '').replace(/\s+/g, ' ');
}
</file>

===== Report script output =====

Produced by ''node scripts/report_privacy_sandbox.mjs''. Unedited.

<file text report_privacy_sandbox-output.txt>
# privacy:privacy_sandbox — every published figure
# generated by scripts/report_privacy_sandbox.mjs

DENOMINATOR (full-text queries): 5869 papers with a paper.cols.txt
  across 7 venues (CCS, IMC, NDSS, PETS, USENIX Sec, TheWebConf, IEEE S&P), 2010-2026.
  2025-2026 are provisional: CCS/IMC 2026 not held, IEEE S&P/WWW 2026 under-selected.

## 1. Reach: how much of the corpus is about this at all

papers naming "Privacy Sandbox" at all      : 43 (0.7% of 5869)
papers naming >=1 API family (folded)       : 67 (1.1%)
papers naming "Privacy Sandbox" >=5 times   : 9 (0.2%)

This is the page's central limitation and it is printed first on purpose:
the Privacy Sandbox literature inside these seven venues is a few dozen papers,
and the double-digit set that measures anything is smaller still.

### Papers naming "Privacy Sandbox" 5+ times, most-naming first
   48x  2025 CCS      exploiting-the-shared-storage-api
   18x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
   14x  2023 NDSS     navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
   12x  2026 PETS     the-pet-paradox-how-amazon-instrumentalises-pets-in-sidewalk-to-entrench-its-inf
   11x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
    6x  2026 NDSS     snpeek-side-channel-analysis-for-privacy-applications-on-confidential-vms
    5x  2024 PETS     overprofiling-analysis-on-major-internet-players
    5x  2025 CCS      fingerprinting-sdks-for-mobile-apps-and-where-to-find-them-understanding-the-mar
    5x  2025 PETS     user-centric-textual-descriptions-of-privacy-enhancing-technologies-for-ad-track

## 2. Papers per API family (denominator 5869 papers with full text)
Folded through scripts/ps_fold.mjs: former names counted with current ones.

API family                                        Former names                        Papers  Share
------------------------------------------------  ----------------------------------  ------  -----
Topics API                                        FLoC (predecessor, withdrawn 2022)  22      0.4%
User-Agent Client Hints / UA reduction            -                                   10      0.2%
Protected Audience                                FLEDGE, TURTLEDOVE                  8       0.1%
Privacy Sandbox on Android                        SDK Runtime                         7       0.1%
CHIPS (partitioned cookies)                       the Partitioned cookie attribute    5       0.1%
Private State Tokens                              Trust Tokens                        5       0.1%
Fenced Frames                                     -                                   4       0.1%
Related Website Sets                              First-Party Sets                    4       0.1%
Attribution Reporting API                         Conversion Measurement API          3       0.1%
Shared Storage API                                -                                   3       0.1%
Private Aggregation / Aggregation Service         -                                   2       0.0%
Storage Access API                                -                                   2       0.0%
FedCM                                             Federated Credential Management     1       0.0%
IP Protection                                     Gnatcatcher                         0       0.0%
Bounce Tracking Mitigations (the Chrome feature)  -                                   0       0.0%

### Per-family paper lists (all of them, so nothing is hidden by a top-N cut)

  -- Topics API (22 papers) --
      162x  2022 CCS      privacy-limitations-of-interest-based-advertising-on-the-web-a-post-mortem-empir
      109x  2024 CCS      the-privacy-utility-trade-off-in-the-topics-api
       94x  2023 PETS     locality-sensitive-hashing-does-not-guarantee-privacy-attacks-on-googles-floc-an
       93x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
       72x  2023 PETS     on-the-robustness-of-topics-api-to-a-re-identification-attack
       33x  2025 CCS      exploiting-the-shared-storage-api
       22x  2025 PETS     user-centric-textual-descriptions-of-privacy-enhancing-technologies-for-ad-track
       10x  2024 PETS     overprofiling-analysis-on-major-internet-players
        8x  2026 PETS     gaze3p-gaze-based-prediction-of-user-perceived-privacy
        4x  2022 IMC      what-factors-affect-targeting-and-bids-in-online-advertising-a-field-measurement
        4x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
        3x  2022 IMC      measuring-uid-smuggling-in-the-wild
        2x  2025 IMC      a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
        2x  2025 NDSS     cascading-spy-sheets-exploiting-the-complexity-of-modern-css-for-email-and-browser-fingerprinting
        2x  2025 PETS     understanding-regional-filter-lists-efficacy-and-impact
        2x  2026 NDSS     cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews
        1x  2023 PETS     usability-and-enforceability-of-global-privacy-control
        1x  2024 PETS     the-devil-is-in-the-details-detection-measurement-and-lawfulness-of-server-side
        1x  2024 PETS     website-data-transparency-in-the-browser
        1x  2025 PETS     unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie
        1x  2025 USENIX   websites-global-privacy-control-compliance-at-scale-and-over-time
        1x  2026 NDSS     are-your-sites-truly-isolated-automatically-detecting-logic-bugs-in-site-isolation-implementations

  -- Protected Audience (8 papers) --
      150x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
       26x  2023 NDSS     navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
       11x  2025 CCS      exploiting-the-shared-storage-api
        7x  2024 CCS      the-privacy-utility-trade-off-in-the-topics-api
        5x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        2x  2022 IMC      what-factors-affect-targeting-and-bids-in-online-advertising-a-field-measurement
        1x  2025 NDSS     you-can-rand-but-you-cant-hide-a-holistic-security-analysis-of-google-fuchsias-and-gvisors-network-stack
        1x  2026 PETS     the-pet-paradox-how-amazon-instrumentalises-pets-in-sidewalk-to-entrench-its-inf

  -- Attribution Reporting API (3 papers) --
        2x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        2x  2025 IMC      a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
        1x  2026 NDSS     snpeek-side-channel-analysis-for-privacy-applications-on-confidential-vms

  -- Private Aggregation / Aggregation Service (2 papers) --
        6x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
        4x  2025 CCS      exploiting-the-shared-storage-api

  -- Shared Storage API (3 papers) --
      162x  2025 CCS      exploiting-the-shared-storage-api
        1x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        1x  2026 NDSS     are-your-sites-truly-isolated-automatically-detecting-logic-bugs-in-site-isolation-implementations

  -- Fenced Frames (4 papers) --
       21x  2025 CCS      exploiting-the-shared-storage-api
       12x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
        3x  2023 NDSS     navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
        1x  2026 NDSS     are-your-sites-truly-isolated-automatically-detecting-logic-bugs-in-site-isolation-implementations

  -- CHIPS (partitioned cookies) (5 papers) --
       31x  2025 PETS     intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
       11x  2023 IMC      understanding-the-privacy-risks-of-popular-search-engine-advertising-systems
        4x  2025 IMC      cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
        2x  2025 WWW      least-privilege-access-for-persistent-storage-mechanisms-in-web-browsers
        1x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi

  -- Storage Access API (2 papers) --
        2x  2024 IMC      a-first-look-at-related-website-sets
        2x  2025 PETS     tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we

  -- Related Website Sets (4 papers) --
       63x  2024 IMC      a-first-look-at-related-website-sets
        2x  2022 PETS     who-knows-i-like-jelly-beans-an-investigation-into-search-privacy
        2x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        1x  2021 NDSS     whos-hosting-the-block-party-studying-third-party-blockage-of-csp-and-sri

  -- Private State Tokens (5 papers) --
       23x  2023 NDSS     navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
        1x  2024 IMC      browser-polygraph-efficient-deployment-of-coarse-grained-browser-fingerprints-fo
        1x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        1x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
        1x  2025 NDSS     you-can-rand-but-you-cant-hide-a-holistic-security-analysis-of-google-fuchsias-and-gvisors-network-stack

  -- FedCM (1 papers) --
        3x  2025 IEEE-SP  only-as-strong-as-the-weakest-link-on-the-security-of-brokered-single-sign-on-on

  -- User-Agent Client Hints / UA reduction (10 papers) --
       12x  2024 IEEE-SP  tabbed-out-subverting-the-android-custom-tab-security-model
        6x  2026 PETS     an-improved-entropy-measure-for-web-browser-fingerprinting-risk
        3x  2025 PETS     how-unique-is-whose-web-browser-the-role-of-demographics-in-browser-fingerprinti
        2x  2023 PETS     your-drm-can-watch-you-too-exploring-the-privacy-implications-of-browsers-mis-im
        2x  2025 CCS      exploiting-the-shared-storage-api
        2x  2025 IMC      a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
        1x  2022 USENIX   phish-in-sheeps-clothing-exploring-the-authentication-pitfalls-of-browser-finger
        1x  2023 USENIX   account-security-interfaces-important-unintuitive-and-untrustworthy
        1x  2024 USENIX   arcanum-detecting-and-evaluating-the-privacy-risks-of-browser-extensions-on-web
        1x  2025 CCS      hidden-in-plain-bytes-investigating-interpersonal-account-compromise-with-data-e

  -- IP Protection (0 papers) --

  -- Bounce Tracking Mitigations (the Chrome feature) (0 papers) --

  -- Privacy Sandbox on Android (7 papers) --
        5x  2024 USENIX   exploring-covert-third-party-identifiers-through-external-storage-in-the-android
        4x  2023 USENIX   union-under-duress-understanding-hazards-of-duplicate-resource-mismediation-in-a
        3x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        2x  2025 PETS     your-signal-their-data-an-empirical-privacy-analysis-of-wireless-scanning-sdks-i
        1x  2023 PETS     usability-and-enforceability-of-global-privacy-control
        1x  2024 CCS      the-privacy-utility-trade-off-in-the-topics-api
        1x  2025 CCS      fingerprinting-sdks-for-mobile-apps-and-where-to-find-them-understanding-the-mar

## 3. By year: when the corpus started noticing

Year   papers  PS-named  share  any-API  share
-----  ------  --------  -----  -------  -----
2010   118     0         0.0%   0        0.0%
2011   116     0         0.0%   0        0.0%
2012   151     0         0.0%   0        0.0%
2013   125     0         0.0%   0        0.0%
2014   165     0         0.0%   0        0.0%
2015   190     0         0.0%   0        0.0%
2016   182     0         0.0%   0        0.0%
2017   232     0         0.0%   0        0.0%
2018   254     0         0.0%   0        0.0%
2019   402     0         0.0%   0        0.0%
2020   402     1         0.2%   1        0.2%
2021   380     1         0.3%   2        0.5%
2022   546     4         0.7%   7        1.3%
2023   720     7         1.0%   12       1.7%
2024   701     13        1.9%   17       2.4%
2025*  770     13        1.7%   21       2.7%
2026*  415     4         1.0%   7        1.7%
* 2025-2026 provisional (CCS/IMC 2026 not held; IEEE S&P/WWW 2026 under-selected).

## 4. Regexes measured and REJECTED, with the paper count each produced
Kept so the next run does not re-add them.

Rejected pattern                             Papers it matched  Why rejected
-------------------------------------------  -----------------  --------------------------------------------------------------------------
/\bCHIPS\b/ unqualified                      231                silicon; Rowhammer and GPU papers
/\bCHIPS\b/ within 200 chars of "partition"  8                  DRAM bank partitioning — 3 of the 8 were silicon
/\bthe Topics\b/                             216                ordinary English
/\bIPA\b/                                    53                 shared with Interoperable Private Attribution only rarely
/\bPPA\b/                                    23                 "Preference Profiling Attack", among others
/IP Protection/ unqualified                  31                 intellectual property
/k-anonymity/                                97                 generic privacy term, not Privacy Sandbox specific
/Privacy Budget/ unqualified                 106                generic differential-privacy term
/SPARROW|DOVEKEY|PARAKEET/                   24                 matches "sparrow"/"parakeet" in unrelated papers
/interest\s+group/ (bare)                    234                political science, federated learning, recommender systems
/bounce\s+tracking/                          12                 the phenomenon, not the Chrome countermeasure — see privacy:cookie_syncing
/\bFLoC\b/ before a year                     3                  "FLoC 2018" is the Federated Logic Conference
/Aggregation Service/ (bare)                 2                  a 2022 outage paper and a 2012 analytics paper, neither about the Sandbox
/\bFLEDGE\b/i                                2                  "full-fledge crawling system" — the hyphen is a word boundary
/First[- ]Party Sets/i                       1                  "the first party sets the cookies" is a verb phrase
/attribution reporting/i (bare, lowercase)   1                  Apple's SKAdNetwork "anonymises attribution reporting"

## 5. The measuring papers: population, instrument, and measured result
Denominator per row is the paper's OWN population, printed in the table.
Every prevalence string below is verbatim from detection[].prevalence.

### CCS 2022 — Privacy Limitations of Interest-based Advertising on The Web: A Post-mortem Empirical Analysis of Google's FLoC.
    mechanism: FLoC
    population: comScore Web Behavior Database n=93808 other (pre-existing-dataset) | comScore Web Behavior Database n=2073405 other (pre-existing-dataset) | 2017 U.S. Census Bureau Current Population Survey n=? other (pre-existing-dataset) | 2017 U.S. Census Bureau American Community Survey n=? other (pre-existing-dataset)
    temporal:   existing-dataset 2017-01..2017-12
    crawlConfig: null (no crawl-config object extracted)
      * unique FLoC cohort ID sequences
          technique : Counted unique sequences across four weekly cohort recomputations.
          metric    : fraction of samples uniquely identifiable
          PREVALENCE: More than 50% after 3 weeks and 95% after 4 weeks.
      * fingerprinting-enhanced cohort unicity
          technique : Combined cohort ID sequences with U.S. state as a weak fingerprint proxy.
          metric    : fraction of uniquely identifiable samples
          PREVALENCE: (null)
      * demographic browsing differences
          technique : Compared top-domain visit-frequency distributions using chi-square tests.
          metric    : chi-square test significance
          PREVALENCE: p < 0.0001 for every tested demographic subpopulation and domain set.
      * demographic t-closeness violations
          technique : Compared cohort demographic frequencies with population frequencies across representative panels.
          metric    : fraction of cohorts violating t-closeness
          PREVALENCE: No greater than random chance for race or income.

### PETS 2023 — Locality-Sensitive Hashing Does Not Guarantee Privacy! Attacks on Google's FLoC and the MinHash Hierarchy System
    mechanism: FLoC
    population: MovieLens n=125000 documents (pre-existing-dataset) | Porto Taxi dataset n=30000 other (top-n)
    temporal:   existing-dataset ?..? | existing-dataset ?..?
    crawlConfig: null (no crawl-config object extracted)
      * FLoC browsing-history reconstruction
          technique : GAN-generated histories filtered by integer programming to match SimHash
          metric    : fraction of target history reconstructed
          PREVALENCE: more than 10% of browsing history for at least 30% of users
      * MinHash trajectory narrowing
          technique : Partitioned checkpoints by comparing vehicle and checkpoint MinHash signatures
          metric    : ratio of possibly visited checkpoints
          PREVALENCE: around 10% ± 5% of checkpoints on average
      * SimHash pre-image generation
          technique : Linear integer program maximizing a matching subset of domains
          metric    : success rate and runtime
          PREVALENCE: 100% success at length 5, declining to 11% at length 25
      * MinHash checkpoint identification
          technique : Classified checkpoints as certainly absent, likely present, or unknown
          metric    : possible-checkpoint set size
          PREVALENCE: 805.5 ± 439.7 checkpoints out of 7744

### PETS 2023 — On the Robustness of Topics API to a Re-Identification Attack
    mechanism: Topics
    population: EasyPIMS n=268 human-participants (convenience) | EasyPIMS browsing-history dataset n=50976 websites (pre-existing-dataset)
    temporal:   passive-collection 2022..2022
    crawlConfig: null (no crawl-config object extracted)
      * cross-site re-identification
          technique : Match denoised reconstructed profiles across two simulated website audiences
          metric    : probability of correct re-identification
          PREVALENCE: 15–17% for a pool of 1,000 users
      * profile uniqueness
          technique : Compute k-anonymity of denoised reconstructed profiles
          metric    : fraction of users that are non-2-anonymous
          PREVALENCE: 35–42% with a population of 100,000 personas
      * false re-identification
          technique : Exact profile matching against a wrong user across simulated websites
          metric    : false-positive probability
          PREVALENCE: less than 0.2%

### CCS 2024 — The Privacy-Utility Trade-off in the Topics API.
    mechanism: Topics
    population: AOL search logs dataset n=436005 human-participants (pre-existing-dataset) | AOL search logs dataset with Citizen Lab classification n=211313 human-participants (pre-existing-dataset) | AOL search logs dataset with Google Topics classification n=198023 human-participants (pre-existing-dataset)
    temporal:   existing-dataset 2006-03-01..2006-05-31
    crawlConfig: null (no crawl-config object extracted)
      * Third-party-cookie re-identification
          technique : Quantitative information-flow channel modeling of cookies and browsing histories.
          metric    : average-case Bayes vulnerability
          PREVALENCE: Analysts using third-party cookies always succeeded on average.
      * Topics API user re-identification
          technique : Computed Bayes leakage and average- and max-case channel capacities.
          metric    : multiplicative Bayes leakage
          PREVALENCE: Complete-pipeline leakage was 0.0028% and 0.0162% of cookie leakage for Citizen Lab and Google v1.
      * Topic popularity inference
          technique : Kronecker-product channel and counting-query analysis over reported topics.
          metric    : probability of correctly counting topic occurrences
          PREVALENCE: With 10 individuals, correct counting probability was 0.56% for both taxonomy sizes.
      * Distinguishing genuine from random topics
          technique : IBA gain function evaluated on bounded-noise and differential-privacy channels.
          metric    : posterior IBA expected gain
          PREVALENCE: Posterior expected gain was 95.8% for Citizen Lab and 96.2% for Google v1.

### PETS 2024 — Interest-disclosing Mechanisms for Advertising are Privacy-Exposing (not Preserving)
    mechanism: Topics
    population: CrUX top-list n=1000000 websites (top-n) | Tranco n=1000000 websites (top-n) | Google static mapping n=9254 domains (pre-existing-dataset) | Mozilla-reported browsing-history distribution n=52000 human-participants (pre-existing-dataset) | synthetic dataset generated from published browsing distributions n=250000 other (random) | CrUX top-list n=10000 websites (top-n)
    temporal:   existing-dataset 2022-12..2023-06
    crawlConfig: null (no crawl-config object extracted)
      * Topics noise removal
          technique : Repeated-topic checks plus a ten-domain occurrence threshold
          metric    : accuracy, precision, TPR, FPR, and proportion of noisy topics removed
          PREVALENCE: about 25% of noisy topics in one-shot scenarios; 49% after 15 epochs and 94% after 30 epochs
      * Cross-site re-identification
          technique : Match users across two advertisers by shared genuine top-five topics
          metric    : proportion of users uniquely or probabilistically re-identified
          PREVALENCE: 0.4% uniquely re-identified in one-shot; 57% after 15 epochs and 75% after 30 epochs
      * Topics classification utility
          technique : Compare Topics predictions with Google mapping, manual judgments, and Cloudflare categories
          metric    : accuracy, balanced accuracy, Jaccard, Dice, overlap, and at-least-one-correct ratio
          PREVALENCE: at least one topic matched in 57% of categorized top-million domains
      * Subdomain topic manipulation
          technique : Prepend topic-associated WordNet words to top-site domains
          metric    : number of successful targeted additions and untargeted eliminations
          PREVALENCE: more than 114 targeted additions for half of the initial 10k domains

### USENIX 2024 — Fledging Will Continue Until Privacy Improves: Empirical Analysis of Google's Privacy-Preserving Targeted Advertising
    mechanism: Protected Audience
    population: Tranco n=70000 domains (top-n) | custom seed list n=500 domains (purposive)
    temporal:   live-crawl 2023-06..2023-09
    crawlConfig: browsers=["Chrome"] headless=not-stated stateful=stateless consent=no-interaction depth=landing-plus-subpages
      * FLEDGE API adoption
          technique : Instrumented API calls during automated domain crawling.
          metric    : share of visited sites
          PREVALENCE: 9.5% (n = 6,682) of 70,000 sites
      * Google auction dominance
          technique : Logged and attributed observed FLEDGE auctions to sellers.
          metric    : share of observed auctions
          PREVALENCE: Google Ad Manager ran 11,941 of 11,959 auctions (99.8%)
      * Interest-group creation
          technique : Captured browser API calls and inspected Chrome Interest Group storage.
          metric    : number of observed interest groups
          PREVALENCE: 15,935 interest groups
      * Interest-group persistence attempts
          technique : Inspected expiration values in joinInterestGroup calls.
          metric    : share of join calls exceeding the limit
          PREVALENCE: 30.90% (n = 94,673) attempted expiration times greater than 30 days
      * FLEDGE privacy attacks
          technique : Controlled web pages, code review, documentation study, and custom exploits.
          metric    : number of attacks
          PREVALENCE: 12 novel attacks across tracking, cross-site leakage, service disruption, and pollution
      * Owner-sniffing attack performance
          technique : Repeated Puppeteer experiments over lists of candidate owners.
          metric    : completion time and accuracy
          PREVALENCE: Approximately 4.2 seconds for 500 owners; fully accurate in all runs

### CCS 2025 — Exploiting the Shared Storage API.
    mechanism: Shared Storage
    population: Google's Privacy Sandbox Enrollment Report and privacy-sandbox-attestations.dat n=289 domains (exhaustive) | Tranco n=1000000 domains (top-n) | Tranco n=15000 domains (stratified) | Disconnect Tracker Protection list n=? domains (pre-existing-dataset)
    temporal:   active-probing late December 2024..late December 2024 | live-crawl early February 2025..early February 2025 | existing-dataset December 25, 2024..December 25, 2024
    crawlConfig: browsers=["Chrome"] headless=not-stated stateful=stateless consent=no-interaction depth=single-target-page
      * network timing covert channel
          technique : Delayed worklet execution and server-side request timing
          metric    : bits leaked per page
          PREVALENCE: 33-bit identifiers feasible with delays of 0.36–1.82 seconds
      * worklet crash covert channel
          technique : Conditional worklet crashes and observing missing requests
          metric    : identifier recovery delay
          PREVALENCE: Random identifiers consistently recovered with approximately 0.5-second reload delays
      * queue timing covert channel
          technique : Flooded Shared Storage queues and measured returned-call timing
          metric    : 5,000 API calls
          PREVALENCE: Two-second flooding intervals produced observable return-time differences
      * iframe caching covert channel
          technique : Compared cached and uncached iframe resource requests
          metric    : requests per 33-bit identifier
          PREVALENCE: 66 requests needed to read a 33-bit identifier
      * data leakage over time
          technique : Repeated selectURL reads after daily budget resets
          metric    : bits leaked per day
          PREVALENCE: Up to 12 bits per day
      * attestation-file availability
          technique : HTTP retrieval followed by manual URL inspection
          metric    : share of checked domains hosting valid files
          PREVALENCE: 245 of 289 domains (85%) hosted valid attestation files
      * Shared Storage API usage
          technique : Puppeteer crawl with Chrome developer-tools capture
          metric    : share of reachable websites
          PREVALENCE: 1,311 of 12,955 reachable sites (10.1%) invoked the API; 1,250 used selectURL
      * Shared Storage access among attested domains
          technique : Parsed collected attestation files
          metric    : share of valid attestation files
          PREVALENCE: 149 of 245 files (61%) reported Shared Storage access

### IMC 2024 — A First Look at Related Website Sets.
    mechanism: Related Website Sets
    population: Related Website Sets list n=146 websites (exhaustive) | Tranco n=200 websites (random) | Related Website Sets GitHub pull requests n=114 other (exhaustive)
    temporal:   existing-dataset ?..2024-03-30 | live-crawl 2024-05..2024-05
    crawlConfig: null (no crawl-config object extracted)
      * Perceived website relatedness
          technique : Timed participant judgments for 20 website pairs.
          metric    : classification accuracy and response counts
          PREVALENCE: 36.8% of 114 same-set responses incorrectly identified websites as unrelated
      * RWS set composition
          technique : Counted sites and subsets in the 26 March 2024 list.
          metric    : share of sets containing associated sites
          PREVALENCE: 92.7% of 41 sets had one or more associated sites
      * RWS pull-request outcomes
          technique : Analyzed GitHub pull-request final states.
          metric    : share closed without merging
          PREVALENCE: 58.8% of 114 pull requests were closed without being merged
      * Second-level-domain similarity
          technique : Computed Levenshtein distance between member and primary SLDs.
          metric    : median edit distance and exact-match share
          PREVALENCE: Median edit distance was 7; 9.3% of associated SLDs were identical
      * HTML similarity
          technique : Compared CSS, HTML structure, and joint similarity scores.
          metric    : median joint HTML similarity score
          PREVALENCE: Median joint HTML similarity was 0.04
      * Participant relatedness cues
          technique : Surveyed factors participants used in judgments.
          metric    : percentage selecting each factor
          PREVALENCE: Branding elements were used by 66.7%; domain names by 57.1%

### NDSS 2023 — Navigating Murky Waters: Automated Browser Feature Testing for Uncovering Tracking Vectors
    mechanism: cross-browser storage vectors
    population: custom browser-version list n=126 other (purposive)
    temporal:   active-probing 2019-07..2022-04
    crawlConfig: browsers=["Brave","Chrome","Edge","Firefox","Safari","Opera","Tor"] headless=headful stateful=stateless consent=no-interaction depth=single-target-page
      * Browser mechanisms usable as tracking vectors
          technique : Write and read 32-bit identifiers across browser contexts
          metric    : number of mechanisms and browser versions
          PREVALENCE: 21 mechanisms across 126 versions of seven browsers; all latest tested versions were vulnerable to at least one technique
      * Third-party tracking vectors
          technique : Automated cross-origin and embedded-context read/write tests
          metric    : number of mechanisms
          PREVALENCE: 13 mechanisms enabled third-party tracking
      * Private-browsing isolation bypass
          technique : Cross-session identifier reads in private browsing contexts
          metric    : number of mechanisms
          PREVALENCE: two mechanisms bypassed private-browsing isolation
      * History sniffing via favicons
          technique : Compared cached favicon loads with Performance API requests
          metric    : qualitative attack demonstration
          PREVALENCE: Chrome and Safari supported novel favicon history-sniffing attacks

### IMC 2024 — Browsing without Third-Party Cookies: What Do You See?
    mechanism: third-party-cookie blocking
    population: Tranco n=10000 domains (top-n) | Tranco n=255 websites (top-n)
    temporal:   live-crawl ?..?
    crawlConfig: browsers=["Firefox"] headless=headless stateful=stateful consent=no-interaction depth=landing-plus-subpages
      * Cookie-notice tracking-cookie violations
          technique : Clicked accept and reject controls, then counted injected cookies
          metric    : number and percentage of websites retaining tracking cookies
          PREVALENCE: 100 (39%) of 255 websites continued using tracking cookies after rejection
      * Third-party-cookie rendering effects
          technique : Compared controlled baseline, control, and cookie-disabled crawl groups
          metric    : BCE screenshot difference and frequency-vector DiD
          PREVALENCE: More than 90% of domains exhibited less than a 10% screenshot difference
      * Website-content changes
          technique : Compared screenshot, image, text, and link feature vectors
          metric    : Jaccard distance and difference in distance
          PREVALENCE: The frequency-vector DiD distribution was concentrated and symmetric at 0
      * Advertisement-request prevalence
          technique : Counted requests to domains listed in EasyList
          metric    : average advertisement requests versus average BCE screenshot difference
          PREVALENCE: Positive correlation across categorized website types

### PETS 2025 — Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies
    mechanism: CHIPS
    population: Tranco n=20000 domains (top-n) | Tranco n=20000 domains (random) | Tranco n=6518 websites (purposive)
    temporal:   live-crawl 2024-07..2024-07 | live-crawl 2024-08..2024-08 | live-crawl 2025-01..2025-01
    crawlConfig: browsers=["Firefox v121.0","Chrome"] headless=not-stated stateful=both consent=accept-and-reject depth=landing-page-only
      * intractable cookie transmission
          technique : Compare cookies in accepted-phase Cookie Jar with HTTP-request cookies before rejection.
          metric    : share of websites sending at least one
          PREVALENCE: around 50% of websites; approximately 45%–55% across runs
      * banner rejection effect
          technique : Reject banners, reload pages, and compare sent-cookie counts.
          metric    : average reduction after reload
          PREVALENCE: websites stop sending approximately 25% of intractable cookies after reload
      * GPC effect
          technique : Repeat stateless rejection runs with the GPC signal enabled.
          metric    : average reduction in intractable cookies
          PREVALENCE: approximately 30%, with an additional 32% after subsequent rejection
      * banner-type differences
          technique : Compare intractable-cookie counts for CMP, native, and cookie-paywall banners.
          metric    : relative cookie count
          PREVALENCE: CMP banners set 6.91 times more intractable cookies than native banners
      * cookie persistence
          technique : Analyze actual Cookie Jar expiration times and renewal counts.
          metric    : share exceeding ten days
          PREVALENCE: nearly 60% of cookies have expiration exceeding 10 days
      * cookie synchronization
          technique : Inspect cookie values transferred through redirection URL parameters.
          metric    : share synchronized at least once
          PREVALENCE: 76 of 2,545 unique intractable cookies, or 3%
      * partitioned-cookie adoption
          technique : Chrome stateful crawl records partitioned and non-partitioned cookie attributes.
          metric    : share of tracking cookies partitioned
          PREVALENCE: 40 of 3,177 tracking cookies, or 1.3%; 26 had accompanying non-partitioned cookies

### IMC 2025 — $CookieGuard: $ Characterizing and Isolating the First-Party Cookie Jar.
    mechanism: CHIPS (context)
    population: Universal Tranco list n=20000 websites (top-n) | Tranco top 10k list n=10000 websites (top-n) | Tranco top 10k list n=100 websites (random)
    temporal:   live-crawl ?..?
    crawlConfig: browsers=["Chrome"] headless=not-stated stateful=not-stated consent=not-stated depth=landing-plus-subpages
      * cross-domain cookie exfiltration
          technique : Match cookie-derived identifiers against third-party outbound request query strings.
          metric    : share of websites and unique cookie pairs
          PREVALENCE: 55.7% of websites; 5.9% of 82,000 unique cookie pairs
      * cross-domain cookie overwriting
          technique : Track later writes by scripts whose domains differ from cookie creators.
          metric    : share of websites and unique cookie pairs
          PREVALENCE: 31.5% of websites; 2.72% of unique cookie pairs
      * cross-domain cookie deletion
          technique : Track delete operations by non-owning scripts against attributed cookies.
          metric    : share of websites and unique cookie pairs
          PREVALENCE: 6.3% of websites; 1.8% of unique cookie pairs
      * third-party main-frame scripts
          technique : Identify script inclusion and classify script URLs with filter lists.
          metric    : share of websites
          PREVALENCE: 93.3% of successfully crawled websites
      * CookieGuard access-control effectiveness
          technique : Compare cross-domain actions with and without the browser extension.
          metric    : percentage reduction in affected sites
          PREVALENCE: 82.2% overwriting, 86.2% deletion, and 83.2% exfiltration reductions
      * website breakage
          technique : Manual comparison of functionality with and without CookieGuard.
          metric    : percentage of websites with minor or major breakage
          PREVALENCE: 11% major SSO breakage; 3% major functionality breakage
      * CookieGuard runtime overhead
          technique : Paired Selenium visits with and without the extension.
          metric    : page-load time and with/no-extension ratio
          PREVALENCE: average overhead of 0.3 seconds across 8,171 paired sites
      * cross-domain DOM modification
          technique : Pilot analysis of scripts modifying elements outside their ownership.
          metric    : share of sites
          PREVALENCE: 9.4% of sites

### WWW 2025 — Least Privilege Access for Persistent Storage Mechanisms in Web Browsers.
    mechanism: CHIPS (context)
    population: Tranco n=10000 websites (top-n) | Tranco top 10K websites n=100 websites (purposive)
    temporal:   live-crawl March 2024..April 2024
    crawlConfig: browsers=["Nightly Firefox version 98.0a1"] headless=not-stated stateful=not-stated consent=not-stated depth=landing-page-only
      * Third-party cookie accesses
          technique : Instrumented cookie APIs logged script and host domains.
          metric    : share of all cookie accesses
          PREVALENCE: 89.84% of all cookie accesses
      * Third-party localStorage accesses
          technique : Instrumented web-storage APIs logged script and host domains.
          metric    : share of all localstorage accesses
          PREVALENCE: 90.98% of all localstorage accesses
      * Third-party IndexedDB accesses
          technique : Instrumented IndexedDB APIs logged script and host domains.
          metric    : share of all IndexedDB accesses
          PREVALENCE: 72.49% of all IndexedDB accesses
      * Host-created cookies accessed by third parties
          technique : Grouped accesses by creator and subsequent accessor domains.
          metric    : share of third-party-accessed cookies
          PREVALENCE: 20.14% of all cookies accessed by third-party scripts
      * Host-created localStorage accessed by third parties
          technique : Grouped accesses by creator and subsequent accessor domains.
          metric    : share of host-created localStorage objects
          PREVALENCE: 76% of all localstorage objects created by first-party scripts
      * Functionality breakage
          technique : Manual comparison of instrumented and vanilla browser behavior.
          metric    : number of affected websites
          PREVALENCE: 100 manually analyzed websites

### IMC 2023 — Understanding the Privacy Risks of Popular Search Engine Advertising Systems.
    mechanism: CHIPS (context)
    population: Google Trends and MovieLens n=500 other (random)
    temporal:   live-crawl ?..?
    crawlConfig: browsers=["Chrome"] headless=not-stated stateful=stateless consent=accept-all depth=landing-page-only
      * bounce tracking
          technique : Traced URL navigation chains and validated Location and status-code headers.
          metric    : share of ad clicks
          PREVALENCE: 4% on Bing, 86% on Qwant, and 100% on Google, DuckDuckGo, and StartPage
      * tracker requests
          technique : Matched browser network-request URLs against EasyList and EasyPrivacy.
          metric    : share of destination pages
          PREVALENCE: 93% of ad destination pages included tracker and privacy-harming resources
      * UID smuggling
          technique : Filtered query parameters, cookies, and localStorage values using heuristics and manual inspection.
          metric    : share of ad clicks with identifiers in destination query parameters
          PREVALENCE: 80% Bing, 94% Google, 68% DuckDuckGo, 92% StartPage, and 53% Qwant
      * first-party reidentification
          technique : Inspected cookies and localStorage for unique identifiers across queries and visits.
          metric    : presence of stored user identifiers
          PREVALENCE: Google and Bing stored identifiers; the other search engines did not
      * post-click ad information collection
          technique : Recorded network requests after ad clicks before navigation away.
          metric    : search engines exhibiting collection
          PREVALENCE: All five search engines recorded additional user or click information

## 6. The silence: recent web crawls that never mention any of these APIs

  web crawls published 2023-2026: 332
    of those, naming >=1 Privacy Sandbox API family: 24 (7.2%)
  web crawls published 2024-2026: 235
    of those, naming >=1 Privacy Sandbox API family: 18 (7.7%)
  web crawls published 2025-2026*: 153
    of those, naming >=1 Privacy Sandbox API family: 11 (7.2%)

  Population "web crawl": crawlConfig != null OR studyTypes contains
  automated-web-crawl, AND platforms contains 'web'. This is the same
  definition lib.mjs uses for POPULATIONS.webCrawled.

## 7. Of the web crawls that drove Chrome/Chromium, how many name an API

  Chrome/Chromium web crawls 2023-2026: 129
    naming >=1 Privacy Sandbox API family: 11 (8.5%)
  Chrome/Chromium web crawls 2024-2026: 86
    naming >=1 Privacy Sandbox API family: 8 (9.3%)

  NOTE the sentinel rule: crawlConfig.browsers is stated by only 47.2% of
  the 1,120 crawling papers, so this denominator is "papers that SAID they
  drove Chrome", not "papers that drove Chrome".
</file>

===== Quote-check output =====

Produced by ''node scripts/ps_quotecheck.mjs''. Unedited.

<file text ps_quotecheck-output.txt>

== CCS 2022 privacy-limitations-of-interest-based-advertising-on-the-web-a-post-mortem-empir
   PASS  detection/unique FLoC cohort ID sequences
   PASS* detection/fingerprinting-enhanced cohort unicity  (matched after stripping punctuation/spaces)
   NEAR  detection/demographic browsing differences  (11/11 long tokens present)
         quote: For each of the chi-square tests of independence described in Section 5.1.1, we find a statistically significant difference in domain visit frequency 
   PASS  detection/demographic t-closeness violations
   NEAR  population/comScore Web Behavior Database  (7/7 long tokens present)
         quote: Before preprocessing, the sessions dataset includes 93,808 machines.
   NEAR  population/comScore Web Behavior Database  (7/7 long tokens present)
         quote: The resulting preprocessed dataset contains 2,073,405 machine-week records.
   PASS  population/2017 U.S. Census Bureau Current Population Sur
   NEAR  population/2017 U.S. Census Bureau American Community Sur  (9/9 long tokens present)
         quote: We also use 2017 census data from the U.S. Census Bureau American Community Survey (ACS) and Current Population Survey (CPS)
   PASS  temporal/existing-dataset

== PETS 2023 locality-sensitive-hashing-does-not-guarantee-privacy-attacks-on-googles-floc-an
   PASS* detection/FLoC browsing-history reconstruction  (matched after stripping punctuation/spaces)
   PASS  detection/MinHash trajectory narrowing
   NEAR  detection/SimHash pre-image generation  (3/3 long tokens present)
         quote: We vary the SimHash bit length from 5 to 25 in increments of 5.
   NEAR  detection/MinHash checkpoint identification  (7/7 long tokens present)
         quote: A set of checkpoints found by our attack has on average 805.5 ± 439.7 checkpoints. Recall that the total number of checkpoint is 7744.
   NEAR  population/MovieLens  (4/4 long tokens present)
         quote: The training set contains 120 000 histories and the test set 5000 histories.
   PASS  population/Porto Taxi dataset
   NEAR  temporal/existing-dataset  (5/5 long tokens present)
         quote: To evaluate our attacks, we instead use the MovieLens dataset [14].
   PASS  temporal/existing-dataset

== PETS 2023 on-the-robustness-of-topics-api-to-a-re-identification-attack
   PASS  detection/cross-site re-identification
   NEAR  detection/profile uniqueness  (5/5 long tokens present)
         quote: even in the case of a population of 100, 000 personas, we still observe 35−42% of them being non-2-anonymous.
   PASS  detection/false re-identification
   PASS  population/EasyPIMS
   PASS  population/EasyPIMS browsing-history dataset
   PASS  temporal/passive-collection

== CCS 2024 the-privacy-utility-trade-off-in-the-topics-api
   PASS* detection/Third-party-cookie re-identification  (matched after stripping punctuation/spaces)
   PASS* detection/Topics API user re-identification  (matched after stripping punctuation/spaces)
   NEAR  detection/Topic popularity inference  (10/10 long tokens present)
         quote: For instance, for a population of only 10 individuals, the chance of an analyst correctly counting the occurrence of a topic t is as low as 0.56% for 
   PASS  detection/Distinguishing genuine from random topics
   PASS  population/AOL search logs dataset
   PASS… population/AOL search logs dataset with Citizen Lab class  (2 elided fragments, all present in order)
   PASS… population/AOL search logs dataset with Google Topics cla  (2 elided fragments, all present in order)
   PASS  temporal/existing-dataset

== PETS 2024 interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
   NEAR  detection/Topics noise removal  (5/5 long tokens present)
         quote: we find that (1) about 25% of the noisy topics on single websites in one-shot scenarios
   PASS  detection/Cross-site re-identification
   PASS  detection/Topics classification utility
   PASS  detection/Subdomain topic manipulation
   PASS  population/CrUX top-list
   NEAR  population/Tranco  (5/5 long tokens present)
         quote: the top 1M most visited eTLD+1 from Tranco classified with the Topics API
   NEAR  population/Google static mapping  (9/9 long tokens present)
         quote: Consisting of exactly 9254 domains, Table 2 shows the distribution of topics per individual domain on this static mapping.
   PASS  population/Mozilla-reported browsing-history distribution
   PASS  population/synthetic dataset generated from published bro
   PASS  population/CrUX top-list
   NEAR  temporal/existing-dataset  (5/5 long tokens present)
         quote: we use the latest version of the individual draft proposal of Topics from May 30, 2023

== USENIX 2024 fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
   NEAR  detection/FLEDGE API adoption  (7/7 long tokens present)
         quote: We detected the use of FLEDGE APIs in 9.5% (n = 6,682) of the 70K sites that we visited during the measurement period.
   NEAR  detection/Google auction dominance  (11/11 long tokens present)
         quote: We observed a total of 11,959 auctions for ad spaces during our measurement period, almost all of which (n = 11,941) were run by Google Ad Manager.
   PASS  detection/Interest-group creation
   PASS  detection/Interest-group persistence attempts
   PASS  detection/FLEDGE privacy attacks
   PASS… detection/Owner-sniffing attack performance  (2 elided fragments, all present in order)
   NEAR  population/Tranco  (5/5 long tokens present)
         quote: Using our automated approach, we perform a crawl of the top 70K domains from the Tranco list [35].
   NEAR  population/custom seed list  (10/10 long tokens present)
         quote: For our evaluation we gathered a list of 500 domains and used Puppeteer to open a fresh browser instance and join interest groups from a subset of own
   NEAR  temporal/live-crawl  (5/5 long tokens present)
         quote: Our framework collected the API calls on these sites in June and July 2023 ... and again in September 2023 when it was publicly released.

== CCS 2025 exploiting-the-shared-storage-api
   NEAR  detection/network timing covert channel  (6/6 long tokens present)
         quote: we find that the maximum delay would be between 0.36 seconds ... and 1.82 seconds ... for a 33-bit long identifier
   PASS  detection/worklet crash covert channel
   PASS… detection/queue timing covert channel  (3 elided fragments, all present in order)
   NEAR  detection/iframe caching covert channel  (6/6 long tokens present)
         quote: this would require 66 requests to read a 33 bit identifier as the two possible resources must be unique for each bit
   PASS  detection/data leakage over time
   PASS  detection/attestation-file availability
   PASS  detection/Shared Storage API usage
   PASS  detection/Shared Storage access among attested domains
   PASS  population/Google's Privacy Sandbox Enrollment Report and
   NEAR  population/Tranco  (4/4 long tokens present)
         quote: we check the rank of these domains in the Tranco list from the same date as the Chrome browser file.
   PASS  population/Tranco
   PASS… population/Disconnect Tracker Protection list  (2 elided fragments, all present in order)
   PASS  temporal/active-probing
   PASS  temporal/live-crawl
   PASS  temporal/existing-dataset

== IMC 2024 a-first-look-at-related-website-sets
   PASS  detection/Perceived website relatedness
   PASS… detection/RWS set composition  (2 elided fragments, all present in order)
   NEAR  detection/RWS pull-request outcomes  (10/11 long tokens present)
         quote: the split between approved and closed (without merging) requests has shifted, with 58.8% of all pull requests closed without being merged
   PASS… detection/Second-level-domain similarity  (2 elided fragments, all present in order)
   PASS  detection/HTML similarity
   PASS  detection/Participant relatedness cues
   PASS  population/Related Website Sets list
   PASS  population/Tranco
   NEAR  population/Related Website Sets GitHub pull requests  (8/8 long tokens present)
         quote: Figure 5 shows the cumulative count of pull requests on the Related Website Sets list over time, through to March 30th 2024, comprising 114 requests.
   NEAR  temporal/existing-dataset  (6/6 long tokens present)
         quote: Figure 5 shows the cumulative count of pull requests on the Related Website Sets list over time, through to March 30th 2024
   PASS  temporal/live-crawl

== NDSS 2023 navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
   PASS… detection/Browser mechanisms usable as tracking vectors  (2 elided fragments, all present in order)
   NEAR  detection/Third-party tracking vectors  (9/9 long tokens present)
         quote: We test 21 browser mechanisms and uncover a slew of tracking vectors, including 13 that enable third-party tracking
   NEAR  detection/Private-browsing isolation bypass  (10/10 long tokens present)
         quote: including 13 that enable third-party tracking and two that bypass the isolation offered by private browsing modes.
   NEAR  detection/History sniffing via favicons  (7/7 long tokens present)
         quote: We then developed a test to link different 3P favicons to the Performance API, and included it in the test suite offered by CanITrack.
   PASS* population/custom browser-version list  (matched after stripping punctuation/spaces)
   PASS… temporal/active-probing  (2 elided fragments, all present in order)

== IMC 2024 browsing-without-third-party-cookies-what-do-you-see
   PASS  detection/Cookie-notice tracking-cookie violations
   PASS  detection/Third-party-cookie rendering effects
   PASS  detection/Website-content changes
   PASS  detection/Advertisement-request prevalence
   PASS  population/Tranco
   PASS  population/Tranco
   PASS* temporal/live-crawl  (matched after stripping punctuation/spaces)

== PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
   PASS  detection/intractable cookie transmission
   PASS  detection/banner rejection effect
   PASS… detection/GPC effect  (2 elided fragments, all present in order)
   PASS  detection/banner-type differences
   PASS  detection/cookie persistence
   NEAR  detection/cookie synchronization  (6/6 long tokens present)
         quote: out of 2,545 unique intractable cookies in the RandComb run, 76 (i.e., 3%) are synchronized at least once
   NEAR  detection/partitioned-cookie adoption  (9/9 long tokens present)
         quote: among 3,177 unique tracking cookies, only 40 (1.3%) are partitioned, of which 26 are accompanied by non-partitioned tracking cookies
   NEAR  population/Tranco  (5/5 long tokens present)
         quote: Our target list consists of the landing pages of top-ranked domains.
   NEAR  population/Tranco  (4/4 long tokens present)
         quote: we sample and mix up 20k domains from Tranco's top 50k domains list
   NEAR  population/Tranco  (11/11 long tokens present)
         quote: we conduct a separate stateful run using Chrome on the domains with previously detected banners on them in the RandComb run (i.e., 6,518 in total)
   PASS… temporal/live-crawl  (2 elided fragments, all present in order)
   PASS… temporal/live-crawl  (1 elided fragments, all present in order)
   PASS… temporal/live-crawl  (2 elided fragments, all present in order)

== IMC 2025 cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
   NEAR  detection/cross-domain cookie exfiltration  (12/12 long tokens present)
         quote: We find that about 55.7% of websites include at least one script that exfiltrates a cookie it did not set originally. These behaviors impact 5.9% (4,8
   NEAR  detection/cross-domain cookie overwriting  (7/7 long tokens present)
         quote: We find that approximately 32% of websites include at least one script that overwrites a cookie it did not originally set
   NEAR  detection/cross-domain cookie deletion  (13/13 long tokens present)
         quote: while 6.3% include a script that deletes a cookie it did not create. Overall, 2.72% of all unique cookie pairs are overwritten by non-owning scripts, 
   NEAR  detection/third-party main-frame scripts  (8/8 long tokens present)
         quote: We find that 93.3% of the 14,917 successfully crawled websites in our dataset include at least one third-party script in their main frame
   NEAR  detection/CookieGuard access-control effectiveness  (13/13 long tokens present)
         quote: CookieGuard significantly reduces cross-domain actions on first-party cookies: overwriting by 82.2%, deletion by 86.2%, and exfiltration by 83.2%.
   PASS  detection/website breakage
   PASS  detection/CookieGuard runtime overhead
   PASS  detection/cross-domain DOM modification
   PASS  population/Universal Tranco list
   PASS  population/Tranco top 10k list
   PASS  population/Tranco top 10k list
   PASS  temporal/live-crawl

== WWW 2025 least-privilege-access-for-persistent-storage-mechanisms-in-web-browsers
   PASS  detection/Third-party cookie accesses
   PASS  detection/Third-party localStorage accesses
   PASS  detection/Third-party IndexedDB accesses
   PASS  detection/Host-created cookies accessed by third parties
   PASS  detection/Host-created localStorage accessed by third pa
   NEAR  detection/Functionality breakage  (12/12 long tokens present)
         quote: We manually analyzed the effect of our solution for 100 websites where third-party scripts access the host-page cookies with the default policy
   PASS* population/Tranco  (matched after stripping punctuation/spaces)
   NEAR  population/Tranco top 10K websites  (9/9 long tokens present)
         quote: We manually saved the top 100 websites in the list of websites that contained at least one third-party script accessing cookies set by the host-page.
   PASS  temporal/live-crawl

== IMC 2023 understanding-the-privacy-risks-of-popular-search-engine-advertising-systems
   PASS  detection/bounce tracking
   PASS  detection/tracker requests
   PASS  detection/UID smuggling
   PASS  detection/first-party reidentification
   PASS  detection/post-click ad information collection
   PASS  population/Google Trends and MovieLens
   PASS  temporal/live-crawl

== TOTAL 131 quotes: PASS 91, NEAR 40, FAIL 0
   PASS  = quote found verbatim after whitespace collapse.
   PASS* = found after also stripping punctuation and spaces
   PASS… = quote contains an "..." elision; every fragment of >=12
           characters was found, in the paper's own order.
           (a space inside a number, a ligature, an en-dash).
   NEAR = >=80% of its 6+-character tokens present but not contiguous
          (column-reading or ligature damage). Read these by hand.
   FAIL = not located. No figure resting on a FAIL is published.
</file>

===== Review log =====

Three focused ''sonnet'' passes on the published first draft, run in parallel, each told explicitly that the author's context may not be exhaustive and each handed the page text, the report script, its output and these notes. Findings applied below; a generic ''fable'' pass follows.

==== sonnet — figures versus script ====

^ Finding ^ Disposition ^
| **By-year table: 2020 says 4 and 2022 says 8 in the "any API family" column; the script says 2 and 7.** | **Accepted, fixed.** Diagnosed: the year table was copied from a run made //before// the folding regexes were narrowed, and never refreshed. This is exactly the carry-over defect the task spec warns about, committed inside a single sitting. The whole table was regenerated from the current output |
| ''%%/\bFLEDGE\b/i%%'' **matches "full-fledge crawling system"** in de-Kodi (WWW 2020) and "a full-fledge experience" in Android SmartTVs (USENIX 2021) | **Accepted, fixed.** Verified both by hand. The Protected Audience family is now case-sensitive; count 11 → 8 |
| ''%%/First[- ]Party Sets/i%%'' **matches "the first party //sets// the cookies"** in Cookie Swap Party (WWW 2021) | **Accepted, fixed.** Verified. RWS family is now case-sensitive; count 6 → 4 (the same fix also dropped a second borderline match) |
| **Bare "attribution reporting" matches Apple's SKAdNetwork** in the 2026 PETS PET-paradox paper, so the page's "four passing mentions" is three | **Accepted, fixed.** Verified. The naive case-sensitive fix over-corrected to **zero** — papers write "Attribution reporting API" and "privacy sandbox attribution reporting api" — so the accepted rule is capitalised-proper-name OR phrase-plus-"API". Count 4 → **3**, and both places on the page that said "four" now say "three" |
| **The published ''ps_cdp_probe.mjs'' snippet produces zero events when run as printed**, contradicting the page's "verified end to end" claim; the real script uses a local mock HTTPS origin the snippet omits | **Accepted, fixed, and the most useful finding of the three passes.** The block now contains ''sandbox/ps_cdp_probe.mjs'' in full — mock server, bidding script, decision script, worklet and all — and the surrounding prose says what its real output was and what happens if you point the listeners at a site you do not control. The reviewer also mutation-tested the real script (removing ''setSharedStorageTracking'' drops the event count from 7 to 3), which is quoted on the page |
| Provenance says "3 more" CHIPS-context papers; the content page names two, and the third has no CHIPS content of its own | **Accepted, fixed.** Now one, and it is named |
| Family table not sorted descending by count | **Accepted, fixed** (had already been caught independently) |
| Rendered heading/citekey counts in this log are close but do not reproduce exactly | **Accepted, fixed.** Recounted from the rendered DOM after the final save; the numbers in [[#Bibliography]] are the recount |

**Not found by this pass, and worth recording:** it verified the silence table against the pre-fix script and reported it correct, which it was — but the four fold fixes then moved it (25/19/12 → 24/18/11). The page was re-derived from the post-fix run, not patched.

==== sonnet — citations and quotes ====

^ Finding ^ Disposition ^
| ''kancherla2025_least'' **does not support the claim it is cited for.** The page said it and ''bahrami2025_cookieguard'' "both note that Chrome's partitioning is opt-in per cookie while Firefox and Safari partition by default". "Safari" and "opt-in" appear **zero** times in that paper; "CHIPS" appears once, in the reference list | **Accepted, fixed.** Verified. The sentence now attributes the claim to ''bahrami2025_cookieguard'' alone, quotes its actual wording, and says plainly that an earlier draft attached it to the wrong paper |
| Five **pre-existing** same-paper-different-key duplicates elsewhere in ''literature:bibliography'' (''lerner2016internet''/''lerner2016_internet'', ''bouhoula2024automated''/''bouhoula2024_automated'', ''fouad2022my''/''fouad2022_cookie'', ''bottger2025_regional''/''boettger2025_regional'', ''ahmad2026_ipfp''/''ahmad2026_more'') | **Noted, not acted on.** None involves this page's 13 keys and none was introduced by this run. Left for whoever owns the bibliography; recorded here so the next run does not rediscover it as new |

Everything else passed: 13 keys resolve, 724 keys unique, the six new entries match Crossref on authors, order, title, year, venue and DOI, ~34 quantitative claims traced to the sentence in ''paper.cols.txt'', all 8 footnotes verbatim against live sources, and the claim that ''rasaii2025_crumbs'' cites the PAM CHIPS paper with a broken DOI independently confirmed (''10.1007/978-3-031-55528-2_1'' 404s; the correct one is ''10.1007/978-3-031-85960-1_8'').

==== sonnet — external currency ====

^ Finding ^ Disposition ^
| Nothing wrong. ~65 external claims independently re-fetched; **zero** out of date | **No change.** Confirmed specifically: M153 has **not** shipped (''stable_date'' 2026-09-08, ''stable_cut'' is today), no removal entry has moved off ''Proposed'', and the "there is a window" framing is still correct as written |
| A summarising fetch tool mis-read the status page's Discontinue / Do-not-launch groupings; the raw HTML table matches the page exactly | **Noted.** Recorded as a warning to the next reviewer: on that page, parse the table, do not summarise it |
| ''bugzilla.mozilla.org/show_bug.cgi?id=1979093'' returns HTTP 400 to a bare ''HEAD'' but 200 to a ''GET'' | **Noted.** Not a dead link; recorded so a future link-checker run does not report it as one |

Also confirmed by this pass and not previously checked here: Playwright 1.62.1 is npm's current ''latest'' (2026-07-30) and bundles exactly Chromium 151.0.7922.34; Playwright's ''chromiumSwitches.ts'' on ''main'' disables ''ThirdPartyStoragePartitioning'' and no ads-API feature; the W3C Attribution Level 1 Working Draft is dated 2026-08-28; ''taxonomy_v3.md'' returns 404.

==== fable — generic ====

Run after the three focused passes and their fixes, with no checklist. It found more than the other three combined, and two of its findings were substantive enough to change what the page tells a reader to do.

^ Finding ^ Disposition ^
| **"Topics and Attribution Reporting have no CDP surface at all, in any Chromium version checked" is misleading, and it misdirects the page's own headline call to action.** "Any version checked" was two versions. ARA had a full CDP ''Storage'' surface until it was removed from the protocol in April 2026 | **Accepted, fixed, and this was the most valuable finding of the whole review.** Verified independently by bisecting the ''devtools-protocol'' history (present 2026-04-01, absent 2026-04-08). The page now carries a box saying the gap is closable with first-class instrumentation on a pre-April-2026 build, with a one-line check for whether a given binary has it. The CDP table has a new row. The two dead ARA listeners in the published script now carry a comment saying why they are there |
| **HTTP headers are missing entirely as an observation surface**, and they are arguably the //primary// one for Attribution Reporting and Topics | **Accepted, fixed.** New subsection with all five headers, verified against MDN. Added to the "What to Report" list |
| **Wrapping the ''attributionSrc'' IDL setter misses server-rendered ''%%attributionsrc%%'' content attributes**, because the parser does not invoke IDL setters | **Accepted, fixed.** The page now says not to do it and gives three alternatives. This was a genuine instrument bug in advice the page was giving |
| ''privacysandbox/attestation'' **and** ''patcg-individual-drafts/topics'' **are also archived**; the page marked only the RWS repo, and said "two of the three" artefacts are frozen | **Accepted, fixed.** Verified through the GitHub API: archived, last pushes 2026-01-22 and 2025-11-07. All three rows now carry the archive date, and the "two of the three" sentence is rewritten — with the distinction that the ''.dat'' inside a Chromium install still moves with the component updater |
| **The enrollment-closure "consequence" this log claimed the page stated was never actually written on the page** | **Accepted, fixed.** The quote and the ''%%--privacy-sandbox-enrollment-overrides%%'' workaround are now both on the content page. This log's own claim has been corrected |
| Two stale figures in **this log's prose**: "4 of 5,869 papers name Attribution Reporting" and "the 8.1% silence figure", both pre-fold-fix | **Accepted, fixed.** This is the known failure mode where a correction reaches the page but not the log; recording that it happened here too |
| **The removal-date slip history is only in this log, not where the reader decides.** "Measured in days" is stated as if M153 were firm | **Accepted, fixed.** The slip history (M144 → M150 → M152/M153/M155) is now a bullet in the top box, and "days" is hedged |
| **"They have not been removed yet" rests on a Chromium 151 probe while stable is M152** | **Accepted, fixed.** The box now says so in one clause |
| **Missing hedge: field trials.** A code-removal milestone is the //latest// end of the window; Chrome ramps features down server-side first, and an automation Chromium has no variations seed | **Accepted, added**, flagged as not established for these specific features |
| **The measured-results table has no written inclusion rule**, and two of its rows are not Privacy Sandbox measurements | **Accepted, fixed.** The rule is now stated above the table and the two exceptions are named and justified. The precision sentence in [[#Folding and residue]] counts the same 11 |
| **Missing: user-side gating.** Real users hold heterogeneous "Ad privacy" toggle states; a crawler profile is one | **Accepted, added** to the pitfalls list |
| "A dozen papers … over sixteen years", after showing 43/67/9 and an 11-row table; and self-referential prose about its own placement; and "the re-identification numbers everyone cites" in a page that proves almost nobody cites them | **All three accepted, fixed** |
| The silence figure's denominator includes crawls with no reason to touch an ads API | **Accepted.** The defence was in this log only; half a sentence of it is now on the content page, framing the figure as an upper bound on non-engagement |
| Bounce-tracking dating differs in phrasing from [[privacy:browser_storage]] | **Accepted, fixed** by naming both the milestone and the later default-on, and cross-linking |
| The provenance page is honest in tone; its overclaims are the three concrete ones above | **Noted.** All three fixed |

**Rejected: nothing.** Every finding from this pass was accepted. That is unusual and is recorded as such: it is evidence the generic slot earns its place, and also that the three focused passes, by having checklists, all missed the same class of defect — advice that is well-sourced and wrong.

==== Work done after the generic pass, and the second round ====

Verifying the generic pass's "removal dates have already slipped twice" finding against the blink-dev thread turned up more than the finding itself, and the content page gained a section that no reviewer had seen: **"The only post-2025 adoption numbers that exist are Chrome's own"**, five rows of Chrome Platform Status ''motivation'' telemetry. It is recorded here rather than folded silently into the page because it postdates every review, and because it is exactly the kind of late addition that escapes an audit trail. Its sources are in [[#External sources, verified and rejected]]; two subsequent re-review passes checked all five quotes verbatim and found no error in them.

Two ''sonnet'' re-review passes were then run over the edited pages, one on figures and one on currency and citations, both told the earlier fixes might themselves be wrong.

^ Finding ^ Disposition ^
| **The DOM self-check numbers in [[#Bibliography]] are still wrong** — "60 citation markers, 10 tables, 21 headings, 4 WRAP boxes" against actual 33 source markers / 12 tables / 23 headings / 5 boxes. Found independently by both re-reviewers, who then disagreed with each other (33 vs 60 markers, 21 vs 22 headings) | **Accepted, fixed, and the disagreement diagnosed.** The whole paragraph is now a table with the counting method stated, and it explains the trap that caught both of them: the plugin emits two spans per source marker, and ''%%~~DISCUSSION~~%%'' adds a heading. Third time |
| **"Every call returned a benign empty value rather than throwing" is contradicted by the page's own committed probe output** — ''sharedStorage.worklet.addModule()'' throws ''OperationError'' in all four configurations, and the illustrative code box on the page had silently dropped that line | **Accepted, fixed.** The eighth call is back in the box, with the reason (the probe server returns ''text/html'' for every path, so the worklet module fails a MIME check — an artefact of the probe, not of the API) and a note that it was trimmed for one revision |
| **The headers table overclaims**: ''Attribution-Reporting-Register-Source'' names a ''destination'' field; MDN documents no "reporting origin" field, which is implicit in the sending origin | **Accepted, fixed** |
| **The bisect window is wider than necessary.** The removal landed in one commit, ''96e032552f'', 2026-04-02, "Roll protocol to r1608973"; the last commit with the symbols is ''1abe750809'', 2026-03-25 | **Accepted, fixed.** Both re-reviewers found the same commit independently. The page now names it |
| The page's "which partition by default" gloss on Firefox and Safari is not literally in ''bahrami2025_cookieguard'' | **Accepted, fixed.** The gloss is now marked as ours and attributed to [[privacy:browser_storage]] instead |
| The new telemetry section had no provenance trail | **Accepted, fixed** — this subsection |
| ''%%--privacy-sandbox-enrollment-overrides%%'' could not be confirmed against Chromium source (code search needed auth); corroborated only by Google's own docs and by the fact that this run's own probe passes it without error | **Accepted as a limitation, recorded.** The switch is used in ''sandbox/ps_call_probe.mjs'' and Chromium does not reject it, which is weaker than a source citation |
| ''w3.org/TR/attribution/'' returns 403 to ''curl'' but 200 to a browser-grade fetch; Bugzilla rejects bare ''HEAD'' | **Noted.** Neither is a dead link; recorded for future link-checkers |

Everything else in both re-reviews checked out: the fold fix lost exactly the one true positive already admitted and no more (179 of 180 case-insensitive extras in the Protected Audience family are "full-fledged"), every regenerated table matches a fresh script run byte for byte, the published code block is byte-identical to the committed script and reproduces its seven events, the mutation test still drops it to three, and all 34 external claims re-fetched today were confirmed verbatim.

====== References ======

<bibtex bibliography></bibtex>