Back to Measuring the Privacy Sandbox. Corpus-wide selection and extraction notes are on corpus. This page is the query log, the folding rules with their measured residue, the browser probes with their unedited output, and the record of what could not be established.

No ~~DISCUSSION~~ block: comments belong on the content page. This is the convention the existing provenance: pages follow and this page keeps it.

• Run date: 2026-09-01 (UTC).
• Authoring agent: Claude Opus 5, executing the drain item privacy:privacy_sandbox (new). Two background research sub-agents (sonnet) for the currency and tooling passes; every load-bearing fact they returned was re-fetched and re-verified by the authoring agent before it reached the page — see Sub-agent findings that did not survive verification, which is the part of this log with the most value.
• Corpus at run time: 5,859 extracted papers, 2010–2026, seven venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P). The full-text sweep runs over the 5,869 papers that have a rendered paper.cols.txt; the 10-paper difference is papers with text but no extraction record, and it is why the page names 5,869 as the full-text denominator and 5,859 as the extraction denominator rather than using one number for both.
• Read-only inputs under /workspace/publications_dataset/data/. Nothing was written there.
• Browser measurements: Chromium 151.0.7922.34 as shipped with Playwright 1.62.1, Linux container, headless. Puppeteer was pointed at the same binary via chromium.executablePath() because the container's own /usr/bin/chromium cannot be driven (the crashpad-flag problem documented in the workdir README).
• This is a new page, not an extension. See Why a new page and not a broadened neighbour.
• Wiki saves through scripts/dw.mjs (JSON-RPC). Bibliography saved with –if-rev 1788205676.

Grepped every page in the privacy:, programming: and design: namespaces for privacy sandbox, topics api, protected audience, fledge, attribution reporting, CHIPS, storage access, related website, trust token, fenced frame, shared storage, bounce tracking and partition. The only Privacy Sandbox hits anywhere on the site were the 2025-04-22 reversal (three pages) and one developers.google.com/privacy-sandbox URL cited as the source for Chrome's storage partitioning. Nothing on the site covered the replacement APIs. Broadening cookies was rejected because that page is about classifying cookies, its own namespace page already flags it as the shortest of the ten children, and a status-and-instrumentation page for eleven APIs would have swamped it.

All counts are papers, never tuples. Sentinels are never counted as answers. Every figure below is reproduced by scripts/report_privacy_sandbox.mjs; its unedited output is in Report script output.

“Web crawl” is crawlConfig != null OR studyTypes contains automated-web-crawl, AND platforms contains web — the same definition lib.mjs uses for POPULATIONS.webCrawled.

The Chrome row's denominator is not “papers that drove Chrome”. It is papers that stated a browser containing chrom. crawlConfig.browsers is stated by only 47.2% of the 1,120 crawling papers, so 86 is a lower bound and 9.3% is a share of the ones that told you. The page says so.

detection.phenomenon and classification.resourceName were not usable here: nothing in the extraction schema has a field for “measured the Topics API”, and the free-text fields agree run-to-run on only about 20% of exact strings. The topic's reach can therefore only be established from full text. scripts/ps_fold.mjs holds 15 ordered families, each an alternation of the current name and every former name, applied to whitespace-collapsed text with soft hyphens rejoined.

Every regex below was measured against the corpus before it was accepted or rejected. The rejected ones are the useful half of this section.

Two of these needed a structural fix rather than a narrower alternation:

• The CHIPS family is the only case-sensitive family in the folder. Lowercase chips is silicon, and a WPA3 paper that says “anti-clogging cookie” a few hundred characters from “chips” lands in the family if the acronym is matched case-insensitively — Dragonblood did exactly that. The report script therefore honours each family's own regex flags instead of forcing gi. This removed 1 false positive and the family went 6 → 5.
• Protected Audience had to drop bare interest group entirely; the ad-tech phrasings (ad interest group, joinAdInterestGroup, runAdAuction, leaveAdInterestGroup, interest-group bidding/auction) are the whole family. This took the count from 234 to 11 — and then to 8, because \bFLEDGE\b with an i flag matches “a full-fledge crawling system” and “a full-fledge experience”. The Protected Audience, Related Website Sets and Attribution Reporting families are now all case-sensitive, for the same reason CHIPS is.
• Attribution Reporting is the subtlest of the three. Lowercase “attribution reporting” is ordinary ad-tech English, and a 2026 PETS paper used it of Apple's SKAdNetwork. But papers also write “Attribution reporting API” and “privacy sandbox attribution reporting api”, so a purely case-sensitive rule loses two of the three true positives. The accepted rule is: the capitalised proper name in any position, or the phrase followed by “API” in any case. Family count 4 → 3.

Residue that remains, stated rather than hidden. Two kinds:

• False positives. The folded families still admit passing mentions. Of the 67 papers that name at least one family, 11 were judged to actually measure a Privacy Sandbox mechanism — the page's table — plus one, bahrami2025_cookieguard, that supplies CHIPS context without measuring the attribute. That is a precision of roughly 16% for “names a family” as a proxy for “measures the thing”, and it is why the page publishes the family counts as reach and the measured results as a hand-audited table, never as a percentage of the family counts. The per-family lists are printed in full in the report output below so that anyone can redo that audit and disagree with it.
• A known false negative, accepted deliberately. Pinning FLEDGE to upper case also drops 2024/USENIX/web-platform-threats-automated-detection-of-web-security-issues-with-wpt, which lists fledge in lower case as one of the web-platform-tests directories it exercises. That is a genuine reference to the API. It is excluded because the only way to keep it is to re-admit “full-fledge”, and one true positive is not worth two false ones. It is recorded here rather than silently lost.

scripts/ps_quotecheck.mjs locates every evidence.quote behind the 14 papers in the measured-results table against data/fulltext/<year>/<venue>/<slug>/paper.cols.txt. Whitespace is collapsed, soft hyphens rejoined; three match levels are reported and a NEAR is never treated as a PASS.

The 40 NEARs are a rendering artefact, not a quote problem, and the cause is documented: the .cols repair does not fully de-interleave every two-column PDF. The Fledging paper is the clearest case — the extraction quotes “We detected the use of FLEDGE APIs in 9.5% (n = 6,682) of the 70K sites that we visited during the measurement period”, and the .cols rendering reads “…FLEDGE APIs in cannot combine that interest with other information about 9.5% (n = 6,682) of the 70K sites that we visited during the the person…” — the sentence is there, with the facing column woven through it.

Every figure the page publishes was additionally located by hand with a targeted regex over the collapsed text, and the surrounding sentence read:

One figure was reworded because the paper and the extraction disagree. bahrami2025_cookieguard`s extraction records cross-domain cookie overwriting as “31.5% of websites”; the paper's own sentence says “approximately 32% of websites”. Neither number is published on this page — the paper is cited only for CHIPS context — but the disagreement is recorded here because the next run may want that figure.

Four probes, all against Chromium 151.0.7922.34 (Playwright 1.62.1) on 2026-09-01, all committed under sandbox/. Their real, unedited output follows.

• sandbox/ps_probe.mjs — feature detection and Permissions-Policy, four launch configurations.
• sandbox/ps_call_probe.mjs — calls each API from an HTTPS origin, on localhost and on a host-resolver-mapped domain that is definitely not enrolled, with and without the ads-API override and the enrollment override.
• sandbox/ps_cdp_probe.mjs — turns on the CDP Storage tracking toggles and records what arrives.
• sandbox/ps_cdp_surface.mjs — enumerates the Storage domain from the shipping build's own /json/protocol and from ChromeDevTools/devtools-protocol master.

ps_probe-output.txt

probe run: 2026-09-01
  Playwright default (headless): 151.0.7922.34
  Playwright + PrivacySandboxAdsAPIsOverride: 151.0.7922.34
  Puppeteer default (headless): Chrome/151.0.7922.34
  Puppeteer + PrivacySandboxAdsAPIsOverride: Chrome/151.0.7922.34
 
expression                         Playwright default (headle  Playwright + PrivacySandbo  Puppeteer default (headles  Puppeteer + PrivacySandbox
---------------------------------  --------------------------  --------------------------  --------------------------  --------------------------
document.browsingTopics            function                    function                    function                    function                  
navigator.joinAdInterestGroup      function                    function                    function                    function                  
navigator.runAdAuction             function                    function                    function                    function                  
navigator.leaveAdInterestGroup     function                    function                    function                    function                  
window.sharedStorage               object                      object                      object                      object                    
sharedStorage.selectURL            function                    function                    function                    function                  
HTMLFencedFrameElement             function                    function                    function                    function                  
document.hasPrivateToken           function                    function                    function                    function                  
document.hasRedemptionRecord       function                    function                    function                    function                  
document.requestStorageAccess      function                    function                    function                    function                  
document.requestStorageAccessFor   function                    function                    function                    function                  
window.IdentityCredential (FedCM)  function                    function                    function                    function                  
navigator.userAgentData            object                      object                      object                      object                    
navigator.cookieDeprecationLabel   undefined                   undefined                   undefined                   undefined                 
cookieStore                        object                      object                      object                      object                    
PP:browsing-topics                 true                        true                        true                        true                      
PP:join-ad-interest-group          true                        true                        true                        true                      
PP:run-ad-auction                  true                        true                        true                        true                      
PP:attribution-reporting           true                        true                        true                        true                      
PP:shared-storage                  true                        true                        true                        true                      
PP:private-aggregation             true                        true                        true                        true                      
HTMLImageElement.attributionSrc    yes                         yes                         yes                         yes                       
HTMLAnchorElement.attributionSrc   yes                         yes                         yes                         yes                       

ps_call_probe-output.txt

=== localhost, Playwright default (151.0.7922.34) ===
  document.browsingTopics()              RETURNED []
  navigator.joinAdInterestGroup()        RETURNED undefined
  navigator.runAdAuction()               RETURNED null
  sharedStorage.set()                    RETURNED undefined
  sharedStorage.worklet.addModule()      OperationError: Rejecting load of https://localhost:8443/w.js due to unexpected MIME type.
  document.hasPrivateToken()             RETURNED false
  document.requestStorageAccess()        RETURNED undefined
  fetch(attributionReporting)            RETURNED 200
 
=== probe.example (NOT enrolled), Playwright default (151.0.7922.34) ===
  document.browsingTopics()              RETURNED []
  navigator.joinAdInterestGroup()        RETURNED undefined
  navigator.runAdAuction()               RETURNED null
  sharedStorage.set()                    RETURNED undefined
  sharedStorage.worklet.addModule()      OperationError: Rejecting load of https://probe.example:8444/w.js due to unexpected MIME type.
  document.hasPrivateToken()             RETURNED false
  document.requestStorageAccess()        RETURNED undefined
  fetch(attributionReporting)            RETURNED 200
 
=== probe.example + PrivacySandboxAdsAPIsOverride (151.0.7922.34) ===
  document.browsingTopics()              RETURNED []
  navigator.joinAdInterestGroup()        RETURNED undefined
  navigator.runAdAuction()               RETURNED null
  sharedStorage.set()                    RETURNED undefined
  sharedStorage.worklet.addModule()      OperationError: Rejecting load of https://probe.example:8444/w.js due to unexpected MIME type.
  document.hasPrivateToken()             RETURNED false
  document.requestStorageAccess()        RETURNED undefined
  fetch(attributionReporting)            RETURNED 200
 
=== probe.example + enrollment override for that origin (151.0.7922.34) ===
  document.browsingTopics()              RETURNED []
  navigator.joinAdInterestGroup()        RETURNED undefined
  navigator.runAdAuction()               RETURNED null
  sharedStorage.set()                    RETURNED undefined
  sharedStorage.worklet.addModule()      OperationError: Rejecting load of https://probe.example:8444/w.js due to unexpected MIME type.
  document.hasPrivateToken()             RETURNED false
  document.requestStorageAccess()        RETURNED undefined
  fetch(attributionReporting)            RETURNED 200

ps_cdp_probe-output.txt

  toggle OK    Storage.setInterestGroupTracking
  toggle OK    Storage.setInterestGroupAuctionTracking
  toggle OK    Storage.setSharedStorageTracking
  toggle FAIL  Storage.setAttributionReportingTracking: cdpSession.send: Protocol error (Storage.setAttributionReportingTracking): 'Storage.setAtt
 
== API calls from the page ==
  joinAdInterestGroup    ok undefined
  runAdAuction           ok null
  sharedStorage.set      ok undefined
  sharedStorage.addModule ok undefined
  sharedStorage.run      ok undefined
 
== CDP events received (7) ==
  Storage.interestGroupAuctionEventOccurred            {"eventTime":1788282880.844885,"type":"started","uniqueAuctionId":"BAA2639A8868AB941264DB3DB6CB5BED","auctionConfig":{"auctionSignals":{"pending":false,"value":null},"decisionLogicURL":"https://probe.example:8444/decide.
  Storage.interestGroupAuctionNetworkRequestCreated    {"type":"bidderJs","requestId":"06A218F8B3F436C7E8D3F44A2D2806C3","auctions":["BAA2639A8868AB941264DB3DB6CB5BED"]}
  Storage.interestGroupAuctionNetworkRequestCreated    {"type":"sellerJs","requestId":"C09A1952CA56CC58940B85D959CCD3A3","auctions":["BAA2639A8868AB941264DB3DB6CB5BED"]}
  Storage.sharedStorageAccessed                        {"accessTime":1788282880.902479,"scope":"window","method":"set","mainFrameId":"B3037C0FA13BA8CE8A07D1020A778F25","ownerOrigin":"https://probe.example:8444","ownerSite":"https://probe.example","params":{"key":"k","value":
  Storage.sharedStorageAccessed                        {"accessTime":1788282880.904117,"scope":"window","method":"addModule","mainFrameId":"B3037C0FA13BA8CE8A07D1020A778F25","ownerOrigin":"https://probe.example:8444","ownerSite":"https://probe.example","params":{"scriptSourc
  Storage.sharedStorageAccessed                        {"accessTime":1788282880.912412,"scope":"window","method":"run","mainFrameId":"B3037C0FA13BA8CE8A07D1020A778F25","ownerOrigin":"https://probe.example:8444","ownerSite":"https://probe.example","params":{"operationName":"p
  Storage.sharedStorageWorkletOperationExecutionFinished {"finishedTime":1788282880.913208,"executionTime":1050,"method":"run","operationId":"0","workletTargetId":"EBB22A0151158B1D33AB96EBCA57DF2F","mainFrameId":"B3037C0FA13BA8CE8A07D1020A778F25","ownerOrigin":"https://probe.e

ps_cdp_surface-output.txt

== Chromium 151.0.7922.34 — Storage domain ==
  commands (12): getInterestGroupDetails, setInterestGroupTracking, setInterestGroupAuctionTracking, getSharedStorageMetadata, getSharedStorageEntries, setSharedStorageEntry, deleteSharedStorageEntry, clearSharedStorageEntries, resetSharedStorageBudget, setSharedStorageTracking, runBounceTrackingMitigations, getRelatedWebsiteSets
  events   (5): interestGroupAccessed, interestGroupAuctionEventOccurred, interestGroupAuctionNetworkRequestCreated, sharedStorageAccessed, sharedStorageWorkletOperationExecutionFinished
 
== devtools-protocol master — Storage domain ==
  commands (2): runBounceTrackingMitigations, getRelatedWebsiteSets
  events   (0): (none)

What the call probe does and does not license. It shows that on this build, from a non-enrolled origin, every call returns a benign empty value rather than throwing. It does not establish that the APIs were functionally active — an empty Topics array is also the correct answer for a profile with no history. That ambiguity is the finding, and the page states it that way rather than as “the APIs work without enrollment”.

The non-Chrome probe failed and is not on the page as a measurement. sandbox/ps_nonchrome_probe.mjs exists but Playwright's Firefox build will not launch in this container (RenderCompositorSWGL failed mapping default framebuffer), and it timed out at 180 s. The page's Firefox and Safari statements therefore rest on Bugzilla and vendor documentation, and the page says so in its own methodology section.

Everything below was fetched on 2026-09-01, not recalled. Two sonnet sub-agents did a first pass; the URLs, quotes, counts and milestone numbers were then re-fetched by the authoring agent, which is how the errors in the next section were caught.

The two research sub-agents were told to fetch rather than recall and largely did. Three of their conclusions were still wrong, and all three would have put a false statement on the page. Recording them because they are the same class of error the next run will make.

Two further sub-agent claims were accepted but softened: that chrome://topics-internals and friends are gone (circumstantial source-tree evidence only — the page does not mention them at all rather than assert either way), and the Safari PCM status (weakly sourced; the page does not claim PCM is removed).

• Nothing about Attribution Reporting in deployment. 3 of 5,869 papers name it, none instrument it.
• No independent adoption measurement after February 2025. The two crawl-based papers are from 2023 and February 2025; the retirement was announced in October 2025. Chrome's own removal notes claim usage collapsed and give numbers, now quoted on the page; this corpus cannot confirm or refute them, and the party that produced them is the party being measured.
• No CHIPS adoption study inside the seven venues. rasaii2025_crumbs gives a 1.3% figure as a side measurement; the dedicated study is a PAM 2025 paper outside the corpus.
• Regional gating of the ads APIs. Both Google availability pages 404. A DMA-driven gate is plausible but plausible is not measured. A first draft asserted that FLoC's 2021 origin trial excluded the EEA; that came from a sub-agent citing Wikipedia, no primary source for it could be found in this run, and it was removed from the page. What berke2022_privacy does say, and what the page now carries instead: the trial ran Chrome 89 to 91, spring to autumn 2021, for users with at least seven domains in their history, with k = 2000 giving 33,872 cohorts of which 2.3% were deemed sensitive. Published on the page as an explicit unknown with an instruction to test it rather than assume.
• Whether chrome://*-internals pages are still reachable in Chrome 152 stable. Not tested: this container has no Chrome stable, only Playwright's Chromium 151.
• Whether the CHIPS default-on milestone is M114. Chrome Platform Status and Google's status page agree on M114 for CHIPS but disagree for the Storage Access API (M115 versus “Chrome 119 and higher”). The page carries both and tells the reader to test if it matters.

• A new page, not a broadened cookies. Reasoning in Why a new page and not a broadened neighbour.
• Title “Measuring the Privacy Sandbox”, not “The Privacy Sandbox”. The page is about instrumentation and denominators, not about explaining the APIs; the specs do that better and the wiki's own rule is not to teach the platform.
• The retirement is the page's lead, not a footnote. A reader who takes only one sentence away should take “these are being removed and your browser version is the measurement”. The alternative — leading with the API descriptions — would have reproduced the 2022 roadmap, which is the failure mode the task spec warns about.
• Removal milestones are reported as proposed, not as fact. They are the desktop milestone on a Chrome Platform Status entry whose status string is Proposed. Two of them (M144, M150) had already slipped once before landing on M152/M153. The page dates them and does not promise them.
• Published the “7.7% of recent web crawls” silence figure even though it is a keyword proxy, because the direction is unambiguous at that magnitude and the confound (a paper can measure the platform without naming an API) can only inflate the true figure slightly, not reverse it. The page names the proxy, and now also names the opposite confound a review pass raised: the denominator includes crawls with no reason to touch an ads API, so the figure is an upper bound on non-engagement rather than a defect rate.
• Did not publish the “Privacy Budget” or “k-anonymity” counts at all: both regexes are dominated by generic differential-privacy usage and no qualified version was found that was worth the space.
• Did not publish a figure from the PAM 2025 CHIPS paper. It is outside the corpus, Springer would not serve its abstract to this run, and nobody here read it.
• Kept the .cols NEARs visible rather than tuning the matcher until they disappeared. Forty NEARs with a documented cause is a more honest artefact than zero NEARs from a looser matcher.

Six entries added to bibliography before the page was saved, duplicate-checked by key and by DOI/URL against a fresh ?do=export_raw of the live page (718 → 724 entries, zero duplicate keys):

berke2022_privacy, turati2023_locality, calderonio2024_fledging, alvim2024_privacy, mcquistin2024_first, nisenoff2025_exploiting.

Generated with scripts/bibgen.mjs. Two needed hand-completion because PETS and USENIX index records carry no authors: the PoPETs authors came from petsymposium.org/popets/2023/popets-2023-0101.php and the USENIX authors from the venue landing page, both fetched with a browser User-Agent. Reused without change: jha2023_topics, beugin2024_interest, ali2023_navigating, lin2024_browsing, rasaii2025_crumbs, bahrami2025_cookieguard, kancherla2025_least.

After each save, literature:bibliography and the page were purged (?purge=true) and the rendered DOM re-checked, counting only inside the <!-- wikipage start --> … <!-- wikipage stop --> markers so that the theme's own chrome is not counted.

Read the first three rows together, because two reviewers independently got them wrong. The bibtex plugin emits two bibtex_citekey spans per source marker — an anchor and a link — so 33 markers render as 66 spans. Neither number is the reference count: 33 markers over 13 distinct keys give 13 entries in the reference list. And the rendered heading count is one higher than the source heading count because ~~DISCUSSION~~ contributes its own heading. Counting ^-prefixed lines in the source is not a valid table count on this page: the embedded report output contains ==- and ##-prefixed lines that a naive source-side heading count also picks up (44 versus the real 22).

Two earlier versions of this paragraph were wrong — first 58/22, then 60/21/4, both counted with an unscoped grep and both before the last round of edits. A review pass could not reproduce either. It is recorded rather than quietly corrected because a provenance page whose own self-check does not reproduce is worse than one that has none, and because getting a trivial count wrong twice is the honest illustration of why the rest of the page is scripted.

ps_fold.mjs

// Privacy Sandbox API name folder for full-text probes.
//
// Why this exists: the Privacy Sandbox APIs have been renamed at least once
// each (FLoC -> Topics, TURTLEDOVE -> FLEDGE -> Protected Audience, Trust
// Tokens -> Private State Tokens, First-Party Sets -> Related Website Sets),
// so a paper published in 2022 and a paper published in 2026 name the same
// mechanism differently. A count of "Protected Audience papers" that does not
// fold in "FLEDGE" is wrong by an order of magnitude in this corpus.
//
// Each family is an ordered list of ALTERNATIVE spellings. Every regex here is
// deliberately narrow, because the wide version is what produces a confident
// wrong number:
//
//   * `\bCHIPS\b` alone matched 231 papers — silicon, not cookies. It is only
//     counted inside a 200-character window of "cookie" or "partition", or
//     when the acronym is spelled out.
//   * `\bIPA\b` alone matched papers about Instructions Per Access and the
//     International Phonetic Alphabet; `\bPPA\b` matched "Preference
//     Profiling Attack". Both bare acronyms are dropped; only the spelled-out
//     names count.
//   * `IP Protection` unqualified is intellectual property. It is only counted
//     next to Chrome / Privacy Sandbox / proxy.
//   * `the Topics` (without "API") matched ordinary English and is dropped.
//   * `Privacy Budget` is a generic differential-privacy term; it is only
//     counted next to fingerprint / Chrome / Sandbox, and even then the page
//     does not publish the figure (see the provenance page).
//
// Every regex is applied to whitespace-collapsed text with soft hyphens
// rejoined, because a PDF line break inside "Protected Audi-\nence" otherwise
// hides the match.
 
export const FAMILIES = [
  {
    key: 'topics',
    label: 'Topics API',
    also: 'FLoC (predecessor, withdrawn 2022)',
    // `FLoC 2018` is the Federated Logic Conference and appears in the
    // references of formal-methods papers, so the acronym is only counted when
    // it is not immediately followed by a year and not next to "Logic".
    re: /Topics\s+API|browsingTopics|Federated\s+Learning\s+of\s+Cohorts|\bFLoC\b(?!\s*(?:'?\d{2,4}|Logic))(?<!Logic\s+Conference,?\s)/i,
  },
  {
    key: 'protected-audience',
    label: 'Protected Audience',
    also: 'FLEDGE, TURTLEDOVE',
    // NOT case-insensitive. `/\bFLEDGE\b/i` matches "full-fledge crawling
    // system" and "a full-fledge experience" — the hyphen is a word boundary,
    // so \b does not help. Two papers (de-Kodi WWW 2020, Android SmartTVs
    // USENIX 2021) were in this family until the acronyms were pinned to
    // upper case. Found by a review pass on 2026-09-01, not by the author.
    // "interest group" bare also matched 234 papers (political science,
    // federated learning, recommender systems); only ad-tech phrasing counts.
    re: /[Pp]rotected [Aa]udience|FLEDGE|TURTLEDOVE|joinAdInterestGroup|runAdAuction|leaveAdInterestGroup|ad interest group|interest[- ]group (?:bidding|auction)/,
  },
  {
    key: 'attribution-reporting',
    label: 'Attribution Reporting API',
    also: 'Conversion Measurement API',
    // The bare lowercase noun phrase is generic ad-tech English: a 2026 PETS
    // paper used it of *Apple's* SKAdNetwork ("delays and anonymises
    // attribution reporting to advertisers"). Two forms are accepted and
    // nothing else: the capitalised proper name, in any position, and the
    // phrase followed by "API" in any case (papers write "Attribution
    // reporting API" and "privacy sandbox attribution reporting api").
    re: /Attribution Reporting|[Aa]ttribution[- ][Rr]eporting [Aa][Pp][Ii]|Conversion Measurement API|attributionsrc|attributionSrc|aggregatable attribution/,
  },
  {
    key: 'private-aggregation',
    label: 'Private Aggregation / Aggregation Service',
    also: '',
    // Bare "Aggregation Service" matched a 2022 outage paper and a 2012
    // web-analytics paper; it is only counted next to the Privacy Sandbox.
    re: /Private\s+Aggregation\s+API|aggregatable\s+report|Aggregation\s+Service\b(?=[\s\S]{0,200}?(?:Privacy\s+Sandbox|aggregatable|Shared\s+Storage|Attribution\s+Reporting))|(?:Privacy\s+Sandbox|aggregatable|Shared\s+Storage|Attribution\s+Reporting)[\s\S]{0,200}?Aggregation\s+Service\b/i,
  },
  {
    key: 'shared-storage',
    label: 'Shared Storage API',
    also: '',
    re: /Shared\s+Storage\s+API|sharedStorage|selectURL/i,
  },
  {
    key: 'fenced-frames',
    label: 'Fenced Frames',
    also: '',
    re: /Fenced\s+Frames?|fencedframe/i,
  },
  {
    key: 'chips',
    label: 'CHIPS (partitioned cookies)',
    also: 'the Partitioned cookie attribute',
    // NOT case-insensitive, deliberately: lowercase "chips" is silicon, and a
    // WPA3 paper that says "anti-clogging cookie" a few lines from "chips"
    // lands in the family if the acronym is folded to lower case. The
    // spelled-out name and the attribute are matched case-insensitively via
    // explicit character classes.
    // Qualifiers measured: the bare acronym is never counted alone, and
    // "partition" is NOT enough of a qualifier — DRAM bank partitioning put
    // three Rowhammer/GPU papers in the family.
    re: /[Cc]ookies [Hh]aving [Ii]ndependent [Pp]artitioned [Ss]tate|CHIPS(?=[\s\S]{0,200}?[Cc]ookie)|[Cc]ookie[\s\S]{0,200}?CHIPS|[Pp]artitioned attribute|[Pp]artitioned cookies?/,
  },
  {
    key: 'storage-access',
    label: 'Storage Access API',
    also: '',
    re: /Storage\s+Access\s+API|requestStorageAccess/i,
  },
  {
    key: 'rws',
    label: 'Related Website Sets',
    also: 'First-Party Sets',
    // NOT case-insensitive. Lowercase "the first party sets the cookies" is a
    // verb phrase, and it put a 2021 WWW cookie-swapping paper in this family.
    re: /Related Website Sets?|First[- ]Party Sets/,
  },
  {
    key: 'private-state-tokens',
    label: 'Private State Tokens',
    also: 'Trust Tokens',
    re: /Private\s+State\s+Tokens?|Trust\s+Tokens?/i,
  },
  {
    key: 'fedcm',
    label: 'FedCM',
    also: 'Federated Credential Management',
    re: /\bFedCM\b|Federated\s+Credential\s+Management/i,
  },
  {
    key: 'uach',
    label: 'User-Agent Client Hints / UA reduction',
    also: '',
    re: /User[- ]Agent\s+Client\s+Hints|Sec-CH-UA|User[- ]Agent\s+[Rr]eduction/i,
  },
  {
    key: 'ip-protection',
    label: 'IP Protection',
    also: 'Gnatcatcher',
    re: /Gnatcatcher|Willful\s+IP\s+Blindness|IP\s+Protection[\s\S]{0,120}?(?:Chrome|Privacy\s+Sandbox|proxy)|(?:Chrome|Privacy\s+Sandbox)[\s\S]{0,120}?IP\s+Protection/i,
  },
  {
    key: 'bounce-mitigations',
    label: 'Bounce Tracking Mitigations (the Chrome feature)',
    also: '',
    // Deliberately NOT `bounce tracking`: that is the phenomenon, measured by
    // 12 papers and covered by privacy:cookie_syncing. This family counts the
    // Chrome countermeasure by name.
    re: /Bounce\s+Tracking\s+Mitigation/i,
  },
  {
    key: 'ps-android',
    label: 'Privacy Sandbox on Android',
    also: 'SDK Runtime',
    re: /Privacy\s+Sandbox\s+on\s+Android|SDK\s+Runtime/i,
  },
];
 
// The umbrella term itself. Unambiguous: nothing else in a security corpus is
// called a "Privacy Sandbox".
export const UMBRELLA = /Privacy\s+Sandbox/i;
 
// Rejected patterns, kept here so the next run does not re-add them. Each was
// measured against the corpus and produced the paper count in the comment.
export const REJECTED = [
  ['/\\bCHIPS\\b/ unqualified', 231, 'silicon; Rowhammer and GPU papers'],
  ['/\\bCHIPS\\b/ within 200 chars of "partition"', 8, 'DRAM bank partitioning — 3 of the 8 were silicon'],
  ['/\\bthe Topics\\b/', 216, 'ordinary English'],
  ['/\\bIPA\\b/', 53, 'shared with Interoperable Private Attribution only rarely'],
  ['/\\bPPA\\b/', 23, '"Preference Profiling Attack", among others'],
  ['/IP Protection/ unqualified', 31, 'intellectual property'],
  ['/k-anonymity/', 97, 'generic privacy term, not Privacy Sandbox specific'],
  ['/Privacy Budget/ unqualified', 106, 'generic differential-privacy term'],
  ['/SPARROW|DOVEKEY|PARAKEET/', 24, 'matches "sparrow"/"parakeet" in unrelated papers'],
  ['/interest\\s+group/ (bare)', 234, 'political science, federated learning, recommender systems'],
  ['/bounce\\s+tracking/', 12, 'the phenomenon, not the Chrome countermeasure — see privacy:cookie_syncing'],
  ['/\\bFLoC\\b/ before a year', 3, '"FLoC 2018" is the Federated Logic Conference'],
  ['/Aggregation Service/ (bare)', 2, 'a 2022 outage paper and a 2012 analytics paper, neither about the Sandbox'],
  ['/\\bFLEDGE\\b/i', 2, '"full-fledge crawling system" — the hyphen is a word boundary'],
  ['/First[- ]Party Sets/i', 1, '"the first party sets the cookies" is a verb phrase'],
  ['/attribution reporting/i (bare, lowercase)', 1, "Apple's SKAdNetwork \"anonymises attribution reporting\""],
];
 
export function collapse(raw) {
  return raw.replace(/-\n/g, '').replace(/\s+/g, ' ');
}

Produced by node scripts/report_privacy_sandbox.mjs. Unedited.

report_privacy_sandbox-output.txt

# privacy:privacy_sandbox — every published figure
# generated by scripts/report_privacy_sandbox.mjs
 
DENOMINATOR (full-text queries): 5869 papers with a paper.cols.txt
  across 7 venues (CCS, IMC, NDSS, PETS, USENIX Sec, TheWebConf, IEEE S&P), 2010-2026.
  2025-2026 are provisional: CCS/IMC 2026 not held, IEEE S&P/WWW 2026 under-selected.
 
## 1. Reach: how much of the corpus is about this at all
 
papers naming "Privacy Sandbox" at all      : 43 (0.7% of 5869)
papers naming >=1 API family (folded)       : 67 (1.1%)
papers naming "Privacy Sandbox" >=5 times   : 9 (0.2%)
 
This is the page's central limitation and it is printed first on purpose:
the Privacy Sandbox literature inside these seven venues is a few dozen papers,
and the double-digit set that measures anything is smaller still.
 
### Papers naming "Privacy Sandbox" 5+ times, most-naming first
   48x  2025 CCS      exploiting-the-shared-storage-api
   18x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
   14x  2023 NDSS     navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
   12x  2026 PETS     the-pet-paradox-how-amazon-instrumentalises-pets-in-sidewalk-to-entrench-its-inf
   11x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
    6x  2026 NDSS     snpeek-side-channel-analysis-for-privacy-applications-on-confidential-vms
    5x  2024 PETS     overprofiling-analysis-on-major-internet-players
    5x  2025 CCS      fingerprinting-sdks-for-mobile-apps-and-where-to-find-them-understanding-the-mar
    5x  2025 PETS     user-centric-textual-descriptions-of-privacy-enhancing-technologies-for-ad-track
 
## 2. Papers per API family (denominator 5869 papers with full text)
Folded through scripts/ps_fold.mjs: former names counted with current ones.
 
API family                                        Former names                        Papers  Share
------------------------------------------------  ----------------------------------  ------  -----
Topics API                                        FLoC (predecessor, withdrawn 2022)  22      0.4%
User-Agent Client Hints / UA reduction            -                                   10      0.2%
Protected Audience                                FLEDGE, TURTLEDOVE                  8       0.1%
Privacy Sandbox on Android                        SDK Runtime                         7       0.1%
CHIPS (partitioned cookies)                       the Partitioned cookie attribute    5       0.1%
Private State Tokens                              Trust Tokens                        5       0.1%
Fenced Frames                                     -                                   4       0.1%
Related Website Sets                              First-Party Sets                    4       0.1%
Attribution Reporting API                         Conversion Measurement API          3       0.1%
Shared Storage API                                -                                   3       0.1%
Private Aggregation / Aggregation Service         -                                   2       0.0%
Storage Access API                                -                                   2       0.0%
FedCM                                             Federated Credential Management     1       0.0%
IP Protection                                     Gnatcatcher                         0       0.0%
Bounce Tracking Mitigations (the Chrome feature)  -                                   0       0.0%
 
### Per-family paper lists (all of them, so nothing is hidden by a top-N cut)
 
  -- Topics API (22 papers) --
      162x  2022 CCS      privacy-limitations-of-interest-based-advertising-on-the-web-a-post-mortem-empir
      109x  2024 CCS      the-privacy-utility-trade-off-in-the-topics-api
       94x  2023 PETS     locality-sensitive-hashing-does-not-guarantee-privacy-attacks-on-googles-floc-an
       93x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
       72x  2023 PETS     on-the-robustness-of-topics-api-to-a-re-identification-attack
       33x  2025 CCS      exploiting-the-shared-storage-api
       22x  2025 PETS     user-centric-textual-descriptions-of-privacy-enhancing-technologies-for-ad-track
       10x  2024 PETS     overprofiling-analysis-on-major-internet-players
        8x  2026 PETS     gaze3p-gaze-based-prediction-of-user-perceived-privacy
        4x  2022 IMC      what-factors-affect-targeting-and-bids-in-online-advertising-a-field-measurement
        4x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
        3x  2022 IMC      measuring-uid-smuggling-in-the-wild
        2x  2025 IMC      a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
        2x  2025 NDSS     cascading-spy-sheets-exploiting-the-complexity-of-modern-css-for-email-and-browser-fingerprinting
        2x  2025 PETS     understanding-regional-filter-lists-efficacy-and-impact
        2x  2026 NDSS     cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews
        1x  2023 PETS     usability-and-enforceability-of-global-privacy-control
        1x  2024 PETS     the-devil-is-in-the-details-detection-measurement-and-lawfulness-of-server-side
        1x  2024 PETS     website-data-transparency-in-the-browser
        1x  2025 PETS     unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie
        1x  2025 USENIX   websites-global-privacy-control-compliance-at-scale-and-over-time
        1x  2026 NDSS     are-your-sites-truly-isolated-automatically-detecting-logic-bugs-in-site-isolation-implementations
 
  -- Protected Audience (8 papers) --
      150x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
       26x  2023 NDSS     navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
       11x  2025 CCS      exploiting-the-shared-storage-api
        7x  2024 CCS      the-privacy-utility-trade-off-in-the-topics-api
        5x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        2x  2022 IMC      what-factors-affect-targeting-and-bids-in-online-advertising-a-field-measurement
        1x  2025 NDSS     you-can-rand-but-you-cant-hide-a-holistic-security-analysis-of-google-fuchsias-and-gvisors-network-stack
        1x  2026 PETS     the-pet-paradox-how-amazon-instrumentalises-pets-in-sidewalk-to-entrench-its-inf
 
  -- Attribution Reporting API (3 papers) --
        2x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        2x  2025 IMC      a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
        1x  2026 NDSS     snpeek-side-channel-analysis-for-privacy-applications-on-confidential-vms
 
  -- Private Aggregation / Aggregation Service (2 papers) --
        6x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
        4x  2025 CCS      exploiting-the-shared-storage-api
 
  -- Shared Storage API (3 papers) --
      162x  2025 CCS      exploiting-the-shared-storage-api
        1x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        1x  2026 NDSS     are-your-sites-truly-isolated-automatically-detecting-logic-bugs-in-site-isolation-implementations
 
  -- Fenced Frames (4 papers) --
       21x  2025 CCS      exploiting-the-shared-storage-api
       12x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
        3x  2023 NDSS     navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
        1x  2026 NDSS     are-your-sites-truly-isolated-automatically-detecting-logic-bugs-in-site-isolation-implementations
 
  -- CHIPS (partitioned cookies) (5 papers) --
       31x  2025 PETS     intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
       11x  2023 IMC      understanding-the-privacy-risks-of-popular-search-engine-advertising-systems
        4x  2025 IMC      cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
        2x  2025 WWW      least-privilege-access-for-persistent-storage-mechanisms-in-web-browsers
        1x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
 
  -- Storage Access API (2 papers) --
        2x  2024 IMC      a-first-look-at-related-website-sets
        2x  2025 PETS     tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we
 
  -- Related Website Sets (4 papers) --
       63x  2024 IMC      a-first-look-at-related-website-sets
        2x  2022 PETS     who-knows-i-like-jelly-beans-an-investigation-into-search-privacy
        2x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        1x  2021 NDSS     whos-hosting-the-block-party-studying-third-party-blockage-of-csp-and-sri
 
  -- Private State Tokens (5 papers) --
       23x  2023 NDSS     navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
        1x  2024 IMC      browser-polygraph-efficient-deployment-of-coarse-grained-browser-fingerprints-fo
        1x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        1x  2024 USENIX   fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
        1x  2025 NDSS     you-can-rand-but-you-cant-hide-a-holistic-security-analysis-of-google-fuchsias-and-gvisors-network-stack
 
  -- FedCM (1 papers) --
        3x  2025 IEEE-SP  only-as-strong-as-the-weakest-link-on-the-security-of-brokered-single-sign-on-on
 
  -- User-Agent Client Hints / UA reduction (10 papers) --
       12x  2024 IEEE-SP  tabbed-out-subverting-the-android-custom-tab-security-model
        6x  2026 PETS     an-improved-entropy-measure-for-web-browser-fingerprinting-risk
        3x  2025 PETS     how-unique-is-whose-web-browser-the-role-of-demographics-in-browser-fingerprinti
        2x  2023 PETS     your-drm-can-watch-you-too-exploring-the-privacy-implications-of-browsers-mis-im
        2x  2025 CCS      exploiting-the-shared-storage-api
        2x  2025 IMC      a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
        1x  2022 USENIX   phish-in-sheeps-clothing-exploring-the-authentication-pitfalls-of-browser-finger
        1x  2023 USENIX   account-security-interfaces-important-unintuitive-and-untrustworthy
        1x  2024 USENIX   arcanum-detecting-and-evaluating-the-privacy-risks-of-browser-extensions-on-web
        1x  2025 CCS      hidden-in-plain-bytes-investigating-interpersonal-account-compromise-with-data-e
 
  -- IP Protection (0 papers) --
 
  -- Bounce Tracking Mitigations (the Chrome feature) (0 papers) --
 
  -- Privacy Sandbox on Android (7 papers) --
        5x  2024 USENIX   exploring-covert-third-party-identifiers-through-external-storage-in-the-android
        4x  2023 USENIX   union-under-duress-understanding-hazards-of-duplicate-resource-mismediation-in-a
        3x  2024 PETS     interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
        2x  2025 PETS     your-signal-their-data-an-empirical-privacy-analysis-of-wireless-scanning-sdks-i
        1x  2023 PETS     usability-and-enforceability-of-global-privacy-control
        1x  2024 CCS      the-privacy-utility-trade-off-in-the-topics-api
        1x  2025 CCS      fingerprinting-sdks-for-mobile-apps-and-where-to-find-them-understanding-the-mar
 
## 3. By year: when the corpus started noticing
 
Year   papers  PS-named  share  any-API  share
-----  ------  --------  -----  -------  -----
2010   118     0         0.0%   0        0.0%
2011   116     0         0.0%   0        0.0%
2012   151     0         0.0%   0        0.0%
2013   125     0         0.0%   0        0.0%
2014   165     0         0.0%   0        0.0%
2015   190     0         0.0%   0        0.0%
2016   182     0         0.0%   0        0.0%
2017   232     0         0.0%   0        0.0%
2018   254     0         0.0%   0        0.0%
2019   402     0         0.0%   0        0.0%
2020   402     1         0.2%   1        0.2%
2021   380     1         0.3%   2        0.5%
2022   546     4         0.7%   7        1.3%
2023   720     7         1.0%   12       1.7%
2024   701     13        1.9%   17       2.4%
2025*  770     13        1.7%   21       2.7%
2026*  415     4         1.0%   7        1.7%
* 2025-2026 provisional (CCS/IMC 2026 not held; IEEE S&P/WWW 2026 under-selected).
 
## 4. Regexes measured and REJECTED, with the paper count each produced
Kept so the next run does not re-add them.
 
Rejected pattern                             Papers it matched  Why rejected
-------------------------------------------  -----------------  --------------------------------------------------------------------------
/\bCHIPS\b/ unqualified                      231                silicon; Rowhammer and GPU papers
/\bCHIPS\b/ within 200 chars of "partition"  8                  DRAM bank partitioning — 3 of the 8 were silicon
/\bthe Topics\b/                             216                ordinary English
/\bIPA\b/                                    53                 shared with Interoperable Private Attribution only rarely
/\bPPA\b/                                    23                 "Preference Profiling Attack", among others
/IP Protection/ unqualified                  31                 intellectual property
/k-anonymity/                                97                 generic privacy term, not Privacy Sandbox specific
/Privacy Budget/ unqualified                 106                generic differential-privacy term
/SPARROW|DOVEKEY|PARAKEET/                   24                 matches "sparrow"/"parakeet" in unrelated papers
/interest\s+group/ (bare)                    234                political science, federated learning, recommender systems
/bounce\s+tracking/                          12                 the phenomenon, not the Chrome countermeasure — see privacy:cookie_syncing
/\bFLoC\b/ before a year                     3                  "FLoC 2018" is the Federated Logic Conference
/Aggregation Service/ (bare)                 2                  a 2022 outage paper and a 2012 analytics paper, neither about the Sandbox
/\bFLEDGE\b/i                                2                  "full-fledge crawling system" — the hyphen is a word boundary
/First[- ]Party Sets/i                       1                  "the first party sets the cookies" is a verb phrase
/attribution reporting/i (bare, lowercase)   1                  Apple's SKAdNetwork "anonymises attribution reporting"
 
## 5. The measuring papers: population, instrument, and measured result
Denominator per row is the paper's OWN population, printed in the table.
Every prevalence string below is verbatim from detection[].prevalence.
 
### CCS 2022 — Privacy Limitations of Interest-based Advertising on The Web: A Post-mortem Empirical Analysis of Google's FLoC.
    mechanism: FLoC
    population: comScore Web Behavior Database n=93808 other (pre-existing-dataset) | comScore Web Behavior Database n=2073405 other (pre-existing-dataset) | 2017 U.S. Census Bureau Current Population Survey n=? other (pre-existing-dataset) | 2017 U.S. Census Bureau American Community Survey n=? other (pre-existing-dataset)
    temporal:   existing-dataset 2017-01..2017-12
    crawlConfig: null (no crawl-config object extracted)
      * unique FLoC cohort ID sequences
          technique : Counted unique sequences across four weekly cohort recomputations.
          metric    : fraction of samples uniquely identifiable
          PREVALENCE: More than 50% after 3 weeks and 95% after 4 weeks.
      * fingerprinting-enhanced cohort unicity
          technique : Combined cohort ID sequences with U.S. state as a weak fingerprint proxy.
          metric    : fraction of uniquely identifiable samples
          PREVALENCE: (null)
      * demographic browsing differences
          technique : Compared top-domain visit-frequency distributions using chi-square tests.
          metric    : chi-square test significance
          PREVALENCE: p < 0.0001 for every tested demographic subpopulation and domain set.
      * demographic t-closeness violations
          technique : Compared cohort demographic frequencies with population frequencies across representative panels.
          metric    : fraction of cohorts violating t-closeness
          PREVALENCE: No greater than random chance for race or income.
 
### PETS 2023 — Locality-Sensitive Hashing Does Not Guarantee Privacy! Attacks on Google's FLoC and the MinHash Hierarchy System
    mechanism: FLoC
    population: MovieLens n=125000 documents (pre-existing-dataset) | Porto Taxi dataset n=30000 other (top-n)
    temporal:   existing-dataset ?..? | existing-dataset ?..?
    crawlConfig: null (no crawl-config object extracted)
      * FLoC browsing-history reconstruction
          technique : GAN-generated histories filtered by integer programming to match SimHash
          metric    : fraction of target history reconstructed
          PREVALENCE: more than 10% of browsing history for at least 30% of users
      * MinHash trajectory narrowing
          technique : Partitioned checkpoints by comparing vehicle and checkpoint MinHash signatures
          metric    : ratio of possibly visited checkpoints
          PREVALENCE: around 10% ± 5% of checkpoints on average
      * SimHash pre-image generation
          technique : Linear integer program maximizing a matching subset of domains
          metric    : success rate and runtime
          PREVALENCE: 100% success at length 5, declining to 11% at length 25
      * MinHash checkpoint identification
          technique : Classified checkpoints as certainly absent, likely present, or unknown
          metric    : possible-checkpoint set size
          PREVALENCE: 805.5 ± 439.7 checkpoints out of 7744
 
### PETS 2023 — On the Robustness of Topics API to a Re-Identification Attack
    mechanism: Topics
    population: EasyPIMS n=268 human-participants (convenience) | EasyPIMS browsing-history dataset n=50976 websites (pre-existing-dataset)
    temporal:   passive-collection 2022..2022
    crawlConfig: null (no crawl-config object extracted)
      * cross-site re-identification
          technique : Match denoised reconstructed profiles across two simulated website audiences
          metric    : probability of correct re-identification
          PREVALENCE: 15–17% for a pool of 1,000 users
      * profile uniqueness
          technique : Compute k-anonymity of denoised reconstructed profiles
          metric    : fraction of users that are non-2-anonymous
          PREVALENCE: 35–42% with a population of 100,000 personas
      * false re-identification
          technique : Exact profile matching against a wrong user across simulated websites
          metric    : false-positive probability
          PREVALENCE: less than 0.2%
 
### CCS 2024 — The Privacy-Utility Trade-off in the Topics API.
    mechanism: Topics
    population: AOL search logs dataset n=436005 human-participants (pre-existing-dataset) | AOL search logs dataset with Citizen Lab classification n=211313 human-participants (pre-existing-dataset) | AOL search logs dataset with Google Topics classification n=198023 human-participants (pre-existing-dataset)
    temporal:   existing-dataset 2006-03-01..2006-05-31
    crawlConfig: null (no crawl-config object extracted)
      * Third-party-cookie re-identification
          technique : Quantitative information-flow channel modeling of cookies and browsing histories.
          metric    : average-case Bayes vulnerability
          PREVALENCE: Analysts using third-party cookies always succeeded on average.
      * Topics API user re-identification
          technique : Computed Bayes leakage and average- and max-case channel capacities.
          metric    : multiplicative Bayes leakage
          PREVALENCE: Complete-pipeline leakage was 0.0028% and 0.0162% of cookie leakage for Citizen Lab and Google v1.
      * Topic popularity inference
          technique : Kronecker-product channel and counting-query analysis over reported topics.
          metric    : probability of correctly counting topic occurrences
          PREVALENCE: With 10 individuals, correct counting probability was 0.56% for both taxonomy sizes.
      * Distinguishing genuine from random topics
          technique : IBA gain function evaluated on bounded-noise and differential-privacy channels.
          metric    : posterior IBA expected gain
          PREVALENCE: Posterior expected gain was 95.8% for Citizen Lab and 96.2% for Google v1.
 
### PETS 2024 — Interest-disclosing Mechanisms for Advertising are Privacy-Exposing (not Preserving)
    mechanism: Topics
    population: CrUX top-list n=1000000 websites (top-n) | Tranco n=1000000 websites (top-n) | Google static mapping n=9254 domains (pre-existing-dataset) | Mozilla-reported browsing-history distribution n=52000 human-participants (pre-existing-dataset) | synthetic dataset generated from published browsing distributions n=250000 other (random) | CrUX top-list n=10000 websites (top-n)
    temporal:   existing-dataset 2022-12..2023-06
    crawlConfig: null (no crawl-config object extracted)
      * Topics noise removal
          technique : Repeated-topic checks plus a ten-domain occurrence threshold
          metric    : accuracy, precision, TPR, FPR, and proportion of noisy topics removed
          PREVALENCE: about 25% of noisy topics in one-shot scenarios; 49% after 15 epochs and 94% after 30 epochs
      * Cross-site re-identification
          technique : Match users across two advertisers by shared genuine top-five topics
          metric    : proportion of users uniquely or probabilistically re-identified
          PREVALENCE: 0.4% uniquely re-identified in one-shot; 57% after 15 epochs and 75% after 30 epochs
      * Topics classification utility
          technique : Compare Topics predictions with Google mapping, manual judgments, and Cloudflare categories
          metric    : accuracy, balanced accuracy, Jaccard, Dice, overlap, and at-least-one-correct ratio
          PREVALENCE: at least one topic matched in 57% of categorized top-million domains
      * Subdomain topic manipulation
          technique : Prepend topic-associated WordNet words to top-site domains
          metric    : number of successful targeted additions and untargeted eliminations
          PREVALENCE: more than 114 targeted additions for half of the initial 10k domains
 
### USENIX 2024 — Fledging Will Continue Until Privacy Improves: Empirical Analysis of Google's Privacy-Preserving Targeted Advertising
    mechanism: Protected Audience
    population: Tranco n=70000 domains (top-n) | custom seed list n=500 domains (purposive)
    temporal:   live-crawl 2023-06..2023-09
    crawlConfig: browsers=["Chrome"] headless=not-stated stateful=stateless consent=no-interaction depth=landing-plus-subpages
      * FLEDGE API adoption
          technique : Instrumented API calls during automated domain crawling.
          metric    : share of visited sites
          PREVALENCE: 9.5% (n = 6,682) of 70,000 sites
      * Google auction dominance
          technique : Logged and attributed observed FLEDGE auctions to sellers.
          metric    : share of observed auctions
          PREVALENCE: Google Ad Manager ran 11,941 of 11,959 auctions (99.8%)
      * Interest-group creation
          technique : Captured browser API calls and inspected Chrome Interest Group storage.
          metric    : number of observed interest groups
          PREVALENCE: 15,935 interest groups
      * Interest-group persistence attempts
          technique : Inspected expiration values in joinInterestGroup calls.
          metric    : share of join calls exceeding the limit
          PREVALENCE: 30.90% (n = 94,673) attempted expiration times greater than 30 days
      * FLEDGE privacy attacks
          technique : Controlled web pages, code review, documentation study, and custom exploits.
          metric    : number of attacks
          PREVALENCE: 12 novel attacks across tracking, cross-site leakage, service disruption, and pollution
      * Owner-sniffing attack performance
          technique : Repeated Puppeteer experiments over lists of candidate owners.
          metric    : completion time and accuracy
          PREVALENCE: Approximately 4.2 seconds for 500 owners; fully accurate in all runs
 
### CCS 2025 — Exploiting the Shared Storage API.
    mechanism: Shared Storage
    population: Google's Privacy Sandbox Enrollment Report and privacy-sandbox-attestations.dat n=289 domains (exhaustive) | Tranco n=1000000 domains (top-n) | Tranco n=15000 domains (stratified) | Disconnect Tracker Protection list n=? domains (pre-existing-dataset)
    temporal:   active-probing late December 2024..late December 2024 | live-crawl early February 2025..early February 2025 | existing-dataset December 25, 2024..December 25, 2024
    crawlConfig: browsers=["Chrome"] headless=not-stated stateful=stateless consent=no-interaction depth=single-target-page
      * network timing covert channel
          technique : Delayed worklet execution and server-side request timing
          metric    : bits leaked per page
          PREVALENCE: 33-bit identifiers feasible with delays of 0.36–1.82 seconds
      * worklet crash covert channel
          technique : Conditional worklet crashes and observing missing requests
          metric    : identifier recovery delay
          PREVALENCE: Random identifiers consistently recovered with approximately 0.5-second reload delays
      * queue timing covert channel
          technique : Flooded Shared Storage queues and measured returned-call timing
          metric    : 5,000 API calls
          PREVALENCE: Two-second flooding intervals produced observable return-time differences
      * iframe caching covert channel
          technique : Compared cached and uncached iframe resource requests
          metric    : requests per 33-bit identifier
          PREVALENCE: 66 requests needed to read a 33-bit identifier
      * data leakage over time
          technique : Repeated selectURL reads after daily budget resets
          metric    : bits leaked per day
          PREVALENCE: Up to 12 bits per day
      * attestation-file availability
          technique : HTTP retrieval followed by manual URL inspection
          metric    : share of checked domains hosting valid files
          PREVALENCE: 245 of 289 domains (85%) hosted valid attestation files
      * Shared Storage API usage
          technique : Puppeteer crawl with Chrome developer-tools capture
          metric    : share of reachable websites
          PREVALENCE: 1,311 of 12,955 reachable sites (10.1%) invoked the API; 1,250 used selectURL
      * Shared Storage access among attested domains
          technique : Parsed collected attestation files
          metric    : share of valid attestation files
          PREVALENCE: 149 of 245 files (61%) reported Shared Storage access
 
### IMC 2024 — A First Look at Related Website Sets.
    mechanism: Related Website Sets
    population: Related Website Sets list n=146 websites (exhaustive) | Tranco n=200 websites (random) | Related Website Sets GitHub pull requests n=114 other (exhaustive)
    temporal:   existing-dataset ?..2024-03-30 | live-crawl 2024-05..2024-05
    crawlConfig: null (no crawl-config object extracted)
      * Perceived website relatedness
          technique : Timed participant judgments for 20 website pairs.
          metric    : classification accuracy and response counts
          PREVALENCE: 36.8% of 114 same-set responses incorrectly identified websites as unrelated
      * RWS set composition
          technique : Counted sites and subsets in the 26 March 2024 list.
          metric    : share of sets containing associated sites
          PREVALENCE: 92.7% of 41 sets had one or more associated sites
      * RWS pull-request outcomes
          technique : Analyzed GitHub pull-request final states.
          metric    : share closed without merging
          PREVALENCE: 58.8% of 114 pull requests were closed without being merged
      * Second-level-domain similarity
          technique : Computed Levenshtein distance between member and primary SLDs.
          metric    : median edit distance and exact-match share
          PREVALENCE: Median edit distance was 7; 9.3% of associated SLDs were identical
      * HTML similarity
          technique : Compared CSS, HTML structure, and joint similarity scores.
          metric    : median joint HTML similarity score
          PREVALENCE: Median joint HTML similarity was 0.04
      * Participant relatedness cues
          technique : Surveyed factors participants used in judgments.
          metric    : percentage selecting each factor
          PREVALENCE: Branding elements were used by 66.7%; domain names by 57.1%
 
### NDSS 2023 — Navigating Murky Waters: Automated Browser Feature Testing for Uncovering Tracking Vectors
    mechanism: cross-browser storage vectors
    population: custom browser-version list n=126 other (purposive)
    temporal:   active-probing 2019-07..2022-04
    crawlConfig: browsers=["Brave","Chrome","Edge","Firefox","Safari","Opera","Tor"] headless=headful stateful=stateless consent=no-interaction depth=single-target-page
      * Browser mechanisms usable as tracking vectors
          technique : Write and read 32-bit identifiers across browser contexts
          metric    : number of mechanisms and browser versions
          PREVALENCE: 21 mechanisms across 126 versions of seven browsers; all latest tested versions were vulnerable to at least one technique
      * Third-party tracking vectors
          technique : Automated cross-origin and embedded-context read/write tests
          metric    : number of mechanisms
          PREVALENCE: 13 mechanisms enabled third-party tracking
      * Private-browsing isolation bypass
          technique : Cross-session identifier reads in private browsing contexts
          metric    : number of mechanisms
          PREVALENCE: two mechanisms bypassed private-browsing isolation
      * History sniffing via favicons
          technique : Compared cached favicon loads with Performance API requests
          metric    : qualitative attack demonstration
          PREVALENCE: Chrome and Safari supported novel favicon history-sniffing attacks
 
### IMC 2024 — Browsing without Third-Party Cookies: What Do You See?
    mechanism: third-party-cookie blocking
    population: Tranco n=10000 domains (top-n) | Tranco n=255 websites (top-n)
    temporal:   live-crawl ?..?
    crawlConfig: browsers=["Firefox"] headless=headless stateful=stateful consent=no-interaction depth=landing-plus-subpages
      * Cookie-notice tracking-cookie violations
          technique : Clicked accept and reject controls, then counted injected cookies
          metric    : number and percentage of websites retaining tracking cookies
          PREVALENCE: 100 (39%) of 255 websites continued using tracking cookies after rejection
      * Third-party-cookie rendering effects
          technique : Compared controlled baseline, control, and cookie-disabled crawl groups
          metric    : BCE screenshot difference and frequency-vector DiD
          PREVALENCE: More than 90% of domains exhibited less than a 10% screenshot difference
      * Website-content changes
          technique : Compared screenshot, image, text, and link feature vectors
          metric    : Jaccard distance and difference in distance
          PREVALENCE: The frequency-vector DiD distribution was concentrated and symmetric at 0
      * Advertisement-request prevalence
          technique : Counted requests to domains listed in EasyList
          metric    : average advertisement requests versus average BCE screenshot difference
          PREVALENCE: Positive correlation across categorized website types
 
### PETS 2025 — Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies
    mechanism: CHIPS
    population: Tranco n=20000 domains (top-n) | Tranco n=20000 domains (random) | Tranco n=6518 websites (purposive)
    temporal:   live-crawl 2024-07..2024-07 | live-crawl 2024-08..2024-08 | live-crawl 2025-01..2025-01
    crawlConfig: browsers=["Firefox v121.0","Chrome"] headless=not-stated stateful=both consent=accept-and-reject depth=landing-page-only
      * intractable cookie transmission
          technique : Compare cookies in accepted-phase Cookie Jar with HTTP-request cookies before rejection.
          metric    : share of websites sending at least one
          PREVALENCE: around 50% of websites; approximately 45%–55% across runs
      * banner rejection effect
          technique : Reject banners, reload pages, and compare sent-cookie counts.
          metric    : average reduction after reload
          PREVALENCE: websites stop sending approximately 25% of intractable cookies after reload
      * GPC effect
          technique : Repeat stateless rejection runs with the GPC signal enabled.
          metric    : average reduction in intractable cookies
          PREVALENCE: approximately 30%, with an additional 32% after subsequent rejection
      * banner-type differences
          technique : Compare intractable-cookie counts for CMP, native, and cookie-paywall banners.
          metric    : relative cookie count
          PREVALENCE: CMP banners set 6.91 times more intractable cookies than native banners
      * cookie persistence
          technique : Analyze actual Cookie Jar expiration times and renewal counts.
          metric    : share exceeding ten days
          PREVALENCE: nearly 60% of cookies have expiration exceeding 10 days
      * cookie synchronization
          technique : Inspect cookie values transferred through redirection URL parameters.
          metric    : share synchronized at least once
          PREVALENCE: 76 of 2,545 unique intractable cookies, or 3%
      * partitioned-cookie adoption
          technique : Chrome stateful crawl records partitioned and non-partitioned cookie attributes.
          metric    : share of tracking cookies partitioned
          PREVALENCE: 40 of 3,177 tracking cookies, or 1.3%; 26 had accompanying non-partitioned cookies
 
### IMC 2025 — $CookieGuard: $ Characterizing and Isolating the First-Party Cookie Jar.
    mechanism: CHIPS (context)
    population: Universal Tranco list n=20000 websites (top-n) | Tranco top 10k list n=10000 websites (top-n) | Tranco top 10k list n=100 websites (random)
    temporal:   live-crawl ?..?
    crawlConfig: browsers=["Chrome"] headless=not-stated stateful=not-stated consent=not-stated depth=landing-plus-subpages
      * cross-domain cookie exfiltration
          technique : Match cookie-derived identifiers against third-party outbound request query strings.
          metric    : share of websites and unique cookie pairs
          PREVALENCE: 55.7% of websites; 5.9% of 82,000 unique cookie pairs
      * cross-domain cookie overwriting
          technique : Track later writes by scripts whose domains differ from cookie creators.
          metric    : share of websites and unique cookie pairs
          PREVALENCE: 31.5% of websites; 2.72% of unique cookie pairs
      * cross-domain cookie deletion
          technique : Track delete operations by non-owning scripts against attributed cookies.
          metric    : share of websites and unique cookie pairs
          PREVALENCE: 6.3% of websites; 1.8% of unique cookie pairs
      * third-party main-frame scripts
          technique : Identify script inclusion and classify script URLs with filter lists.
          metric    : share of websites
          PREVALENCE: 93.3% of successfully crawled websites
      * CookieGuard access-control effectiveness
          technique : Compare cross-domain actions with and without the browser extension.
          metric    : percentage reduction in affected sites
          PREVALENCE: 82.2% overwriting, 86.2% deletion, and 83.2% exfiltration reductions
      * website breakage
          technique : Manual comparison of functionality with and without CookieGuard.
          metric    : percentage of websites with minor or major breakage
          PREVALENCE: 11% major SSO breakage; 3% major functionality breakage
      * CookieGuard runtime overhead
          technique : Paired Selenium visits with and without the extension.
          metric    : page-load time and with/no-extension ratio
          PREVALENCE: average overhead of 0.3 seconds across 8,171 paired sites
      * cross-domain DOM modification
          technique : Pilot analysis of scripts modifying elements outside their ownership.
          metric    : share of sites
          PREVALENCE: 9.4% of sites
 
### WWW 2025 — Least Privilege Access for Persistent Storage Mechanisms in Web Browsers.
    mechanism: CHIPS (context)
    population: Tranco n=10000 websites (top-n) | Tranco top 10K websites n=100 websites (purposive)
    temporal:   live-crawl March 2024..April 2024
    crawlConfig: browsers=["Nightly Firefox version 98.0a1"] headless=not-stated stateful=not-stated consent=not-stated depth=landing-page-only
      * Third-party cookie accesses
          technique : Instrumented cookie APIs logged script and host domains.
          metric    : share of all cookie accesses
          PREVALENCE: 89.84% of all cookie accesses
      * Third-party localStorage accesses
          technique : Instrumented web-storage APIs logged script and host domains.
          metric    : share of all localstorage accesses
          PREVALENCE: 90.98% of all localstorage accesses
      * Third-party IndexedDB accesses
          technique : Instrumented IndexedDB APIs logged script and host domains.
          metric    : share of all IndexedDB accesses
          PREVALENCE: 72.49% of all IndexedDB accesses
      * Host-created cookies accessed by third parties
          technique : Grouped accesses by creator and subsequent accessor domains.
          metric    : share of third-party-accessed cookies
          PREVALENCE: 20.14% of all cookies accessed by third-party scripts
      * Host-created localStorage accessed by third parties
          technique : Grouped accesses by creator and subsequent accessor domains.
          metric    : share of host-created localStorage objects
          PREVALENCE: 76% of all localstorage objects created by first-party scripts
      * Functionality breakage
          technique : Manual comparison of instrumented and vanilla browser behavior.
          metric    : number of affected websites
          PREVALENCE: 100 manually analyzed websites
 
### IMC 2023 — Understanding the Privacy Risks of Popular Search Engine Advertising Systems.
    mechanism: CHIPS (context)
    population: Google Trends and MovieLens n=500 other (random)
    temporal:   live-crawl ?..?
    crawlConfig: browsers=["Chrome"] headless=not-stated stateful=stateless consent=accept-all depth=landing-page-only
      * bounce tracking
          technique : Traced URL navigation chains and validated Location and status-code headers.
          metric    : share of ad clicks
          PREVALENCE: 4% on Bing, 86% on Qwant, and 100% on Google, DuckDuckGo, and StartPage
      * tracker requests
          technique : Matched browser network-request URLs against EasyList and EasyPrivacy.
          metric    : share of destination pages
          PREVALENCE: 93% of ad destination pages included tracker and privacy-harming resources
      * UID smuggling
          technique : Filtered query parameters, cookies, and localStorage values using heuristics and manual inspection.
          metric    : share of ad clicks with identifiers in destination query parameters
          PREVALENCE: 80% Bing, 94% Google, 68% DuckDuckGo, 92% StartPage, and 53% Qwant
      * first-party reidentification
          technique : Inspected cookies and localStorage for unique identifiers across queries and visits.
          metric    : presence of stored user identifiers
          PREVALENCE: Google and Bing stored identifiers; the other search engines did not
      * post-click ad information collection
          technique : Recorded network requests after ad clicks before navigation away.
          metric    : search engines exhibiting collection
          PREVALENCE: All five search engines recorded additional user or click information
 
## 6. The silence: recent web crawls that never mention any of these APIs
 
  web crawls published 2023-2026: 332
    of those, naming >=1 Privacy Sandbox API family: 24 (7.2%)
  web crawls published 2024-2026: 235
    of those, naming >=1 Privacy Sandbox API family: 18 (7.7%)
  web crawls published 2025-2026*: 153
    of those, naming >=1 Privacy Sandbox API family: 11 (7.2%)
 
  Population "web crawl": crawlConfig != null OR studyTypes contains
  automated-web-crawl, AND platforms contains 'web'. This is the same
  definition lib.mjs uses for POPULATIONS.webCrawled.
 
## 7. Of the web crawls that drove Chrome/Chromium, how many name an API
 
  Chrome/Chromium web crawls 2023-2026: 129
    naming >=1 Privacy Sandbox API family: 11 (8.5%)
  Chrome/Chromium web crawls 2024-2026: 86
    naming >=1 Privacy Sandbox API family: 8 (9.3%)
 
  NOTE the sentinel rule: crawlConfig.browsers is stated by only 47.2% of
  the 1,120 crawling papers, so this denominator is "papers that SAID they
  drove Chrome", not "papers that drove Chrome".

Produced by node scripts/ps_quotecheck.mjs. Unedited.

ps_quotecheck-output.txt

== CCS 2022 privacy-limitations-of-interest-based-advertising-on-the-web-a-post-mortem-empir
   PASS  detection/unique FLoC cohort ID sequences
   PASS* detection/fingerprinting-enhanced cohort unicity  (matched after stripping punctuation/spaces)
   NEAR  detection/demographic browsing differences  (11/11 long tokens present)
         quote: For each of the chi-square tests of independence described in Section 5.1.1, we find a statistically significant difference in domain visit frequency 
   PASS  detection/demographic t-closeness violations
   NEAR  population/comScore Web Behavior Database  (7/7 long tokens present)
         quote: Before preprocessing, the sessions dataset includes 93,808 machines.
   NEAR  population/comScore Web Behavior Database  (7/7 long tokens present)
         quote: The resulting preprocessed dataset contains 2,073,405 machine-week records.
   PASS  population/2017 U.S. Census Bureau Current Population Sur
   NEAR  population/2017 U.S. Census Bureau American Community Sur  (9/9 long tokens present)
         quote: We also use 2017 census data from the U.S. Census Bureau American Community Survey (ACS) and Current Population Survey (CPS)
   PASS  temporal/existing-dataset
 
== PETS 2023 locality-sensitive-hashing-does-not-guarantee-privacy-attacks-on-googles-floc-an
   PASS* detection/FLoC browsing-history reconstruction  (matched after stripping punctuation/spaces)
   PASS  detection/MinHash trajectory narrowing
   NEAR  detection/SimHash pre-image generation  (3/3 long tokens present)
         quote: We vary the SimHash bit length from 5 to 25 in increments of 5.
   NEAR  detection/MinHash checkpoint identification  (7/7 long tokens present)
         quote: A set of checkpoints found by our attack has on average 805.5 ± 439.7 checkpoints. Recall that the total number of checkpoint is 7744.
   NEAR  population/MovieLens  (4/4 long tokens present)
         quote: The training set contains 120 000 histories and the test set 5000 histories.
   PASS  population/Porto Taxi dataset
   NEAR  temporal/existing-dataset  (5/5 long tokens present)
         quote: To evaluate our attacks, we instead use the MovieLens dataset [14].
   PASS  temporal/existing-dataset
 
== PETS 2023 on-the-robustness-of-topics-api-to-a-re-identification-attack
   PASS  detection/cross-site re-identification
   NEAR  detection/profile uniqueness  (5/5 long tokens present)
         quote: even in the case of a population of 100, 000 personas, we still observe 35−42% of them being non-2-anonymous.
   PASS  detection/false re-identification
   PASS  population/EasyPIMS
   PASS  population/EasyPIMS browsing-history dataset
   PASS  temporal/passive-collection
 
== CCS 2024 the-privacy-utility-trade-off-in-the-topics-api
   PASS* detection/Third-party-cookie re-identification  (matched after stripping punctuation/spaces)
   PASS* detection/Topics API user re-identification  (matched after stripping punctuation/spaces)
   NEAR  detection/Topic popularity inference  (10/10 long tokens present)
         quote: For instance, for a population of only 10 individuals, the chance of an analyst correctly counting the occurrence of a topic t is as low as 0.56% for 
   PASS  detection/Distinguishing genuine from random topics
   PASS  population/AOL search logs dataset
   PASS… population/AOL search logs dataset with Citizen Lab class  (2 elided fragments, all present in order)
   PASS… population/AOL search logs dataset with Google Topics cla  (2 elided fragments, all present in order)
   PASS  temporal/existing-dataset
 
== PETS 2024 interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi
   NEAR  detection/Topics noise removal  (5/5 long tokens present)
         quote: we find that (1) about 25% of the noisy topics on single websites in one-shot scenarios
   PASS  detection/Cross-site re-identification
   PASS  detection/Topics classification utility
   PASS  detection/Subdomain topic manipulation
   PASS  population/CrUX top-list
   NEAR  population/Tranco  (5/5 long tokens present)
         quote: the top 1M most visited eTLD+1 from Tranco classified with the Topics API
   NEAR  population/Google static mapping  (9/9 long tokens present)
         quote: Consisting of exactly 9254 domains, Table 2 shows the distribution of topics per individual domain on this static mapping.
   PASS  population/Mozilla-reported browsing-history distribution
   PASS  population/synthetic dataset generated from published bro
   PASS  population/CrUX top-list
   NEAR  temporal/existing-dataset  (5/5 long tokens present)
         quote: we use the latest version of the individual draft proposal of Topics from May 30, 2023
 
== USENIX 2024 fledging-will-continue-until-privacy-improves-empirical-analysis-of-googles-priv
   NEAR  detection/FLEDGE API adoption  (7/7 long tokens present)
         quote: We detected the use of FLEDGE APIs in 9.5% (n = 6,682) of the 70K sites that we visited during the measurement period.
   NEAR  detection/Google auction dominance  (11/11 long tokens present)
         quote: We observed a total of 11,959 auctions for ad spaces during our measurement period, almost all of which (n = 11,941) were run by Google Ad Manager.
   PASS  detection/Interest-group creation
   PASS  detection/Interest-group persistence attempts
   PASS  detection/FLEDGE privacy attacks
   PASS… detection/Owner-sniffing attack performance  (2 elided fragments, all present in order)
   NEAR  population/Tranco  (5/5 long tokens present)
         quote: Using our automated approach, we perform a crawl of the top 70K domains from the Tranco list [35].
   NEAR  population/custom seed list  (10/10 long tokens present)
         quote: For our evaluation we gathered a list of 500 domains and used Puppeteer to open a fresh browser instance and join interest groups from a subset of own
   NEAR  temporal/live-crawl  (5/5 long tokens present)
         quote: Our framework collected the API calls on these sites in June and July 2023 ... and again in September 2023 when it was publicly released.
 
== CCS 2025 exploiting-the-shared-storage-api
   NEAR  detection/network timing covert channel  (6/6 long tokens present)
         quote: we find that the maximum delay would be between 0.36 seconds ... and 1.82 seconds ... for a 33-bit long identifier
   PASS  detection/worklet crash covert channel
   PASS… detection/queue timing covert channel  (3 elided fragments, all present in order)
   NEAR  detection/iframe caching covert channel  (6/6 long tokens present)
         quote: this would require 66 requests to read a 33 bit identifier as the two possible resources must be unique for each bit
   PASS  detection/data leakage over time
   PASS  detection/attestation-file availability
   PASS  detection/Shared Storage API usage
   PASS  detection/Shared Storage access among attested domains
   PASS  population/Google's Privacy Sandbox Enrollment Report and
   NEAR  population/Tranco  (4/4 long tokens present)
         quote: we check the rank of these domains in the Tranco list from the same date as the Chrome browser file.
   PASS  population/Tranco
   PASS… population/Disconnect Tracker Protection list  (2 elided fragments, all present in order)
   PASS  temporal/active-probing
   PASS  temporal/live-crawl
   PASS  temporal/existing-dataset
 
== IMC 2024 a-first-look-at-related-website-sets
   PASS  detection/Perceived website relatedness
   PASS… detection/RWS set composition  (2 elided fragments, all present in order)
   NEAR  detection/RWS pull-request outcomes  (10/11 long tokens present)
         quote: the split between approved and closed (without merging) requests has shifted, with 58.8% of all pull requests closed without being merged
   PASS… detection/Second-level-domain similarity  (2 elided fragments, all present in order)
   PASS  detection/HTML similarity
   PASS  detection/Participant relatedness cues
   PASS  population/Related Website Sets list
   PASS  population/Tranco
   NEAR  population/Related Website Sets GitHub pull requests  (8/8 long tokens present)
         quote: Figure 5 shows the cumulative count of pull requests on the Related Website Sets list over time, through to March 30th 2024, comprising 114 requests.
   NEAR  temporal/existing-dataset  (6/6 long tokens present)
         quote: Figure 5 shows the cumulative count of pull requests on the Related Website Sets list over time, through to March 30th 2024
   PASS  temporal/live-crawl
 
== NDSS 2023 navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors
   PASS… detection/Browser mechanisms usable as tracking vectors  (2 elided fragments, all present in order)
   NEAR  detection/Third-party tracking vectors  (9/9 long tokens present)
         quote: We test 21 browser mechanisms and uncover a slew of tracking vectors, including 13 that enable third-party tracking
   NEAR  detection/Private-browsing isolation bypass  (10/10 long tokens present)
         quote: including 13 that enable third-party tracking and two that bypass the isolation offered by private browsing modes.
   NEAR  detection/History sniffing via favicons  (7/7 long tokens present)
         quote: We then developed a test to link different 3P favicons to the Performance API, and included it in the test suite offered by CanITrack.
   PASS* population/custom browser-version list  (matched after stripping punctuation/spaces)
   PASS… temporal/active-probing  (2 elided fragments, all present in order)
 
== IMC 2024 browsing-without-third-party-cookies-what-do-you-see
   PASS  detection/Cookie-notice tracking-cookie violations
   PASS  detection/Third-party-cookie rendering effects
   PASS  detection/Website-content changes
   PASS  detection/Advertisement-request prevalence
   PASS  population/Tranco
   PASS  population/Tranco
   PASS* temporal/live-crawl  (matched after stripping punctuation/spaces)
 
== PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
   PASS  detection/intractable cookie transmission
   PASS  detection/banner rejection effect
   PASS… detection/GPC effect  (2 elided fragments, all present in order)
   PASS  detection/banner-type differences
   PASS  detection/cookie persistence
   NEAR  detection/cookie synchronization  (6/6 long tokens present)
         quote: out of 2,545 unique intractable cookies in the RandComb run, 76 (i.e., 3%) are synchronized at least once
   NEAR  detection/partitioned-cookie adoption  (9/9 long tokens present)
         quote: among 3,177 unique tracking cookies, only 40 (1.3%) are partitioned, of which 26 are accompanied by non-partitioned tracking cookies
   NEAR  population/Tranco  (5/5 long tokens present)
         quote: Our target list consists of the landing pages of top-ranked domains.
   NEAR  population/Tranco  (4/4 long tokens present)
         quote: we sample and mix up 20k domains from Tranco's top 50k domains list
   NEAR  population/Tranco  (11/11 long tokens present)
         quote: we conduct a separate stateful run using Chrome on the domains with previously detected banners on them in the RandComb run (i.e., 6,518 in total)
   PASS… temporal/live-crawl  (2 elided fragments, all present in order)
   PASS… temporal/live-crawl  (1 elided fragments, all present in order)
   PASS… temporal/live-crawl  (2 elided fragments, all present in order)
 
== IMC 2025 cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
   NEAR  detection/cross-domain cookie exfiltration  (12/12 long tokens present)
         quote: We find that about 55.7% of websites include at least one script that exfiltrates a cookie it did not set originally. These behaviors impact 5.9% (4,8
   NEAR  detection/cross-domain cookie overwriting  (7/7 long tokens present)
         quote: We find that approximately 32% of websites include at least one script that overwrites a cookie it did not originally set
   NEAR  detection/cross-domain cookie deletion  (13/13 long tokens present)
         quote: while 6.3% include a script that deletes a cookie it did not create. Overall, 2.72% of all unique cookie pairs are overwritten by non-owning scripts, 
   NEAR  detection/third-party main-frame scripts  (8/8 long tokens present)
         quote: We find that 93.3% of the 14,917 successfully crawled websites in our dataset include at least one third-party script in their main frame
   NEAR  detection/CookieGuard access-control effectiveness  (13/13 long tokens present)
         quote: CookieGuard significantly reduces cross-domain actions on first-party cookies: overwriting by 82.2%, deletion by 86.2%, and exfiltration by 83.2%.
   PASS  detection/website breakage
   PASS  detection/CookieGuard runtime overhead
   PASS  detection/cross-domain DOM modification
   PASS  population/Universal Tranco list
   PASS  population/Tranco top 10k list
   PASS  population/Tranco top 10k list
   PASS  temporal/live-crawl
 
== WWW 2025 least-privilege-access-for-persistent-storage-mechanisms-in-web-browsers
   PASS  detection/Third-party cookie accesses
   PASS  detection/Third-party localStorage accesses
   PASS  detection/Third-party IndexedDB accesses
   PASS  detection/Host-created cookies accessed by third parties
   PASS  detection/Host-created localStorage accessed by third pa
   NEAR  detection/Functionality breakage  (12/12 long tokens present)
         quote: We manually analyzed the effect of our solution for 100 websites where third-party scripts access the host-page cookies with the default policy
   PASS* population/Tranco  (matched after stripping punctuation/spaces)
   NEAR  population/Tranco top 10K websites  (9/9 long tokens present)
         quote: We manually saved the top 100 websites in the list of websites that contained at least one third-party script accessing cookies set by the host-page.
   PASS  temporal/live-crawl
 
== IMC 2023 understanding-the-privacy-risks-of-popular-search-engine-advertising-systems
   PASS  detection/bounce tracking
   PASS  detection/tracker requests
   PASS  detection/UID smuggling
   PASS  detection/first-party reidentification
   PASS  detection/post-click ad information collection
   PASS  population/Google Trends and MovieLens
   PASS  temporal/live-crawl
 
== TOTAL 131 quotes: PASS 91, NEAR 40, FAIL 0
   PASS  = quote found verbatim after whitespace collapse.
   PASS* = found after also stripping punctuation and spaces
   PASS… = quote contains an "..." elision; every fragment of >=12
           characters was found, in the paper's own order.
           (a space inside a number, a ligature, an en-dash).
   NEAR = >=80% of its 6+-character tokens present but not contiguous
          (column-reading or ligature damage). Read these by hand.
   FAIL = not located. No figure resting on a FAIL is published.

Three focused sonnet passes on the published first draft, run in parallel, each told explicitly that the author's context may not be exhaustive and each handed the page text, the report script, its output and these notes. Findings applied below; a generic fable pass follows.

Not found by this pass, and worth recording: it verified the silence table against the pre-fix script and reported it correct, which it was — but the four fold fixes then moved it (25/19/12 → 24/18/11). The page was re-derived from the post-fix run, not patched.

Everything else passed: 13 keys resolve, 724 keys unique, the six new entries match Crossref on authors, order, title, year, venue and DOI, ~34 quantitative claims traced to the sentence in paper.cols.txt, all 8 footnotes verbatim against live sources, and the claim that rasaii2025_crumbs cites the PAM CHIPS paper with a broken DOI independently confirmed (10.1007/978-3-031-55528-2_1 404s; the correct one is 10.1007/978-3-031-85960-1_8).

Also confirmed by this pass and not previously checked here: Playwright 1.62.1 is npm's current latest (2026-07-30) and bundles exactly Chromium 151.0.7922.34; Playwright's chromiumSwitches.ts on main disables ThirdPartyStoragePartitioning and no ads-API feature; the W3C Attribution Level 1 Working Draft is dated 2026-08-28; taxonomy_v3.md returns 404.

Run after the three focused passes and their fixes, with no checklist. It found more than the other three combined, and two of its findings were substantive enough to change what the page tells a reader to do.

Rejected: nothing. Every finding from this pass was accepted. That is unusual and is recorded as such: it is evidence the generic slot earns its place, and also that the three focused passes, by having checklists, all missed the same class of defect — advice that is well-sourced and wrong.

Verifying the generic pass's “removal dates have already slipped twice” finding against the blink-dev thread turned up more than the finding itself, and the content page gained a section that no reviewer had seen: “The only post-2025 adoption numbers that exist are Chrome's own”, five rows of Chrome Platform Status motivation telemetry. It is recorded here rather than folded silently into the page because it postdates every review, and because it is exactly the kind of late addition that escapes an audit trail. Its sources are in External sources, verified and rejected; two subsequent re-review passes checked all five quotes verbatim and found no error in them.

Two sonnet re-review passes were then run over the edited pages, one on figures and one on currency and citations, both told the earlier fixes might themselves be wrong.

Everything else in both re-reviews checked out: the fold fix lost exactly the one true positive already admitted and no more (179 of 180 case-insensitive extras in the Protected Audience family are “full-fledged”), every regenerated table matches a fresh script run byte for byte, the published code block is byte-identical to the committed script and reproduces its seven events, the mutation test still drops it to three, and all 34 external claims re-fetched today were confirmed verbatim.