A web-measurement paper has to land somewhere. The instinct is to send it to “the measurement conference” or “a top-tier security venue” and treat ranking tables as the decision. That is how a crawl of websites ends up at IMC because IMC is in the name, or at IEEE S&P because the H5-index is large, and then the reviews ask why the paper is not a user study, or why it did not measure the Internet.

This page is a venue map for a PhD student who is about to pick. It is not a guide to writing a paper, to CORE, or to how a PC works. Those belong in a methods textbook and in the CFP. What belongs here is what the seven venues this corpus actually published, which other venues take the same work and are missing from the corpus, and which deadlines are open as of 2026-08-27.

The corpus behind the rates is 5,859 extracted papers from CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026. Only 1,120 (19.1%) of them ran a crawl. 2025 and 2026 are provisional — CCS 2026 and IMC 2026 contribute zero extracted papers (those conferences have not been held relative to the freeze), and IEEE S&P / WWW 2026 are thin by construction. Queries, the unedited report and the CFP fetches are on conferences. Corpus-wide caveats: Corpus. The seven-venue SoK trap is on Literature review.

Match the object you measured to the community that already publishes that object, then check the CFP's own scope sentence.

• A sample of websites, crawled. The Web Conference first (it is the web venue, and it is the crawl-heaviest of the seven). PETS if the claim is about tracking, consent, or a privacy mechanism. A security venue if the claim is an attack, a defence, or a vulnerability in the wild. IMC only if the contribution is also a measurement of the Internet — path, DNS, CDN, TLS ecosystem — not merely “we used Tranco”.
• The Internet as an operational network. IMC. RAID explicitly solicits “security measurement studies”. PAM is the other dedicated measurement venue; it is not in this corpus and this sitting did not fetch a 2027 CFP.
• A privacy mechanism, a tracker, a consent signal. PETS (journal issues four times a year, symposium in July). IEEE S&P and USENIX Security take the same papers when the contribution is a new attack or system.
• People using security or privacy UI. SOUPS first; CHI if the contribution is an HCI result that happens to be about security. PETS takes some of this (42.2% of its extracted papers have participants). IMC almost does not (10.5%).
• Consumer protection / dark patterns / deceptive UI, with a measurement. ConPro (IEEE S&P workshop). Check whether that year's workshop has proceedings before you treat it as archival. The content page Darkpatterns is the measurement, not the venue.
• Privacy engineering (translating law and requirements into systems). IWPE (EuroS&P workshop).
• Usable-security measurement that needs a full paper, not a workshop. SOUPS or CHI, not a security-flagship cycle that will ask for a new attack.

Stafeev and Pellegrino [1Stafeev, Aleksei; Pellegrino, Giancarlo (2024): "SoK: State of the Krawlers – Evaluating the Effectiveness of Crawling Algorithms for Web Security Measurements", in: Proceedings of the USENIX Security Symposium. (Link)] started from the same seven venues this corpus uses. They are a crawling SoK, not a venue guide, and they then keyword-cut. Use them as the sibling for “these venues, then a filter”, not as a list of where to submit.

Rates are of that venue's extracted papers, not of 5,859. USENIX is the largest slice of the corpus (1,410 / 5,859 = 24.1%) because USENIX Security is large, not because it is where web measurement lives. The crawl-rate column is the one that answers “does this venue actually publish crawls?”.

The script below reprints the ranking. It is the whole lesson in one table: WWW, then PETS, then IMC.

venue_rates.py

#!/usr/bin/env python3
"""Print crawl / empirical / human-subjects rates per venue.
 
The seven-venue extraction is not a web-measurement corpus. This script is
the table on writing:conferences: of the papers each venue actually published
in extract/run1, how many crawled, how many are empirical, how many recruited
human participants.
 
Fails if extract/run1 is missing, if a record has no venue, year or slug, or if
the crawled definition disagrees with lib.mjs (crawlConfig present OR
automated-web-crawl in studyTypes).
 
Usage:
    uv run python pages/venue_rates.py
"""
 
from __future__ import annotations
 
import json
from pathlib import Path
 
ROOTS = [
    Path("/workspace/publications_dataset/data"),
    Path("/workspace/publications_dataset"),
]
 
VENUE_ORDER = ["WWW", "PETS", "IMC", "NDSS", "CCS", "USENIX", "IEEE-SP"]
VENUE_LABEL = {
    "WWW": "The Web Conference",
    "PETS": "PETS / PoPETs",
    "IMC": "IMC",
    "NDSS": "NDSS",
    "CCS": "ACM CCS",
    "USENIX": "USENIX Security",
    "IEEE-SP": "IEEE S&P",
}
 
 
def data_root() -> Path:
    for root in ROOTS:
        if (root / "extract/run1/extractions.jsonl").is_file():
            return root
    raise FileNotFoundError(
        "extract/run1/extractions.jsonl not found under "
        + ", ".join(str(r) for r in ROOTS)
    )
 
 
def is_crawled(p: dict) -> bool:
    return p["crawlConfig"] is not None or "automated-web-crawl" in p["studyTypes"]
 
 
def is_empirical(p: dict) -> bool:
    return p["isEmpirical"] is True
 
 
def is_human_subjects(p: dict) -> bool:
    return len(p["participants"]) > 0
 
 
def pct(n: int, d: int) -> str:
    if d == 0:
        raise ZeroDivisionError("venue has zero papers")
    return f"{100 * n / d:.1f}%"
 
 
def main() -> None:
    path = data_root() / "extract/run1/extractions.jsonl"
    rows: list[dict] = [json.loads(line) for line in path.read_text().splitlines() if line]
    if not rows:
        raise RuntimeError(f"no extraction records in {path}")
 
    by_venue: dict[str, list[dict]] = {v: [] for v in VENUE_ORDER}
    for p in rows:
        v = p["venue"]
        if v not in by_venue:
            raise RuntimeError(f"unexpected venue {v!r} on {p['year']}/{p['slug']}")
        _year = p["year"]
        _slug = p["slug"]
        if _year is None or _slug is None or _slug == "":
            raise RuntimeError(f"missing year or slug on venue {v!r}: year={_year!r} slug={_slug!r}")
        by_venue[v].append(p)
 
    crawled = [p for p in rows if is_crawled(p)]
    print(f"extracted {len(rows)}  crawled {len(crawled)}  ({pct(len(crawled), len(rows))} of extracted)")
    print()
    header = (
        f"{'Venue':<22} {'Papers':>6} {'Crawled':>18} {'Empirical':>18} {'Human subj.':>18}"
    )
    print(header)
    print("-" * len(header))
    for v in VENUE_ORDER:
        g = by_venue[v]
        n = len(g)
        cr = sum(1 for p in g if is_crawled(p))
        emp = sum(1 for p in g if is_empirical(p))
        hs = sum(1 for p in g if is_human_subjects(p))
        print(
            f"{VENUE_LABEL[v]:<22} {n:>6} "
            f"{cr:>5}/{n:<5} {pct(cr, n):>5} "
            f"{emp:>5}/{n:<5} {pct(emp, n):>5} "
            f"{hs:>5}/{n:<5} {pct(hs, n):>5}"
        )
    missing = [v for v in VENUE_ORDER if len(by_venue[v]) == 0]
    if missing:
        raise RuntimeError(f"venues with zero papers: {missing}")
 
 
if __name__ == "__main__":
    main()

Real output, 2026-08-27, against extract/run1:

extracted 5859  crawled 1120  (19.1% of extracted)

Venue                  Papers            Crawled          Empirical        Human subj.
--------------------------------------------------------------------------------------
The Web Conference        843   242/843   28.7%   740/843   87.8%   170/843   20.2%
PETS / PoPETs             510   123/510   24.1%   477/510   93.5%   215/510   42.2%
IMC                       638   132/638   20.7%   625/638   98.0%    67/638   10.5%
NDSS                      701   129/701   18.4%   586/701   83.6%   144/701   20.5%
ACM CCS                   990   163/990   16.5%   818/990   82.6%   186/990   18.8%
USENIX Security          1410   221/1410  15.7%  1226/1410  87.0%   367/1410  26.0%
IEEE S&P                  767   110/767   14.3%   646/767   84.2%   208/767   27.1%

“Rolling” in the previous revision of this page meant two to four discrete cycles, not a continuous deadline. CCS, USENIX Security, IEEE S&P and NDSS all forbid resubmitting a paper rejected in cycle 1 of the same year to cycle 2 (read the current CFP: the embargo text moves). PETS skips one issue. IMC offers a one-shot revision instead.

None of these are in the 5,859. A rate about “how often EuroS&P publishes crawls” cannot be produced here. What the corpus can say is how often the seven-venue papers name them (full-text upper bounds, 4 papers missing paper.cols.txt). Those counts are citations and related-work lists, not publications at the named venue. RAID's bare token also matches disk RAID; the table uses the strict pattern (a year or the full symposium name).

h5-index values are Google Scholar Metrics for articles dated 2020–2024, fetched 2026-08-27. They are not a quality ordering of web-measurement venues: CHI's 139 says it is a large HCI venue, not that a crawl paper belongs there. ICORE is CORE's 2026 successor; A* is 7.52% of 825 ranked venues.

Workshops are how a measurement that is not yet a flagship paper gets a specialist audience. They are also how a paper fails to count as archival. Read whether that year has proceedings.

IEEE S&P 2026's other workshops on the SPW2026 index were ConPro, CyberBio and Data4SoftSec. IWPE was not among them.

PoPETs is the journal. PETS is the symposium that talks about the year's issues. A PETS deadline is a PoPETs issue deadline. That is current practice, not a 2015-era workshop.

ACM Transactions on the Web (TWEB) is the web journal this field already uses for surveys that are not SoKs. Laperdrix, Bielova, Baudry and Avoine [2Laperdrix, Pierre; Bielova, Nataliia; Baudry, Benoit; Avoine, Gildas (2020): "Browser Fingerprinting: A Survey", ACM Transactions on the Web 14(2). (DOI)] is the fingerprinting survey Fingerprinting sends you to; it is a TWEB paper, not one of the seven venues. 137 of 5,859 extracted papers mention TWEB or “Transactions on the Web” (upper bound). TWEB has no conference cycle; check the journal's current CFP / author instructions rather than a month.

This sitting did not add an “engineering journal” row. IEEE TDSC and similar take some measurement; they are not the first place a web-crawl paper goes.

These are process facts from the 2026-08-27 CFPs, not folklore about “what reviewers want”:

• IEEE S&P freezes title, abstract, full author list with ORCIDs, and conflicts at the abstract-registration deadline, a week before the paper. Cycle 1 paper deadline was 11 June 2026, not 12 June (an off-by-one that circulated in secondary notes).
• USENIX Security '27 requires an Open Science appendix on submission, recommends an ethics appendix, limits the body to 13 pages, and caps each author at seven papers per cycle.
• CCS 2026 capped authors at seven papers per cycle and forbade cycle-1 rejects from cycle 2. The 2026 home page also reports a HotCRP breach that exfiltrated about 500 pre-deadline PDFs; that is a fact about that cycle, not a reason to avoid the venue.
• CHI 2027 has no abstract deadline, freezes the author list at paper submission, and is running an assisted desk-reject aimed at sending roughly 50–60% of submissions to full external review (the chairs' 2026-08-17 post).
• PETS is four issues, revise-or-skip-an-issue, symposium in July.
• IMC 2026 ran two deadlines and a one-shot revision. The replicability track needed an earlier expression of interest.

Conference-specific advice of the form “IMC likes graphs” is still a TODO: it is subjective, and this corpus cannot score review-style.

Use a ranking when you have no colleague in the community and need to know whether a name is a workshop. Do not use it to choose between WWW and IMC.

• ICORE2026 (CORE's successor): A* for CCS, CHI, IEEE S&P, NDSS, USENIX Security, WWW. A for ACSAC, AsiaCCS, EuroS&P, ESORICS, IMC, PETS, RAID, SOUPS. portal.core.edu.au.
• Google Scholar Metrics h5-index, 2020–2024 window, 2026-08-27: CHI 139, WWW 120, USENIX Security 116, IEEE S&P 110, CCS 90, NDSS 72, PoPETs 56, EuroS&P 52, IMC 43, AsiaCCS 41, ACSAC 40, SOUPS 35, ESORICS 34, RAID 28. Subtopic lists: Security and Cryptography, HCI. H5 is susceptible to manipulation; it is still better than mixing Scholar with Scimago, which is what the previous revision of this page did for IMC and ACSAC.

sec-deadlines.github.io lists security/privacy CFPs by deadline. It does not list WWW, IMC, CHI or TWEB. It is a tracker, not a source of the dates on this page — those were fetched from each CFP.

• Literature review — the keyword-derived denominator trap, measured on the SoKs in these same seven venues.
• Corpus — how the 5,859 were selected; the nine venue-years that contribute nothing.
• Website selection — Tranco / Radar / CrUX, which is a different question from where the paper goes.
• Crawler — the crawl instruments the WWW/PETS papers above actually used.
• Darkpatterns — a topic ConPro is built for.
• Study preregistration — PETS and USENIX Security are where most of the 15 preregistrations in this corpus sit; the venue choice is part of when you can freeze a plan.

Every corpus rate on this page is produced by scripts/report_conferences.mjs (and the short pages/venue_rates.py reprint). The population of each rate is that venue's extracted papers, or the 1,120 crawled papers, never “all 5,859” except where the share of the corpus is the point (USENIX 24.1%). Posters are identified by a poster- slug or a Poster: title. Out-of-corpus venue rows are mention sweeps, labelled as upper bounds; RAID has a strict pattern and a loose homograph. Deadlines, ICORE ranks and Scholar h5 values are external and were fetched on 2026-08-27; scripts/external_checks_conferences.sh re-fetches them. Full query log, residue, quote samples and the review log: conferences. Corpus-wide caveats: Corpus.

[1]

Stafeev, Aleksei; Pellegrino, Giancarlo (2024): "SoK: State of the Krawlers – Evaluating the Effectiveness of Crawling Algorithms for Web Security Measurements", in: Proceedings of the USENIX Security Symposium. (Link)

[2]

Laperdrix, Pierre; Bielova, Nataliia; Baudry, Benoit; Avoine, Gildas (2020): "Browser Fingerprinting: A Survey", ACM Transactions on the Web 14(2). (DOI)