Pith. sign in

REVIEW 3 major objections 5 minor 2 cited by

Every Keystroke You Make: A Tech-Law Measurement and Analysis of Event Listeners for Wiretapping

T0 review · 3 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read At least 3.18% of top-million websites run third-party scripts that capture keystrokes and transmit them to a remote server, a pattern the paper argues satisfies California's wiretapping criteria.

desk verdict A useful tech-law measurement with a real causal-attribution gap in the headline 3.18% figure; the abstract also oversells 38.52%. read the letter →

arxiv 2508.19825 v1 pith:D7PN5FIG submitted 2025-08-27 cs.CR

Shaoor Munir , Nurullah Demir , Qian Li , Konrad Kollnig , Zubair Shafiq This is my paper
classification cs.CR
keywords webtrackingeventlistenerskeystrokeinterceptionwiretappingCIPA§631sessionreplayprivacymeasurementtech-lawanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a specific, measurable form of web tracking—third-party JavaScript event listeners that capture keystrokes and send them to a remote server—can be mapped to the legal definition of wiretapping under California's wiretapping law, CIPA §631, and that this practice is not rare. The paper translates the statute into three mechanical criteria: install a listener for keydown, keyup, or keypress; intercept the user's typing in real time; and transmit the captured input to a third-party server. Applying those criteria to 15,000 sampled top-million websites, it reports that 38.52% of sites have third-party keystroke listeners and that at least 3.18% both intercept and transmit typed input off-site, which it classifies as wiretapping. It further shows that email addresses typed into forms but never submitted are exfiltrated and later used for unsolicited marketing email. If the mapping holds, the stakes are concrete: unlike newer privacy statutes, U.S. wiretapping laws carry private rights of action, so individual users could have a legal remedy against this form of tracking.

What carries the argument

The load-bearing mechanism is a three-part technical bridge between law and measurement. First, an instrumented browser overrides addEventListener and removeEventListener before any page script runs, logging every listener registration and invocation with its call stack and originating script; this supplies attribution for who installed and fired each listener. Second, a deliberately narrow event set—keydown, keyup, and the deprecated keypress—counts as real-time interception of a user's communication, excluding events that fire only after an interaction ends. Third, a network-side check requires that the typed input, raw or transformed by encoding, hashing, or compression, appears in a requ

What would settle it

Re-crawl the sites flagged as wiretappers with the specific key listener disabled or removed, leaving all other scripts and page code unchanged; if the typed input still reaches the third-party domain, then the listener was not the transmission cause and the 3.18% estimate would need to be revised downward. A complementary check is to record the JavaScript call stack that issued the network request and confirm it belongs to the listener's handler, or to test whether transmissions occur only after keyup rather than during typing, which would contradict real-time interception.

Watch

Extended reading notes

Core claim

The paper's central claim is that a third-party script which installs a keydown, keyup, or keypress listener, intercepts a user's typing in real time, and transmits the captured input to a non-first-party server satisfies the technical criteria for wiretapping under California's Invasion of Privacy Act, CIPA §631, and that this pattern occurs on at least 3.18% of a balanced 15,000-site sample of the top-million web. The paper deliberately restricts the label to these three keyboard events and to transmissions that leave the browser, framing the count as a conservative lower bound: 38.52% of sites had third-party keystroke listeners, 41.57% had at least one of the three keyboard-event listene

Load-bearing premise

The 3.18% figure depends on the assumption that when a typed value appears in a network request to a third-party server, the event-listener handler whose invocation was recorded is the code that sent it; if another script, a blur or change handler, or first-party code triggered the transmission, the wiretapping count would be inflated.

Editorial extensions

If this is right

  • If the measurement is right, at least one in every 31 sampled top-million websites is capturing user keystrokes and shipping them to a third-party server in real time, before any form submission.
  • The criteria define a conservative technical lower bound: the paper only detects inputs transformed by known encodings, hashes, and compressions, so the true prevalence of keystroke interception with off-site transmission is at least 3.18% and likely higher.
  • Because CIPA and similar wiretapping statutes carry private rights of action, the paper's method gives plaintiffs and regulators a repeatable, web-scale way to identify candidate wiretappers without site cooperation.
  • The honey-token results indicate a commercial pipeline: email addresses typed but never submitted still reach marketers, showing that real-time interception has downstream monetization.
  • Under the paper's legal reading, a valid consent defense under CIPA must be prior to interception, specific about third-party sharing, and effectively implemented—issues the paper does not attempt to evaluate at scale.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct control experiment would settle the attribution question: re-crawl flagged sites with the identified key listener removed and nothing else changed; if typed data still reaches the same third-party domain, the 3.18% figure is not caused by that listener and would need to shrink.
  • The same legal mapping could plausibly extend to pointer events, clipboard events, and DOM-scraping APIs that read input fields directly; those channels are also real-time input access, so a broader measurement would likely push the wiretapping rate above 3.18%.
  • The honey-token results imply an opaque downstream market for intercepted keystrokes; embedding per-listener unique tokens in typed values would make it possible to attribute each unsolicited email to the specific script that first exfiltrated it.
  • If courts continue to require prior consent, the paper's method could be turned into a compliance audit: check whether any key listeners fire before a consent banner is accepted, making that legal standard a machine-checkable property.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper presents a tech-law measurement of key-event listeners installed by third-party scripts on top-million websites, with operational criteria for "wiretapping" derived from CIPA §631. The authors instrument Chromium by overriding addEventListener/removeEventListener, crawl 15k sites / 125k pages, inject synthetic keystrokes into forms, and detect whether the synthetic inputs appear in network requests in raw, encoded, or hashed forms. They report that 38.52% of sites have third-party key listeners and that at least 3.18% of sites "wiretap" by both installing such listeners and transmitting captured inputs to a third-party server. They categorize wiretappers, examine session replay/analytics providers, and use honey-token emails to investigate downstream misuse.

Significance. If substantiated, this would be a first-of-its-kind large-scale measurement bridging U.S. wiretap law and web tracking, with practical implications for litigation and enforcement. Strengths: the lower-bound framing with respect to encodings, the broad algorithmic coverage, the careful legal disclaimers, the use of synthetic inputs rather than real user data, and the release of open-source code. However, the central causal attribution is not demonstrated, so the 3.18% number is not yet a solid empirical contribution.

major comments (3)
  1. [§3.3, §4.2] The wiretapper definition in §4.2 requires that a script with a key listener "shares captured inputs," but §3.3 only checks whether synthetic inputs appear in any network request. The listener invocation and the request are never causally joined. A blur/change handler, first-party code, or a different third-party script that reads DOM values can produce the same observed signal. Since the lower-bound framing only limits false negatives from encodings/hashes, it does not bound these false positives. Please add attribution evidence (e.g., initiator stacks, selective listener disabling, or manual audit) or report a false-positive rate; otherwise 3.18% may be inflated.
  2. [§3.2] The crawler records timestamps and call stacks for listener invocations, but the matching algorithm does not appear to use them. If stack traces are available, the authors should report how many matching requests have the flagged handler in their initiator stack, and how many have unrelated initiators. This is the key test for the central claim and would directly address the attribution gap.
  3. [§4.4 and Abstract] The abstract's claim that intercepted emails are "used for unsolicited email marketing" is not established. Only 3 of 50 websites receiving unsolicited emails had an identified wiretapper, and the paper itself notes the attribution challenge: the email headers carry no indication of which entity first exfiltrated the address. The observed correlation does not show that the wiretapper leaked the address. Please soften the claim or add direct evidence of the leakage path.
minor comments (5)
  1. [Abstract, §4.2] The abstract says 38.52% of websites "installed third-party event listeners to intercept keystrokes," while §4.2 reports key-related listeners on 41.57% of websites overall. Clarify that installing a key listener is not itself interception, and clearly distinguish the 38.52% listener-installation figure from the 3.18% wiretapping figure.
  2. [Table 1] The 'test' event appears on 64.95% of websites, which is surprising and unexplained. Add a footnote describing what this event is and why it is so common.
  3. [Figure 2] The check/cross symbols are described only by the caption. Define both symbols explicitly for readability.
  4. [§3.3] The sentence "As related work shows" could cite the relevant prior work more concretely, rather than the general reference to [89].
  5. [§4.3] In the Raptive example, the phrase "through the keyboardjaroflemons.com" appears to be a typo or misplaced text. Please fix.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: wiretapping criteria are sourced from CIPA and external case law, and the 3.18% figure is a direct measurement rather than a fitted or self-referential prediction.

full rationale

Walking the derivation chain: Section 2.3 derives the threat model from CIPA §631 and external court rulings (Javier, TikTok, Frasco, Vita), producing three criteria: a key-event listener, real-time in-path interception, and off-device sharing to a third-party server. Sections 3.2–3.3 implement these independently: addEventListener is overridden to record listener installation and invocation, and synthetic typed inputs are matched in network request payloads/URLs using a fixed set of encodings and hash algorithms. The 3.18% figure in Section 4.2 is the measured fraction of sites satisfying these pre-defined criteria; no parameter is fitted to that number, and no prediction is derived from it. The honey-token email-marketing analysis in Section 4.4 is a separate result and is not used to define a wiretapper. The paper repeatedly labels its estimate a lower bound and explicitly defers consent, standing, and ultimate illegality to future/legal analysis (Section 5, Appendix C). The 'Attribution Challenge' in Section 4.4 and the lack of a demonstrated causal join between listener invocation and network request initiator are measurement-validity concerns, not circularity: they do not reduce the output to an input or to a self-citation. Self-citations ([26], [35], [47], [82], [83], [90]) appear for methodology, the honey-token technique, and related-work framing; none is load-bearing for the wiretapping definition or the 3.18% result. Accordingly, no circular step is identified; the score of 1 reflects only the presence of minor, non-load-bearing self-citations in the methodology stack, not any definitional or fitted-input circularity.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new technical entities, mediators, or conserved quantities. The 'wiretapper' label is a classification of known JavaScript behavior, not a new postulated thing. The central claim rests on methodological parameters (algorithm set, subpage choice, buffer) and legal or sampling assumptions, all listed above.

free parameters (4)
  • Exfiltration matching algorithm set
    The list of hash, encoding, and compression transforms (MD5, SHA, Base64, Gzip, etc.) determines the detection lower bound. Adding or removing transforms changes the 3.18% estimate, so the algorithm set is a chosen parameter of the measurement.
  • Subpage selection strategy = 10 subpages per site, preferring HTML forms
    A manual choice that shapes which pages are crawled. Form pages are more likely to contain keystroke capture, so the resulting prevalence figures may overstate behavior relative to all pages.
  • Post-load interaction buffer = 3 seconds
    Chosen wait time after page load before synthetic interactions begin. It affects which listeners are installed and invoked, and thus the measured interception rate.
  • Synthetic input values = example.email@domain.com, ExamplePassword1!, 098765432109
    Typed values must be recognizable in network traces. Unrealistic inputs could alter the behavior of anti-bot scripts or form validation, so the specific values are a free parameter of the detection pipeline.
assumptions (5)
  • domain assumption CIPA section 631's 'communication in transit' includes keystrokes captured by an in-page script before form submission.
    The threat model in Section 2.3 asserts this mapping. It is contested (e.g., Vita in Massachusetts reached a different conclusion for pixels), and the paper explicitly leaves illegality determinations to courts.
  • domain assumption Off-device transmission to a remote server is required for the wiretapping classification (interception plus disclosure reading).
    Section 2.3 adopts the district-court view that sharing to a remote server is a potentially important requirement. This narrows the definition and is a legal interpretation, not a technical fact.
  • domain assumption Consent is assumed absent for all measured websites.
    Section 2.3 and Appendix C assume the user did not consent because the crawler does not interact with consent banners. Consent is a legal element the paper does not measure.
  • domain assumption The instrumented browser's synthetic interactions faithfully reproduce the event sequences the paper attributes to interception.
    Section 3.2 describes simulated mouse, keyboard, and form-filling actions. Detection of wiretapping depends on these triggers, and no validation against real-user behavior is reported.
  • domain assumption The Tranco top-million rank buckets are a reasonable sample of the web.
    Section 3.1 samples 3,000 sites per rank range. The resulting 15k is not a uniform sample of the top million, so prevalence statistics are weighted by design.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Every Keystroke You Make: A Tech-Law Measurement and Analysis of Event Listeners for Wiretapping." pith.science (2026). https://pith.science/paper/D7PN5FIG

@misc{pith2026250819825,
  author       = {Pith},
  title        = {Pith review of: Every Keystroke You Make: A Tech-Law Measurement and Analysis of Event Listeners for Wiretapping},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D7PN5FIG}},
  note         = {Machine review of arXiv:2508.19825}
}
read the original abstract

The privacy community has a long track record of investigating emerging types of web tracking techniques. Recent work has focused on compliance of web trackers with new privacy laws such as Europe's GDPR and California's CCPA. Despite the growing body of research documenting widespread lack of compliance with new privacy laws, there is a lack of robust enforcement. Different from prior work, we conduct a tech-law analysis to map decades-old U.S. laws about interception of electronic communications--so-called wiretapping--to web tracking. Bridging the tech-law gap for older wiretapping laws is important and timely because, in cases where legal harm to privacy is proven, they can provide statutory private right of action, are at the forefront of recent privacy enforcement, and could ultimately lead to a meaningful change in the web tracking landscape. In this paper, we focus on a particularly invasive tracking technique: the use of JavaScript event listeners by third-party trackers for real-time keystroke interception on websites. We use an instrumented web browser to crawl a sample of the top-million websites to investigate the use of event listeners that aligns with the criteria for wiretapping, according to U.S. wiretapping law at the federal level and in California. We find evidence that 38.52% websites installed third-party event listeners to intercept keystrokes, and that at least 3.18% websites transmitted intercepted information to a third-party server, which aligns with the criteria for wiretapping. We further find evidence that the intercepted information such as email addresses typed into form fields are used for unsolicited email marketing. Beyond our work that maps the intersection between technical measurement and U.S. wiretapping law, additional future legal research is required to determine when the wiretapping observed in our paper passes the threshold for illegality.

Figures

Figures reproduced from arXiv: 2508.19825 by the authors.

Figure 1
Figure 1. Comparison of input processing on a webpage with and without third-party event listeners. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. This figure illustrates how terms used in this paper differ based on the mechanisms of information access, the sharing [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Understanding Data Collection, Brokerage, and Spam in the Lead Marketing Ecosystem

    cs.CR 2026-04 unverdicted novelty 8.0 of 10

    An empirical study of over 100 lead-generation websites and 200 controlled contacts shows sensitive health data shared with more than 70 parties, leading to thousands of immediate marketing calls and texts, with evide...

  2. Security Considerations for Multi-agent Systems

    cs.CR 2026-03 unverdicted novelty 6.0 of 10

    No existing AI security framework covers a majority of the 193 identified multi-agent system threats in any category, with OWASP Agentic Security Initiative achieving the highest overall coverage at 65.3%.

Reference graph

Works this paper leans on

124 extracted references · 79 canonical work pages · cited by 2 Pith papers

  1. [1]

    Councilman

    US v. Councilman. https://www.eff.org/cases/ us-v-councilman

  2. [2]

    The Communications Act of 1934, 1934

    1934

  3. [3]

    United States, 1967

    Katz v. United States, 1967

    1967

  4. [4]

    https://www.ojp.gov/ ncjrs/virtual-library/abstracts/ omnibus-crime-control-and-safe-streets-act-1968 , 1968

    Omnibus crime control and safe streets act of 1968. https://www.ojp.gov/ ncjrs/virtual-library/abstracts/ omnibus-crime-control-and-safe-streets-act-1968 , 1968

    1968

  5. [5]

    Electronic Communications Privacy Act (ECPA), 1986

    1986

  6. [6]

    Electronic communications privacy act of

  7. [7]

    harriet carter gifts, inc

    Popa v. harriet carter gifts, inc. 426 F. Supp. 3d 108 (Dist. Court, WD Pennsylvania 2019), 2019

    2019

  8. [8]

    nike, inc

    Saleh v. nike, inc. 562 F. Supp. 3d 503 (Dist. Court, CD California 2021), 2021

    2021

Show all 124 references
  1. [9]

    assurance iq, llc

    Javier v. assurance iq, llc. United States District Court N.D. California, Case No. 20-cv-02860-CRB, 2023

    2023

  2. [10]

    California Penal Code § 631 - Wiretapping and Eaves- dropping, 2024

    2024

  3. [11]

    https://pptr.dev/, 2024

    Puppeteer. https://pptr.dev/, 2024. Version 20.8.2

    2024

  4. [12]

    new england baptist hospital

    Vita v. new england baptist hospital. Massachusetts Supreme Judicial Court, No. SJC-13542, 494 Mass. 824, 2024 WL 4558621 (Mass. Oct. 24, 2024), 2024

    2024

  5. [13]

    https://firefox-source-docs.mozilla

    Shavar lists documentation — firefox source docs. https://firefox-source-docs.mozilla. org/toolkit/components/antitracking/ anti-tracking/tracking-lists/index.html,

  6. [14]

    No boundaries: data exfiltration by third parties embed- ded on web pages

    Gunes Acar, Steven Englehardt, and Arvind Narayanan. No boundaries: data exfiltration by third parties embed- ded on web pages. Proceedings on Privacy Enhancing Technologies, 2020

    2020

  7. [15]

    The web never forgets: Persistent tracking mechanisms in the wild

    Gunes Acar, Christian Eubank, Steven Englehardt, Marc Juarez, Arvind Narayanan, and Claudia Diaz. The web never forgets: Persistent tracking mechanisms in the wild. In Proceedings of the 2014 ACM SIGSAC conference on computer and communications security, pages 674–689, 2014

    2014

  8. [16]

    Fpdetective: dusting the web for fingerprinters

    Gunes Acar, Marc Juarez, Nick Nikiforakis, Claudia Diaz, Seda Gürses, Frank Piessens, and Bart Preneel. Fpdetective: dusting the web for fingerprinters. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security , pages 1129– 1140, 2013

    2013

  9. [17]

    Waqar Aqeel, Balakrishnan Chandrasekaran, Anja Feldmann, and Bruce M. Maggs. On Landing and Internal Web Pages: The Strange Case of Jekyll and Hyde in Web Performance Measurement. In ACM SIGCOMM Internet Measurement Conference, IMC, 2020

    2020

  10. [18]

    Knowing the user’s every move: user activity tracking for website usability evaluation and implicit interaction

    Richard Atterer, Monika Wnuk, and Albrecht Schmidt. Knowing the user’s every move: user activity tracking for website usability evaluation and implicit interaction. In Proceedings of the 15th International Conference on World Wide Web, WWW ’06, pages 203–212, New York, NY , US...

    2006

  11. [19]

    Tracing information flows between ad exchanges using retargeted ads

    Muhammad Ahmad Bashir, Sajjad Arshad, William Robertson, and Christo Wilson. Tracing information flows between ad exchanges using retargeted ads. In 25th USENIX Security Symposium (USENIX Security 16), pages 481–496, 2016

    2016

  12. [20]

    The effect of design patterns on (present and future) cookie consent decisions

    Nataliia Bielova, Laura Litvine, Anysia Nguyen, Mariam Chammat, Vincent Toubiana, and Estelle Hary. The effect of design patterns on (present and future) cookie consent decisions. In 33rd USENIX Security Symposium (USENIX Security 24), pages 2813–2830, 2024

    2024

  13. [21]

    What Is a Data Clean Room and How Does It Work?

    Clearcode. What Is a Data Clean Room and How Does It Work?

  14. [22]

    Cloudflare web analytics, 2024

    Cloudflare. Cloudflare web analytics, 2024

    2024

  15. [23]

    Congress

    Congress.gov, U.S. Congress. Fourth Amendment to the United States Constitution, 2024

    2024

  16. [24]

    Cname cloaking-based tracking on the web: Characteriza- tion, detection, and protection

    Ha Dao, Johan Mazel, and Kensuke Fukuda. Cname cloaking-based tracking on the web: Characteriza- tion, detection, and protection. IEEE Transactions on Network and Service Management, 18(3):3873–3888, 2021

    2021

  17. [25]

    We Value Your Privacy

    Martin Degeling, Christine Utz, Christoper Lentzsch, Henry Hosseini, Florian Schaub, and Thorsten Holz. We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR’s Impact on Web Privacy. In Symposium on Network and Distributed System Secu- rity, NDSS, 2019. 14

    2019

  18. [26]

    Reproducibility and Replicabil- ity of Web Measurement Studies

    Nurullah Demir, Matteo Große-Kampmann, Tobias Urban, Christian Wressnegger, Thorsten Holz, and Pohlmann Norbert. Reproducibility and Replicabil- ity of Web Measurement Studies. In International Conference on World Wide Web, TheWebConf, 2022

    2022

  19. [27]

    Jury finds meta violated california pri- vacy law with flo app data, 2025

    Maria Dinzeo. Jury finds meta violated california pri- vacy law with flo app data, 2025

    2025

  20. [28]

    Improving web application testing with user ses- sion data

    Sebastian Elbaum, Srikanth Karre, and Gregg Rother- mel. Improving web application testing with user ses- sion data. IEEE Transactions on Software Engineering, 2003

    2003

  21. [29]

    United States Privacy Laws, 2024

    Electronic Privacy Information Center (EPIC). United States Privacy Laws, 2024

    2024

  22. [30]

    No boundaries: Exfiltration of personal data by session- replay scripts, 2017

    Steven Englehardt, Gunes Acar, and Arvind Narayanan. No boundaries: Exfiltration of personal data by session- replay scripts, 2017

    2017

  23. [31]

    Online tracking: A 1-million-site measurement and analysis

    Steven Englehardt and Arvind Narayanan. Online tracking: A 1-million-site measurement and analysis. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016

    2016

  24. [32]

    Frequently Asked Questions: The Data Retention Directive — ec.europa.eu

    European Comision. Frequently Asked Questions: The Data Retention Directive — ec.europa.eu. https: //ec.europa.eu/commission/presscorner/ detail/en/memo_14_269, 2014

    2014

  25. [33]

    State of Play in Web- site and Privacy Litigation

    Eva Yang and Jeffrey Margulies. State of Play in Web- site and Privacy Litigation. The Computer & Internet Lawyer, 41(9), October 2024

    2024

  26. [34]

    Google Analytics and Google Tag Manager

    Tabatha Farney. Google Analytics and Google Tag Manager. ALA TechSource, 2016

    2016

  27. [35]

    Canarytrap: Detecting data misuse by third-party apps on online social networks

    Shehroze Farooqi, Maaz Musa, Zubair Shafiq, and Fa- reed Zaffar. Canarytrap: Detecting data misuse by third-party apps on online social networks. Proceed- ings on Privacy Enhancing Technologies, 4:336–354, 2020

    2020

  28. [36]

    The devil is in the details: Detection, measurement and lawfulness of server-side tracking on the web

    Imane Fouad, Cristiana Santos, and Pierre Laperdrix. The devil is in the details: Detection, measurement and lawfulness of server-side tracking on the web. In 24th Privacy Enhancing Technologies Symposium (PETS 2024), volume 2024, 2024

    2024

  29. [37]

    What is session replay?, 2024

    FullStory. What is session replay?, 2024

    2024

  30. [38]

    Privacy Sandbox

    Google. Privacy Sandbox

  31. [39]

    Custom event trigger in google tag manager, 2024

    Google. Custom event trigger in google tag manager, 2024

    2024

  32. [40]

    Custom search element documentation, 2024

    Google. Custom search element documentation, 2024

    2024

  33. [41]

    Page view trigger in google tag manager, 2024

    Google. Page view trigger in google tag manager, 2024

    2024

  34. [42]

    Scroll depth trigger in google tag manager, 2024

    Google. Scroll depth trigger in google tag manager, 2024

    2024

  35. [43]

    Grodzinsky, Keith W

    Frances S. Grodzinsky, Keith W. Miller, and Marty J. Wolf. Session replay scripts: A privacy analysis. The Information Society, 38(4):257–268, 2022

    2022

  36. [44]

    Scroll tracking: How it works and how to use it, 2024

    Hotjar. Scroll tracking: How it works and how to use it, 2024

    2024

  37. [45]

    All eyes on me: Inside third party trackers’ exfiltration of phi from healthcare providers’ online systems

    Mingjia Huo, Maxwell Bland, and Kirill Levchenko. All eyes on me: Inside third party trackers’ exfiltration of phi from healthcare providers’ online systems. In Proceedings of the 21st Workshop on Privacy in the Electronic Society, 2022

    2022

  38. [46]

    Cloak of Visibility: Detecting When Ma- chines Browse a Different Web

    Luca Invernizzi, Kurt Thomas, Alexandros Kaprave- los, Oxana Comanescu, Jean-Michel Picod, and Elie Bursztein. Cloak of Visibility: Detecting When Ma- chines Browse a Different Web. In IEEE Symposium on Security and Privacy, S&P, 2016

    2016

  39. [47]

    Tracking, profiling, and ad targeting in the alexa echo smart speaker ecosystem

    Umar Iqbal, Pouneh Nikkhah Bahrami, Rah- madi Trimananda, Hao Cui, Alexander Gamero- Garrido, Daniel J Dubois, David Choffnes, Athina Markopoulou, Franziska Roesner, and Zubair Shafiq. Tracking, profiling, and ad targeting in the alexa echo smart speaker ecosystem. In Proceedi...

    2023

  40. [48]

    Europe’s enforcement paralysis, 2021

    Irish Council for Civil Liberties. Europe’s enforcement paralysis, 2021

    2021

  41. [49]

    An empirical study of privacy-violating information flows in javascript web applications

    Dongseok Jang, Ranjit Jhala, Sorin Lerner, and Hovav Shacham. An empirical study of privacy-violating information flows in javascript web applications. In Proceedings of the 17th ACM Conference on Computer and Communications Security, CCS ’10, pages 270–

  42. [50]

    Kaplan, Joseph A

    Howard J. Kaplan, Joseph A. Matteo, Richard Sillett, and Arkin Kaplan. The history and law of wiretapping: The lessons of the raj rajaratnam trial: Be careful who’s listening, 2012. Presentation at the 2012 ABA Section of Litigation Annual Conference

    2012

  43. [51]

    A fait accompli? an empirical study into the absence of consent to Third-Party tracking in android apps

    Konrad Kollnig, Pierre Dewitte, Max Van Kleek, Ge Wang, Daniel Omeiza, Helena Webb, and Nigel Shadbolt. A fait accompli? an empirical study into the absence of consent to Third-Party tracking in android apps. In Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021)...

    2021

  44. [52]

    Beauty and the beast: Diverting modern web browsers to build unique browser fingerprints

    Pierre Laperdrix, Walter Rudametkin, and Benoit Baudry. Beauty and the beast: Diverting modern web browsers to build unique browser fingerprints. In 2016 IEEE Symposium on Security and Privacy (SP), 2016

    2016

  45. [53]

    A New Chapter In Video Privacy Protection Act’s History, 2014

    Law360. A New Chapter In Video Privacy Protection Act’s History, 2014

    2014

  46. [54]

    adblock-rust

    Lazarev, Anton. adblock-rust. https://web. archive.org/web/20240327153321/https: //github.com/brave/adblock-rust, 2024

    2024

  47. [55]

    Tranco: A Research-Oriented Top Sites Ranking Hard- ened Against Manipulation

    Victor Le Pochat, Tom Van Goethem, Samaneh Tajal- izadehkhoob, Maciej Korczy´nski, and Wouter Joosen. Tranco: A Research-Oriented Top Sites Ranking Hard- ened Against Manipulation. In Symposium on Network and Distributed System Security, NDSS, 2019

    2019

  48. [56]

    Common Law

    Legal Information Institute. Common Law

  49. [57]

    Fashion faux pas: Implicit stylistic fingerprints for bypassing browsers’ anti-fingerprinting defenses

    Xu Lin, Frederico Araujo, Teryl Taylor, Jiyong Jang, and Jason Polakis. Fashion faux pas: Implicit stylistic fingerprints for bypassing browsers’ anti-fingerprinting defenses. In 2023 IEEE Symposium on Security and Privacy (SP), pages 987–1004. IEEE, 2023

    2023

  50. [58]

    Opted out, yet tracked: Are regulations enough to protect your privacy? Proceedings on Privacy Enhancing Technolo- gies, 2024

    Zengrui Liu, Umar Iqbal, and Nitesh Saxena. Opted out, yet tracked: Are regulations enough to protect your privacy? Proceedings on Privacy Enhancing Technolo- gies, 2024

    2024

  51. [59]

    Data Power

    Orla Lynskey. Grappling with “Data Power”: Norma- tive Nudges from Data Protection and Privacy. Theo- retical Inquiries in Law, 20(1):189–220, 2019

    2019

  52. [60]

    Two Years under GDPR, 2020

    Estelle Massé. Two Years under GDPR, 2020. Imple- mentation Progress Report, Access Now

    2020

  53. [61]

    Do cookie banners respect my choice?: Measuring legal compliance of banners from iab europe’s trans- parency and consent framework

    Célestin Matte, Nataliia Bielova, and Cristiana San- tos. Do cookie banners respect my choice?: Measuring legal compliance of banners from iab europe’s trans- parency and consent framework. In 2020 IEEE Sym- posium on Security and Privacy (SP), pages 791–809. IEEE, 2020

    2020

  54. [62]

    Third-party web tracking: Policy and technology

    Jonathan R Mayer and John C Mitchell. Third-party web tracking: Policy and technology. In 2012 IEEE symposium on security and privacy , pages 413–427. IEEE, 2012

    2012

  55. [63]

    Fb.event.subscribe - javascript sdk documenta- tion, 2024

    Meta. Fb.event.subscribe - javascript sdk documenta- tion, 2024

    2024

  56. [64]

    Get started with the meta pixel, 2024

    Meta. Get started with the meta pixel, 2024

    2024

  57. [65]

    Clarity data collection, 2024

    Microsoft. Clarity data collection, 2024

    2024

  58. [66]

    Moti et al

    Z. Moti et al. Targeted and troublesome: Tracking and advertising on children’s websites. In 2024 IEEE Symposium on Security and Privacy (SP), 2024

    2024

  59. [67]

    Document - web apis, 2024

    Mozilla Developer Network. Document - web apis, 2024

    2024

  60. [68]

    Document object model (dom) - web apis, 2024

    Mozilla Developer Network. Document object model (dom) - web apis, 2024

    2024

  61. [69]

    Document.url - web apis, 2024

    Mozilla Developer Network. Document.url - web apis, 2024

    2024

  62. [70]

    Element: keydown event, 2024

    Mozilla Developer Network. Element: keydown event, 2024

    2024

  63. [71]

    Element: keypress event, 2024

    Mozilla Developer Network. Element: keypress event, 2024

    2024

  64. [72]

    Element: keyup event, 2024

    Mozilla Developer Network. Element: keyup event, 2024

    2024

  65. [73]

    Event - web apis, 2024

    Mozilla Developer Network. Event - web apis, 2024

    2024

  66. [74]

    Event handlers - web apis, 2024

    Mozilla Developer Network. Event handlers - web apis, 2024

    2024

  67. [75]

    Http headers: Referer, 2024

    Mozilla Developer Network. Http headers: Referer, 2024

    2024

  68. [76]

    Keyboardevent - web apis, 2024

    Mozilla Developer Network. Keyboardevent - web apis, 2024

    2024

  69. [77]

    Mouseevent - web apis, 2024

    Mozilla Developer Network. Mouseevent - web apis, 2024

    2024

  70. [78]

    Web apis, 2024

    Mozilla Developer Network. Web apis, 2024

    2024

  71. [79]

    Window: load event, 2024

    Mozilla Developer Network. Window: load event, 2024

    2024

  72. [80]

    Window.location - web apis, 2024

    Mozilla Developer Network. Window.location - web apis, 2024

    2024

  73. [81]

    Xmlhttprequest - web apis, 2024

    Mozilla Developer Network. Xmlhttprequest - web apis, 2024

    2024

  74. [82]

    PURL: Safe and effective saniti- zation of link decoration

    Shaoor Munir, Patrick Lee, Umar Iqbal, Zubair Shafiq, and Sandra Siby. PURL: Safe and effective saniti- zation of link decoration. In 33rd USENIX Security Symposium (USENIX Security 24), 2024

    2024

  75. [83]

    Cookie- graph: Understanding and detecting first-party tracking cookies

    Shaoor Munir, Sandra Siby, Umar Iqbal, Steven Engle- hardt, Zubair Shafiq, and Carmela Troncoso. Cookie- graph: Understanding and detecting first-party tracking cookies. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Secu- rity, 2023

    2023

  76. [84]

    New Wave of Website Privacy Lawsuits Under the Pen Register and Trap and Trace Device Theory , 2024

    National Law Review. New Wave of Website Privacy Lawsuits Under the Pen Register and Trap and Trace Device Theory , 2024. 16

    2024

  77. [85]

    Cookieless monster: Exploring the ecosystem of web-based device fingerprinting

    Nick Nikiforakis, Alexandros Kapravelos, Wouter Joosen, Christopher Kruegel, Frank Piessens, and Gio- vanni Vigna. Cookieless monster: Exploring the ecosystem of web-based device fingerprinting. In 2013 IEEE Symposium on Security and Privacy, pages 541–

    2013

  78. [86]

    Dark patterns after the gdpr: Scraping consent pop-ups and demonstrating their in- fluence

    Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, and Lalana Kagal. Dark patterns after the gdpr: Scraping consent pop-ups and demonstrating their in- fluence. In Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems , CHI ’20, page 1–13, New ...

    2020

  79. [87]

    Why Johnny Can’t Browse in Peace: On the Unique- ness of Web Browsing History Patterns

    Lukasz Olejnik, Claude Castelluccia, and Artur Janc. Why Johnny Can’t Browse in Peace: On the Unique- ness of Web Browsing History Patterns. InProceedings on Privacy Enhancing Technologies, PETS, 2012

    2012

  80. [88]

    won’t somebody think of the children?

    Irwin Reyes, Primal Wijesekera, Joel Reardon, Amit Elazari Bar On, Abbas Razaghpanah, Narseo Vallina- Rodriguez, Serge Egelman, et al. “won’t somebody think of the children?” examining coppa compliance at scale. In The 18th Privacy Enhancing Technologies Symposium (PETS 2018), 2018

    2018

  81. [89]

    Leaky forms: A study of email and password exfiltration before form submis- sion

    Asuman Senol, Gunes Acar, Mathias Humbert, and Frederik Zuiderveen Borgesius. Leaky forms: A study of email and password exfiltration before form submis- sion. In 31st USENIX Security Symposium (USENIX Security 22), pages 1813–1830, Boston, MA, Aug 2022. USENIX Association

    2022

  82. [90]

    WebGraph: Captur- ing advertising and tracking information flows for ro- bust blocking

    Sandra Siby, Umar Iqbal, Steven Englehardt, Zubair Shafiq, and Carmela Troncoso. WebGraph: Captur- ing advertising and tracking information flows for ro- bust blocking. In 31st USENIX Security Symposium (USENIX Security 22), 2022

    2022

  83. [91]

    Dawn Reddy Solowey and Daniel M. Jaffe. Meta’s liability under cipa for flo sdk data: Key takeaways from the jury verdict, 2025

    2025

  84. [92]

    Automated replay and failure detection for web applications

    Sara Sprenkle, Emily Gibson, Sreedevi Sampath, and Lori Pollock. Automated replay and failure detection for web applications. In Proceedings of the Automated Software Engineering (ASE), 2005

    2005

  85. [93]

    Are you sure you want to contact us? quantifying the leak- age of pii via website contact forms

    Oleksii Starov, Phillipa Gill, and Nick Nikiforakis. Are you sure you want to contact us? quantifying the leak- age of pii via website contact forms. Proceedings on Privacy Enhancing Technologies, 2016(1):20–33, 2016

    2016

  86. [94]

    Measuring compliance with the california con- sumer privacy act over space and time

    Van Hong Tran, Aarushi Mehrotra, Marshini Chetty, Nick Feamster, Jens Frankenreiter, and Lior Strahile- vitz. Measuring compliance with the california con- sumer privacy act over space and time. In Proceedings of the 2024 CHI Conference on Human Factors in Computing Systems, C...

    2024

  87. [95]

    18 U.S.C

    United States Code. 18 U.S.C. § 2511(1)(c), (d), 2018. Accessed 2025 from Cornell LII

    2018

  88. [96]

    18 U.S.C

    United States Code. 18 U.S.C. § 2511(2)(d), 2018. Accessed 2025 from Cornell LII

    2018

  89. [97]

    18 U.S.C

    United States Code. 18 U.S.C. §§ 2511(1)(a), 2520(a),

  90. [98]

    Title iii - wiretapping and electronic surveillance, section 801(d), 1968

    United States Congress. Title iii - wiretapping and electronic surveillance, section 801(d), 1968

    1968

  91. [99]

    What Does Free Speech Mean? - Educational Resources, 2024

    United States Courts. What Does Free Speech Mean? - Educational Resources, 2024

    2024

  92. [100]

    Graham v

    Northern District of California United States Dis- trict Court. Graham v. noom, inc., 2021. Case No. 3:20-cv-06903, final dismissal with prejudice

    2021

  93. [101]

    Javier v

    United States District Court for the Northern District of California. Javier v. Assurance IQ, LLC. https://www.courtlistener.com/docket/ 17100379/javier-v-assurance-iq-llc/ , 2020. 3:20-cv-02860 (N.D. Cal.)

    2020

  94. [102]

    In re Facebook, Inc

    United States District Court, Northern District of Cali- fornia. In re Facebook, Inc. Internet Tracking Litiga- tion (Perrin Davis v. Facebook), 2017. 263 F. Supp. 3d 836 (N.D. Cal. 2017), appeal docketed, No. 17-17486 (9th Cir. Dec. 15, 2017)

    2017

  95. [103]

    In re TikTok, Inc

    United States District Court, Northern District of Illi- nois. In re TikTok, Inc. In-App Browser Privacy Liti- gation. MDL 2948-A, Case No. 1:24-cv-02110, Docu- ment #77, Filed: Oct. 1, 2024, PageID: 1412

    2024

  96. [104]

    In re TikTok, Inc

    United States District Court, Northern District of Illi- nois. In re TikTok, Inc. In-App Browser Privacy Liti- gation, 2024. MDL 2948-A

    2024

  97. [105]

    Olmstead v

    United States Supreme Court. Olmstead v. United States, 1928. 277 U.S. 438 (1928)

    1928

  98. [106]

    Beyond the Front Page: Measuring Third Party Dynamics in the Field

    Tobias Urban, Martin Degeling, Thorsten Holz, and Norbert Pohlmann. Beyond the Front Page: Measuring Third Party Dynamics in the Field. In International Conference on World Wide Web, TheWebConf, 2020

    2020

  99. [107]

    In re: Face- book, Inc

    US Court of Appeals for the Ninth Circuit. In re: Face- book, Inc. Internet Tracking Litigation, 2020. 956 F.3d 589 (9th Cir. 2020). 17

    2020

  100. [108]

    Department of Health and Human Services

    U.S. Department of Health and Human Services. Deci- sion charts: 2018 requirements (common rule), 2018

    2018

  101. [109]

    N.D. Cal. U.S. District Court. Jury verdict form in frasco v. flo health, inc., 2025

    2025

  102. [110]

    N.D. Cal. U.S. District Court. Order granting class certification in frasco v. flo health, inc., 2025

    2025

  103. [111]

    (Un)informed Consent: Studying GDPR Consent Notices in the Field

    Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz. (Un)informed Consent: Studying GDPR Consent Notices in the Field. In ACM Conference on Computer and Communications Secu- rity, CCS, 2019

    2019

  104. [112]

    Riva, Marguerite Barry, and Derek Doran

    Natalija Vlajic, Marmara El Masri, Gianluigi M. Riva, Marguerite Barry, and Derek Doran. Online tracking of kids and teens by means of invisible images: Coppa vs. gdpr. In Proceedings of the 2nd International Work- shop on Multimedia Privacy and Security, 2018

    2018

  105. [113]

    Ecommerce marketplace - vtex, 2024

    VTEX. Ecommerce marketplace - vtex, 2024

    2024

  106. [114]

    In- depth technical and legal analysis of tracking on health related websites with ernie extension

    Vera Wesselkamp, Imane Fouad, Cristiana Santos, Ya- nis Boussad, Nataliia Bielova, and Arnaud Legout. In- depth technical and legal analysis of tracking on health related websites with ernie extension. In Proceedings of the 20th Workshop on Privacy in the Electronic So- ciety, 2021

    2021

  107. [115]

    Initializing the counter - yandex metrica, 2024

    Yandex. Initializing the counter - yandex metrica, 2024

    2024

  108. [116]

    Session replay - yandex metrica

    Yandex. Session replay - yandex metrica. help, 2024

    2024

  109. [117]

    What are goals? types of goals - yandex met- rica

    Yandex. What are goals? types of goals - yandex met- rica. help, 2024

    2024

  110. [118]

    “traffic” report - yandex metrica

    Yandex. “traffic” report - yandex metrica. help, 2024

    2024

  111. [119]

    example.email@domain.com

    X. Yu, N. Samarasinghe, M. Mannan, and A. Youssef. Got sick and tracked: Privacy analysis of hospital web- sites. In 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 2022. A Ethical Considerations A.1 Guiding Principles and Institutional Re- view This...

    2022

  112. [283]

    Association for Computing Machinery, 2010

    2010

  113. [1986]

    https://www.congress.gov/bill/ 99th-congress/senate-bill/2375, 1986

    1986

  114. [2018]

    Accessed 2025 from Cornell LII

    2025

  115. [2024]

    Association for Computing Machinery

  116. [2025]

    Describes disconnect-entitylist.json as the Disconnect entity list used by Firefox Tracking Protection

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.