REVIEW 4 major objections 4 minor 32 references
Surveillance Capitalism Revealed: Tracing The Hidden World Of Web Data Collection
T0 review · 4 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash
Pith's one-line read One visit to samsung.com triggered a burst of requests to Facebook, TikTok, Pinterest, Bing, and other ad services, and a later globo.com visit showed Samsung ads, presented as concrete evidence of surveillance capitalism's data flows.
desk verdict A well-intentioned but thin case study whose central retargeting claim lacks controls and whose novelty claim ignores the existing web-privacy measurement literature. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the man-in-the-middle proxy: the test device trusts a certificate installed by the researchers, so all HTTP and HTTPS traffic passes through the proxy and can be read in plaintext. This makes every third-party request triggered by a page visit observable, including connections to pixel servers, analytics beacons, ad exchanges, and identity-sync services. The other half of the machinery is the advertising and tracking stack embedded in commercial websites: third-party cookies, tracking pixels, and JavaScript that report user activity to external domains, exactly the requests the proxy records.
What would settle it
On a clean phone and clean network, visit a set of neutral news sites and record whether Samsung ads appear before ever visiting samsung.com; if they appear at the same rate, the advertisement observation does not support the causal link. A second check is to dump the actual third-party cookie identifiers and real-time bidding requests during the globo.com visit and see whether they contain identifiers previously observed during the samsung.com visit.
Extended reading notes
Core claim
The central observation is that a single, ordinary web action produces a burst of machine-to-machine data transfers to companies the user never contacted. Visiting samsung.com triggers connections to external domains that host tracking pixels, retargeting services, content recommendation engines, programmatic ad exchanges, and identity-resolution services; the packet payloads reference samsung.com, showing that the visit itself is being reported. In the second case, after that visit, a subsequent navigation to globo.com shows Samsung advertisements, which the authors take as evidence that the first visit fed the ad-targeting chain. A separate search for 'Paris 6 Hotels' produces traffic to Google analytics and optimization endpoints. The paper presents these traces as direct evidence of the data-harvesting mechanisms behind surveillance capitalism.
Load-bearing premise
The paper's strongest evidence, Samsung ads appearing on globo.com after visiting samsung.com, assumes the ads were caused by that single visit, with no control visit, no request timeline, and no filtering of background traffic on the test device to rule out other explanations.
Editorial extensions
If this is right
- If a single visit to samsung.com produces requests to a dozen external services, then ordinary browsing routinely distributes one user's activity across many companies the user never chose, making per-company consent in practice impossible to grant.
- The globo.com Samsung-ad observation implies that recent browsing history can change the advertising a user sees on unrelated sites, so the ad environment is not neutral content but a personalized response to prior behavior.
- Because HTTPS traffic is decrypted and logged at the proxy, the study demonstrates that encryption alone does not hide web activity from the parties that control the user's device or network path, a relevant fact for privacy engineering.
- The search-trace results show that even a plain Google query contacts dedicated analytics and optimization endpoints, extending the tracking picture beyond third-party cookies to first-party telemetry.
Reading between the lines
- A direct test of the paper's causal reading would be to repeat the globo.com observation with a clean device that never visits samsung.com; if Samsung ads appear with similar frequency, the ads were not caused by the visit.
- The same proxy method could be applied to other e-commerce sites; if the pattern generalizes, then the 'one visit, many trackers' structure is a property of the advertising ecosystem rather than of one retailer.
- The microphone anecdote in the conclusion is not supported by data in this study, but it suggests a controlled experiment that compares ad delivery with the microphone blocked versus enabled to see whether ambient speech changes the ad stream.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper reports a small-scale empirical study of web traffic captured with a man-in-the-middle proxy (Mitmproxy). The authors describe two case studies: visiting samsung.com and performing a web search, and they claim that the captured traces show third-party tracking services being contacted and, in one case, a later visit to globo.com displaying Samsung advertisements. The paper frames these observations as evidence for 'surveillance capitalism' and concludes with policy recommendations for data protection, particularly in Brazil. The central observation—that a page visit triggers requests to multiple external domains—is plausible, but the manuscript provides no quantitative data, no timestamps, no payload excerpts, and no control conditions to support the stronger causal claims about cross-site retargeting and profile building.
Significance. If properly supported, the paper would fill a useful niche by providing a concrete, reproducible demonstration of third-party data flows during ordinary browsing and searching, complementing the largely theoretical surveillance-capitalism literature. The methodological approach—intercepting HTTPS with a user-installed certificate and documenting the resulting connections—is appropriate for this purpose and is a strength of the design. However, as written, the empirical content is presented only through narrative and screenshots, with no machine-readable trace, no counts, and no causal controls, so the significance of the findings cannot yet be assessed. The paper's accessibility and relevance to privacy regulation debates are real, but the evidence currently falls short of the abstract's claims about 'specific data types' and 'concrete evidence.'
major comments (4)
- [Section 4, paragraph after Figure 3] The claim that Samsung advertisements on globo.com appeared 'shortly after' visiting samsung.com and that this 'shows the efficacy of technologies in tracking user interests and behaviors across the web' requires a causal link that the manuscript does not establish. There is no control condition (e.g., visiting globo.com without having first visited samsung.com on the same device and network), no timeline of requests, no statement that the browser profile was clean or that background traffic on the test device was excluded, and no check that globo.com does not display Samsung ads to all visitors. Without these, the observation is consistent with the retargeting explanation but also with several alternative explanations. This paragraph is the paper's strongest evidence, so this gap is load-bearing.
- [Figure 3 and Section 4] Figure 3 is described only as showing a packet payload containing the string 'samsung.com.' This does not demonstrate cross-site correlation. A payload snippet containing the domain name could arise from many benign mechanisms (e.g., a same-site script, a referrer field, or an analytics beacon) and does not by itself show that a unique identifier, cookie, or user profile was transferred between samsung.com and the later globo.com advertising request. The manuscript should show the actual request chain with headers, cookies, and timestamps, and explain why the observed fields constitute personal data transfer.
- [Abstract and Section 4.1] The abstract states that the research 'reveals specific data types exchanged between users and web services,' but the manuscript never identifies any data type beyond domain names. In Section 4.1, accesses to beacons.gcp.gvt2.com and optimizationguide-pa.googleapis.com are labeled as contributing to 'profile building,' yet no payload content or user-specific fields are shown. These are generic Google endpoints that can be contacted for performance monitoring, A/B testing, or resource fetching without transmitting personal data. The interpretation that these accesses constitute surveillance-capitalism data harvesting is therefore not supported by the presented evidence.
- [Section 3 and data availability statement] The methodology omits essential reproducibility information: the mobile device model and OS version, browser type, whether the device was freshly reset or had an existing profile, the number of repeated runs, the duration of each capture, the specific filter criteria used in Mitmweb, and how certificate pinning or apps that bypass the proxy were handled. The paper states that 'all personal data captured during our case studies are available at https://github.com/antonyseabramedeiros/,' but that URL points to a user profile rather than a named repository, and no dataset identifier or archival record is given. Without a citable, inspectable trace, the empirical claims cannot be independently verified.
minor comments (4)
- [Section 4, first paragraph] There is a typo in the sentence beginning 'Following the capture of network traffic initiated by a visit tosamsung.com'—'tosamsung.com' should be 'to samsung.com.'
- [Figure captions] Figure 4 ('Advertising') and Figure 5 ('Web searching for Paris 6 Hotels') have captions that are too vague; each should describe what is shown, what was captured, and what the reader should conclude from it.
- [Section 5] The anecdote about advertisements appearing after verbal discussions near a smartphone is explicitly described as having no collected evidence. This is fine as a motivation for future work, but it should be clearly separated from the empirical findings of Sections 4 and 4.1 to avoid the impression that the study supports voice-capture claims.
- [Section 2] The claim that 89 percent of Alphabet revenues derived from Google's targeted advertising by 2016 is cited to Zuboff (2023) without a page or external source; providing a primary reference would strengthen the factual basis.
Circularity Check
No circular dependency: the empirical traffic captures are independent of the paper's framing; the causal overreach in Section 4 is an evidence gap, not a definitional loop.
full rationale
The paper's derivation chain is observational rather than mathematical: a Mitmproxy setup captures HTTP/HTTPS requests during navigation, and the case studies list contacted third-party domains and a later Samsung advertisement on globo.com. There are no fitted parameters, no equations whose left-hand side is defined by the right-hand side, and no prediction that reduces by construction to the data used to produce it. The interpretation of the captured domains under Zuboff's surveillance-capitalism framework is an external conceptual lens, not an input to the capture itself. The Samsung-ad observation in Section 4 is causally under-supported—there is no control condition, timeline, or exclusion of background traffic—but that is an evidentiary weakness, not circularity: the paper does not define 'targeted advertising' as 'presence of samsung.com in a later capture,' nor does it derive the ad from a fitted model. Citations are to external literature (Zuboff, GDPR/LGPD analyses, Mitmproxy documentation) and to the authors' own GitHub repository of raw captures; the repository is data sharing rather than a load-bearing self-citation of an unverified result. Section 5 even concedes that no direct evidence was collected for the audio-surveillance anecdote, which further shows the paper is not forcing its conclusions by definition. No self-definitional step, fitted-input-as-prediction, imported uniqueness theorem, ansatz-smuggling citation, or renaming of a known result into a new derivation is present. Therefore the circularity score is 0.
Assumptions & free parameters
assumptions (3)
- domain assumption The test device, network, and certificate installation do not alter which third-party services are contacted.
- domain assumption All observed external requests were caused by the user's action, such as visiting samsung.com or searching, and not by background apps, other tabs, or the proxy tool itself.
- domain assumption External domain contacts constitute data harvesting or tracking rather than purely functional content delivery.
Cite this review
Pith. "Pith review of Surveillance Capitalism Revealed: Tracing The Hidden World Of Web Data Collection." pith.science (2026). https://pith.science/paper/JO6P6IQR
@misc{pith2026241217944,
author = {Pith},
title = {Pith review of: Surveillance Capitalism Revealed: Tracing The Hidden World Of Web Data Collection},
year = {2026},
howpublished = {\url{https://pith.science/paper/JO6P6IQR}},
note = {Machine review of arXiv:2412.17944}
}
read the original abstract
This study investigates the mechanisms of Surveillance Capitalism, focusing on personal data transfer during web navigation and searching. Analyzing network traffic reveals how various entities track and harvest digital footprints. The research reveals specific data types exchanged between users and web services, emphasizing the sophisticated algorithms involved in these processes. We present concrete evidence of data harvesting practices and propose strategies for enhancing data protection and transparency. Our findings highlight the need for robust data protection frameworks and ethical data usage to address privacy concerns in the digital age.
Figures
Figures from the paper (2 more)
Reference graph
Works this paper leans on
-
[1]
write newline
" write newline "" before.all 'output.state := FUNCTION fin.entry add.period write newline FUNCTION new.block output.state before.all = 'skip after.block 'output.state := if FUNCTION new.sentence output.state after.block = 'skip output.state before.all = 'skip after.sentence 'output.state := if if FUNCTION not #0 #1 if FUNCTION and 'skip pop #0 if FUNCTIO...
-
[2]
Chen, J., Lin, H., Han, X., and Sun, L. (2024). Benchmarking large language models in retrieval-augmented generation. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 38, pages 17754--17762
2024
-
[3]
Fan, W., Ding, Y., Ning, L., Wang, S., Li, H., Yin, D., Chua, T.-S., and Li, Q. (2024). A survey on rag meeting llms: Towards retrieval-augmented large language models. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , pages 6491--6501
2024
-
[4]
Feng, Z., Feng, X., Zhao, D., Yang, M., and Qin, B. (2024). Retrieval-generation synergy augmented large language models. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 11661--11665. IEEE
2024
-
[5]
Gao, D., Wang, H., Li, Y., Sun, X., Qian, Y., Ding, B., and Zhou, J. (2023a). Text-to-sql empowered by large language models: A benchmark evaluation. arXiv preprint arXiv:2308.15363
arXiv 2023
-
[6]
Gao, Y., Xiong, Y., Gao, X., Jia, K., Pan, J., Bi, Y., Dai, Y., Sun, J., and Wang, H. (2023b). Retrieval-augmented generation for large language models: A survey. arXiv preprint arXiv:2312.10997
arXiv 2023
-
[7]
Giray, L. (2023). Prompt engineering with chatgpt: a guide for academic writers. Annals of biomedical engineering , 51(12):2629--2633
2023
-
[8]
Jeong, C. (2023). A study on the implementation of generative ai services using an enterprise data-based llm application architecture. arXiv preprint arXiv:2309.01105
arXiv 2023
Show all 32 references
-
[9]
Jin, H., Huang, L., Cai, H., Yan, J., Li, B., and Chen, H. (2024). From llms to llm-based agents for software engineering: A survey of current, challenges and future. arXiv preprint arXiv:2408.02479
2024 arXiv
-
[10]
u ttler, H., Lewis, M., Yih, W.-t., Rockt \
Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., K \"u ttler, H., Lewis, M., Yih, W.-t., Rockt \"a schel, T., et al. (2020). Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in Neural Information Processing Systems , 33:9459--9474
2020
-
[11]
Liu, A., Hu, X., Wen, L., and Yu, P. S. (2023). A comprehensive evaluation of chatgpt's zero-shot text-to-sql capability. arXiv preprint arXiv:2303.13547
2023 arXiv
-
[12]
Mialon, G., Dess \` , R., Lomeli, M., Nalmpantis, C., Pasunuru, R., Raileanu, R., Rozi \`e re, B., Schick, T., Dwivedi-Yu, J., Celikyilmaz, A., et al. (2023). Augmented language models: a survey. arXiv preprint arXiv:2302.07842
2023 arXiv
-
[13]
Chatgpt fine-tune description
OpenAI (2023a). Chatgpt fine-tune description. https://help.openai.com/en/articles/6783457-what-is-chatgpt. Accessed: 2024-03-01
2023
-
[14]
Chatgpt prompt engineering
OpenAI (2023b). Chatgpt prompt engineering. https://platform.openai.com/docs/guides/prompt-engineering. Accessed: 2024-04-01
2023
-
[15]
Pinheiro, J., Victorio, W., Nascimento, E., Seabra, A., Izquierdo, Y., Garc a, G., Coelho, G., Lemos, M., Leme, L. A. P. P., Furtado, A., et al. (2023). On the construction of database interfaces based on large language models. In Proceedings of the 19th International Conferen...
2023
-
[16]
Saeed, M., De Cao, N., and Papotti, P. (2023). Querying large language models with sql. arXiv preprint arXiv:2304.00472
2023 arXiv
-
[17]
Seabra, A., Nepomuceno, J., Lago, L., Ruberg, N., and Lifschitz, S. (2024). Contrato360: uma aplicação de perguntas e respostas usando modelos de linguagem, documentos e bancos de dados. In Anais do XXXIX Simpósio Brasileiro de Bancos de Dados
2024
-
[18]
Singh, A., Ehtesham, A., Kumar, S., and Khoei, T. T. (2024). Enhancing ai systems with agentic workflows patterns in large language model. In 2024 IEEE World AI IoT Congress (AIIoT) , pages 527--532. IEEE
2024
-
[19]
N., Kaiser, ., and Polosukhin, I
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, ., and Polosukhin, I. (2017). Attention is all you need. Advances in neural information processing systems , 30
2017
-
[20]
Wang, M., Wang, M., Xu, X., Yang, L., Cai, D., and Yin, M. (2023). Unleashing chatgpt's power: A case study on optimizing information retrieval in flipped classrooms via prompt engineering. IEEE Transactions on Learning Technologies
2023
-
[21]
S., Mishra, S., Perot, V., Zhang, Y., Mattapalli, A., Taly, A., Shang, J., et al
Wang, Z., Wang, Z., Le, L., Zheng, H. S., Mishra, S., Perot, V., Zhang, Y., Mattapalli, A., Taly, A., Shang, J., et al. (2024). Speculative rag: Enhancing retrieval augmented generation through drafting. arXiv preprint arXiv:2407.08223
2024 arXiv
-
[22]
White, J., Fu, Q., Hays, S., Sandborn, M., Olea, C., Gilbert, H., Elnashar, A., Spencer-Smith, J., and Schmidt, D. C. (2023). A prompt pattern catalog to enhance prompt engineering with chatgpt. arXiv preprint arXiv:2302.11382
2023 arXiv
-
[23]
write newline
" write newline "" before.all 'output.state := FUNCTION fin.entry add.period write newline FUNCTION new.block output.state before.all = 'skip after.block 'output.state := if FUNCTION new.sentence output.state after.block = 'skip output.state before.all = 'skip after.sentence '...
-
[24]
and Baker, M
Andrew, J. and Baker, M. (2021). The general data protection regulation in the age of surveillance capitalism. Journal of Business Ethics , 168:565--578
2021
-
[25]
Lucas, L. (2024). How to inspect network traffic using Mitmproxy . https://lucaslegname.github.io/mitmproxy/2020/04/10/mitmproxy.html. Last Accessed: September 2024
2024
-
[26]
Martins, A. D. F., da Silva Barros, P. V., Monteiro, J. M., and de Castro Machado, J. (2020). LGPD : a formal concept analysis and its evaluation. In Brazilian Symposium on Databases , pages 259--264. SBC
2020
-
[27]
How Mitmproxy works
Mitmproxy (2024). How Mitmproxy works. https://docs.mitmproxy.org/stable/concepts-howmitmproxyworks. Last Accessed: September 2024
2024
-
[28]
C., Schroeder, D., and Rodrigues, R
Stahl, B. C., Schroeder, D., and Rodrigues, R. (2022). Surveillance capitalism. In Ethics of Artificial Intelligence: Case Studies and Options for Addressing Ethical Challenges , pages 39--52. Springer
2022
-
[29]
K., and Das, S
Wu, Y., Bice, S., Edwards, W. K., and Das, S. (2023). The slow violence of surveillance capitalism: How online behavioral advertising harms people. In Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency , pages 1826--1837
2023
-
[30]
Zuboff, S. (2019). The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier . Profile Books
2019
-
[31]
Zuboff, S. (2022). Surveillance capitalism or democracy? the death match of institutional orders and the politics of knowledge in our information civilization. Organization Theory , 3(3):26317877221129290
2022
-
[32]
Zuboff, S. (2023). The age of surveillance capitalism. In Social theory re-wired , pages 203--213. Routledge
2023
Reviewed August 11, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.