*IEEE Symposium on Security and Privacy*, SP '13, pages 541–555, Washington, DC, USA, 2013. IEEE Computer Society. doi: 10.1109/SP.2013.43.

[NLV<sup>+</sup>20] M. Nouwens, I. Liccardi, M. Veale, D. Karger, and L. Kagal. Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence. In *CHI*, 2020.

[OCJ12] Ł. Olejnik, C. Castelluccia, and A. Janc. Why johnny can't browse in peace: On the uniqueness of web browsing history patterns. In *Hot Topics in Privacy Enhancing Technologies (HotPETs 2012)*, 07 2012.

[Odl03] A. Odlyzko. Privacy, economics, and price discrimination on the internet. In *Proceedings of the 5th International Conference on Electronic Commerce*, ICEC '03, pages 355–366, New York, NY, USA, 2003. ACM. doi: 10.1145/948005.948051.

[OTC14] L. Olejnik, M. Tran, and C. Castelluccia. Selling off user privacy at auction. In *21st Annual Network and Distributed System Security Symposium, NDSS 2014*, San Diego, California, USA, February 23–26, 2014, 2014.

[P3P] The platform for privacy preferences 1.0 (P3P 1.0) specification. https://www.w3.org/TR/P3P/.

[PB] Privacy Badger Official website - Electronic Frontier Foundation. https://www.eff.org/privacybadger.

[PC20] H. Pawlata and G. Caki. The Impact of the Transparency Consent Framework on current Programmatic Advertising Practices. 2020. 4th International Conference on Computer-Human Interaction Research and Applications.

[PKM19] P. Papadopoulos, N. Kourtellis, and E. P. Markatos. Cookie synchronization: Everything you always wanted to know but were afraid to ask. In *The World Wide Web Conference, WWW 2019, San Francisco, CA, USA, May 13-17, 2019*, pages 1432–1442, 2019.

[RBC<sup>+</sup>20] S. Roth, T. Barron, S. Calzavara, N. Nikiforakis, and B. Stock. Complex security policy? a longitudinal analysis of deployed content security policies. In *Network and Distributed Systems Security Symposium (NDSS)*, 2020.

[rep18] OpenWPM - A web privacy measurement framework, 2018. https://github.com/citp/OpenWPM.
[RKW12] F. Roesner, T. Kohno, and D. Wetherall. Detecting and defending against third-party tracking on the web. In *Proceedings of the 9th USENIX Symposium on Networked Systems Design and Implementation*, NSDI 2012, pages 155–168, 2012.

[RNV+18] A. Razaghpanah, R. Nithyanand, N. Vallina-Rodriguez, S. Sundaresan, M. Allman, C. Kreibich, and P. Gill. Apps, trackers, privacy, and regulators: A global study of the mobile tracking ecosystem. In *Network and Distributed System Security Symposium, NDSS*, 2018.

[RS10] A. Russo and A. Sabelfeld. Dynamic vs. static flow-sensitive security analysis. In *IEEE Computer Security Foundations Symposium (CSF'10)*, pages 186–199. IEEE, 2010.

[Sam] Same Origin Policy. https://www.w3.org/Security/wiki/Same_Origin_Policy.

[Sam11] A. Sampson. Ryanair exhibit a., 2011. URL https://twitter.com/sampsonian/status/50199798099357696.

[SCM+10] A. Soltani, S. Canty, Q. Mayo, L. Thomas, and C. J. Hoofnagle. Flash cookies and privacy. In *AAAI Spring Symposium: Intelligent Information Privacy Management*, 2010.

[SM03] A. Sabelfeld and A. C. Myers. Language-based information-flow security. *IEEE Journal on Selected Areas in Communication*, 21(1):5–19, 2003.

[Smi09] G. Smith. On the foundations of quantitative information flow. In *Foundations of Software Science and Computational Structures*, volume 5504 of *Lecture Notes in Computer Science*, pages 288–302. Springer Berlin / Heidelberg, 2009.

[SMWL10] K. Singh, A. Moshchuk, H. J. Wang, and W. Lee. On the incoherencies in web browser access control policies. In *Proc. of the 2010 Symposium on Security and Privacy*, pages 463–478. IEEE, 2010.

[SN17] O. Starov and N. Nikiforakis. Xhound: Quantifying the fingerprintability of browser extensions. In *Proceedings of the 38th IEEE Symposium on Security and Privacy*, pages 941–956, 2017.

[SNGS20] T. H. Soe, O. E. Nordberg, F. Guribye, and M. Slavkovik. Circumvention by design—dark patterns in cookie consents for online news outlets. 2020, 2006.13985. URL http://arxiv.org/abs/2006.13985.
[SR14] J. F. Santos and T. Rezk. An Information Flow Monitor-Inlining Compiler for Securing a Core of Javascript. In *ICT Systems Security and Privacy Protection - 29th IFIP TC 11 International Conference, SEC 2014*, 2014.

[SRB] D. F. Some, T. Rezk, and N. Bielova. Web stats. http://webstats.inria.fr/.

[SRDK+19] I. Sanchez-Rola, M. Dell'Amico, P. Kotzias, D. Balzarotti, L. Bilge, P.-A. Vervier, and I. Santos. Can I opt out yet?: GDPR and the global illusion of cookie control. In *Asia Conference on Computer and Communications Security (AsiaCCS'19)*, 2019.

[SSB17] I. Sánchez-Rola, I. Santos, and D. Balzarotti. Extension breakdown: Security analysis of browsers extension resources control policies. In *26th USENIX Security Symposium*, pages 679–694, 2017.

[SSM10] S. Stamm, B. Sterne, and G. Markham. Reining in the web with content security policy. In *Proceedings of the 19th International Conference on World Wide Web, WWW 2010, Raleigh, North Carolina, USA, April 26-30, 2010*, pages 921–930, 2010. doi: 10.1145/1772690.1772784.

[SVAS17] A. Sjösten, S. Van Acker, and A. Sabelfeld. Discovering browser extensions via web accessible resources. In *Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, CODASPY '17*, pages 329–336. ACM, 2017.

[TArc] Trustarc privacycentral: Your new privacy management experience. https://trustarc.com/. Accessed on April 10, 2021.

[TTBM19] M. Trevisan, S. Traverso, E. Bassi, and M. Mellia. 4 years of EU cookie law: Results and lessons learned. *Proceedings on Privacy Enhancing Technologies Symposium (PETS'19)*, 2019.

[TTG+17] S. Traverso, M. Trevisan, L. Giannantoni, M. Mellia, and H. Metwalley. Benchmark and comparison of tracker-blockers: Should you trust them? In *Network Traffic Measurement and Analysis Conference (TMA'17)*, 2017.

[ubl] uBlock Origin - An efficient blocker for Chromium and Firefox. Fast and lean. https://github.com/gorhill/uBlock.

[UTD+18] T. Urban, D. Tatang, M. Degeling, T. Holz, and N. Pohlmann. The Unwanted Sharing Economy: An Analysis of Cookie Syncing and User Transparency under GDPR. *CoRR*, abs/1811.08660, 2018.
[vAWN19] R. van Eijk, H. Asghari, P. Winter, and A. Narayanan. The impact of user location on cookie notices (inside and outside of the European union). In *Workshop on Technology and Consumer Protection (ConPro’19)*, 2019.

[VFG$^{+}$19] P. Vallina, Á. Feal, J. Gamba, N. Vallina-Rodriguez, and A. F. Anta. Tales from the porn: A comprehensive privacy analysis of the web porn ecosystem. In *Proceedings of the Internet Measurement Conference (IMC’19)*, 2019.

[VLRR18] A. Vastel, P. Laperdrix, W. Rudametkin, and R. Rouvoy. FP-STALKER: Tracking Browser Fingerprint Evolutions. In *39th IEEE Symposium on Security and Privacy (S&P 2018)*, San Francisco, United States, May 2018.

[VNBJ14] T. Vissers, N. Nikiforakis, N. Bielova, and W. Joosen. Online airline price discrimination dataset, 2014. URL http://people.cs.kuleuven.be/~thomas.vissers/data/price_discrimination.zip.

[VNJ$^{+}$07] P. Vogt, F. Nentwich, N. Jovanovic, E. Kirda, C. Kruegel, and G. Vigna. Cross-Site Scripting Prevention with Dynamic Data Tainting and Static Analysis. In *Proc. of the Symposium on Network and Distributed System Security (NDSS’07)*, 2007.

[VSI96] D. Volpano, G. Smith, and C. Irvine. A sound type system for secure flow analysis. 4(2-3):167–187, 1996.

[W3C12] W3C. A vocabulary and associated apis for html and xhtml, 2012. Online: http://dev.w3.org/html5/spec/single-page.html#history.

[WBV15] M. West, A. Barth, and D. Veditz. Content Security Policy Level 2. W3C Candidate Recommendation, 2015.

[WP136] WP29 Opinion 04/2007 on the concept of personal data (WP 136, 2007. https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2007/wp136_en.pdf.

[WP212] WP29 Opinion 04/2012 on the Cookie Consent Exemption - ARTICLE 29 DATA PROTECTION WORKING PARTY, 2012. https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf.
[YCIS07] D. Yu, A. Chander, N. Islam, and I. Serikov. Javascript instrumenta-
tion for browser security. In *ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL'07)*, pages 237–249, 2007.

[YMMP16] Z. Yu, S. Macbeth, K. Modi, and J. M. Pujol. Tracking the track-
ers. In *International Conference on World Wide Web, WWW*, pages
121–132, 2016.

[Zda02] S. A. Zdancewic. *Programming languages for information security.*
PhD thesis, Cornell University, 2002.

[ZJR13] D. Zanarini, M. Jaskelioff, and A. Russo. Precise enforcement of confidentiality for reactive systems. In *IEEE 26th Computer Security Foundations Symposium*, pages 18–32, 2013.