# Stetoscope: underStand TargEting and manipulaTiOnS
via COllaborative Private data collEction

Tao Beaufils, Antoine Boutet

► To cite this version:

Tao Beaufils, Antoine Boutet. Stetoscope: underStand TargEting and manipulaTiOnS via COllaborative Private data collEction. MADWeb 2026 - Workshop on Measurements, Attacks, and Defenses for the Web, Feb 2026, San Diego, United States. hal-05527927

HAL Id: hal-05527927

https://hal.science/hal-05527927v1

Submitted on 26 Feb 2026

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# STETOSCOPE: understand TargEting and manipulaTiOnS via COllaborative Private data collection

Tao Beaufils

Inria, Lille,

Hauts-de-France, France

tao.beaufils@inria.fr

Antoine Boutet

INSA Lyon, Inria, CITI, UR3720,

69621 Villeurbanne, France

antoine.boutet@insa-lyon.fr

## Abstract

Content personalization is ubiquitous on the web and mobile applications. However, the mechanisms that practically control this personalization by the different parties in the targeted advertising ecosystem remain unclear, raising serious questions about possible user manipulations to encourage them to take certain actions (e.g., consent to cookies, purchase a product). Due to its user-centric nature, it is technically difficult to collect this personalization in order to analyze it on a large scale. In this paper, we present STETOSCOPE (underSTand targETing and manipulatiOnS via COllaborative Private data collection), a participative mobile application to analyze content personalization. Instead of relying on bots for data collection (which are subject to detection by platforms and may induce bias in the content), STETOSCOPE engages individuals by providing them with data collection campaigns linked to legitimate questions posed by citizens (e.g., is there price discrimination on this platform? Is this incentive message trustworthy?). A data collection campaign guides the user to specific web pages or mobile applications where a screenshot is triggered by the participant to collect the targeted information. These screenshots are then analyzed on a backend server to draw conclusions. This participatory application allows users to be involved in issues related to different forms of personalization on mobile, such as the analysis of dark patterns, price or search discrimination, the exchange of personal information with third parties, trust in incentive messages, or information bubbles for instance. To assess the prospects and limitations of the STETOSCOPE, we conducted preliminary data collection campaigns on e-commerce, bus and hotel booking, and recruitment platforms. Our preliminary results show evidence of search discrimination on most platforms, evidence of price discrimination on AliExpress, and evidence of fake discounts during Black Friday on Temu and on many e-commerce platforms before and after Christmas.

## Keywords

Web Measurements, Collaborative Platform, Unethical practices on the Web

## 1 Introduction

Content personalization [34] involves creating a unique experience for each user, tailored to their specific needs, interests, and preferences. To ensure this personalization, the system relies on the construction of profiles that gather the activity of each user including, for example, pages visited, articles liked, time spent watching videos, etc. By leveraging these profiles, the personalization system can offer each user content that they are likely to be interested in.

Content personalization is now ubiquitous on the Web and in mobile applications. This massive deployment of personalization stems from the fact that, on one hand, it increases user engagement [29] and, on the other, generates additional revenue for application providers [2].

However, the mechanisms that actually control this personalization remain unclear, raising serious questions about possible user influence or manipulation [8]. Indeed, since personalization systems are black-box systems, we do not know what information is actually used (i.e., what constitutes the user profile), and how the decision to expose users to particular content is made [19]. This lack of transparency is fertile ground for abuse. For example, evidence of price and search discrimination has been reported in different studies [11, 20]. Moreover, the Cambridge Analytica scandal [7] also showed that users' psychological characteristics were used to target specific users with content in order to influence them during elections. This targeting of content for political purposes (e.g., to influence elections or create distrust among citizens in their policies) is increasingly making headlines [26, 30, 31]. Finally, some incentive mechanisms (also called nudging) that encourage users to take actions also raise questions about their legitimate purpose or their manipulative purpose [17, 28]. For example, some dark patterns [21], particularly on cookie banners, can be seen as consent theft [9, 23]. Furthermore, some incentive messages urging users to buy quickly because only a limited number of items remain and several other users are viewing them, also raise questions about their truthfulness [17].

Collecting and analyzing personalized content delivered to users by multiple platforms is complex [33]. Relying on the creation of bots that automatically collect content through API faces several limitations. First, these bots are not linked to real users and may contain biased or limited content. Second, since platforms monetize user visits, they try to quickly detect bots in order to filter them out [16]. Circumventing bot detection systems never works for very long and requires constantly changing strategies [10]. In addition, creating bots on smartphones often requires rooting the phone in order to instrument the device. This information (i.e., a rooted phone) is known to the platforms, which also biases the delivered content. Moreover, automating data collection can be very complicated on mobile. For example, it may be necessary to follow a specific path through multiple pages or to fill out forms to access the desired information. The information displayed may also be dynamically generated by running scripts (generally obfuscated) when the page loads, making web page (e.g., HTML) analysis useless.

To overcome these limitations, we developed STETOSCOPE (underSTand targETing and manipulatiOnS via COllaborative Private data
collectEction), a participatory tool for analyzing content personal-
ization on mobile devices. Instead of using bots for data collection,
STETOSCOPE engages individuals by offering them data collection
campaigns linked to legitimate questions asked by citizens (e.g.,
is there price discrimination on this platform? Is this incentive
message trustworthy?). A data collection campaign guides the user
through specific web pages or mobile applications to the informa-
tion that needs to be collected. A screenshot is then triggered by the
user. These screenshots are then sent to and analyzed on a backend
server. A dashboard allows the administrator to view, filter, and
process the screenshots manually or automatically by extracting
the necessary content from them. Finally, analysis tools allow the
administrator to view screenshots, process them automatically, and
plot graphs.

This participatory tool helps to raise awareness and engage users
on the challenges of transparency in mobile personalization. The
generic behavior of STETOSCOPE allows, for example, the analysis of
dark patterns, price and search discrimination, the exchange of per-
sonal information between a platform and third parties, content and
behavior changes between web and mobile platforms (e.g., prices on
a mobile application are not the same as on the associated website),
the trustworthiness of incentive messages, and information bubbles.
To illustrate the potential and limits of STETOSCOPE, several data
collection campaigns have been conducted. Our preliminary results
show evidence of price discrimination, especially on AliExpress
where this practice is systematic. Results also show systematic evi-
dence of search discrimination on most of e-commerce platforms.
We also show evidence of abusive practices regarding fake discounts
during Black Friday on Temu and on many e-commerce platforms
before and after Christmas (e.g., the price remains the same during
and after Black Friday, but a large discount rate is advertised during
Black Friday). Finally, we also noticed an inconsistency regarding
an experience counter on Booking.com. The use of STETOSCOPE is
not limited to these use cases and can be useful for many projects
to analyze other personalization mechanisms. To encourage its use,
STETOSCOPE is publicly available and open source<fnref n="1" />.

In this article, after a discussion of the background and state-
of-the-art (Section 2), we present STETOSCOPE (Section 3) before
illustrating some possible use cases of data collection campaigns
(Section 3.4). Finally, we provide preliminary results (Section 4)
before discussing the limitations (Section 5) and concluding (Sec-
tion 6).

2 Background and related work

In this section, we review the background and related work on data
collection and personalization (Section 2.1), and measurement tools
to analyze the evolution of the practices (Section 2.2).

## 2.1 Ubiquitous data collection and personalization

As profiling has become the norm on the Internet, users' personal
data is being collected on a massive scale to personalize content.
Recently, [18] shows how commercial smart speakers profile users
based on vocal traits to deliver targeted advertisements. This study

provides empirical evidence that users may be subjected to person-
alized advertising even when opting out of certain data practices,
emphasizing the gap between user expectations and actual system
behavior. However, determining precisely what information is col-
lected and how it is used remains a challenge [8, 37]. This lack of
transparency [19], combined with the emergence of controversial
practices such as consent theft or other kinds of manipulation via
dark patterns [9, 21, 23], the exchange of personal data among third
parties [3], or discrimination [20] raises serious concerns. The root
causes of this discrimination remain poorly understood and demon-
strating evidence of such discrimination requires meticulous and
time-consuming data collection. While some studies do not find any
evidence of systematic price discrimination (e.g., on online airline
tickets [36]), other studies have clearly demonstrated the existence
of both price and search discrimination [20] and the impact of user
location data on price differences [11] and tracking practices [27].

## 2.2 Measurement Tools

**Deceptive patterns:** Tools for detecting abusive manipulation patterns vary considerably in terms of technique and scope, and there is no single approach that works for all platforms. Rule-based systems are one of the most traditional methods for analyzing websites and searching for predefined signals that correspond to known manipulation patterns. For instance [15] uses this approach to collect cookie banners from different websites and flags designs that quietly reduce user choice, such as hiding the reject button or presenting “agree” as the easiest option. Even though this approach works well for clear patterns, it can struggle with more subtle tactics that do not follow fixed templates.

Data-driven systems, on the other hand, rely on predefined rules and depend on high-quality annotated datasets. For instance, [38] leverages machine learning models to automatically identify data manipulation or dark patterns. This makes detection more flexible, especially when such manipulation evolves or appears unexpectedly. However, these approaches remain highly dependent on how the training data is labeled and on the very definition of what constitutes manipulation. Hybrid solutions attempt to combine both approaches. UI Guard [6], for instance, analyzes screenshots, extracts text, and then evaluates both the visual layout and the language to detect deceptive patterns. This approach helps detect manipulation techniques that rely on a combination of interface design and wording. Indeed, a button might appear harmless but be associated with deceptive text, or vise versa. Consequently, tools that use only one method can miss important elements.

More and more tools rely on the analysis of screenshots like STETOSCOPE, which tend to be more stable and consistent than the underlying HTML code of the web page [13, 14]. Indeed, HTML code can vary depending on the device and the version of the application, or it can be dynamically generated or modified by JavaScript, making analysis difficult.

More recently, DPGuard [25] automatically detects deceptive pat-
terns from screenshots by directly prompting VLLMs. AutoBot [22]
follows a similar approach, combined with text extraction and the
use of an LLM to understand the context in order to identify and
localize deceptive patterns. Although these solutions improve the
detection of deceptive patterns, they are not suitable for analyzing

<footnote n="1">¹https://gitlab.inria.fr/tbeaufil/nudging-analysis</footnote>
content personalization in a population of individuals to identify
other unethical practices, such as price or search discrimination. Fur-
thermore, these tools rely on the ability of the underlying machine
learning solutions (e.g., VLLMs) to analyze and extract information
from screenshots. STETOSCOPE faces the same limitation, but this
analysis can be easily refined manually for each campaign to avoid
false positives as much as possible.

**Data collection from mobiles:** With the massive adoption of mobile devices in recent years, most interactions between users and online services now take place via these devices. This makes it significantly more difficult to automate information collection and analysis. While in-depth analysis with Frida<fnref n="2" />, a dynamic instrumentation toolkit for developers, reverse engineers, and security researchers, is still possible, it usually requires rooting the smartphone, which skews the results. Indeed, platforms monetize visits and therefore search for and exclude bots [1, 12, 24], rooted phones, or fake accounts [11] from monetized targeting to reassure advertisers wishing to use their platform. This bot detection and prevention make automation difficult. For instance, [35] analyzed intentional fingerprint inconsistencies used by bots to bypass detection and revealed that platforms rely heavily on fingerprinting to identify automated behavior. This makes bot-based auditing of personalization increasingly ineffective because automated clients are likely to be excluded from the user experience they attempt to study. To overcome this limitation, STETOSCOPE adopts a different strategy by directly engaging individuals in participatory research to increase the transparency of targeted advertising and personalized services in the specific context of mobile computing. To assist participants in these tasks, STETOSCOPE guides them (potentially through several actions) until the targeted information is visible.

Finally, participatory approaches provide a completely different perspective and are increasingly developed in diverse topics [5] ranging from plant identification and monitoring protected areas [4] to the participatory exploration of pollution data using smartphones [32]. In a participatory and user driven approach, instead of machines scanning interfaces, real people report dark patterns they encounter in everyday use. We believe that with the growing awareness of the population regarding privacy and manipulation issues, an application like STETOSCOPE that would make it possible to analyze the behavior of new practices of websites and mobile applications is timely and would find great enthusiasm.

3 STETOSCOPE

STETOSCOPE consists of a mobile application for data collection campaign participants and a backend server providing a configuration and analysis dashboard for campaign administrators. In this section, an overview of STETOSCOPE's functionality is presented (Section 3.1), before describing the mobile application (Section 3.2), the administration dashboard (Section 3.3), and the wide range of data collection campaigns that can be carried out with STETOSCOPE (Section 3.4).

3.1 Overview

An overview of how STETOSCOPE works is depicted Figure 1, in-
cluding four main steps.

*   **Step 1 - Collection Configuration:** An administrator defines and configures a data collection campaign by specifying a description that explains the purpose of the collection and the different steps that will guide the participants. Specifically, the URL(s) to which the participant will be redirected and the messages that will allow them to reach the targeted information are defined. Once the collection is made public, participants have access to it in the catalog of current data collections (Figure 2).

    *   **Step 2 - User Guidance:** Once the participant clicks on a current data collection, they are redirected to one or a series of links. Depending on the nature of the link, it can either open in a browser or in a mobile application. A banner at the top of the screen with help messages remains visible (i.e., overlays the current application) to guide the participant to the information targeted by the collection. Once this is reached, a button allows the participant to trigger a screenshot.

    *   **Step 3 - Sending the screenshot(s):** Once the participant triggers a screenshot, it is then sent to the backend server with some metadata (e.g., the location, the device, the UID).

*   **Step 4 - Automatic screenshot analysis:** The administrator can view the screenshots associated with each data collection (Figure 3) and manually filter and remove those that do not comply with the expectations. The administrator can then extract the text content contained in the screenshot and apply regular expressions to automatically extract targeted information. An analysis tab allows viewing a graphical representation of the results (e.g., the distribution of the average price of items in a search, or the variation of a counter over time).

In data collection campaigns that require navigation across multiple platforms (e.g., to assess whether a search on one platform can vary the personalization on another platform), steps 3 and 4 can be repeated by defining a redirection sequence in the configuration of the data collection campaign.

*   **Step 2 - User Guidance:** Once the participant clicks on a current data collection, they are redirected to one or a series of links. Depending on the nature of the link, it can either open in a browser or in a mobile application. A banner at the top of the screen with help messages remains visible (i.e., overlays the current application) to guide the participant to the information targeted by the collection. Once this is reached, a button allows the participant to trigger a screenshot.

*   **Step 3 - Sending the screenshot(s):** Once the participant triggers a screenshot, it is then sent to the backend server with some metadata (e.g., the location, the device, the UID).

*   **Step 4 - Automatic screenshot analysis:** The administrator can view the screenshots associated with each data collection (Figure 3) and manually filter and remove those that do not comply with the expectations. The administrator can then extract the text content contained in the screenshot and apply regular expressions to automatically extract targeted information. An analysis tab allows viewing a graphical representation of the results (e.g., the distribution of the average price of items in a search, or the variation of a counter over time).

In data collection campaigns that require navigation across mul-
tiple platforms (e.g., to assess whether a search on one platform can
vary the personalization on another platform), steps 3 and 4 can be
repeated by defining a redirection sequence in the configuration of
the data collection campaign.

3.2 Mobile application

The mobile application of STETOSCOPE is intended for participants and has been developed using Java for Android. It requires several user permissions for installation and use, including the right to overlay other applications and to collect location information. The overlay permission is required to add a banner to easily guide the participant through the collection process and to access the expected information. Location information is optional and is collected as metadata, along with the screenshot, to analyze the impact of this information on personalization. This mobile application consists of two main interfaces: one for selecting experiments to be performed (Figure 2) and one for running the experiment. Particular attention has been paid to clearly and precisely explaining the purpose of the experiments offered to participants. For example, all steps are clarified before launching an experiment. This

<footnote n="2">²https://frida.re/</footnote>
<figure><img src="image_2.png" /><figcaption>Figure 1: Overview of STETOSCOPE: 1) once configured and published, a collection campaign is visible to participants who may wish to contribute to it, 2) participants are guided throughout the process to access the desired information, 3) the user triggers a screenshot which is sent to the backend server, 4) automatic processing of the screenshots allows the results of the analyses to be displayed.</figcaption></figure>

allows users to freely choose the experiments in which they agree to participate.

## 3.3 Analysis dashboard

An administration dashboard has been designed to manage data collection campaigns. Its main purpose is to facilitate the creation and configuration of a campaign, as well as the analysis of collected screenshots. The dashboard allows for a comprehensive and precise observation of all screenshots (Figure 3). It also allows for the comparison of different screenshots, the extraction of information from them, and the filtering of the desired data using OCR (Optical Character Recognition) and regular expressions. Lastly, different visualization options (e.g., scatter plot, histogram) can be configured to simplify analysis. The dashboard was developed using the Vite framework and its React/TypeScript combination. Exchanges with the mobile application are done through a REST API using the FastAPI framework.

## 3.4 Data Collection Campaigns

The generic and flexible nature of the STETOSCOPE can prove useful in many use cases, including the analysis of price and search

discrimination, dark patterns, ad targeting, platform impact, nudging message reliability, information bubbles, route suggestions in navigation systems, and fairness bias.

**Price Discrimination:** To analyze the presence or absence of price discrimination, we can redirect all users participating in the data collection to the webpage of the same item. Once the screenshot is sent to the backend server, the price can be automatically extracted, and the analysis reports the distribution of prices provided to participants.

**Search Discrimination:** Price personalization can occur at the level of an item (i.e., the price of the same item varies depending on the user) or at the level of the items presented during a search (i.e., for the same search, the overall cost of all returned items varies depending on the user). In this type of campaign, participants are redirected to the results of the same search. They are then asked to capture the price of the first results. Once the screenshot is sent to the server, the price of the first items is automatically extracted, and the analysis provides participants with the average price distribution (i.e., for the first results).
<figure><img src="image_3.png" /><figcaption>**Figure 2:** The STETOSCOPE mobile application lists the collection campaigns available to participants.</figcaption></figure>

**Ad Targeting:** Targeted advertising involves renting banner ads on specific websites. The content of these ads changes based on the user's activity, which is recorded in various ways. An ad targeting data collection campaign can specifically aim to analyze the exchange of information between a website and the targeted advertising ecosystem. More precisely, the user is first directed to a website containing a banner ad, then to a search engine to perform a search. Finally, they are redirected back to the original website displaying the banner ad. A screenshot is taken at each step to verify whether the displayed ads have taken the intermediate search into account. If so, it means that the content of that search has been shared with the advertising network.

**Impact of platform:** A system's behavior can change depending on whether a user uses a browser or a dedicated application. In this type of data collection, we guide the participant to a specific platform via their browser and then through the associated mobile application. We ask the user to trigger a screenshot in both cases to analyze the differences once it has been sent to the backend server.

**Reliability of incentive messages:** To encourage users to quickly purchase or consume an item, messages are often displayed, informing them, for example, that only a limited number of items remain available and that other users are about to make a purchase. However, verifying the reliability of these messages is difficult. In this type of campaign, we collect the counters associated with the items to verify their consistency automatically.

**Dark patterns:** Dark patterns are increasingly used to encourage users to take action (e.g., consent, purchase). They are embodied by visual tricks of various kinds (e.g., buttons of different shapes, colors, and locations). To characterize the most commonly used

<figure><img src="image_4.png" /><figcaption>**Figure 3:** The dashboard allows the administrator to easily access participant screenshots, pre-process them, extract useful information and visualize the results in graphical form.</figcaption></figure>

dark patterns, we can redirect participants to websites and trigger a screenshot while they are there. These dark patterns will then be analyzed on the administration dashboard.

**Fairness bias:** Different treatment may be applied to different groups of individuals. For example, men may be offered higher salaries than women. To highlight these practices with STETOSCOPE, an indirect observation method can be used: asking men to participate in one campaign and women in another. Analyzing the screenshots then makes it possible to detect this fairness bias.

# 4 Preliminary results

In order to evaluate the relevance of our solution, we carried out preliminary collections with a small population of users (Section 4.1). Our preliminary results show evidence of price discrimination by some e-commerce platforms, especially AliExpress where this practice is systematic (Section 4.2). Our preliminary results also show a generalization of search discrimination on e-commerce platforms with a large variation in average price for the top 3 items associated to a search (Section 4.3). Finally, we also observed a number of inconsistencies regarding the discounts during and after Black Friday or the Christmas period, and some counters with a non consistent behavior over time (Section 4.5). However, we did not observe gender discrimination in salary on the Employment website platform and price discrimination on the bus operator's website.

## 4.1 Experiment setup

**Recruitment:** We conducted initial data collection campaigns between November and January 2025. We recruited about twenty young participants (with an average age of around 22) for our data collection through a course offered to final-year students in the computer science department at INSA Lyon, France. This recruitment process ensured that data was collected simultaneously for all participants. Participants were not paid, their participation was anonymous and voluntary (i.e., they could decline without penalty), and the course was not graded.
<table><caption>Table 1: Our data collection campaign included e-commerce, hotel and bus/train booking, and recruitment platforms.</caption><thead><tr><td>Services</td><td>Platforms</td></tr></thead><tbody><tr><td>E-Commerce</td><td>AliExpress, Amazon, Boulanger, Cdiscount, Conforama, Fnac, Temu.</td></tr><tr><td>Lodging reservation services</td><td>Booking</td></tr><tr><td>Bus and Train Operator</td><td>Flixbus</td></tr><tr><td>Employment website</td><td>Indeed</td></tr></tbody></table>

**Targeted platforms** These campaigns targeted e-commerce platforms, a hotel booking platform, a bus and train booking platform, and a recruitment platform. More precisely, we analyzed price and search discrimination on e-commerce and hotel booking platforms, dynamic pricing on the bus and train ticket booking platforms, and fairness biases regarding salaries between men and women on the recruitment platform.

## 4.2 Evidence of price discrimination

Most of the platforms analyzed did not exhibit price discrimination, meaning that users were served with the same price for the same item. Only the e-commerce platform AliExpress almost systematically exhibited this type of behavior during the data collection campaign we conducted on headphones. Figure 4(a) shows the cumulative distribution of the displayed price for our user population. Results show that the displayed prices varied between approximately €3 and almost €10.5, with an average of around €8.50. We also see that 25% of users saw a price displayed below €6.50, and 25% saw a price displayed above €9.50. However, we did not identify any correlation between the smartphone model and the displayed price. Figure 4(b) shows the displayed price over time, depending on the participant. This evolution does not show consistent behavior based on stock levels, raising suspicions of price manipulation.

## 4.3 Evidence of search discrimination

Although price discrimination was observed on only one platform, search discrimination was noted on the majority of platforms studied. This means that for the same search, the first items presented to the user had different average prices. Figure 5 depicts the variation in the average price of the top 3 items on Amazon related to a search for a laptop. The results show a large average price disparity, ranging from less than €200 to around €1600. On average, this price is around €300, but 20% of users had an average price for the top 3 items of over €1000. Here again, we did not identify a correlation between average price and mobile phone model.

## 4.4 Fake discounts

During our data collection campaign, we were also able to analyze the practices adopted during Black Friday and Christmas time. More specifically, we analyzed the discounts displayed during and after the sales period. We found that the advertised discount did not correspond at all to the price variation of the item between Black Friday and the following days, nor before and after Christmas.

<figure><img src="image_5.png" /></figure>

<figure><img src="image_6.png" /><figcaption>Figure 4: Price discrimination on AliExpress: for the same item, its price varies considerably between participant, ranging from less than 3 euros to almost 10.5 euros (each line and each point represents a participant).</figcaption></figure>

Moreover, sometimes the item's price did not change, and only a discount message was added during Black Friday or before Christmas. This behavior was observed mainly on the Temu e-commerce platform during Black Friday and on many e-commerce platforms during Christmas period. Figure 6 shows the price and discount for an item on Temu. We can see that during Black Friday, this item was displayed at €136.46 with a -72% discount, and that after Black Friday, this item was displayed at €150.03. Furthermore, we can see the various dark patterns adopted in the user interface to stimulate the user to buy quickly to take advantage of the promotional offer, where the -72% discount is clearly highlighted. Figure 7, in turn, depicts the price of items before Christmas, which appears to be reduced, but their prices remain the same after the Christmas period.
<figure><img src="image_7.png" /><figcaption>Figure 5: Search discrimination on Amazon: the average price of the top 3 items returned after a search varies considerably.</figcaption></figure>

## 4.5 Inconsistency counter

We also analyzed the consistency of different counters present on the interfaces. In one case, on Booking.com, we observed a counter that varied inconsistently over time. Specifically, the hotel experience counter displayed a value that decreased over time, whereas we would expect the value to increase. This could be due to an implementation bug or a problem with the counter’s definition.

## 5 Limitations

Our work has limitations. It is difficult to fully understand black-box systems such as personalization. STETOSCOPE is a very useful resource for analyzing the black-box output. However, we do not know what information led to this personalization. It would be interesting to combine STETOSCOPE with a request for access to personal data managed by the platforms (the right to data portability defined in the GDPR) to better understand the overall behavior of personalization.

STETOSCOPE raises ethical issues. First, this application platform uses personal data, specifically screenshots of the mobile device and a few associated metadata. This data is not necessarily sensitive in itself, but it can contain additional sensitive data (e.g., the presence of notifications). To reduce risks, participants trigger the screenshots themselves. In addition, once the useful information is extracted from the screenshot, the rest of the capture is blurred. We took as many precautions as needed to guaranty informed consent and security of data storage and processing (e.g., the data is encrypted server-side). The DPO of the authors' institution has validated the application.

## 6 Discussion and Conclusion

To shed light on the mechanisms of personalization, we present STETOSCOPE, a participatory research tool for understanding mobile targeting and manipulation. STETOSCOPE guides participants through a website or mobile application until the relevant information is captured via a screenshot. This operation, although simple,

<figure><img src="image_8.png" /><figcaption>Figure 6: Fake discount during Black Friday on Temu: the discount displayed very attractively during Black Friday does not correspond to the price difference observed after this sales period.</figcaption></figure>

ensures unbiased data collection from real users and allows for the analysis of a large number of widespread practices on the Web that raise serious questions ranging from manipulation and discrimination to the exchange of personal information. Relying on participatory research to address these societal concerns allows citizens to become involved in these issues.

The new Digital Services Act (DSA) regulates the practices of platforms. It would be worthwhile to conduct a legal analysis of our observations in relation to this regulation.

Finally, it would also be interesting to compare the results of the analyzes from STETOSCOPE with an analysis based on automated querying of the platforms by bots.

## Acknowledgment

This work has been supported by the ANR 22-PECY-0002 IPOP (Interdisciplinary Project on Privacy) project of the Cybersecurity PEPR. We would also like to thank Melisse Cochet, Louis Kusno and Jixiang Sun, students from Insa-Lyon, for their help in collecting and analyzing the data.

## References

[1] Iroshan Aberathne and Chamila Walgampaya. 2021. Real Time Mobile Ad Investigator: An Effective and Novel Approach for Mobile Click Fraud Detection. *Computing & Informatics* 40, 3 (2021).

[2] Abdal Ahmed and Ahmed Mahdi Abdulkareem. 2023. Big data analytics in the entertainment Industry: audience behavior analysis, content recommendation, and Revenue maximization. *Reviews of Contemporary Business Analytics* 6, 1 (2023), 88–102.
<figure><img src="image_9.png" /><figcaption>(a) Before Christmas (Fnac)</figcaption></figure>

<figure><img src="image_10.png" /><figcaption>Figure 7: Fake discount during Christmas: the price of the item before Christmas appears to be reduced, but its price remains the same after the Christmas period.</figcaption></figure>

<footnote>[3] Hazim Almuhimedji, Florian Schaub, Norman Sadeh, Idris Adjerid, Alessandro Acquisti, Joshua Gluck, Lorrie Faith Cranor, and Yuvraj Agarwal. 2015. Your location has been shared 5,398 times! A field study on mobile app privacy nudging. In *Proceedings of the 33rd annual ACM conference on human factors in computing systems*. 787–796.</footnote>

<footnote>[4] Pierre Bonnet, Alexis Joly, Jean-Michel Faton, Susan Brown, David Kimiti, Benjamin Deneu, Maximilien Servajean, Antoine Affouard, Jean-Christophe Lombardo, Laura Mary, et al. 2020. How citizen scientists contribute to monitor protected areas thanks to automatic plant identification tools. *Ecological Solutions and Evidence* 1, 2 (2020), e12023.</footnote>

<footnote>[5] Nicole Brown. 2022. Scope and continuum of participatory research. *International journal of research & method in education* 45, 2 (2022), 200–211.</footnote>

<footnote>[6] Jieshan Chen, Jiamou Sun, Sidong Feng, Zhenchang Xing, Qinghua Lu, Xiwei Xu, and Chunyang Chen. 2023. Unveiling the Tricks: Automated Detection of Dark Patterns in Mobile Applications. In *Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology* (San Francisco, CA, USA) (UIST '23). ACM, Article 114, 20 pages. doi:10.1145/3586183.3606783</footnote>

<footnote>[7] Nicholas Confessore. 2018. Cambridge Analytica and Facebook: The scandal and the fallout so far. *The New York Times* 4 (2018), 2018.</footnote>

<footnote>[8] Amit Datta, Michael Carl Tschantz, and Anupam Datta. 2015. Automated Experiments on Ad Privacy Settings. *Proc. Priv. Enhancing Technol. 2015*, 1 (2015), 92–112. doi:10.1515/POPETS-2015-0007</footnote>

<footnote>[9] Colin M Gray, Cristiana Santos, Nataliia Bielova, Michael Toth, and Damian Clifford. 2021. Dark patterns and the legal requirements of consent banners: An interaction criticism perspective. In *Proceedings of the 2021 CHI conference on human factors in computing systems*. 1–18.</footnote>

<footnote>[10] Sajad Hamzenejadi, Mahdieh Ghazvini, and Seyedamiryousef Hosseini. 2023. Mobile botnet detection: a comprehensive survey. *International Journal of Information Security* 22, 1 (2023), 137–175.</footnote>

<footnote>[11] Aniko Hannak, Gary Soeller, David Lazer, Alan Mislove, and Christo Wilson. 2014. Measuring Price Discrimination and Steering on E-commerce Web Sites. In *Proceedings of the 2014 Conference on Internet Measurement Conference* (Vancouver, BC, Canada) (IMC '14). ACM, 305–318. doi:10.1145/2663716.2663744</footnote>

<footnote>[12] Pankaj Kumar Keserwani, Mahesh Chandra Govil, and Emmanuel Shubhakar Pilli. 2022. The web ad-click fraud detection approach for supporting to the online advertising system. *International Journal of Swarm Intelligence* 7, 1 (2022), 3–24.</footnote>

<footnote>[13] Rishabh Khandelwal, Thomas Linden, Hamza Harkous, and Kassem Fawaz. 2021. PriSEC: A Privacy Settings Enforcement Controller. In *30th USENIX Security Symposium (USENIX Security 21)*. USENIX Association, 465–482. https://www.usenix.org/conference/usenixsecurity21/presentation/khandelwal</footnote>

<footnote>[14] Rishabh Khandelwal, Asmit Nayak, Hamza Harkous, and Kassem Fawaz. 2023. Automated cookie notice analysis and enforcement. In *Proceedings of the 32nd USENIX Conference on Security Symposium* (Anaheim, CA, USA) (SEC '23). USENIX Association, USA, Article 63, 18 pages.</footnote>

<footnote>[15] Daniel Kirkman, Kami Vaniea, and Daniel W. Woods. 2023. DarkDialogs: Automated detection of 10 dark patterns on cookie dialogs. In *2023 IEEE 8th European Symposium on Security and Privacy (EuroSP)*. 847–867. doi:10.1109/EuroSP57164. 2023.00055</footnote>

<footnote>[16] Sneha Kudugunta and Emilio Ferrara. 2018. Deep neural networks for bot detection. *Information Sciences* 467 (2018), 312–322.</footnote>

<footnote>[17] Paul Kuyer and Bert Gordijn. 2023. Nudge in perspective: A systematic literature review on the ethical issues with nudging. *Rationality and Society* 35, 2 (2023), 191–230.</footnote>

<footnote>[18] Tu Le, Luca Baldesi, Athina Markopoulou, Carter T. Butts, and Zubair Shafiq. 2025. From Voice to Ads: Auditing Commercial Smart Speakers for Targeted Advertising based on Voice Characteristics. In *Proceedings of the 2025 ACM Internet Measurement Conference* (USA) (IMC '25). ACM, 558–577. doi:10.1145/3730567. 3764444</footnote>

<footnote>[19] William Melicher, Mahmood Sharif, Joshua Tan, Lujo Bauer, Mihai Christodorescu, and Pedro Giovanni Leon. 2016. (Do Not) Track Me Sometimes: Users' Contextual Preferences for Web Tracking. *Proc. Priv. Enhancing Technol.* 2016, 2 (2016), 135–154. doi:10.1515/POPETS-2016-0009</footnote>

<footnote>[20] Jakub Mikians, László Gyarmati, Vijay Erramilli, and Nikolaos Laoutaris. 2012. Detecting price and search discrimination on the internet. In *Proceedings of the 11th ACM Workshop on Hot Topics in Networks* (Redmond, Washington) (HotNets-XI). ACM, 79–84. doi:10.1145/2390231.2390245</footnote>

<footnote>[21] Alberto Monge Roffarello and Luigi De Russis. 2022. Towards Understanding the Dark Patterns That Steal Our Attention. In *Extended Abstracts of the 2022 CHI Conference on Human Factors in Computing Systems* (New Orleans, LA, USA) (CHI EA '22). ACM, Article 274, 7 pages. doi:10.1145/3491101.3519829</footnote>

<footnote>[22] Asmit Nayak, Yash Wani, Shirley Zhang, Rishabh Khandelwal, and Kassem Fawaz. 2025. Automatically Detecting Online Deceptive Patterns. In *Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security* (Taipei, Taiwan) (CCS '25). ACM, 96–110. doi:10.1145/3719027.3765191</footnote>

<footnote>[23] Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, and Lalana Kagal. 2020. Dark patterns after the GDPR: Scraping consent pop-ups and demonstrating their influence. In *Proceedings of the 2020 CHI conference on human factors in computing systems*. 1–13.</footnote>

<footnote>[24] Shadi Sadeghpour and Natalija Vlajic. 2021. Ads and fraud: A comprehensive survey of fraud in online advertising. *Journal of Cybersecurity and Privacy* 1, 4 (2021), 804–832.</footnote>
[25] Zewei Shi, Ruoxi Sun, Jieshan Chen, Jiamou Sun, Minhui Xue, Yansong Gao, Feng Liu, and Xingliang Yuan. 2025. 50 Shades of Deceptive Patterns: A Unified Taxonomy, Multimodal Detection, and Security Implications. In Proceedings of the ACM on Web Conference 2025 (Sydney NSW, Australia) (WWW '25). Association for Computing Machinery, New York, NY, USA, 978-989. doi:10.1145/3696410.3714593

[26] Márcio Silva, Lucas Santos de Oliveira, Athanasios Andreou, Pedro Olmo Vaz de Melo, Oana Goga, and Fabricio Benevenuto. 2020. Facebook Ads Monitor: An Independent Auditing System for Political Ads on Facebook. In Proceedings of The Web Conference 2020 (Taipei, Taiwan) (WWW '20). ACM, 224-234. doi:10.1145/3366423.3380109

[27] Sachin Kumar Singh, Robert Ricci, and Alexander Gamero-Garrido. 2025. Where in the World Are My Trackers? Mapping Web Tracking Flow Across Diverse Geographic Regions. In Proceedings of the 2025 ACM Internet Measurement Conference (USA) (IMC '25). ACM, 692-708. doi:10.1145/3730567.3764427

[28] Vibhav Singh, Niraj Kumar Vishvakarma, and Vinod Kumar. 2024. Unveiling digital manipulation and persuasion in e-commerce: a systematic literature review of dark patterns and digital nudging. Journal of Internet Commerce 23, 2 (2024), 144-171.

[29] Enoch Oluwademilade Sodiya, Olukunle Oladipupo Amoo, Uchenna Joseph Umoga, Akoh Atadoga, EO Sodiya, OO Amoo, UJ Umoga, and A Atadoga. 2024. AI-driven personalization in web content delivery: A comparative study of user engagement in the USA and the UK. World Journal of Advanced Research and Reviews 21, 2 (2024), 887-902.

[30] Vera Sosnovik and Oana Goga. 2021. Understanding the Complexity of Detecting Political Ads. In Proceedings of the Web Conference 2021 (Ljubljana, Slovenia) (WWW '21). ACM, 2002-2013. doi:10.1145/3442381.3450049

[31] Vera Sosnovik, Romaissa Kessi, Maximin Coavoux, and Oana Goga. 2023. On Detecting Policy-Related Political Ads: An Exploratory Analysis of Meta Ads in 2022 French Election. In Proceedings of the ACM Web Conference 2023 (Austin, TX, USA) (WWW '23). ACM, 4104-4114. doi:10.1145/3543507.3583875

[32] Matthias Stevens and Ellie D'Hondt. 2010. Crowdsourcing of pollution data using smartphones. In Workshop on ubiquitous crowdsourcing. ACM, 1-4.

[33] Florian Tramër, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, Jean-Pierre Hubaux, Mathias Humbert, Ari Juels, and Huang Lin. 2017. FairTest: Discovering Unwarranted Associations in Data-Driven Applications. In IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 401-416. https://arxiv.org/abs/1510.02377

[34] J Arockia Venice, D Arivazhagan, Nupur Suman, HJ Sthanthi, and R Swadhi. 2025. Recommendation Systems and Content Personalization: Algorithms, Applications, and Adaptive Learning. In AI for Large Scale Communication Networks. IGI Global, 323-348.

[35] Hari Venugopalan, Shaoor Munir, Shuaib Ahmed, Tangbaihe Wang, Samuel T. King, and Zubair Shafiq. 2025. FP-Inconsistent: Measurement and Analysis of Fingerprint Inconsistencies in Evasive Bot Traffic. In Proceedings of the 2025 ACM Internet Measurement Conference (USA) (IMC '25). ACM, 134-149. doi:10.1145/3730567.3732919

[36] Thomas Vissers, Nick Nikiforakis, Natalia Bielova, and Wouter Joosen. 2014. Crying Wolf? On the Price Discrimination of Online Airline Tickets. In 7th Workshop on Hot Topics in Privacy Enhancing Technologies (HotPETs 2014). Amsterdam, Netherlands. https://inria.hal.science/hal-01081034

[37] Yuhao Wu, Evin Jaff, Ke Yang, Ning Zhang, and Umar Iqbal. 2025. An In-Depth Investigation of Data Collection in LLM App Ecosystems. In Proceedings of the 2025 ACM Internet Measurement Conference (USA) (IMC '25). ACM, 150-170. doi:10.1145/3730567.3732912

[38] Yuki Yada, Jiaying Feng, Tsuneo Matsumoto, Nao Fukushima, Fuyuko Kido, and Hayato Yamana. 2022. Dark patterns in e-commerce: a dataset and its baseline evaluations. In 2022 IEEE International Conference on Big Data (Big Data). 3015-3022. doi:10.1109/BigData55660.2022.10020800