GESIS Surf: An Open-Source Infrastructure for Privacy-Preserving Longitudinal Web Browsing Data Collection

GESIS Surf: An Open-Source Infrastructure for Privacy-Preserving Longitudinal Web Browsing Data Collection Mario Alberto Ramireza,∗, Frank Mangolda , Sebastian Stiera,b

arXiv:2610.41441v1 [cs.CR] 30 Oct 2026

a

Department Computational Social Science, GESIS – Leibniz Institute for the Social Sciences, Unter Sachsenhausen 6–8, 50667 Cologne, Germany b School of Social Sciences, University of Mannheim, A5, 6, 68159 Mannheim, Germany

Abstract Understanding how people navigate digital media environments requires behavioral data beyond survey self-reports. However, existing infrastructures for collecting such data reproducibly, sustainably, and with strong privacy guarantees remain limited: commercial solutions lack transparency and data governance, while academic tools are typically designed for narrow, shortterm use cases and do not support general-purpose academic panel data collections. We address this gap with GESIS Surf, a research infrastructure for large-scale longitudinal collection of web behavioral data in naturalistic environments. The system consists of a browser extension (Chrome and Firefox), a backend with a REST application programming interface (API), and a relational database. It passively captures user interactions, page metadata, and full HTML snapshots of each rendered page, embedding each observation within a hierarchical session model that preserves the structure of browsing behavior. GESIS Surf implements privacy-by-design through strict opt-in participation, per-domain collection rules, and client-side data minimization, ensuring that sensitive data are controlled at the point of collection. The system has been deployed with more than 1,000 participants in a large-scale academic panel infrastructure that includes surveys of participants, and supports reproducible, content-level, and structurally rich analysis of digital behavior. By combining hierarchical session modeling, content-level capture, and inte∗

Corresponding author. Email addresses: mario.ramirez@gesis.org (Mario Alberto Ramirez), frank.mangold@gesis.org (Frank Mangold), sebastian.stier@gesis.org (Sebastian Stier)

grated privacy enforcement within a unified system, GESIS Surf provides a general-purpose infrastructure for studying digital behavior in a reproducible manner over time. Keywords: web tracking, digital behavioral data, browser-based data collection, computational social science, research infrastructure, longitudinal data collection Metadata Nr. C1 C2

Code metadata description Current code version Permanent link to code/repository used for this code version

C3

Permanent link to Reproducible Capsule Legal Code License Code versioning system used Software code languages, tools, and services used

C4 C5 C6

C7

Compilation requirements, operating environments & dependencies

C8

If available Link to developer documentation/manual

C9

Support email for questions

Metadata V2.0.0 https://github.com/ gesiscss/gesis_surf_ extension Not applicable MIT License git TypeScript, Vite (browser extension); Python, Django REST Framework, PostgreSQL (backend); Elasticsearch, Logstash, Kibana (logging); Docker, Docker Compose (infrastructure) Extension: Node.js, Vite build toolchain. Backend: Docker and Docker Compose; PostgreSQL 14+; Elasticsearch 8+ (ELK stack for logging). https://github.com/ gesiscss/gesis_surf_ extension/blob/main/ README.md mario.ramirez@gesis.org

Table 1: Code metadata

2

Nr. S1 S2

S3 S4 S5 S6

S7

S8

(Executable) software metadata description Current software version Permanent link to executables of this version Permanent link to Reproducible Capsule Legal Software License Computing platforms/Operating Systems Installation requirements & dependencies If available, link to user manual - if formally published include a reference to the publication in the reference list Support email for questions

Metadata V2.0.0 https://github.com/ gesiscss/gesis_surf_ extension/releases/tag/ v2.0.0 Not applicable MIT License Google Chrome, Mozilla Firefox; Windows, macOS, Linux Browser extension: Google Chrome ≥ 88 or Mozilla Firefox ≥ 109. Backend: Docker and Docker Compose. https://github.com/ gesiscss/gesis_surf_ extension/blob/main/ README.md mario.ramirez@gesis.org

Table 2: Software metadata

1. Motivation and significance Internet use has become increasingly individualized and fragmented, spanning a diverse range of platforms, websites, and usage practices that vary across users and contexts. While surveys remain central to understanding attitudes, they are often inaccurate and systematically biased when it comes to measuring (digital) media use [1, 2]. Understanding digital media use scientifically therefore requires precise measurements of digital behavior. To generate such insights, academics recruit participants and collect behavioral data with their informed consent through browser-based technologies, thereby enabling valid observations of digital activities over time [3, 4]. These approaches have been used to investigate news exposure, political communication, information-seeking behavior in health and environmental domains, and online polarization across computational social science [e.g., 5, 6]. Despite these advances, a central limitation remains the lack of a generalpurpose infrastructure for collecting web-based behavioral data in a reproducible, scalable, and privacy-compliant manner. Existing approaches span 3

multiple technical paradigms, including browser-based tracking tools operating within the user’s browser (e.g., Eule [7], WebTrack [8]), proxy-based systems routing traffic through intermediary servers (e.g., Roxy [9], Robin [10, 11]), and passive network-level measurement that infers behavior from traffic monitored at institutional networks or Internet service providers [12]. Commercial solutions are optimized for analytics and marketing purposes, offering limited transparency, restricted data access, and non-standardized outputs that hinder scientific reuse. Academic tools, in contrast, are typically developed for specific study designs or short-term deployments and do not generalize well to longitudinal, passive data collection in panel settings and broader, general-purpose research applications. These approaches also differ substantially in terms of data granularity, privacy architecture, and suitability for different topical research interests [6, 13]. As a result, three interrelated challenges arise. First, no general-purpose system supports passive data collection under conditions suitable for longitudinal panel-based research designs. Second, academic tracking tools vary in their privacy-preserving capabilities, while commercial solutions often provide limited transparency and control over data collection and governance. Third, existing approaches capture only partial behavioral signals: networklevel measurements record cross-site activity [12] but discard both the structural representation of browsing sessions and the content-level information required to reconstruct user trajectories and analyze exposure. To situate GESIS Surf within this landscape, Table 3 compares design features across the main categories of academic tracking approaches, based on the representative implementations discussed above. Each category optimizes for specific dimensions—such as traffic-level measurement or contentlevel capture—while their integration into longitudinal, panel-ready infrastructures remains limited. GESIS Surf addresses this gap with a panel-ready infrastructure for longitudinal web behavioral data collection in naturalistic environments. The system consists of a browser extension (Chrome and Firefox), a REST API backend, and a relational database with standardized schemas. It passively captures scroll events, click interactions, page metadata, and full DOM/HTML snapshots, embedding each observation within a five-level session hierarchy that preserves the relational structure of browsing behavior. Data collection is strictly opt-in, and privacy is enforced through per-domain rules and a temporary private mode that implements data minimization directly on the participant’s device. A typical deployment involves provisioning participant accounts via the backend, installing the browser extension, and collecting behavioral data during ordinary browsing. Data are stored locally and synchronized securely to the backend, where they can be accessed via API endpoints 4

Table 3: Comparison of academic approaches to collecting web browsing data, based on representative implementations. Feature

Passive, naturalistic data collection Longitudinal / panel-ready Content-level capture (in situ) Hierarchical session modeling Privacy-by-design (client-side control) General-purpose research use

GESIS Surf

Proxy-based tools

Browserbased tools

Passive network measurement

✓

✓

✓

✓

✓

×

×

×

✓

×

∼

×

✓

×

×

×

✓

×

∼

×

✓

×

×

×

Note: ∼ indicates partial support or implementation-specific limitations (e.g., selective capture, post-hoc reconstruction, or lack of personalized, rendered content). Content-level capture refers to rendered HTML as presented to the user at the moment of exposure. Commercial tracking solutions are not included in this comparison, as they are typically designed for proprietary analytics contexts and do not provide the transparency, data access, or reproducibility required for academic research.

5

or direct database queries. GESIS Surf makes three contributions: 1. Hierarchical session modeling: a five-level structure enabling relational reconstruction of complete browsing trajectories across windows, tabs, domains, and interaction events; 2. Privacy-by-design enforcement: a policy architecture that applies attribute-level masking locally on the participant’s device, ensuring that sensitive data are controlled before transmission; 3. Content-level capture: an event pipeline that records rendered HTML in situ, enabling analysis of participants’ actual content exposure and avoiding the biases inherent to retrospective web scraping of URLs. 2. Software description 2.1. Software architecture GESIS Surf is designed as a modular system consisting of a browser extension, a backend API, and a relational database. These components jointly implement three core capabilities: hierarchical session tracking, privacy-by-design enforcement, and content-level data capture. The system is further guided by four design imperatives: precise behavioral measurement, privacy preservation, long-term sustainability, and horizontal scalability, which shape all technical decisions from session management to domain-level data collection policies. User interactions are captured by the browser extension, processed locally according to domain-specific privacy policies, and transmitted to the backend, where they are stored in a relational schema that reflects the session hierarchy. The browser extension is implemented in TypeScript using Vite and uses a shared Manifest V3 architecture across Chrome and Firefox, with browserspecific adaptations where required. It comprises two functional layers. The background service worker manages the global session lifecycle: it initializes session identifiers on start-up, coordinates child-session creation as windows and tabs open, and maintains the extension’s responsiveness under Chrome’s Manifest V3 service-worker lifecycle. Because Manifest V3 terminates idle service workers, GESIS Surf employs a heartbeat mechanism to maintain active collection during ongoing browsing sessions. Session objects are managed in IndexedDB across their full lifetime: when a trackable unit opens (a window, tab, or domain visit), a record is created in IndexedDB with its composite UUID key, updated as events accumulate,

6

Figure 1: Client-side architecture of the GESIS Surf browser extension. The figure shows the internal extension components responsible for session management, data collection, local storage, and communication with the backend.

and once the unit closes, the completed object is transmitted securely to the backend over HTTPS. The content script is injected automatically into every visited page; it captures scroll events (position, page offsets, timestamp), click events (type, coordinates, target element, tag, identifier, class, referrer, timestamp), page metadata (title, description, favicon URL), and full DOM/HTML snapshots. Participants perform no additional task; capture is fully passive and imposes no visible interface on ordinary browsing. Figure 1 provides a client-side view of the GESIS Surf architecture, illustrating the internal components of the browser extension and the flow between its services. 2.1.1. Backend and infrastructure The REST API is built with Django REST Framework and exposes tokenauthenticated endpoints organized around the five-level session hierarchy: dedicated Django apps handle global sessions, windows, tabs, domains, clicks, scrolls, and host rules. Whereas Figure 1 focuses on the client-side architecture of the browser extension, Figure 2 provides a system-level view of the backend and supporting infrastructure. Incoming payloads pass through a middleware chain (security, session, authentication, threat detection) before being routed to the corresponding data 7

models. Data are stored in a normalized PostgreSQL relational schema whose entity relationships mirror the session containment model. This design ensures that the analytical representation of the data directly reflects the underlying behavioral structure captured at the client level. Researchers retrieve collected data either through authenticated REST API endpoints or by querying the PostgreSQL database directly. GESIS Surf maintains two event pipelines. The domain pipeline opens a new database record when the user navigates to a URL and closes the previous one, with the privacy classification applied before transmission. The content pipeline forwards click, scroll, and HTML capture events—each evaluated and masked by the content policy service (Section 2.2.2)—to dedicated REST endpoints; scroll events are throttled to one per second to limit bandwidth. Asynchronous tasks—such as host-rule updates and extension processing— are handled by Celery workers backed by a Redis broker. System events feed into an ELK stack (Elasticsearch, Logstash, Kibana) that provides dashboards for operational monitoring, throughput analytics, and compliance documentation. Access logs are tamper-evident and stored in accordance with centrally defined institutional IT-security guidelines and technical and organizational measures. Every collected record also stores timestamps, the participant’s active consent version, and the applied pipeline configuration, enabling full reproducibility of the collection context. Docker ensures consistent environments across development, staging, and production. A GitHub Actions pipeline automatically executes tests, builds images, and deploys verified versions to an internal registry. Versioned releases guarantee traceability and rollback capability. Together, these components provide a scalable and privacy-compliant infrastructure for longitudinal behavioral data collection, enabling content-level exposure analysis within a structured session framework. 2.2. Software functionalities GESIS Surf provides the following major functionalities: • passive capture of scroll and click events, page metadata, and HTML snapshots; • hierarchical session tracking across browser windows, tabs, and domain visits; • per-domain privacy policies and a temporary private mode, enforced on the participant’s device; • local buffering in IndexedDB with secure synchronization to the backend; 8

Figure 2: Backend and infrastructure architecture of GESIS Surf. The extension communicates over HTTPS through an Nginx reverse proxy into a private network containing the Django REST Framework application, PostgreSQL database, ELK stack monitoring, and Redis/Celery async task processing.

9

• data access via the REST API or direct SQL queries; • operational monitoring and logging via an ELK stack. The session model and the privacy policies are described in detail below. 2.2.1. Session model GESIS Surf models each participant’s web journey as a five-level hierarchy: global session → browser window → tab → domain visit → interaction event (Figure 3). Each level is identified by a deterministic composite key that encodes its full ancestry, enabling researchers to reconstruct any segment of the web journey and query behavioral data at any level of granularity without ambiguity. This hierarchical structure enables the reconstruction of complete browsing trajectories and supports analysis across multiple levels of aggregation. Containment is strict: if any parent session is missing from IndexedDB when a child event is to be created, the event is discarded and the error is logged. Table 4 details the composition formula for each level. By preserving the relational structure of browsing behavior across windows, tabs, and domains, the model allows researchers to move beyond flat event logs or domain-level aggregates. Global Session one per browser-lifetime

Window Session one per open browser window

Tab Session one per browser tab

Domain Session one per URL visited in a tab

Event one per captured interaction Figure 3: Five-level session containment hierarchy. The hierarchy organizes browsing activity from global sessions to windows, tabs, domain visits, and individual interaction events.

10

Table 4: Session ID composition rules across the five-level hierarchy.

Session level

Composition formula

Global Session Window Session Tab Session Domain Session Event

global-session-{UUID} {globalSessionId}-windowId-{windowId} {windowSessionId}-tabId-{tabId} {tabSessionId}-domain-{urlPart} References domain_id (server-assigned UUID)

Note: The {urlPart} component of the Domain Session key is policy-sensitive: full URL under full allow/default, hostname only under only host, literal "full_deny" under full deny.

2.2.2. Privacy and data collection policies A server-managed host classification system governs collection on a perdomain basis. Each domain is assigned one of five privacy modes: default (no explicit rule exists for the URL; full behavioral capture applies as fallback); full allow (explicit full-collection rule: scroll events, click events, DOM snapshot, and metadata); only host (URL restricted to the hostname, with sensitive content attributes masked and HTML capture disabled while retaining non-content interaction signals; e.g., mail.google.com); full deny (domain and content information suppressed while retaining non-content interaction signals; e.g., pornhub.com); or private (user-activated temporary suspension with 15-minute auto-expiry). This design enforces data minimization directly at the point of data collection, rather than as a post-hoc filtering step, allowing sensitive browsing contexts to be excluded by design. Participation is strictly opt-in and the extension becomes active only after informed consent is recorded and after a user logs in with an individual user name and password. Table 5 details the domain-level masking applied under each mode; Table 6 shows the resulting collection matrix at the content-event level. Table 5: Privacy policy classifications and domain-level attribute masking. Classification

When applied

domain_url sent to API

domain_title

domain_fav_icon

default / full_allow only_host full_deny private

Fallback / explicit full-collection rule Blocklist entry—hostname only Blocklist entry—fully suppressed Private Mode active

Full URL (path + query) Hostname (e.g., bank.example.com) "full_deny" literal "Private-Mode" literal

Real title Masked ("only_host") "full_deny" "Private-Mode"

Real icon Masked "full_deny" "Private-Mode"

Policy evaluation is implemented as a three-service hierarchy. A BasePolicy Service resolves the active classification for any URL—checking Private Mode first, consulting cached host rules, then falling back to default—and two specialized services inherit from it: DomainPolicyService, which builds 11

Table 6: Content event data collection by privacy policy classification. Classification

Click referrer + target_element

Click coordinates (x, y)

Scroll metrics

HTML snapshot

default / full_allow only_host full_deny private

Original Masked → "only_host" Masked → "full_deny" Blocked

Original Original Original Blocked

Original Original Original Blocked

Original Blocked Blocked Blocked

the domain payload with masking applied per Table 5, and ContentPolicy Service, which evaluates each event kind (click, scroll, HTML snapshot) and returns allow, mask, or block. All policy evaluation occurs locally on the user’s device before any network transmission, ensuring that sensitive data do not leave the client environment regardless of backend configuration. Host rules are fetched at login and cached locally in both IndexedDB and chrome.storage.local; updates are synchronized only when the rule version changes, reducing unnecessary network overhead. 3. Illustrative examples Building on the system architecture described above, the following example demonstrates a typical data collection and retrieval workflow using GESIS Surf, showing how hierarchical session tracking and privacy policies are applied during runtime. The example traces the full process from session initialization to data storage and retrieval, highlighting how behavioral data are structured, filtered, and made accessible for analysis: 1. Initialization. When the browser is opened, the extension initializes a global session via the GlobalSessionService. A corresponding window session is created, establishing the first levels of the session hierarchy before any navigation occurs. 2. Data collection under domain policies. When the user navigates to a website (e.g., domain_url = "example-bank.com"), the system evaluates the domain against the configured policy rules. In the case of an "only_host" classification, the domain URL is reduced to the hostname, while metadata fields such as title and favicon are masked. Selected interaction-event attributes (e.g., click referrer and target element) are masked according to the policy, and content-level data such as HTML snapshots are not collected. All policy decisions are applied locally on the user’s device prior to transmission. 3. Session transitions and full capture. Upon navigation to another domain (e.g., "example-news.org"), the system closes the previous domain session and creates a new one. If no restrictive policy applies, 12

the default mode enables full data capture, including complete URLs, interaction events, and HTML snapshots. All events are stored within the hierarchical session structure, preserving their relational context across windows, tabs, and domains. 4. Data retrieval. Collected data can be accessed either via the REST API or directly from the PostgreSQL database. For example, click events can be retrieved and joined with domain-level information using a structured query (Listing 1). Listing 1: Retrieving a participant’s click events joined with their domain-level context. 1 2 3 4 5 6 7

SELECT c . click_time , c . click_page_x , c . click_page_y , c . click_target_tag , c . click_referrer , d . domain_url , d . start_time FROM clicks_click c JOIN tab_domain d ON d . id = c . domain_id WHERE c . user_id = ’ < participant_uuid > ’ ORDER BY c . click_time ;

This query returns both masked and unmasked events depending on the applied domain policies, while preserving their position within the session hierarchy. 4. Impact GESIS Surf extends the capabilities of digital behavior research by enabling content-level and structurally rich behavioral data collection in naturalistic settings. By capturing the rendered HTML at the moment of exposure, the system allows researchers to move beyond domain-level proxies—recording only which websites were visited—towards analyzing the actual content encountered by users in situ. This addresses a central limitation of retrospective URL-based scraping, which distorts content measures mainly because content retrieved outside the participant’s browser differs from what they saw (e.g., paywalls, login states, personalized elements), and only secondarily because of time delays [14]. The software further enables fine-grained reconstruction of browsing trajectories through its five-level session hierarchy. By explicitly modeling the nested relationships between windows, tabs, domain visits, and interaction events, GESIS Surf supports the analysis of cross-domain navigation, platform switching, and multi-tab browsing behavior within coherent user sessions. This structured representation allows queries at multiple levels of granularity while preserving contextual relationships, thereby extending the analytical scope of behavioral data beyond flat event logs or domain-level aggregates. 13

A key capability of the system is its integration with longitudinal survey panel infrastructures, allowing behavioral data to be linked with self-reported measures such as demographics and attitudes. This enables combined analyses of observed behavior and personal characteristics within the same individuals, supporting a more comprehensive and behaviorally grounded understanding of digital media use [3]. Beyond data collection, the system operationalizes privacy-by-design as a core architectural principle. Data minimization is enforced locally on the participant’s device, ensuring that sensitive data are controlled prior to transmission. In contrast to tracking infrastructures that rely on server-side data collection or opaque data governance, GESIS Surf embeds privacy and ethics safeguards directly into the technical design, in line with calls to build robust ethics tools into user-sourced data collection [15] and to treat privacy implementation as a core criterion for tracking tools [6]. This approach is supported by collaboration with data-protection officers and formal documentation (e.g., records of processing activities under the EU General Data Protection Regulation, GDPR), integrating compliance requirements as reusable components of the system architecture. GESIS Surf is designed as a production-grade infrastructure rather than a project-specific prototype. The system has been deployed at scale within the GESIS Panel.dbd, involving more than 1,000 participants over a period of more than 2 years [16, 17]. This deployment demonstrates the feasibility of long-term passive data collection for capturing user behavior in academic research. The implementation builds on experience from prior user-centric tracking studies with browser plug-ins and browsing panels [18, 19, 7] and addresses current technical constraints through local buffering via IndexedDB, compatibility with Chrome Manifest V3, and robust session management. Finally, GESIS Surf supports reproducibility and long-term reuse through open-source availability (MIT license), semantic versioning, automated testing pipelines, and containerized deployment, allowing other researchers to independently deploy and adapt the software to their own research settings. Continuous maintenance by professional research software engineers, which is considered essential for research software sustainability [20], keeps the extension compatible with evolving browser environments, while the integration of governance, monitoring, and version control mechanisms enables transparent and replicable data collection processes. Together, these features position GESIS Surf as a scalable and reusable infrastructure for computational social science research on digital behavior.

14

5. Conclusions GESIS Surf provides an institutionally governed system for longitudinal digital behavioral data collection, combining fine-grained measurement with integrated data governance. The system thereby enables a shift from domainlevel tracking to content-level and structurally rich behavioral analysis within a GDPR-compliant framework. It has been successfully deployed at scale within the GESIS Panel.dbd. As an open-source, continuously maintained infrastructure with integrated governance and reproducibility features, GESIS Surf enables the systematic study of content exposure and web browsing trajectories in naturalistic environments at scale. Acknowledgements The authors thank Judith Gilsbach and Felix Schmidt for their contributions to the project, and Fernando Guzmán for his work as software architect on the first version of GESIS Surf. CRediT author contribution statement Mario Alberto Ramirez: Conceptualization, Software, Methodology, Writing – original draft. Frank Mangold: Writing – review & editing. Sebastian Stier: Writing – review & editing. Funding This research did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors. Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Data availability No data were used for the research described in this article. Previously collected web browsing data obtained using GESIS Surf are available through the GESIS Data Archive at https://doi.org/10.4232/1.14467 [17] and https://doi.org/10.4232/1.14646 [21]. 15

Declaration of generative AI and AI-assisted technologies in the manuscript preparation process During the preparation of this work the authors used Claude (Anthropic) and ChatGPT (OpenAI) to improve clarity and language of the manuscript. After using these tools, the authors reviewed and edited the content as needed and take full responsibility for the content of the published article. References [1] D. A. Parry, B. I. Davidson, C. J. R. Sewall, J. T. Fisher, H. Mieczkowski, D. S. Quintana, A systematic review and meta-analysis of discrepancies between logged and self-reported digital media use, Nature Human Behaviour 5 (11) (2021) 1535–1547. doi:10.1038/ s41562-021-01117-5. [2] M. Scharkow, The accuracy of self-reported internet use: A validation study using client log data, Communication Methods and Measures 10 (1) (2016) 13–27. doi:10.1080/19312458.2015.1118446. [3] S. Stier, J. Breuer, P. Siegers, K. Thorson, Integrating survey data and digital trace data: Key issues in developing an emerging field, Social Science Computer Review 38 (5) (2020) 503–516. doi:10.1177/ 0894439319843669. [4] C. Wagner, S. Stier, M. Zens, What is digital behavioral data?, in: D. Radovanović, M. Zens, J. Breuer, K. Weller, C. Wagner (Eds.), GESIS Guides to Digital Behavioral Data, Vol. 1, GESIS – Leibniz Institute for the Social Sciences, 2025. doi:10.60762/ggdbd25001.1.0. [5] F. Mangold, S. Stier, Overview of working with web tracking data, in: D. Radovanović, M. Zens, J. Breuer, K. Weller, C. Wagner (Eds.), GESIS Guides to Digital Behavioral Data, Vol. 23, GESIS – Leibniz Institute for the Social Sciences, 2025. doi:10.60762/ggdbd25023.1.0. [6] C. Christner, A. Urman, S. Adam, M. Maier, Automated tracking approaches for studying online media use: A critical review and recommendations, Communication Methods and Measures 16 (2) (2022) 79–95. doi:10.1080/19312458.2021.1907841. [7] M. Haim, A. Nienierza, Computational observation: Challenges and opportunities of automated observation within algorithmically curated media environments using a browser plug-in, Computational Communication Research 1 (1) (2019) 79–102. doi:10.5117/CCR2019.1.004.HAIM. 16

[8] S. Adam, M. Makhortykh, M. Maier, V. Aigenseer, A. Urman, T. Gil Lopez, et al., Improving the quality of individual-level web tracking: Challenges of existing approaches and introduction of a new content and long-tail sensitive academic solution, Social Science Computer Review 43 (5) (2025) 1050–1070. doi:10.1177/08944393241287793. [9] E. Menchen-Trevino, C. Karr, Researching real-world web use with Roxy: Collecting observational web data with informed consent, Journal of Information Technology & Politics 9 (3) (2012) 254–268. doi: 10.1080/19331681.2012.664966. [10] B. Bodó, N. Helberger, K. Irion, F. Zuiderveen Borgesius, J. Möller, B. van de Velde, et al., Tackling the algorithmic control crisis: The technical, legal, and ethical challenges of research into algorithmic agents, Yale Journal of Law & Technology 19 (1) (2017) 133–180. [11] J. Möller, R. N. van de Velde, L. Merten, C. Puschmann, Explaining online news engagement based on browsing behavior: Creatures of habit?, Social Science Computer Review 38 (5) (2020) 616–632. doi:10.1177/0894439319828012. [12] R. Holz, D. Perino, M. Varvello, J. Amann, A. Continella, N. Evans, et al., A retrospective analysis of user exposure to (illicit) cryptocurrency mining on the web, in: Network Traffic Measurement and Analysis Conference (TMA), 2020, arXiv:2004.13239. doi:10.48550/arXiv. 2004.13239. [13] F. Mangold, M. Wieland, S. Stier, L. Otto, Neue Infrastrukturen für die Messung digitaler Mediennutzung, Publizistik 68 (2–3) (2023) 263–280. doi:10.1007/s11616-023-00804-9. [14] R. Ulloa, F. Mangold, F. Schmidt, J. Gilsbach, S. Stier, Beyond time delays: How web scraping distorts measures of online news consumption, Communication Methods and Measures 19 (3) (2025) 179–200. doi: 10.1080/19312458.2025.2482538. [15] M. N. Meyer, J. Basl, D. Choffnes, C. Wilson, D. M. J. Lazer, Enhancing the ethics of user-sourced online data collection and sharing, Nature Computational Science 3 (8) (2023) 660–664. doi:10.1038/ s43588-023-00490-7. [16] J. Gilsbach, J. G. Piepenburg, F. Mangold, S. Stier, B. Weiß, Enhancing participation in web tracking studies through monetary incentives: 17

Experimental evidence from an academic data collection infrastructure, Public Opinion Quarterly (2026). doi:10.1093/poq/nfag032. [17] GESIS, GESIS Panel.dbd – Pre-Release (ZA5668; Version 1.0.0) [Data set] (2025). doi:10.4232/1.14467. [18] J. Breuer, Z. Kmetty, M. Haim, S. Stier, User-centric approaches for collecting Facebook data in the ‘post-API age’: Experiences from two studies and recommendations for future research, Information, Communication & Society 26 (14) (2023) 2649–2668. doi:10.1080/1369118X. 2022.2097015. [19] S. Stier, F. Mangold, M. Scharkow, J. Breuer, Post post-broadcast democracy? News exposure in the age of online intermediaries, American Political Science Review 116 (2) (2022) 768–774. doi:10.1017/ S0003055421001222. [20] H. Anzt, F. Bach, S. Druskat, F. Löffler, A. Loewe, B. Y. Renard, et al., An environment for sustainable research software in Germany and beyond: current state, open challenges, and call for action, F1000Research 9 (2021) 295. doi:10.12688/f1000research.23224.2. [21] GESIS, GESIS Panel.dbd Web Tracking – Campus File (Training and Teaching Dataset) (ZA5670; Version 1.0.0) [Data set] (2025). doi: 10.4232/1.14646.

18

Related documents

• Longitudinal Adoption and Deprecation of the Privacy Sandbox Web APIs#927357
• Behavioral Fingerprinting and Navigation Prediction in Web Browsing#1012469
• PersonaFingerprint: Measuring Persona Inference on Modern Websites with LLM-Driven Browsing#196407
• PromptGraph: Graph-Guided Prompt Sanitization for Balancing Privacy and Utility in LLM Inference#363182
• <b>Anonymized Experimental Results: Multimodal Agentic RAG Framework for University Information Integration</b>#411626