How is Internet privacy really measured? Discover the new heuristic techniques

Surfing the web is like stepping into a room full of eyes: figuring out how safe we really are is trickier than it looks. A team of researchers examined 160 studies on how to assess Internet privacy, creating a kind of “map” of existing techniques. This map, called a taxonomy, groups methods by what they measure (e.g., amount of personal data exposed) and how they do it (automatically or manually). Most research uses information measurement: counting how many personal details are leaked and evaluating disclosure risk. However, almost all studies focus on traditional web browsing, leaving other digital worlds{—}like mobile apps or voice assistants—largely unexplored. Another key finding is that, although many techniques are automatic, they often ignore new technologies that embed privacy by design and telemetry modules that collect background data. The authors call for “privacy‑by‑default” tools that protect users without any effort, and for expanding research to all types of services. In practice, their review not only summarizes the state of the art but also points out gaps and future directions that could make the Internet safer for everyone.

In the future, understanding privacy won’t be a job for experts only: new technologies will need built‑in assessment mechanisms, warning users in real time about potential risks. That could mean apps that automatically check how much of our data is being shared, helping us browse with more peace of mind.

The proposed review is built on a multi‑level classification. The first axis separates exposure metrics (quantitative) from risk metrics (qualitative). Quantitative metrics include counting identifiable attributes (PII), fingerprinting density, and third‑party request frequency. Qualitative metrics assess compliance with standards such as GDPR or CCPA, analyzing consent policies and transparency. The second axis concerns automation level: static techniques (source‑code or HTTP request analysis) versus dynamic techniques (real‑time traffic and user‑behavior monitoring). Static techniques, like header and cookie analysis, are less invasive but may underestimate data collection via obfuscated scripts. Dynamic techniques, e.g., sandboxing or instrumented browsers, provide a fuller picture but demand higher computational resources. A third axis, introduced by the authors, addresses application context: traditional web, mobile apps, IoT, and AR/VR environments. Most studies examined (≈78%) focus on traditional web, leaving a significant gap for IoT, where devices often run proprietary firmware and non‑standard protocols. Moreover, the review highlights a lack of integrated telemetry metrics, critical because telemetry modules can send sensitive data without explicit user consent. To address these gaps, the authors propose a modular framework based on open APIs, allowing the combination of quantitative, qualitative, and contextual metrics into a single privacy score. This framework should support extension to new domains (e.g., smart cities) and include machine‑learning mechanisms to adapt metric weights based on user risk profiles. Finally, the review suggests that standardizing a set of benchmarks, similar to those existing for cybersecurity (e.g., CVE), could facilitate study comparability and accelerate the adoption of privacy‑by‑default practices.