publications

2026

1. Inferring Users’ Demographics and Sensitive Interests Using the Topics API

   Athicha Srivirote, Muhammad Abu Bakar Aziz, Jeffrey Gleason , and 2 more authors

   In Proceedings of the ACM Web Conference 2026 (WWW 2026) , Apr 2026

   Abs

   In 2019, Google introduced the Privacy Sandbox, a collection of APIs designed to facilitate privacy-preserving online advertising. One of the Sandbox APIs, known as Topics, maps users’ browsing history to a set of commercially-focused topics and then shares the top topics with advertisers. Prior work has shown that the Topics API makes Chrome users vulnerable to cross-context reidentification attacks. In this work, we investigate whether the Topics API can be abused to implement a different privacy attack: accurate inferences of users’ demographics and sensitive interests. To answer this question, we use a real-world dataset of browsing histories—containing over 250,000 unique domains over a span of eight months—to train machine learning models that take topics from the Topics API as input. Of the 19 demographic traits and sensitive interests that we evaluate, we find that all but two show predictive signals. Our findings add to the growing body of evidence that the Topics API is privacy-revealing, not privacy-preserving.

2025

1. Third Parties

   Muhammad Jazlan, Muhammad Abu Bakar Aziz, and Barry Pollard

   Apr 2025

   HTML

2024

1. Market or Markets? Investigating Google Search’s Market Shares Under Vertical Segmentation

   Desheng Hu^*, Jeffery Gleason^*, Muhammad Abu Bakar Aziz^* , and 3 more authors

   In Proceedings of the International AAAI Conference on Web and Social Media (ICWSM 2024). Buffalo, NY, June, Apr 2024

   Best Paper Honourable Mention Award

   Abs PDF

   Is Google Search a monopoly with gatekeeping power? Regulators from the US, UK, and Europe have argued that it is based on the assumption that Google Search dominates the market for horizontal (a.k.a. “general”) web search. Google disputes this, claiming that competition extends to all vertical (a.k.a. “specialized”) search engines, and that under this market definition it does not have monopoly power. In this study we present the first analysis of Google Search’s market share under vertical segmentation of online search. We leverage observational trace data collected from a panel of US residents that includes their web browsing history and copies of the Google Search Engine Result Pages they were shown.We observe that participants’ search sessions begin at Google greater than 50% of the time in 24 out of 30 vertical market segments (which comprise almost all of our participants’ searches). Our results inform the consequential and ongoing debates about the market power of Google Search and the conceptualization of online markets in general.

2. Johnny Still Can’t Opt-out: Assessing the IAB CCPA Compliance Framework

   Muhammad Abu Bakar Aziz, and Christo Wilson

   Proceedings on Privacy Enhancing Technologies (PoPETS), 2024(4). Bristol, UK, July, Apr 2024

   Abs PDF Code

   The privacy laws and regulations that govern the collection, sharing, and selling of online data are changing. In the U.S., California adopted the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), and twelve other U.S. states have adopted similar laws. Industry has responded by developing technical standards for collecting and disseminating consent information, such as the IAB CCPA Compliance Framework. While publishers are adopting this framework and the IAB is extending it to cover privacy laws in other U.S. states, recent work has observed that opt-out signals are not being honored under the framework. In this study, we take a deep dive into the IAB CCPA Compliance Framework to measure end-to-end flows of consent information and better understand why opt-out signals are not being honored. Using data crawled from top websites under different experimental conditions, we examine overall adoption of the framework, the flow of consent information from publishers to third parties and between third parties, and finally the reach of opt-out signals. Our results uncover numerous issues with the adoption and implementation of the framework that prevent users’ consent choices from being honored by third parties.