Inside the VPN Tunnel: One Advertising Identifier Reached Two Auction Systems

We kept a verified Proton VPN tunnel active while crossing three binary factors. Every website received all eight assignments in each of three main rounds.

Swipe or scroll horizontally to see all columns on smaller screens.

Untouched does not mean accepted. Refusal requested does not mean refusal completed. An extension-hidden dialog, a missing control, a subscription step and an actual refusal remain separate outcomes.

The browser was isolated Playwright Chromium 151.0.7922.34, with en-US locale, UTC browser time zone and a 1360 × 900 viewport. A new research profile was created for each workflow. Initial cookies and the requested extension mode were checked. Tasks were modest: scroll a homepage, enter a public destination or search term without submitting, or type a generated example.com email into an unsubmitted newsletter field. No real personal data, purchase, login or customer request was used.

The study asks what changed when these particular controls changed inside an already active tunnel. There is no matched non-VPN arm, so it does not estimate the causal effect of connecting a VPN. Our guide to what VPNs cannot protect explains that distinction beyond this experiment. Nor does it compare VPN brands.

Proton describes NetShield as filtering domain lookups against blocklists. A browser blocker can apply additional request and page rules. We pinned the official uBO Lite release, verified Optimal mode and retained a hash inventory of the bundled extension files. These are observations of the measured versions and settings, rather than promises about future releases.

Across the six reviewed TechCrunch workflows, we observed 26 advertising bid POSTs at two precise paths: InMobi's /openrtb/bidder/prebidjs and PubMatic's /translator. There were three untouched-notice workflows and three requested-refusal workflows. The latter never completed a usable refusal and are excluded from refusal-effect estimates.

The endpoint-purpose classification uses the official Prebid InMobi adapter and PubMatic adapter. The IAB OpenRTB specification supplies the meaning of the site/device and extended-identifier structures. The inspected reference code identifies endpoint purpose; it does not establish the precise adapter revision deployed during our visits.

The payloads contained user.ext.eids[].uids[].id, with an identifier source of pubcid.org. Within each workflow, the exact same value appeared at both reviewed recipients. The public evidence replaces that value with within-run-id-1; aliases reset for every run. No raw value or identifier hash is published.

Evidence schematic derived from decoded captures, not a simulated network screenshot. Field presence is shown; private values are omitted. The same alias denotes an exact match within one workflow only.

Observed fields included the page URL, user agent, language, dimensions and browser automation indicators. PubMatic payloads also included a referrer field. Field presence does not measure fingerprint uniqueness. The automation indicator is also a reminder that the research browser may receive different treatment from an ordinary visitor.

All reviewed bid transactions returned HTTP 204. This is evidence of observed upstream transactions, stronger than a blocked browser attempt or a request seen only by our local proxy. It cannot establish retention, profiling, sale, a legal violation or backend identity linking. We did not establish an exact match between the bid identifier and a recorded cookie value.

Timing changes the interpretation

Of the 26 reviewed bid POSTs, 24 occurred during navigation/cookie handling and two during the task action. None of these cases establishes transmission after a successful refusal. They also show why a study should publish its measurement boundary: a post-interaction-only counter can miss information sent before the visitor gets to the task.

On 17 October, the untouched, NetShield-off, blocker-absent TechCrunch workflow began at 09:37:45.937 UTC. Four reviewed bid POSTs were recorded at 09:38:05, during navigation/cookie handling. Two more followed at 09:38:07.974 and 09:38:08.025 during the scroll action. The fixed observation interval began at 09:38:08.357 and ended 60 seconds later. Two classified Clarity uploads occurred in that interval, and another occurred during departure.

Times are relative to this workflow's recorded start. Snapshot time is outside the primary window. A request in the departure window does not by itself establish its exact JavaScript trigger.

This example contains five classified collection requests in the primary task/action/departure windows: two advertising bid requests and three Clarity uploads. The corresponding blocker-enabled workflow contained zero detected classified requests in those windows and completed the task. In the first round, the analogous comparison was six versus zero; the six were Clarity uploads.

These are request-count differences in two matched pairs at one site. They are not six or five trackers, people or independent experiments. The second-round comparison is unavailable in the completed-task analysis because its task evidence did not pass; it appears only in the separate loaded-page exploration.

Clarity is a second concrete example of payload review. Preserved compressed POSTs decoded to JSON with metadata and analytics arrays, consistent with Microsoft's documented structure. This supports the analytics-upload classification. We do not infer individual interaction event types or persistent personal identity merely from the envelope. Raw envelope values and playback/DOM contents are excluded from publication.

The dataset distinguishes reviewed advertising auctions, analytics collection, script downloads, preflight requests, functional email validation and unresolved first-party instrumentation. A third-party hostname or a downloaded JavaScript file is not automatically a tracking disclosure.

Booking instrumentation at the observed C360/sink paths remains purpose-unresolved. It is reported separately and does not increase the classified analytics/advertising metric. Guardian Ophan requests are classified as first-party publisher analytics using its publisher-maintained client documentation. A view identifier is not evidence of a persistent person or cross-site profile.

No synthetic-marker match was detected in the retained main captures using the implemented raw, URL-decoded, base64, MD5, SHA-1 and SHA-256 checks. That is a bounded detection result. It is not proof that the typed field stayed private: unavailable forms, unknown encodings, unobserved transports and server-side processing limit what the method can see.

The sample was frozen before main collection: 20 selected websites spanning shopping, travel, media and online services. It was purposive, not randomly drawn from the web. Challenges remain in the assigned denominator; positive disclosure did not determine inclusion in the main sample.

Each round assigned 160 workflows. The dates below are calculated from actual timestamps in Africa/Nairobi, not filename dates or scheduler promises.

Swipe or scroll horizontally to see all columns on smaller screens.

The five-site pilot contributes 40 separate assignments and is never pooled into the main result. A failed third-round closing configuration probe invalidated an earlier 80 workflow attempts. Those originals were retained with checksum provenance, excluded and recollected. Thus the operational record contains 560 main attempts for 480 planned cells, plus the separate pilot and California assignments. A startup attempt before site visits is recorded as an operational incident, not another website observation.

Mutually exclusive categories derived from the audit. Challenge evidence takes precedence over raw missing-refusal labels. These are availability/evidence outcomes, not privacy-effect scores.

Swipe or scroll horizontally to see all columns on smaller screens.

A raw collector label of “measured” was insufficient. The primary audit also required completed task evidence, a consistent browser and blocker mode, initial-cookie isolation, capture files, observation/departure timing, placement inside a verified block, and stable DNS/configuration/exit checks. Genuine loaded pages with failed tasks form a separately labelled exploratory set of 131 visits, including primary-eligible visits.

Challenge pages can return HTTP 200. The evidence audit found restrictions missed by the collector's initial title/status heuristic. We retained the raw labels and added reasons rather than rewriting the original record. HTTP success therefore never substitutes for task or page validation.

Only Cloudflare, Surfshark and Kayak supplied any primary-eligible refused workflows in the main sample. Cloudflare and Surfshark account for most of those observations. This is a result about the recorded workflows and available controls, not an assertion that every other site offers no refusal option to ordinary users.

We did not buy subscriptions, solve challenges or force dialogs to appear. On the observed Guardian interface, a visible refusal option included a subscription step. It was not purchased or treated as a completed refusal.

Unchanged reviewed research screenshot. It explains a workflow exclusion and makes no legal claim.

Task success is also limited. A homepage could scroll while a notice remained visible. Conversely, a genuine page could load while the dialog prevented scrolling.

Unchanged reviewed screenshot. Observed scrolling establishes this narrow task outcome, not unrestricted site functionality.

These distinctions matter causally. A comparison restricted to working pairs conditions on a state that protections themselves may affect. The surviving sites may differ from excluded sites. Reporting the denominator does not remove that selection; it makes the boundary inspectable. Our location-based cookie-choice investigation examines a different source of consent-interface variation.

We formed 118 single-factor contrasts in Germany. Each contrast holds the other two factors fixed. A workflow can contribute to several contrasts, so this is not a count of independent participants. Repeated differences are averaged within each site before equal-site summaries.

The metric below counts only upstream-confirmed, page-attributed requests to the reviewed analytics/advertising categories during task action, the fixed observation interval and departure. Negative values mean fewer requests with the changed protection on. Navigation/cookie handling and snapshot overhead are excluded from this primary metric and retained separately.

Swipe or scroll horizontally to see all columns on smaller screens.

Factor values use 0 for off/absent/untouched and 1 for on/enabled/completed refusal. The browser-blocker stratum with NetShield off and the notice untouched has 19 paired workflows from seven sites. Its equal-site mean is −0.786 requests, with a site-bootstrap interval of −2.357 to 0. The non-zero evidence is concentrated at TechCrunch, rather than spread across the seven sites.

The remaining primary strata have zero detected mean differences in this classified metric. This is not equivalence, zero total collection or proof that the controls had no effect. Some contrasts contain as few as two site clusters; most surviving workflows do not contain the reviewed endpoint events. NetShield's verified DNS filtering mechanism can function while its incremental effect remains unidentifiable in a sparse, selected completed-task comparison.

Intervals are percentile bootstraps from 10,000 resamples of observed site means with a fixed random seed. They describe this purposive sample. Below five site clusters we omit intervals. A [0, 0] interval when every observed difference is zero is especially easy to overread: it says nothing about excluded sites, unknown endpoint purposes or unseen collection.

The loaded-page exploration was added after inspecting the first round, so it is explicitly post hoc. It retains the same capture, route, mode, timing, isolation and challenge guards but permits an issued task to fail. Across three rounds it shows TechCrunch classified counts of six, four and five without either blocker, versus zero with NetShield alone or the browser blocker alone. Guardian's corresponding first-party analytics count is one versus zero each round, while the scroll task failed. These observations support a narrow loaded-page case study, not an expansion of the primary estimate.

The six-site subset was frozen after the first Germany round for operability and category/task coverage: Booking, Mozilla, Walmart, BBC, Cloudflare and Surfshark. It was not selected by the direction or size of a privacy effect. The server was independently located in Los Angeles before collection, with exact NetShield settings and DNS checks at both block edges.

California contributed 48 assignments, 22 primary-eligible workflows and 21 matched single-factor contrasts. Of those contrasts, 2 contained detected classified collection on either side. Its full outcome denominator appears alongside Germany above; its paired results remain a separate location group in the downloadable data.

The two non-zero California contrasts share one Surfshark baseline workflow: one browser-matched GET to bat.bing.com/action/0 returned HTTP 204 during the task action with both blocking layers off and the notice untouched. The corresponding NetShield-only and browser-blocker-only workflows each had zero detected classified requests and passed the task checks. This is one underlying observed request contributing to two contrasts, not two independent disclosure events. Microsoft documents UET as an advertising activity-measurement mechanism. The endpoint and parameter structure support that classification; they do not establish a completed conversion, named identity or retention.

This is one descriptive subset repetition, not a second three-day experiment. These sites were already selected for working relatively well in Germany, and TechCrunch and Guardian were not in the frozen subset. It cannot independently replicate the advertising-ID case. Geography changes the VPN exit, network identity and potentially consent interface at once; it is not a randomized geography effect and is not pooled into Germany.

An independent local receiver exercised normal requests, frames, workers, departure, storage and raw/encoded/hashed synthetic markers, with negative controls. The HTTP and HTTPS fixtures each logged 17 receiver requests. The proxy captured 17; browser events captured 15 and missed two departure beacons. These bounded tests justify using proxy evidence for departure, rather than asserting universal capture completeness. The same capture distinction matters in our privacy-request form investigation.

Selected direct-browser/proxied resources were compared under NetShield on and off. Effective DNS checks used the tunnel resolver. Three selected tracking-script hosts changed from answers to NXDOMAIN in filtering mode while controls remained resolvable; a selected Facebook host still resolved. This validates a mechanism for those probes, not the entirety of the live blocklist. There was no bypass of blocked resources to make the capture work.

Every live mode block has opening and closing checks for exact configuration, control/filter DNS and exit stability. The exit also had to stay fixed across the two modes. The main rounds used DE#388; California used US-CA#229. Block order was off/on, on/off, off/on across the main rounds; assignments within blocks were randomized. Protection changes are still separated in time, so site changes and order effects remain possible confounders. NetShield’s server-side blocklists could not be frozen; the DNS checks establish the selected probes’ behavior, not an immutable list version.

Browser requests were matched to proxy records by method, URL, body and timing, or attributed through an observed frame referrer. Background browser traffic sharing the proxy was excluded from site metrics. Proxy errors and extension-local replacement responses were not counted as upstream receipt. A remote response still cannot reveal what happened after receipt.

The start schedule suffered dispatch/clock issues, and the second round actually ran after midnight Nairobi on 16 October. The user advanced the final round to the morning of 17 October. The three main dates are therefore 14, 16 and 17 October, with time-of-day variation. Original timestamps were preserved. Host checks found an approximately 35–36 second offset from HTTP Date references; that uncertainty does not change the observed date separation. No exact-time or subsecond synchronization claim is made.

This is a research-browser case study with short, simple tasks and a purposive sample. HTTPS interception, browser automation, the particular exit reputation and extension configuration can affect behavior. No CAPTCHA was bypassed. The method does not establish fingerprint uniqueness, server-to-server collection, persistent cross-session identity, no-logs performance, legality or full browsing usability. Unknown endpoints remain unknown rather than being silently scored safe. Our VPN website-warning study likewise separates a visible protection claim from what an observation actually establishes.

The original contribution is the documented combination of three controls, capture validation, actual cross-day repetitions, payload-level case evidence and an explicit account of failed comparisons. Earlier work already studied tracking-protection effectiveness and pre-submission form disclosure; this is not a first-discovery claim.

For a reader, the practical distinction is between an encrypted route and the content carried over that route. The advertising case demonstrates that scripts can send a shared identifier through a functioning VPN connection. For an evaluator, the equally consequential distinction is between a blocked collection request and a workflow that never became measurable. Both deserve to be visible before a product is called effective.

The sanitized reproducibility package includes the protocol and amendments, frozen samples/settings, audited data, endpoint-purpose review, analysis scripts, tables, chart sources and reviewed screenshot provenance. It reproduces the statistical summaries from sanitized inputs. Private original captures, generated identifiers, proxy CA material and unreviewed screenshots are excluded. Consequently, public readers cannot independently replay every packet-level classification from the ZIP alone; the private evidence is inventoried with checksums for controlled review.

Appendix: which sites supported the primary comparison?

Each main site had 24 planned cells, including 12 assigned refusal cells. Eligibility in this table is a workflow outcome, not a site privacy score.

Swipe or scroll horizontally to see all columns on smaller screens.

Other inputs need separate tests. Our password-checker investigation examines sequences of hash-prefix queries, while the uploaded-file lifecycle investigation separates output retrieval from filename observations and internal erasure. For the storage mechanisms behind consent measurements, see browser cookies explained. None of those separate studies extends this experiment’s advertising results to unmeasured sites.