# Second pass — same-day repeat

**Actual observation date: 13 October 2026, Africa/Nairobi.**

**Both passes occurred on the same calendar day. This is a same-day repeat.**

The second pass contains **19 measured attempts**, with **16 complete visits**. The first pass remains a separate 20-attempt dataset. Across the two passes there are 39 attempts on **one** calendar day. Local fixture checks, location checks and supplementary UI confirmations are not in these denominators.

The second-pass exclusions are three NordVPN security challenges. The first pass also retains its incomplete California Surfshark attempt and successful retry. Kenya again exposed no Surfshark consent controls in its completed sampled homepage visit; refusal and acceptance were unavailable there, not successful tests.

## Cookie counts: each condition remains separate

Entries present at the end of the sixty-second comparison window. These are separate fresh contexts, not a before-and-after deletion test. Identical names on different domains count separately. Cookie entries are not tracker counts or privacy scores.

| Connection | Homepage | First pass: untouched | Second pass: untouched |
| --- | --- | ---: | ---: |
| Germany | Mullvad | 0 | 0 |
| Germany | IVPN | 2 | 2 |
| Germany | Proton VPN | 4 | 4 |
| Germany | Surfshark | 7 | 7 |
| Germany | NordVPN | Unavailable / excluded | Unavailable / excluded |
| California | Mullvad | 0 | 0 |
| California | IVPN | 2 | 2 |
| California | Proton VPN | 4 | 4 |
| California | Surfshark | 22 | 22 |
| California | NordVPN | Unavailable / excluded | Unavailable / excluded |
| Kenya (native ISP) | Mullvad | 0 | 0 |
| Kenya (native ISP) | IVPN | 2 | 2 |
| Kenya (native ISP) | Proton VPN | 4 | 4 |
| Kenya (native ISP) | Surfshark | 23 | 22 |
| Kenya (native ISP) | NordVPN | Unavailable / excluded | Unavailable / excluded |

### Surfshark: choices where available

| Connection | Condition | First pass | Second pass |
| --- | --- | ---: | ---: |
| Germany | untouched | 7 | 7 |
| Germany | refused | 8 | 8 |
| Germany | accepted | 22 | 22 |
| California | untouched | 22 | 22 |
| California | refused | 23 | 11 |
| California | accepted | 23 | 23 |

## What repeated, and what changed

Germany again exposed a direct Decline all control on Surfshark’s initial notice. California again exposed Privacy controls, from which an explicit Decline all choice could be made. Separate second-pass confirmations reopened the panel after refusal and reload in both locations: Analytical and Marketing showed off. Those UI confirmations are distinct from the measured sixty-second visits.

The German Surfshark endpoint counts repeated at 7 untouched, 8 refused and 22 accepted. California repeated at 22 untouched and 23 accepted, but its refused session ended with **11 entries rather than the first pass’s 23**. Its pre-choice checkpoint had 10 entries, its sixty-second endpoint had 11, and its post-reload checkpoint had 12. The original first-pass refused session had 11, 23 and 24 at those respective checkpoints. These different results must not be collapsed into a single representative refusal count.

The Kenyan Surfshark untouched endpoint count was **22 rather than the first pass’s 23**. Its first-pass cookie list included a test_cookie entry that was not present at the second-pass endpoint. This identifies a storage difference, not its cause or a change in the provider’s overall privacy. Eleven of the twelve completed untouched provider/location pairs matched their earlier endpoint counts; the Kenyan Surfshark pair was the exception.

The second California refused visit recorded 14 request starts in its comparison phase, including seven to behaviour.surfshark.events, four to www.google.com and one to googleads.g.doubleclick.net. Two further requests were to surfshark.com. That describes destinations and timing, not the contents of the requests or a finding that consent was ignored. Its reload phase is stored separately. Google documents consent implementations that can send measurements without cookies; we did not establish the consent semantics of these observed requests.

The second German refused visit again recorded six POST requests to the engagement endpoint during its comparison window. Mullvad produced additional connection-check requests in the second pass while its cookie endpoint count remained zero. IVPN and Proton also showed different early loading/checkpoint behavior even where their endpoint cookie counts matched. This is why request counts and initial checkpoints are reported separately.

## Methods and exclusions

The same finalized browser setup was used: Google Chrome 155.0.8059.39, headless, English locale, UTC browser timezone, 1280×800 viewport, isolated non-persistent contexts, disabled page cache, at least ten seconds initially, then a sixty-second comparison window. Refused visits were reloaded and observed for at least another ten seconds. Cookies at the start of every measured context were empty. Bodies, headers, cookie values and query values were not saved in network records.

The second pass applies the bounded extra render wait consistently to every page that is still incomplete at its initial checkpoint. The first pass introduced that rule after one blank California page. This procedural difference and the fixed Germany → California → native Kenya order remain limitations. Both passes share browser software and connection infrastructure and are not independent calendar-day samples.

The local validation fixture initially timed out. Its single-thread server was replaced with ThreadingHTTPServer so idle preconnections would not block other fixture requests; endpoint behavior and assertions were unchanged. The repeated fixture and context-isolation checks passed before provider measurements. The failed validation attempt is retained outside the measured-page denominator.

Germany and California used the existing Proton WireGuard profiles; Kenya used the native ISP connection. Surfshark plus IPinfo supplied usable checks before and after both VPN groups. Kenya used Surfshark plus IPWHOIS because IPinfo returned no usable country field. NordVPN’s checker was challenged. The earlier disputed Nairobi-labelled virtual endpoint remained excluded. The setup record notes Proton’s malware-only NetShield default and no selected optional ad/tracker filtering. Network type, IP reputation, default protections and time remain potential confounds.

## Evidence and interpretation

The original 293 evidence files were verified against their saved checksum manifest. No original observations were overwritten. Second-pass evidence is stored separately under `evidence/2026-10-13/day-2-same-day-replication/`, including screenshots, metadata, request events, route checks, a validation result and round metadata that explicitly records `distinctCalendarDay: false`.

[Second-pass data](article-data-day2.json) · [Comparison data](replication-comparison.json) · [Second-pass protocol](day2-protocol.md) · [Collector](fresh-session-capture-day2.cjs)

These results concern public homepages, not VPN-service logging, app encryption or legal compliance. A saved off state, retained cookies and browser-visible requests measure different things. The California refusal difference is a reason to repeat the study on distinct days and investigate consent signals and selected request contents with appropriate redaction; it is not evidence of a stable privacy ranking.

## Supplementary screenshot visibility check

After the measured collection, an additional California UI-only confirmation used the same refusal-and-reload flow. Its screenshot viewport was enlarged to 1280×1200 solely to show the complete panel; the measured visits remained 1280×800. Both optional switches were off. This supplementary view is outside the 19-attempt denominator.

![Optional switches off after refusal and reload](day2/surfshark-california-refusal-visible.png)