# Fresh-session and refusal extension — 13 October 2026

The initial protocol was written before the extension's measured visits. Practical amendments are disclosed below; this is not a preregistered study. The earlier in-app browser pilot remains a separate dataset.

## Sample and browser

Visit Mullvad, IVPN, Proton VPN, NordVPN and Surfshark homepages, using Germany and California Proton WireGuard connections and the native Kenyan ISP connection. Verify the apparent location at the beginning and end of each group using the NordVPN and Surfshark IP-check pages. Exclude disagreements and security challenges; do not bypass challenges.

Practical amendment, recorded during the German group after the first measured untouched visit: NordVPN's German IP checker returned a security challenge in the separate test browser. When that checker is unavailable, use IPinfo's country/region/city response as the second location check, saving those fields without the IP address. If a provider's complete untouched visit exposes no consent interface, mark refusal and acceptance unavailable from that visit rather than manufacture a choice or repeat identical conditions. The exploratory control-discovery visits are stored separately and excluded from measured results.

Practical amendment after the California Surfshark untouched visit: that attempt returned an empty rendered body at the ten-second checkpoint while resources were still arriving. Preserve it as incomplete and retry once with an additional render wait bounded at twenty seconds. Apply the same render rule to subsequent visits; record `extraRenderWait` and the actual initial duration. The comparison window still runs for at least sixty seconds. Retain the failed attempt and identify the retry explicitly; do not silently replace it. Supplemental settings confirmation uses this render wait too.

Location fallback before the Kenyan measured group: NordVPN's checker was challenged, and IPinfo's browser response supplied no country field. Use IPWHOIS (`https://ipwho.is/`) as a second usable country check, saving only success and country/region/city fields. Its response and Surfshark both reported Kenya before measurement. An empty geolocation response is unavailable, not agreement.

Use local Google Chrome through Playwright, headless, with a separate non-persistent browser context for every provider/condition. Contexts have no imported cookies or storage, English (en-US), UTC timezone, a fixed 1280×800 viewport, no supplied geolocation and no extra extensions. Browser automation/headless operation can affect website behavior and must be disclosed. A new context isolates cookies and site storage; it does not change IP reputation or make visits statistically independent. Capture the browser version. Disable the HTTP cache through CDP, without changing browser security settings.

## Conditions and timing

1. Untouched: make no consent choice.
2. Refused: use the visible reject/decline-all control, or open privacy controls and disable optional categories before saving. Necessary categories remain as required by the interface. Do not equate dismiss/OK with refusal.
3. Accepted: use an explicit accept-all control where present. Do not treat a generic acknowledgment as accept-all unless the interface establishes that meaning.

Navigation starts the initial capture. Allow at least ten seconds after navigation begins before attempting a choice. Use a bounded navigation wait and record actual timestamps. Save cookie metadata, storage key names, visible controls and a screenshot before the choice. Then observe for at least sixty seconds after the completed choice; for untouched visits, start the sixty-second comparison window at the corresponding ten-second checkpoint. Save a final screenshot and state. Reload after refusal and observe another ten seconds to check whether the choice persists and whether new requests occur. Keep post-reload traffic separate.

If a condition has no applicable interface, record it as unavailable, rather than claiming a successful refusal or acceptance. Each condition starts in a new context. Fixed order is untouched, refused, accepted within each provider; location order is Germany, California, native Kenya. This is one pass on one day, with no population estimates or causal claims.

## Evidence and interpretation

Capture request/response/failure events with elapsed phase timestamps, host/path, resource type, status and method. Elapsed times use the host clock and are not an independent monotonic-clock measurement. Strip URL queries/fragments, headers, bodies and cookie values. Cookie metadata includes names, domains, paths, flags and expiry. Record local/session storage key names, without values. Do not save authentication state or reuse personal profiles.

Request counts are not tracker counts. Separate first-party hosting, analytics, advertising, consent services and unclassified endpoints only where primary documentation supports the distinction. Cookie names are leads, not proof of personal-data transmission. A refusal result describes the chosen interface, cookies and observed requests over this window; it cannot prove all tracking stopped. Report failures and unavailable choices alongside successful runs.

Validate the collector against the local known-events fixture and check empty storage in a second fresh context before measuring providers. Save evidence privately, publish only reviewed summaries/screenshots, close contexts immediately, and restore the normal network connection at completion or interruption.