# Privacy protection study: protocol v1
Preregistered 14 October 2026 before measured live runs. This is a purposive paired case study, not a population estimate.

Primary design: 2x2x2 cookie refusal (untouched/refused), NetShield (off/ads-trackers-malware), browser blocker (absent/enabled). Hold verified Proton server/IP and browser configuration constant within paired blocks. Five-site feasibility pilot precedes main sample freeze. Pilot candidates: IKEA, Booking.com, The Guardian, Mozilla, Dealroom. These span shopping/travel/media/online services and a known functional-validation case. No pilot result is treated as prevalence. Consent unavailable or blocked pages are retained, not scored as successful refusal.

Instrumentation: isolated Playwright Chromium contexts and a loopback HTTPS capture proxy, verified against an independent local receiver for exact request bytes, workers, frames, and departure. Direct/proxied DNS behavior must agree before NetShield comparisons. Ordinary browsing only with synthetic entry and no submitted forms. Blocker release and mode pinned in blocker-manifest.json; extension activation must be independently checked in the measured browser.

Discovery is separate from measured runs. Actual tasks, consent selectors, equal observation windows and main sample are frozen after discovery and before the comparison. Three repetitions on distinct days; second-location subset after primary run. No fresh-profile independence claim without initial-state checks. Cases requiring accounts, CAPTCHA, or legal declarations are excluded.

Outcomes: observable synthetic and documented pseudonymous identifiers, task/page information reaching reviewed recipients, functional success, exclusions, and incremental paired changes. Proxy interception is not proof of provider receipt; match upstream responses and failures. Familiar vendors and third-party requests are not automatically trackers. Functional validation is separate. Unmatched values, opaque encodings, and backend processing remain unknown.

No irreversible state changes, global CA installation, personal-profile traffic, purchases, outreach, publication, or shutdown. Restore initial Proton settings and connection state at each stopping point. Preserve original screenshots privately; public derivatives require review.