{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,5,19]],"date-time":"2025-05-19T03:40:09Z","timestamp":1747626009049,"version":"3.40.5"},"reference-count":0,"publisher":"Privacy Enhancing Technologies Symposium Advisory Board","issue":"3","license":[{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["PoPETs"],"abstract":"<jats:p>The Referrer Policy (RP) standard makes it possible for websites to control how much information will be shared in the Referer [sic] header. In this study, we investigate the implementation and circumvention of the Referrer Policy standard across 27,750 distinct websites and over 100K pages from three vantage points: the United States, Singapore and the Netherlands.\nOur findings reveal that 48.38% of websites implement document-wide referrer policies, and 13.39% apply element-specific referrer policies. The majority of the sites (43.81\\%) use the Referrer-Policy HTTP response header to set a document-wide policy, while 11.09% use HTML meta tags. Even on websites with restrictive referrer policies, scripts can access the full page URL and exfiltrate it --- which we label as a referrer policy circumvention. We identified RP circumventions on 77.20% of websites often carried out by third-party advertising and analytics scripts, including Google Analytics, Facebook, and TikTok Pixel. While the ability to manage referrer information and the adoption of more privacy-focused default policies represent positive gains for user privacy, the widespread circumvention of these measures by third-party script remains to be a problem. We recommend implementing technical measures to restrict script access in order to address this privacy and security issue.<\/jats:p>","DOI":"10.56553\/popets-2025-0092","type":"journal-article","created":{"date-parts":[[2025,5,19]],"date-time":"2025-05-19T03:14:51Z","timestamp":1747624491000},"page":"135-155","source":"Crossref","is-referenced-by-count":0,"title":["Referrer Policy: Implementation and Circumvention"],"prefix":"10.56553","volume":"2025","author":[{"given":"Luqman","family":"Zagi","sequence":"first","affiliation":[{"name":"Radboud University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zahra","family":"Moti","sequence":"additional","affiliation":[{"name":"Radboud University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Gunes","family":"Acar","sequence":"additional","affiliation":[{"name":"Radboud University"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"35752","published-online":{"date-parts":[[2025,7]]},"container-title":["Proceedings on Privacy Enhancing Technologies"],"original-title":[],"deposited":{"date-parts":[[2025,5,19]],"date-time":"2025-05-19T03:14:54Z","timestamp":1747624494000},"score":1,"resource":{"primary":{"URL":"https:\/\/petsymposium.org\/popets\/2025\/popets-2025-0092.php"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7]]},"references-count":0,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2025,7]]}},"alternative-id":["10.56553\/popets-2025-0092"],"URL":"https:\/\/doi.org\/10.56553\/popets-2025-0092","relation":{},"ISSN":["2299-0984"],"issn-type":[{"value":"2299-0984","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7]]}}}