What the Measurements Show—and What They Cannot
In Bridges to Self, the claim of large-scale web-to-app tracking rests on a measurement design, not on a handful of suspicious requests. This chapter examines what the researchers counted in their US and EU crawls, how they connected those observations to Meta and Yandex, and what changed after public disclosure. The reader’s task is to interpret the numbers as bounded evidence: large enough to establish real deployment, but not a complete census of users, websites, or future implementations.
What the crawl counted
The researchers had to measure two populations at once. They crawled the top 100,000 sites in the February 2025 Chrome User Experience Report, or CrUX, using machines located in New York and Frankfurt. They emulated several device and browser situations, including an Android phone, an iPhone, and a Windows computer. The crawler recorded HTTP(S) requests, WebSocket frames, selected WebRTC activity, cookies, and relevant JavaScript calls. It did not treat a request to a local address as proof of tracking by itself; the observations were used to find candidate website-app relationships.
The second population was a corpus of 5,000 free Android apps drawn from Google Play’s US and EU rankings. The researchers ranked the candidates by cumulative install counts, then ran them on instrumented Pixel devices across Android 12 through 16. This made it possible to ask whether an app exposed a local listener, which process owned an open port, and what happened when a page containing a candidate script was loaded at the same time. The web and app measurements answered different parts of the same question. A crawl could show that a page initiated local traffic. App instrumentation could show which native process received it.
The first large result came from the April 2025 Android crawls. The researchers observed localhost WebRTC communications on 17,368 sites in the US and 15,819 sites in the EU. They observed HTTP(S) localhost communications on 1,379 US sites and 1,327 EU sites. WebSocket activity was much less common in those crawls, appearing on 35 US sites and 29 EU sites.
| Channel | United States | European Union | Main attribution reported by the study |
|---|---|---|---|
| WebRTC | 17,368 sites | 15,819 sites | Meta accounted for 99.2% in the US and 99.1% in the EU |
| HTTP(S) | 1,379 sites | 1,327 sites | Yandex accounted for 95.1% in the US and 95.0% in the EU |
| WebSocket | 35 sites | 29 sites | Rare in the April Android crawl |
These figures are site observations under a particular crawl configuration. They are not counts of people, installed apps, or completed identity matches. A single site may produce more than one local request, and a site counted as using a channel does not by itself reveal how many visitors were affected. The figures are nevertheless important because the concentration is not diffuse noise. The WebRTC cases were overwhelmingly associated with Meta’s deployment, while the HTTP(S) cases were overwhelmingly associated with Yandex’s.