Publications

2024

• The Effect of Design Patterns on (Present and Future) Cookie Consent Decisions.
  Nataliia Bielova, Laura Litvine, Anysia Nguyen, Mariam Chammat, Vincent Toubiana and Estelle Hary.
  USENIX Security Symposium (Sec), 2024. Accepted for publication.
  
  
• An Ontology of Dark Patterns: Foundations, Definitions, and a Structure for Transdisciplinary Action.
  Colin M. Gray, Nataliia Bielova, Cristiana Santos and Thomas Mildner.
  ACM CHI conference on Human Factors in Computing Systems (CHI), 2024.
  
  
• Two worlds apart! Closing the gap between regulating EU consent and user studies.
  Nataliia Bielova, Cristiana Santos, Colin M. Gray.
  Volume 37 of the Harvard Journal of Law & Technology (JOLT), 2024. [Video]
  
  
  

2023

• Towards a Preliminary Ontology of Dark Patterns Knowledge
  Colin M. Gray, Cristiana Santos, Nataliia Bielova.
  Extended abstract at the ACM CHI Conference on Human Factors in Computing Systems (CHI) [Video]
  
  
• A survey of user studies as evidence for dark patterns in consent banners
  Nataliia Bielova.
  Report for the CNIL while working in the LINC team [LINK]
  
  

2022

• On dark patterns and manipulation of website publishers by CMPs
  Michael Toth, Nataliia Bielova, Vincent Roca.
  Privacy Enhancing Technologies Symposium (PoPETS 2022).
  
  
• My Cookie is a phoenix: detection, measurement, and lawfulness of cookie respawning with browser fingerprinting
  Imane Fouad, Cristiana Santos, Arnaud Legout, Nataliia Bielova.
  Privacy Enhancing Technologies Symposium (PoPETS 2022). [Video]
  Honorary Mention by the 2023 Future of Privacy Forum’s Privacy Papers for Policymakers.
  • Media coverage: LeMonde.fr, La-rem.eu.

2021

• Protecting Privacy of Web Users.
  Nataliia Bielova.
  Habilitation à diriger des recherches (HDR)
  University Cote d’Azur, France.
  
  
• Dark Patterns and the Legal Requirements of Consent Banners: An Interaction Criticism Perspective
  Colin M. Gray, Cristiana Santos, Nataliia Bielova, Michael Toth, Damian Clifford.
  ACM CHI Conference on Human Factors in Computing Systems (ACM CHI 2021) [Video]
  Best of CHI Honorable Mention, top 5%.
  This work has been cited in the following reports by regulators:
  
  • California Privacy Protection Agency (CCPA) while updating the Consumer Privacy Rights Act of 2020 (CPRA) in 2023 [LINK]
  • OECD report on Dark commercial patterns in 2022 [LINK]
  • European Commission study on unfair commercial practices in the digital environment in 2022 [LINK]
  • UK Competition & Markets Authorithy report on Online Choice Architecture in 2022 [LINK]
  • Norwegian Consumer Council report in 2021 [LINK]
  
  
• Consent Management Platforms under the GDPR: processors and/or controllers?
  Cristiana Santos, Midas Nouwens, Michael Toth, Nataliia Bielova, Vincent Roca.
  Annual Privacy Forum (APF 2021).
  Impact:
  • Belgian Data Protection Authority used arguments presented in the paper in its decision to fine IAB Europe over its consent framework's GDPR violations.
  
  
• In-Depth Technical and Legal Analysis of Tracking on Health Related Websites with ERNIE Extension
  Vera Wesselkamp, Imane Fouad, Cristiana Santos, Yanis Boussad, Nataliia Bielova, Arnaud Legout.
  ACM Workshop on Privacy in the Electronic Society (ACM WPES 2021) [ERNIE extension].
  
  • I gave an interview in LeMonde.fr.
  
  

2020

• Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework
  Célestin Matte, Nataliia Bielova, Cristiana Santos.
  IEEE Symposium on Security and Privacy (IEEE S&P 2020). [Video] [BIB]
  
  • NGO NOYB filed 3 complaints to the French Data Protection Authority (CNIL) using our results and our browser extension.
  • Selected media coverage: Lemonde.fr, Businessinsider.fr, Nextinpact.com
  • This work has been cited by the EU Commission in their study on on the impact of recent developments in digital advertising on privacy, publishers and advertisers in 2023 [LINK].
  
  
• Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners.
  Cristiana Santos, Nataliia Bielova and Célestin Matte.
  International Journal on Technology and Regulation (TechReg), 2020. [LINK]
  
  • NGO NOYB filed 500 complaints to European Data Protection Authorities based on our work.
  • I gave an interview in Vice.com.
  
  
• Browser Fingerprinting: A survey.
  Pierre Laperdrix, Nataliia Bielova, Benoit Baudry and Gildas Avoine.
  ACM Transactions on the Web (ACM TWEB), 2020. Impact:
  • I gave an interview in Wired.com.
  • This survey was on a front page of HackerNews.
  • Media coverage: L'Eclaireur FNAC
  
  
• Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels
  Imane Fouad, Nataliia Bielova, Arnaud Legout, Natasa Sarafijanovic-Djukic.
  Privacy Enhancing Technologies (PoPETS 2020). [Video] [BIB]
  
  • Federal Trade Commission selected research for presentation at PrivacyCon conference in 2021.
  
  
• Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?
  Célestin Matte, Cristiana Santos, Nataliia Bielova.
  Annual Privacy Forum (APF 2020). [Video] [BIB]
  
  • Decareto company cites this paper in their report on legality of IAB Europe TCF standard in 2022.
  
  
• On Compliance of Cookie Purposes with the Purpose Specification Principle
  Imane Fouad, Cristiana Santos, Feras Al Kassar, Nataliia Bielova and Stefano Calzavara
  International Workshop on Privacy Engineering (IWPE 2020) [Video] [BIB]
  
  

2019

• Security Analysis of Subject Access Request Procedures.
  Coline Boniface, Imane Fouad, Nataliia Bielova, Cédric Lauradoux, and Cristiana Santos.
  Annual Privacy Forum (APF 2019). [Slides from PUT 2019]
  
  

2018

• To Extend or not to Extend: on the Uniqueness of Browser Extensions and Web Logins
  Gábor György Gulyás, Dolière Francis Somé, Nataliia Bielova and Claude Castelluccia.
  Workshop on Privacy in the Electronic Society (WPES 2018) at ACM CCS 2018.
  Impact:
  • Media coverage: CNIL, TheRegister.co.uk, and DCloudNews.
  
  
• A Better Facet of Dynamic Information Flow Control.
  M. Ngo, N. Bielova, C. Flanagan, T. Rezk, A. Russo and T. Schmitz.
  The Web Conference, Alternative Track (WWW 2018).
  

2017

• Control What You Include! Server-Side Protection against Third Party Web Tracking
  Dolière Francis Somé, Nataliia Bielova and Tamara Rezk.
  International Symposium on Engineering Secure Software and Systems (EssoS 2017)
  
  
• On the Content Security Policy violations due to Same Origin Policy.
  Dolière Francis Somé, Nataliia Bielova and Tamara Rezk.
  World Wide Web Conference, Security and Privacy track (WWW 2017).
  
  
• PLAS 2017, ACM SIGSAC Workshop on Programming Languages and Analysis for Security.
  Nataliia Bielova and Marco Gaboardi, editors.
  CCS '17 Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security.
  

2016

• Dynamic leakage - a need for a new quantitative information flow measure.
  Nataliia Bielova.
  ACM SIGPLAN Workshop on Programming Languages and Analysis for Security (PLAS 2016). [BIB] [Slides]
  
  
• Spot the Difference: Secure Multi-Execution and Multiple Facets.
  Nataliia Bielova and Tamara Rezk.
  European Symposium on Research in Computer Security (ESORICS 2016). [BIB]
  
  
• Hybrid Monitoring of Attacker Knowledge.
  F. Besson, N. Bielova and T. Jensen.
  IEEE Computer Security Foundations Symposium (IEEE CSF 2016). [BIB] [Slides]
  
  
• A Taxonomy of Information Flow Monitors.
  Nataliia Bielova and Tamara Rezk.
  International Conference on Principles of Security and Trust (POST 2016) [BIB]
  
  
• Using JavaScript Monitoring to Prevent Device Fingerprinting.
  F. Besson, N. Bielova and T. Jensen.
  ERCIM News, Special theme: Cybersecurity, 2016.

2015

• ESSoS 2015, Engineering Secure Software and Systems - 7th International Symposium.
  Frank Piessens, Juan Caballero, Nataliia Bielova, editors.
  Lecture Notes in Computer Science 8978, Springer, 2015.
  
  

2014

• Crying Wolf? On the Price Discrimination of Online Airline Tickets.
  T. Vissers, N. Nikiforakis, N. Bielova, W. Joosen.
  Hot Topics in Privacy Enhancing Technologies (HotPETs 2014). [BIB]
  
  
• Browser Randomisation against Fingerprinting: a Quantitative Information Flow Approach.
  F. Besson, N. Bielova and T. Jensen.
  Nordic Security Conference (NordSec 2014). [BIB]
  
  
• ESSoS 2014, Engineering Secure Software and Systems - 6th International Symposium.
  Jan Jürjens, Frank Piessens, Nataliia Bielova, editors.
  Lecture Notes in Computer Science 8364, Springer, 2014.

2013

Hybrid Information Flow Monitoring Against Web Tracking.
F. Besson, N. Bielova and T. Jensen.
IEEE Computer Security Foundations Symposium ( IEEE CSF 2013). [BIB] [Slides]


• Survey on JavaScript Security Policies and their Enforcement Mechanisms in a Web Browser.
  Nataliia Bielova.
  Journal of Logic and Algebraic Programming (JLAP), 2013. [LINK] [BIB]
  

2012

• Iterative Enforcement by Suppression: Towards Practical Enforcement Theories.
  Nataliia Bielova and Fabio Massacci.
  Journal of Computer Security (JCS), 2012. [BIB]
  
  

2011

• A theory of constructive and predictable runtime enforcement mechanisms. PhD thesis.
  Nataliia Bielova.
  University of Trento. [BIB] [Slides]
  
  
• Reactive non-interference for a Browser Model.
  N. Bielova, D. Devriese, F. Massacci and F. Piessens.
  International Conference on Network and System Security (NSS 2011). [BIB]
  
  
• Computer-Aided Generation of Enforcement Mechanisms for Error-Tolerant Policies.
  Nataliia Bielova and Fabio Massacci.
  IEEE International Symposium on Policies for Distributed Systems and Networks (POLICY 2011) [BIB]
  
  
• Predictability of Enforcement.
  Nataliia Bielova and Fabio Massacci.
  In Proceedings of the International Symposium on Engineering Secure Software and Systems (ESSoS 2011) [BIB]
  
  
• Do you really mean what you actually enforced? Edit Automata revisited.
  Nataliia Bielova and Fabio Massacci.
  International Journal of Information Security (IJIS), 2011. [BIB]
  
  

2009

• Matching in Security-by-Contract for Mobile Code.
  N. Bielova, N. Dragoni, F. Massacci, K. Naliuka and I. Siahaan.
  Journal of Logic and Algebraic Programming (JLAP), 2009. [LINK] [BIB]
  
  
• Towards Practical Enforcement Theories.
  Nataliia Bielova, Fabio Massacci and Andrea Micheletti.
  Nordic Conference on Secure IT Systems (NordSec 2009) [BIB]
  
  

2008

• Do you really mean what you actually enforced? Edit Automata revisited.
  Nataliia Bielova and Fabio Massacci.
  International Workshop on Formal Aspects in Security and Trust (FAST 2008). [BIB]
  
  
• Matching Policies with Security Claims of Mobile Applications.
  N. Bielova, M. Dalla Tore, N. Dragoni, and I. Siahaan.
  International Conference on Availability, Reliability and Security (ARES 2008). [BIB]
  
  
• Testing Decision Procedures for Security-by-Contract.
  N. Bielova and I. Siahaan.
  Joint Workshop on Foundations of Computer Security, Automated Reasoning for Security Protocol Analysis and Issues in the Theory of Security (FCS-ARSPA-WITS 2008). [BIB]