Skip to content

Repository files navigation

Heed — Privacy Witness

HEED - Privacy Witness (prototype v0.1)

Firefox extension that detects sites that ignore your Global Privacy Control signal and prepares a complaint to your state Attorney General.

Install (temporary, for testing)

  1. Firefox → about:debugging#/runtime/this-firefox
  2. "Load Temporary Add-on…" → select manifest.json
  3. Make sure GPC is on: Settings → Privacy & Security → "Tell websites not to sell or share my data"

Test plan

  • Signal verification: visit https://global-privacy-control.glitch.me or globalprivacycontrol.org — popup should show GPC sent.
  • Indicator detection: visit any large ad-supported news site. Badge shows an orange count; popup docket lists tracking domains ("host — entity", tagged "category · N×") and cookies. Sites with only analytics tracking show a grey badge and "Analytics-only tracking observed" — the filing button stays disabled.
  • Clean site: visit a site with no ad-tech (e.g. your own). Verdict: clean.
  • Filing gate: set state to AZ → button stays disabled with explanation. Set to CA/CO/TX → button activates only on an "indicators" verdict.

Design decisions (deliberate)

  • Never auto-submits. Complaint text goes to clipboard; the AG form opens; the human reviews and files. A complaint is a personal attestation.
  • "Indicators", not "proof". Loading ad-tech after GPC isn't conclusive evidence of illegal sale/sharing — the site may honor GPC server-side. The complaint language says "may indicate" for that reason. The strongest signal is the CMP check: if the consent platform recorded consent to tracking purposes despite GPC, that's on-device evidence of the recorded state.
  • No banner triggering. Banners are legal. Only GPC-sent + tracking-anyway fires the pipeline.
  • Identical complaints are fine. No fake "uniqueness" — volume is the signal; deception is what gets complaints discounted.

Roadmap

Work tracking lives in docs/ROADMAP.md — the single canonical list of ship blockers, upcoming work, dated triggers, and done items with evidence links.

Known limitations

  • Fingerprinting and server-side tracking are invisible to this approach.
  • SPAs that soft-navigate won't reset per-page state (main_frame only).
  • Cookie sweep reads cookies for the tab URL only; third-party cookie visibility depends on Firefox's partitioning settings.

License

  • Code: GPL-3.0 (see LICENSE).
  • data/tracker-domains.js: generated from Disconnect's tracking- protection list — © Disconnect, Inc., CC BY-NC-SA 4.0 (notice in the file header).
  • data/psl.js: generated from the Public Suffix List — Mozilla Public License 2.0 (https://publicsuffix.org).

About

Firefox extension that detects sites that ignore your Global Privacy Control signal and prepares a complaint to your state Attorney General.

Resources

Stars

0 stars

Watchers

0 watching

Forks

Contributors

Languages