Direct answer: A zero-request parse of 25 cached homepages: 9 reference a recognisable analytics script (Baidu 6, CNZZ 3, GTM 1) and 16 reference none; 3 link to a privacy policy (E02, E03, E11), 5 mention Cookie/consent, only 2 have both, and 21 show an ICP filing. Filing numbers are common; privacy entry points are not.
Earlier studies asked whether AI can read the site and how dates are written; this one changes dimension: analytics scripts, privacy links and consent wording. It does not judge compliance, only records whether these signals appear in the page.
Method: keywords and regex, zero requests
Using the 25 cached homepages from study 4 (2026-10-31 to 11-01), with no network request, each page is checked for common analytics domains (Google Tag Manager, Baidu, CNZZ/Umeng, Matomo, Clarity), a privacy link, Cookie/consent words and an ICP filing number. The study records whether text matches; it does not execute JavaScript or prove that a script runs.
| Signal | Match | Boundary |
|---|---|---|
| Analytics | hm.baidu.com, _hmt, cnzz.com, googletagmanager.com | Reference only, not execution |
| Privacy link | href containing privacy / yinsi / 隐私 | Link target not checked |
| Cookie / consent | Text containing cookie / 同意 / consent | Keywords are not a consent flow |
| ICP filing | ICP备 / beian / icp.gov.cn | Filing is not a privacy policy |
Result: 9 with analytics, 3 with a privacy link
| Signal | Hits | Note |
|---|---|---|
| Any analytics | 9 | E01, E02, E04, E06, E12, E13, E19, E25, E29 |
| Baidu | 6 | E01, E02, E06, E12, E19, E25 |
| CNZZ / Umeng | 3 | E04, E13, E29 |
| Google Tag Manager | 1 | E02 |
| Privacy link | 3 | E02, E03, E11 |
| Cookie / consent words | 5 | E02, E03, E04, E24, E29 |
| Privacy link + consent | 2 | E02, E03 |
| ICP filing | 21 | Almost every page carries a filing number |
Analytics: 9 yes, 16 no
Hits concentrate in Baidu (6) and CNZZ/Umeng (3), plus one GTM; no GA4, Matomo or Clarity reference was found. Sixteen homepages carry no recognisable analytics script — they may genuinely have none, or load it server-side, from another domain or inline, which this method cannot distinguish.
For acceptance: “has an analytics script” only says what the page references, not whether data is collected or handled lawfully. Data-flow checks still need network requests and the privacy statement.
Privacy entry points: 3 links, 5 consent mentions
Only 3 of 25 homepages link to a privacy policy, 5 mention Cookie/consent, and just 2 do both (E02, E03). That means of the 9 sites with analytics, only 2 also show a privacy link and consent wording.
This does not mean the others are non-compliant: the policy may sit on a registration or form page or inside a footer script, and a cookie banner may be injected at runtime. It does mean that privacy entry points are hard to discover from static homepage HTML alone, so acceptance should specify where to look.
ICP filing: 21 of 25
The filing number is the most common signal here: 21 homepages show ICP备 / beian / icp.gov.cn. It proves a filing statement exists, not that a privacy policy exists or that analytics complies. Treating the two as the same is a common misread.
What this means for acceptance
- Record analytics, privacy links and consent separately. Their hit rates differ sharply and cannot be merged into one “compliance score”.
- Keywords are not execution. A reference only says the page writes a script URL.
- ICP filing is not a privacy policy. It only evidences a filing statement.
- Agree where to look. The privacy link may not be on the homepage; specify footer, form or registration page.
- Nine with scripts, two with both. That gap deserves explicit confirmation in a project.
Limits
- Cached, zero-request: pages are frozen at 2026-10-31 to 11-01.
- Regex: keywords can false-positive; scripts injected by JavaScript are invisible.
- No JavaScript: runtime analytics and consent popups cannot be confirmed.
- No compliance judgement: signals only, not legality of processing.
- 25-site pilot: no industry claim.
Data and reproduction
Anonymised data: equipment-privacy-analytics-pilot-2026.csv (25 rows: sample_id, each analytics script, privacy link, Cookie/consent, ICP, any-analytics, privacy+consent). The repository keeps docs/research/2026-11-privacy-analytics-pilot.csv.
Parser: scripts/privacy_signal_probe.py; unit tests: scripts/test_privacy_signal_probe.py (13 tests, no network). Run:
python -m unittest scripts.test_privacy_signal_probe
Related: the title-date distance pilot, the freshness-signal pilot, the 30-site robots scan, and the contact-page privacy pilot (15 forms, 3 privacy links).
Sources and definitions
- Homepage cache: 25 homepages from study 4 (2026-10-31 to 11-01).
- Signals: keyword/domain regex; no JavaScript execution and no compliance judgement.
- Scan: 2026-11-02, zero network requests.