Mapping Web Privacy in Ecuador: A Traceable Repeated- Measurement Study of Tracking, Fingerprinting, Third-Party Dependencies, and LOPDP Implications

Single observations can mischaracterize dynamic web tracking and browser fingerprinting. We measured privacy- and security-relevant indicators across a fixed, purposively curated frame of 947 Ecuador-associated organizational domains using Blacklight on 25 June, 25 July, and 25 August 2026. A completion-aware Playwright pipeline preserved the original JSON artifacts, acquisition provenance, SHA-256 hashes, quality-control results, and contextual taxonomy. Successful JSON export rates were 58.0%, 55.8%, and 59.0%; 500 domains succeeded in all three rounds, 497 satisfied measurement-level quality control in all three rounds, and the strict repeated-measures panel contained 381 domains (40.2% of the target frame) after the contextual-classification-confidence criterion was applied. Within the strict panel, six primary binary indicators varied by less than one percentage point, and none changed significantly after Holm correction (all adjusted p≥0.812); three-round exact agreement was 96.6–99.5%. The 497-domain sensitivity analysis produced closely similar results. Attrition was sector-dependent, so the strict panel is a complete-case analytical population rather than a compositionally representative subset of the original frame. A prospective direct-browser runtime-corroboration campaign on 120 stratified domains yielded 118 Firefox artifacts and 109 quality-valid observations, independently recording third-party domains, cookies, CSP headers, tracker-list matches, and fingerprinting-relevant API activity. Because contemporaneous Blacklight artifacts were not collected, this branch provides runtime corroboration rather than paired accuracy validation. The findings support traceable short-window audit prioritization and repeated-measures inference, but they do not establish national prevalence, long-term website stability, or domain-specific LOPDP violations.