The Web as a Privacy Lab