Hi, thank you for your comment. I plan on using react later to expand the features the popup has. There have been quite a lot of requests for this. As well as an options page. I may switch to a smaller library in the future. Adding react also helped fix several UI bugs, and makes the current UI easier to build on.

FWIW, adding react only adds ~35kb to the packaged file, a %15 increase. Unpacked it is ~120kb. However the public suffix list, and multi-domain first party list combined are 160kb. So I didn't think it was a very significant size bump.

Thanks for the review! To answer the question: yes! Please let me know if you have any questions.

TL;DR Panopticlick and Am I Unique use a homerolled assortment of tracking code that is impractical for commercial tracking.

I'll go into a little detail about Panopticlick to explain more. Panopticlick uses a deployment of the open source fingerprinting tool Fingerprintjs2, along with their own unique fingerprinting code.

I added some debug code and visited Panopticlick I see Privacy Possum detects the page accessing 12 API's that are marked for watching for fingerprinting. Except this is split over 3 different scripts:
https://panopticlick.eff.org/static/fp2.js
https://panopticlick.eff.org/static/fetch_whorls.js
https://panopticlick.eff.org/static/deployJava.js

Privacy watches for fingerprinting on *per script basis*, this is a reasonable assumption because, normally a websites tracking code is bundled into one place, so that the tracking info can be easily aggregated and used. I'm not aware of a real deployment where tracking is split up like this. It is practical for panopticlick (and Am I Unique) because they want to present information about your tracking independently, and manage the code to do that in a more practical way.

For a demonstration of the fingerprinting detection code, I usually point folks to:
http://valve.github.io/fingerprintjs2/

I think it is worth considering cases like Panopticlick, or Am I Unique, because they can be used to evade PP's novel detection. But I have not seen a case like this in the wild.