4 Years of EU Cookie Law: Results and Lessons Learned

Abstract

Personalized advertisement has changed the web. It lets websites monetize the content they offer. The downside is the continuous collection of personal information with significant threats to personal privacy. In 2002, the European Union (EU) introduced a first set of regulations on the use of online tracking technologies. It aimed, among other things, to make online tracking mechanisms explicit to increase privacy awareness among users. Amended in 2009, the EU Directive mandates websites to ask for informed consent before using any kind of profiling technology, e.g., cookies. Since 2013, the ePrivacy Directive became mandatory, and each EU Member State transposed it in national legislation. Since then, most of European websites embed a “Cookie Bar”, the most visible effect of the regulation. In this paper, we run a large-scale measurement campaign to check the current implementation status of the EU cookie directive. For this, we use CookieCheck, a simple tool to automatically verify legislation violations. Results depict a shady picture: 49 % of websites do not respect the Directive and install profiling cookies before any user’s consent is given. Beside presenting a detailed picture, this paper casts lights on the difficulty of legislator attempts to regulate the troubled marriage between ad-supported web services and their users. In this picture, online privacy seems to be continuously at stake, and it is hard to reach transparency.

Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence

“…Various studies have tried to chart the impact of European privacy regulation on the collection and processing of personal data on the web, both within its territorial scope and globally. A longitudinal 4-year study of the impact of the revised ePrivacy directive on cookie placement shows that 1) 49% of websites placed cookies before receiving consent; 2) 28% of websites did not provide any consent mechanism; and 3) the percentage of websites violating the directive stayed constant over the course of 4 years, indicating the policy to be ineffective [48].…”

Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR

“…All construct items are reported in Table 1. Answers were collected on 5point rating scales with semantic anchors "strongly disagree" (1) and "strongly agree" (5). Perceived deception (PDE) is assessed using three (of originally four) items by Román [44], adapted to the context of our study.…”

“…6.3 below). However, our choice of stimulus was not driven by the most prevalent design, which we and other researchers [5,9,10] suspect to trivially violate the GDPR. Instead, we set out to study elementary design options of multi-purpose dialogs, the novel and most under-researched aspect of consent dialogs.…”

“…It is understandable that the industry finds cookie banners disadvantageous as they add fric-1 The principles of consent and purpose binding appear in data protection laws since the 1970s. The specific case for web cookies was harmonized in the EU through the 2009 update of the ePrivacy Directive [2][3][4], but respected by only one in two websites, according to a recent measurement study [5].…”

GDPR consent pop-ups. How are we thinking about them? An Elaboration Likelihood perspective

“…Since 2000, disclosure towards the users about cookie usage has increased (Miyazaki, 2008), and we can say that the GDPR regulation that came in 2018 was a natural continuity of this trend of transparency on how personal data is used on the internet. User's rights to privacy is not necessarily a value for the most websites, as in 2017, in Europe, 49% of them did not respect the European Union Directive that introduced a first set of regulations in 2002 (Trevisan, Traverso, Bassi & Mellia 2019). A study regarding the GDPR cookie consent compliance found out that 54% of the websites violate in a way or another the GDPR regulation (Matte, Bielova & Santos, 2019).…”