Can I Opt Out Yet?

Sánchez-Rola, Iskander; Dell’Amico, Matteo; Kotzias, Platon; Balzarotti, Davide; Bilge, Leyla; Vervier, Pierre-Antoine; Santos, Igor

doi:10.1145/3321705.3329806

Cited by 105 publications

(50 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…However, previous works found that cookie banners often do not work as expected [41], do not offer opt-out choices while instead assume opt-in [55], and showed that the used consent libraries do not meet other GDPR requirements [15]. In addition, Utz et al [55] have also shown that the majority of users does not interact with cookie consent notices, similar to our approach.…”

Section: Conclusion and Limitationssupporting

confidence: 71%

“…The introduced related work measures the tracking capabilities and other privacy implications of websites-some in relation to the GDPR. However, previous work related to the GDPR simply looked at the third parties present on websites and if their presence changed [8,43], measured tracking techniques and their prevalence [1,16], or analyzed cookie setting practices of third parties [15,41]. In this work, we go deeper and provide insights in the connections of third parties as far as these are observable on the client.…”

Section: Distinction From Previous Workmentioning

confidence: 99%

“…As a result, the imbalance of power between data processors (service providers) and data subjects (users) increased in the last couple of years. Users are often not aware of the collection, usage, or consequences of the use of their data [11] and have only limited options when trying to control it [41]. To address some of these problems, the European General Data Protection Regulation (GDPR), which went into effect on May 25, 2018, introduced significant changes that affect how personal data can be collected and shared.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Measuring the Impact of the GDPR on Data Sharing in Ad Networks

Urban¹,

Tatang

Degeling

et al. 2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

The European General Data Protection Regulation (GDPR), which went into effect in May 2018, brought new rules for the processing of personal data that affect many business models, including online advertising. The regulation's definition of personal data applies to every company that collects data from European Internet users. This includes tracking services that, until then, argued that they were collecting anonymous information and data protection requirements would not apply to their businesses. Previous studies have analyzed the impact of the GDPR on the prevalence of online tracking, with mixed results. In this paper, we go beyond the analysis of the number of third parties and focus on the underlying information sharing networks between online advertising companies in terms of client-side cookie syncing. Using graph analysis, our measurement shows that the number of ID syncing connections decreased by around 40 % around the time the GDPR went into effect, but a long-term analysis shows a slight rebound since then. While we can show a decrease in information sharing between third parties, which is likely related to the legislation, the data also shows that the amount of tracking, as well as the general structure of cooperation, was not affected. Consolidation in the ecosystem led to a more centralized infrastructure that might actually have negative effects on user privacy, as fewer companies perform tracking on more sites.

show abstract

Section: Conclusion and Limitationssupporting

confidence: 71%

Section: Distinction From Previous Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Measuring the Impact of the GDPR on Data Sharing in Ad Networks

Urban¹,

Tatang

Degeling

et al. 2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…Sanchez-Rola et al [38] evaluated the functionality of consent notices and opt-out mechanisms under GDPR. They manually visited 2,000 popular websites, tried to opt out of data collection whenever possible, and studied the effects on the website's cookies.…”

Section: Related Workmentioning

confidence: 99%

“…In Section 2, we presented a detailed analysis of variants in consent notices' user interfaces. Previous work had only classified consent notices by the provided information [22], the choices offered [12,38], and if the notice blocks access to the website [38]. Van Eijk et al [49] report some statistics on the height and width of consent notices, their location offset, and notices' word and link/button counts.…”

Section: Related Workmentioning

confidence: 99%

(Un)informed Consent

Utz

Degeling

Fahl

et al. 2019

Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

233

View full text Add to dashboard Cite

Since the adoption of the General Data Protection Regulation (GDPR) in May 2018 more than 60 % of popular websites in Europe display cookie consent notices to their visitors. This has quickly led to users becoming fatigued with privacy notifications and contributed to the rise of both browser extensions that block these banners and demands for a solution that bundles consent across multiple websites or in the browser. In this work, we identify common properties of the graphical user interface of consent notices and conduct three experiments with more than 80,000 unique users on a German website to investigate the influence of notice position, type of choice, and content framing on consent. We find that users are more likely to interact with a notice shown in the lower (left) part of the screen. Given a binary choice, more users are willing to accept tracking compared to mechanisms that require them to allow cookie use for each category or company individually. We also show that the widespread practice of nudging has a large effect on the choices users make. Our experiments show that seemingly small implementation decisions can substantially impact whether and how people interact with consent notices. Our findings demonstrate the importance for regulation to not just require consent, but also provide clear requirements or guidance for how this consent has to be obtained in order to ensure that users can make free and informed choices. CCS CONCEPTS• Security and privacy → Usability in security and privacy;• Human-centered computing → Empirical studies in interaction design; • Social and professional topics → Governmental regulations.

show abstract

A roadmap to achieving a healthier information ecosystem through GDPR implementation and privacy compliance technologies

Li,

Xiong,

Yang

2024

Asso for Info Science & Tech

View full text Add to dashboard Cite

Privacy protection has become a central issue in information science, with the General Data Protection Regulation (GDPR) significantly impacting information ecosystems. Research gaps persist in understanding the causal relationship between GDPR implementation and websites' proactive changes, such as adopting privacy compliance technologies. This study aims to examine the influence of GDPR implementation on websites' information ecosystems and identify boundary conditions that may affect this relationship. Utilizing domain‐level data from a professional platform tracking website technologies before and after GDPR implementation, which encompasses a comprehensive longitudinal dataset of over 1.2 million websites, our results indicate that GDPR implementation has increased the decision, breadth, depth, and intensity of adopting related technologies. The variance in these adoptions is significantly shaped by the differing levels of institutional impacts experienced by trailblazing versus laggard industries. Our study contributes to the literature by revealing the importance of policy factors in fostering a healthier information ecosystem. We demonstrate the complex nature of the relationship between policy factors and technology adoption, highlighting the need for researchers to consider institutional context and industry‐specific characteristics. We further discuss valuable insights for relevant stakeholders.

show abstract

Can I Opt Out Yet?

Cited by 105 publications

References 22 publications

Measuring the Impact of the GDPR on Data Sharing in Ad Networks

Measuring the Impact of the GDPR on Data Sharing in Ad Networks

(Un)informed Consent

A roadmap to achieving a healthier information ecosystem through GDPR implementation and privacy compliance technologies

Contact Info

Product

Resources

About