Cookie Banners, What's the Purpose?

Santos, Cristiana; Rossi, Arianna; Chamorro, Lorena Sánchez; Bongard-Blanchy, Kerstin; Abu-Salma, Ruba

doi:10.1145/3463676.3485611

Cited by 28 publications

(19 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Pursuant to the principle of purpose limitation (Article 5(1)(b) GDPR [15]), personal data can be collected for specified, explicit and legitimate purposes only. Santos et al studied various legal documents and systematized the legal requirements for purposes, which require i) explicitness (availability, unambiguity, shared common understanding), ii) specificity, iii) intelligible (non technical terms, conciseness), iv) clear and plain language (straight forward statements, concreteness), and concrete requirements for consent: v) freely given and vi) informed consent [55].…”

Section: Legal Backgroundmentioning

confidence: 99%

“…While there has been a plethora of research looking at deceptive design choices in the user interfaces of privacy notices [45,49,53,65], less attention has been paid on deceptive practices outside of the UI [45,55]. Of the work that has looked into non-UI deceptive designs, studies have shown that deceptive practices go well beyond the UI, such as deceptive linguistic practices [45,48,55].…”

Section: Deceptive Design Beyond User Interfacesmentioning

confidence: 99%

“…Previous work by Santos et al has found that 89% of privacy notices violate the GDPR; 61% were too vague in describing purposes (thereby violating the purpose specificity principle), and 30% framed their data practices in positive language (violating the freely given and informed requirements for consent) [55]. Kyi et al found that linguistic deceptive designs were exploited in the use of legitimate interests, such as by providing placebic and/or positive explanations to users about their data collection practices, and being vague about legal terms [45].…”

Section: Deceptive Design Beyond User Interfacesmentioning

confidence: 99%

“…We initially collected a set of 201 purposes and descriptions from 6 CMPs (OneTrust, Quantcast, TrustArc, Cookiebot, LiveRamp, and Crownpeak) and 39 companies from our own online browsing and looking at previous literature studying data collection purposes [28,31,55]. We ultimately decided on a smaller set of six purposes for conducting the interviews because we noticed that most purposes we collected were CMP-and DPA-based purposes.…”

Section: Selecting Data Collection Purposesmentioning

confidence: 99%

See 3 more Smart Citations

“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes

Kyi,

Mhaidli,

Santos

et al. 2024

Proceedings of the CHI Conference on Human Factors in Computing Systems

View full text Add to dashboard Cite

Data collection purposes and their descriptions are presented on almost all privacy notices under the GDPR, yet there is a lack of research focusing on how effective they are at informing users about data practices. We fill this gap by investigating users' perceptions of data collection purposes and their descriptions, a crucial aspect of informed consent. We conducted 23 semi-structured interviews with European users to investigate user perceptions of six common purposes (Strictly Necessary, Statistics and Analytics, Performance and Functionality, Marketing and Advertising, Personalized Advertising, and Personalized Content) and identified elements of an effective purpose name and description.We found that most purpose descriptions do not contain the information users wish to know, and that participants preferred some purpose names over others due to their perceived transparency or ease of understanding. Based on these findings, we suggest how the framing of purposes can be improved toward meaningful informed consent. CCS CONCEPTS• Human-centered computing → Empirical studies in HCI; • Security and privacy → Usability in security and privacy; • Applied computing → Law.

show abstract

Section: Legal Backgroundmentioning

confidence: 99%

Section: Deceptive Design Beyond User Interfacesmentioning

confidence: 99%

Section: Deceptive Design Beyond User Interfacesmentioning

confidence: 99%

Section: Selecting Data Collection Purposesmentioning

confidence: 99%

See 2 more Smart Citations

“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes

Kyi,

Mhaidli,

Santos

et al. 2024

Proceedings of the CHI Conference on Human Factors in Computing Systems

View full text Add to dashboard Cite

show abstract

“…Many different scientific works have analyzed the efficacy of these laws [17,55,62], privacy policies [9,18,41,46], third parties [35,59], cookie banners [56,64], and tracking in the Web [5,21,22,24,25,30,39,40,57].…”

Section: Background and Related Workmentioning

confidence: 99%

Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web

Rasaii,

Gosain,

Gasser

2023

Proceedings of the 2023 ACM on Internet Measurement Conference

View full text Add to dashboard Cite

Privacy regulations have led to many websites showing cookie banners to their users. Usually, cookie banners present the user with the option to "accept" or "reject" cookies. Recently, a new form of paywall-like cookie banner has taken hold on the Web, giving users the option to either accept cookies (and consequently user tracking) or buy a paid subscription for a tracking-free website experience.In this paper, we perform the first completely automated analysis of cookiewalls, i.e., cookie banners acting as a paywall. We find cookiewalls on 0.6% of all queried 45k websites. Moreover, cookiewalls are deployed to a large degree on European websites, e.g., for Germany we see cookiewalls on 8.5% of top 1k websites. Additionally, websites using cookiewalls send 6.4 times more third-party cookies and 42 times more tracking cookies to visitors, compared to regular cookie banner websites. We also uncover two large Subscription Management Platforms used on hundreds of websites, which provide website operators with easy-to-setup cookiewall solutions. Finally, we publish tools, data, and code to foster reproducibility and further studies. CCS CONCEPTS• Networks → Network measurement; Network privacy and anonymity.

show abstract

Exploring the Cookieverse: A Multi-Perspective Analysis of Web Cookies

Rasaii

Singh

Gosain

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Web cookies have been the subject of many research studies over the last few years. However, most existing research does not consider multiple crucial perspectives that can influence the cookie landscape, such as the client's location, the impact of cookie banner interaction, and from which operating system a website is being visited. In this paper, we conduct a comprehensive measurement study to analyze the cookie landscape for Tranco top-10k websites from different geographic locations and analyze multiple different perspectives. One important factor which influences cookies is the use of cookie banners. We develop a tool, BannerClick , to automatically detect, accept, and reject cookie banners with an accuracy of 99%, 97%, and 87%, respectively. We find banners to be 56% more prevalent when visiting websites from within the EU region. Moreover, we analyze the effect of banner interaction on different types of cookies (i.e., first-party, third-party, and tracking). For instance, we observe that websites send, on average, 5.5× more third-party cookies after clicking "accept", underlining that it is critical to interact with banners when performing Web measurements. Additionally, we analyze statistical consistency, evaluate the widespread deployment of consent management platforms, compare landing to inner pages, and assess the impact of visiting a website on a desktop compared to a mobile phone. Our study highlights that all of these factors substantially impact the cookie landscape, and thus a multi-perspective approach should be taken when performing Web measurement studies.

show abstract

Cookie Banners, What's the Purpose?

Cited by 28 publications

References 24 publications

“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes

“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes

Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web

Exploring the Cookieverse: A Multi-Perspective Analysis of Web Cookies

Contact Info

Product

Resources

About