Data Protection and Consenting Communication Mechanisms: Current Open Proposals and Challenges

Abstract

Data Protection and Consenting Communication Mechanisms (DPCCMs) enable users to express their privacy decisions and manage their online consent. Thus, they can become a crucial means of protecting individuals' online privacy and agency, thereby replacing the current problematic practices such as "consent dialogues". Based on an in-depth analysis of different DPCCMs, we propose an interdisciplinary set of factors that can be used for a comparison of such mechanisms. Moreover, we use the results from a qualitative expert study to identify some of the main multidisciplinary challenges that DPCCMs should address to become widely adopted data privacy mechanisms. We leverage both the factors and the challenges to compare two current open specifications, i.e. the Advanced Data Protection Control (ADPC) and the Global Privacy Control (GPC), and discuss future work.1. The two terms are used interchangeably in the paper. 2. Consent is not always limited to privacy, hence the term "privacy signal" does not cover other types of consents that can/must be communicated [10], for instance biomedical consent.3.

Measuring Compliance with the California Consumer Privacy Act Over Space and Time

“…It also provided an alternative, frictionless, browser-based preference signal (e.g. Global Privacy Control or GPC) that websites could implement instead of implementing the opt-out link [20,53,60]. Furthermore, the CPRA dierentiates sensitive personal information from general personal data, requiring businesses that collect and process sensitive information to post an additional link titled "Limit the Use of My Sensitive Personal Information".…”

Usability and Enforceability of Global Privacy Control

“…For freely configurable GPC settings the fingerprinting risk depends on the extent to which people turn GPC on and off for different sites and how many of those sites an attacker can observe. However, overall GPC represents minor risks given its binary states [36].…”

“…The Advanced Data Protection Control (ADPC) -similar to P3P and focused on enabling cookie consent and other privacy choices under the GDPR and ePrivacy Directive -establishes bidirectional communication between websites and users [1,36]. ADPC is discussed in the W3C Consent Community Group [80].…”

How could the upcoming ePrivacy Regulation recognise enforceable privacy signals in the EU?

“…Privacy signals are digital representations that allow users to communicate their preferences [1] [2][3] [4] of how users want their personal data to be processed, e.g. Do Not Track [5] [6] for opting out of tracking, Global Privacy Control (GPC) [7] for opting out of third party sharing, IAB's Transparency and Consent (TCF) signal [8] for communicating decisions), or exercise rights (e.g.…”

“…Privacy signals must be adopted by both sides of the communication, i.e., controllers and data subjects along with support from device or software providers. Signals have the advantage to create a level playing field between all actors (users, websites, third parties), and to avoid user consent to be exploited through deceptive interfaces (dark patterns) [4][9] that nudge users to accept tracking though ubiquitous consent banners where consent where consent cannot be 'informed' or 'freely given'.…”