“Okay, whatever”: An Evaluation of Cookie Consent Interfaces

Habib, Hana; Li, Megan; Young, Eleanor; Cranor, Lorrie Faith

doi:10.1145/3491102.3501985

Cited by 41 publications

(25 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Very few participants read privacy notices regularly; almost all participants felt privacy notices were annoying and just usually do what it takes to get rid of them quickly, such as clicking "Accept all" or accepting only necessary cookies by default. This echoes findings from previous research which found that users tend to not interact with privacy notices very thoroughly [11,28,53].…”

Section: Perceptions Of Data Collection Practicessupporting

confidence: 89%

“…In this section we describe our qualitative results. As our interviews were not directly measuring quantities, we have used terminology present in previous qualitative HCI studies to give estimates of quantities [18,28,45].…”

Section: Resultsmentioning

confidence: 99%

“…Last, participants sometimes commented that these different descriptions were sometimes giving them conflicting information. This was especially prominent in Statistics and Analytics, and also Performance and Functionality purposes, a finding Habib et al also found [28]. As demonstrated by P3, "I feel like they have slightly different definitions (for Performance and Functionality).…”

Section: Perceptions Of Purpose Descriptionsmentioning

confidence: 90%

“…We initially collected a set of 201 purposes and descriptions from 6 CMPs (OneTrust, Quantcast, TrustArc, Cookiebot, LiveRamp, and Crownpeak) and 39 companies from our own online browsing and looking at previous literature studying data collection purposes [28,31,55]. We ultimately decided on a smaller set of six purposes for conducting the interviews because we noticed that most purposes we collected were CMP-and DPA-based purposes.…”

Section: Selecting Data Collection Purposesmentioning

confidence: 99%

“…The name was not intuitive for some participants who believed it meant the same as Personalized Advertising because "content" could also refer to advertising content. This misunderstanding could stem from the fact that most users are attuned to how organizations use data for delivering targeted ads [28,40,45]. Therefore, it is recommended that the name be modified to help users better differentiate it from Personalized Advertising, such as Personalized [insert application, e.g., Video/Search] Recommendations.…”

Section: Personalized Contentmentioning

confidence: 99%

See 4 more Smart Citations

“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes

Kyi,

Mhaidli,

Santos

et al. 2024

Proceedings of the CHI Conference on Human Factors in Computing Systems

View full text Add to dashboard Cite

Data collection purposes and their descriptions are presented on almost all privacy notices under the GDPR, yet there is a lack of research focusing on how effective they are at informing users about data practices. We fill this gap by investigating users' perceptions of data collection purposes and their descriptions, a crucial aspect of informed consent. We conducted 23 semi-structured interviews with European users to investigate user perceptions of six common purposes (Strictly Necessary, Statistics and Analytics, Performance and Functionality, Marketing and Advertising, Personalized Advertising, and Personalized Content) and identified elements of an effective purpose name and description.We found that most purpose descriptions do not contain the information users wish to know, and that participants preferred some purpose names over others due to their perceived transparency or ease of understanding. Based on these findings, we suggest how the framing of purposes can be improved toward meaningful informed consent. CCS CONCEPTS• Human-centered computing → Empirical studies in HCI; • Security and privacy → Usability in security and privacy; • Applied computing → Law.

show abstract

Section: Perceptions Of Data Collection Practicessupporting

confidence: 89%

Section: Resultsmentioning

confidence: 99%

Section: Perceptions Of Purpose Descriptionsmentioning

confidence: 90%

Section: Selecting Data Collection Purposesmentioning

confidence: 99%

Section: Personalized Contentmentioning

confidence: 99%

See 3 more Smart Citations

“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes

Kyi,

Mhaidli,

Santos

et al. 2024

Proceedings of the CHI Conference on Human Factors in Computing Systems

View full text Add to dashboard Cite

show abstract

Generic Consents in Digital Ecosystems: Legal, Psychological, and Technical Perspectives

Steffes

Salemi²,

Feth

et al. 2023

Human Factors in Privacy Research

View full text Add to dashboard Cite

Consent is an important authorization basis for the processing of personal data. According to the General Data Protection Regulation (GDPR), consents must be as specific and unambiguous as possible. In practice, however, this leads to users being overwhelmed by the large number of consent requests, which can ultimately be detrimental to freedom of choice. What the overwhelming number of requests for consent can lead to is reflected by the so-called cookie fatigue problem: users have become accustomed to accepting cookies on websites only to get rid of cookie banners as quickly as possible. As cookies do not always lead to the collection of personal data, the cookie fatigue problem cannot be transferred entirely to the problem we would like to address in this chapter. It only serves as an example for the consequences of overloading a data subject with requests for consent. As the GDPR demands that consent be informed and given freely, the current strategy of consent handling cannot be in the spirit of the data protection legislation. In this chapter, we present our vision of how consent can be integrated in the context of digital ecosystems from three perspectives: (1) achieving legal compliance according to data protection law, (2) demonstrating technical feasibility, and (3) assuring user-friendliness by adding cognition to the equation. Our approach aims to enable “generic consents” within a clearly defined scope and context. Although generic consents that serve as a “catch-all” are generally not allowed, we leverage the specific characteristics of digital ecosystems to impose limitations that can justify their use in this particular context. We will also detail the legal implications and present implementation options.

show abstract

What HCI Can Do for (Data Protection) Law—Beyond Design

Jakobi

Grafenstein

2023

Human Factors in Privacy Research

View full text Add to dashboard Cite

Usable Privacy often works at the intersection of regulation to thrive for more usable solutions to normative provisions. The regulatory provisions themselves, or the legal standards of their implementation, however, typically remain unquestioned in the design process. This way, HCI falls short of its potential to inform regulation with insights on human expectations, attitudes, and behavior in the real world, to make law more effective. In this chapter, we present the extensive impulses that are also coming from legal sciences themselves motivating a more substantial collaboration of HCI and legal sciences. We turn to the example of data protection legislation and discuss the legislative intentions surrounding the landmark case of the European General Data Protection Regulation (GDPR). We show how GDPRs’ requirement of “effectiveness” of technical and organizational protection measures opens the door for more in-depth collaboration with HCI and provide examples of high potential for such joint research.

show abstract

“Okay, whatever”: An Evaluation of Cookie Consent Interfaces

Cited by 41 publications

References 12 publications

“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes

“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes

Generic Consents in Digital Ecosystems: Legal, Psychological, and Technical Perspectives

What HCI Can Do for (Data Protection) Law—Beyond Design

Contact Info

Product

Resources

About