Navigating Cookie Compliance Around the Globe
June 28, 2022 • 2 min • 301 words •
Information
Authors
Brian Tang, Duc Bui , Kang G. Shin
Conference
To be submitted to PETS
Blog
Intro
Online services increasingly provide users with cookie consent settings to accept/reject the cookies placed on their web browsers. Despite this increased adoption, little has been done to detect and understand the behavior of users’ cookie consent from a global perspective. These cookie consent mechanisms are notoriously inconsistent in their behavior, often violating users’ specified consent. To remedy this important oversight, we propose an end-to-end automated system, called ConsentChk, that detects and analyzes inconsistencies between a website’s cookie usage and users’ cookie consent preferences. ConsentChk uses a formal model to systematically categorize the types of cookie consent violations. ConsentChk detects and analyzes cookie usage and consent preferences even on websites that do not display cookie banners for new visitors. We have conducted large-scale studies in 8 English-speaking regions across the world, and analyzed discrepancies in cookie consent behavior across 1,458 globally-popular websites. We find that location is one of the largest root causes of cookie consent inconsistencies, with regions outside of the GDPR containing up to 26,149 more cookie consent violations than within the GDPR for a set of 1,458 sites. On average, this results in up to 20 additional cookie inconsistencies per website. Our evaluation reveals that specifics details in regulations and consent management platform implementations significantly impact cookie consent behavior. Our work has uncovered various root causes behind these persistent cookie consent inconsistencies, indicating the prevalence of inconsistently implemented and enforced cookie consent with respect to regional privacy laws. The resulting implementations produce misleading, or even deceptive, cookie consent management, highlighting the need to improve consent libraries and privacy law clarity.
Citation
@article{tang2023cookie,
title={Navigating Cookie Compliance Around the Globe},
author={Tang, Brian and Bui, Duc and Shin, Kang G.},
year={2023}
}