Characterising Third Party Cookie Usage in the EU after GDPR

Hu, Xuehui; Sastry, Nishanth

doi:10.1145/3292522.3326039

Cited by 31 publications

(17 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We add to a growing empirical literature on technical and commercial implications of the GDPR, and relate to theoretical work on its implications for competition policy. This literature spans across disciplines, including industry reports (WhotracksMe, 2018), and academic work in computer science and communication (Dabrowski et al, 2019;Solomos et al, 2019;Hu and Sastry, 2019;Degeling et al, 2018;Libert et al, 2018;Sørensen and Kosta, 2019;Urban et al, 2020), marketing (Johnson and Shriver, 2020;Goldberg et al, 2019;Goddard, 2017), information systems and economics (Godinho de Matos and Adjerid, 2020;Zhuo et al, 2019;Sharma et al, 2019;Lefrere et al, 2019;Jia et al, 2019b,a;Aridor et al, 2020), and law (Gal and Aviv, forthcoming;Geradin et al, 2020).…”

Section: Introductionmentioning

confidence: 99%

European Privacy Law and Global Markets for Data

Peukert

Bechtold²,

Batikas

et al. 2021

Proceedings

View full text Add to dashboard Cite

We demonstrate how privacy law interacts with competition and trade policy in the context of the European General Data Protection Regulation (GDPR). We follow more than 110,000 websites for 18 months to show that websites reduced their connections to web technology providers after the GDPR became effective, especially regarding requests involving personal data. This also holds for websites catering to non-EU audiences and therefore not bound by the GDPR. We further document an increase in market concentration in web technology services after the introduction of the GDPR. While most firms lose market share, the leading firm, Google, significantly increases market share.

show abstract

Section: Introductionmentioning

confidence: 99%

European Privacy Law and Global Markets for Data

Peukert

Bechtold²,

Batikas

et al. 2021

Proceedings

View full text Add to dashboard Cite

show abstract

“…A simple Web crawler visiting the websites without accepting the privacy policies would offer a biased picture, with no trackers and no ads being loaded. Hu et al [35] already found that the number of third-parties dropped by more than 10% after GDPR when visiting websites automatically. Conversely, when using a dataset from 15 real users, they measure no significant reduction in long-term numbers of third-party cookies.…”

Section: The Effect Of Privacy Banners On Web Measurementsmentioning

confidence: 99%

“…Interestingly, many websites correctly implement the regulations, and they activate trackers and personalized ads only after consent is collected. This makes the illusion that tracking is decreasing with respect to the past [35]. However, the number of trackers websites embed substantially increases upon acceptance of the privacy policy, in some cases up to 70.…”

mentioning

confidence: 99%

The Internet with Privacy Policies: Measuring The Web Upon Consent

Jha¹,

Trevisan²,

Vassio³

et al. 2021

Preprint

View full text Add to dashboard Cite

To protect users' privacy, legislators have regulated the usage of tracking technologies, mandating the acquisition of users' consent before collecting data. Consequently, websites started showing more and more consent management modules -i.e., Privacy Banners -the visitors have to interact with to access the website content. They challenge the automatic collection of Web measurements, primarily to monitor the extensiveness of tracking technologies but also to measure Web performance in the wild. Privacy Banners in fact limit crawlers from observing the actual website content.In this paper, we present a thorough measurement campaign focusing on popular websites in Europe and the US, visiting both landing and internal pages from different countries around the world. We engineer Priv-Accept, a Web crawler able to accept the privacy policies, as most users would do in practice. This let us compare how webpages change before and after. Our results show that all measurements performed not dealing with the Privacy Banners offer a very biased and partial view of the Web. After accepting the privacy policies, we observe an increase of up to 70 trackers, which in turn slows down the webpage load time by a factor of 2x-3x.

show abstract

“…Researchers using the GDPR as a standard to assess compliance to the law have found that while there was some observed reduction on the amount of tracking since the law went into effect, this did not translate generally [27]. In fact, while websites gave users a glanceable means of determining compliance to GDPR via "levelled choices" on their tracked activities [14], the websites tracked the users anyways-before, and even after the user has stated their preferences against being tracked. This direct contravention of both the letter and the spirit of the GDPR laws was observed to be especially prevalent in news sites whose revenues are primarily based on advertising [8].…”

Section: 2mentioning

confidence: 99%

The TL;DR Charter: Speculatively Demystifying Privacy Policy Documents and Terms Agreements

Kotut

McCrickard

2022

Proc. ACM Hum.-Comput. Interact.

View full text Add to dashboard Cite

Privacy policy and term agreement documents are considered the gateway for software adoption and use. The documents provide a means for the provider to outline expectations of the software use, and also provide an often-separate document outlining how user data is collected, stored, and used--including if it is shared with other parties. A user agreeing with the terms, assumes that they have a full understanding the terms of the agreement and have provided consent. Often however, users do not read the documents because they are long and full of legalistic and inconsistent language, are regularly amended, and may not disclose all the details on what is done to the user data. Enforcing compliance and ensuring user consent have been persistent challenges to policy makers and privacy researchers. This design fiction puts forward an alternate reality and presents a policy-based approach to fording the consent gap with the TL;DR Charter: an agreement governing the parties involved by harnessing the power of formal governments, industry, and other stakeholders, and taking users expectation of privacy into account. The Charter allows us as researchers to examine the implications on trust, decision-making, consent, accountability and the impact of future technologies.

show abstract

Characterising Third Party Cookie Usage in the EU after GDPR

Cited by 31 publications

References 8 publications

European Privacy Law and Global Markets for Data

European Privacy Law and Global Markets for Data

The Internet with Privacy Policies: Measuring The Web Upon Consent

The TL;DR Charter: Speculatively Demystifying Privacy Policy Documents and Terms Agreements

Contact Info

Product

Resources

About