In-Depth Technical and Legal Analysis of Tracking on Health Related Websites with ERNIE Extension

Wesselkamp, Vera; Fouad, Imane; Santos, Cristiana; Boussad, Yanis; Bielova, Nataliia; Legout, Arnaud

doi:10.1145/3463676.3485603

Cited by 8 publications

(4 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We have also enabled all third-party cookies and disabled the "Enhanced Tracking Protection" of Firefox to avoid interference with our experiments. We install the extension Ernie [38] on this browser, that is able to detect 6 categories of cross-site tracking via cookies, including several types of cookie synchronizations. This extension, that implements cookie-based tracking detection proposed by Fouad et al [39], enables us to detect and flag cookies according to their behaviour.…”

Section: Liverampmentioning

confidence: 99%

“…To detect tracking cookies and other suspicious behaviors, we rely on the Firefox web developer tools as well as Ernie extension [38], and visit the subdomain cmp-name-version.inrialpes.fr, one per each CMP service. We record all HTTP(S) requests and responses, cookies stored/sent that give indications of possible data collection.…”

Section: Monitoring and Analysis Of The Network Communicationsmentioning

confidence: 99%

“…We first tested the Quantcast Choice service in January 2021: this service loads the choice.js script that further sends a request to pixel.quantserve.com to fetch a 1x1 gif image. Upon loading this image, pixel.quantserve.com sets a third-party cookie named mc with a random value, that is different across our session and private Firefox container, indicating that such cookie is user-specific (see the details of detection of such cookies in the description of Ernie extension we used for these experiments [38]). This cookie have an expiry time of one year.…”

Section: Cmp Abusing Its Position To Collect Data For Its Own Usementioning

confidence: 99%

See 2 more Smart Citations

On dark patterns and manipulation of website publishers by CMPs

Toth

Bielova²,

Roca

2022

PoPETs

Self Cite

View full text Add to dashboard Cite

Web technologies and services widely rely on data collection via tracking users on websites. In the EU, the collection of such data requires user consent thanks to the ePrivacy Directive (ePD), and the General Data Protection Regulation (GDPR). To comply with these regulations and integrate consent collection into their websites, website publishers often rely on third-party contractors, called Consent Management Providers (CMPs), that provide consent pop-ups as a service. Since the GDPR came in force in May 2018, the presence of CMPs continuously increased. In our work, we systematically study the installation and configuration process of consent pop-ups and their potential effects on the decision making of the website publishers. We make an in-depth analysis of the configuration process from ten services provided by five popular CMP companies and identify common unethical design choices employed. By analysing CMP services on an empty experimental website, we identify manipulation of website publishers towards subscription to the CMPs paid plans and then determine that default consent pop-ups often violate the law. We also show that configuration options may lead to non-compliance, while tracking scanners offered by CMPs manipulate publishers. Our findings demonstrate the importance of CMPs and design space offered to website publishers, and we raise concerns around the privileged position of CMPs and their strategies influencing website publishers.

show abstract

Section: Liverampmentioning

confidence: 99%

Section: Monitoring and Analysis Of The Network Communicationsmentioning

confidence: 99%

Section: Cmp Abusing Its Position To Collect Data For Its Own Usementioning

confidence: 99%

See 1 more Smart Citation

On dark patterns and manipulation of website publishers by CMPs

Toth

Bielova²,

Roca

2022

PoPETs

Self Cite

View full text Add to dashboard Cite

show abstract

“…Regarding the materiality of certain consent related infringements damages, though concrete dark pattern practices need to be evaluated in a case by case basis, it has been established that when consent requests present unlawfully preselected options for processing personal data purposes, or when the user interface design offers the option "accept all" purposes at the very first layer of the banner, consequently, the personal data (or very sensitive categories of data) of the user will be shared by default with all the potential third-party advertisers that the website operates with [123,137]. Regarding severity, dark patterns literature noted in section 2.1.2 identifies several harms in consent related studies.…”

Section: Current State Of Consent Damage Claimsmentioning

confidence: 99%

Redress for Dark Patterns Privacy Harms? A Case Study on Consent Interactions

Gunawan

Santos

Kamara

2022

Proceedings of the 2022 Symposium on Computer Science and Law

Self Cite

View full text Add to dashboard Cite

General rightsCopyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights.• Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal Take down policyIf you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.

show abstract