Privacy Preference Signals: Past, Present and Future

Abstract

Privacy preference signals are digital representations of how users want their personal data to be processed. Such signals must be adopted by both the sender (users) and intended recipients (data processors). Adoption represents a coordination problem that remains unsolved despite efforts dating back to the 1990s. Browsers implemented standards like the Platform for Privacy Preferences (P3P) and Do Not Track (DNT), but vendors profiting from personal data faced few incentives to receive and respect the expressed wishes of data subjects. In the wake of recent privacy laws, a coalition of AdTech firms published the Transparency and Consent Framework (TCF), which defines an optin consent signal. This paper integrates post-GDPR developments into the wider history of privacy preference signals. Our main contribution is a high-frequency longitudinal study describing how TCF signal gained dominance as of February 2021. We explore which factors correlate with adoption at the website level. Both the number of third parties on a website and the presence of Google Ads are associated with higher adoption of TCF. Further, we show that vendors acted as early adopters of TCF 2.0 and provide two case-studies describing how Consent Management Providers shifted existing customers to TCF 2.0. We sketch ways forward for a pro-privacy signal.

Data Protection and Consenting Communication Mechanisms: Current Open Proposals and Challenges

“…This factor considers if there are known loopholes in the interpretation of the signal -that we define as any condition or event preventing the correct interpretation of a signal's values. An example is that none of the signals specify how conflicts with other values or signals should be addressed [14]. GPC and ADPC do not clarify how to interpret which signal takes precedence when conflicting interpretations are possible through differences between the signal's communication and the user's actions (e.g.…”

“…This represents the specific activity or action the signal aims to change or regulate. 14 Most of the existing signals relate to tracking, surveillance, and permission to share data in some way. GPC is meant to prohibit "selling" (as defined by CCPA) or sharing of personal data with "any party other than the one the person intends to interact with".…”

“…They vary in their approach and ambition, and range from simple binary signals such as the "Do Not Track" 3 (DNT) and the more recent "Global Privacy Control" 4 (GPC) [11], to more expressive mechanisms such as the Platform for Privacy Preferences Project (P3P) 5 , the "Advanced Data Protection Control" 6 (ADPC) [12], [13], and industrycontrolled efforts such as the IAB Europe Transparency and Consent Framework 7 (TCF v2). Earlier attempts, such as DNT and P3P, faced strong multidimensional barriers to their adoption and a lack of legal enforcement, which led them to rapidly become obsolete [14]. However, DPCCMs have seen a resurgence in recent times (i.e., GPC, ADPC, TCF), owing to multiple factors: advancements in data protection and privacy legislation, in particular the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA); and proactive measures taken by large platforms such as Apple's App Tracking Transparency (ATT) 8 .…”

COnSeNT 2022: 2nd International Workshop on Consent Management in Online Services, Networks and Things

“…The key strategy is to display a prominent consent request that asks for user action in an unambiguous (e.g., by clicking a button) and, in principle, halts data collection until the user's notification. The second approach, which is sponsored by CCPAs, is to use simple notifications, or "signals" such as the Global Privacy Control (GPC), sent directly from the user agent (often a browser) and, commonly, which can be asynchronously to a notice (see a comprehensive overview on consent signals in [31]). The third approach is to rely on an authenticated user artefact, such as a Consent Receipt [1], that enables management of the consent lifecycle thus removing the focus from the point of collection and bringing to the front accountability and transparency.…”

How could the upcoming ePrivacy Regulation recognise enforceable privacy signals in the EU?

“…Of the current efforts, IAB's TCF signal [3][16] is adopted by hundreds of ad-tech vendors and thousands of websites in the EU, despite its lawfulness being questioned by the Belgian Data Protection Authority [25]. GPC, active within USA, has been adopted by web browsers (e.g., Firefox, DuckDuckGo, Brave), consent management platforms, and service providers (e.g., The Washington Post), and includes applications for GDPR to "restrict third-party data sharing" [7].…”