Privacy regulations such as the GDPR and the revised ePrivacy Directive of the European Union require websites to inform EU-based users about the collection of their data and to request their consent to use tracking technologies such as non-essential cookies (Art. 6(1)(e), 13 GDPR, Art. 5(3) revised e-Privacy Directive). The GDPR and e-Privacy Directive establish an opt-in regime when a collection of personal data in most cases is only possible with explicit ex-ante consent of the user. This has led to the global adoption of cookie notices, which are now unavoidable in EU users’ daily browsing activities. Yet, many websites violate these regulations, as several studies showed in the past. Alarming high levels of non-compliance have been observed, suggesting that consent notices are failing users. Website owners frequently rely on independent contractors, known as Consent Management Platforms (CMPs), who offer consent banners (’pop-ups’) as a service, to help websites comply with privacy laws and incorporate consent gathering into their website interface. While they hold a promise to facilitate the technical and legal knowledge required, recent qualitative studies, suggest they may be nudging websites into non-compliance, operating at the nexus point for spreading flawed practices and dark patterns. In this work, we study the role of CMPs in facilitating adherence to privacy laws using a large-scale quantitative approach. Specifically, we aim to investigate the effects of competition (or the lack of it) among CMPs on their incentives to comply with the laws. The existing appetite for violations can be a result of destructive market competition between CMP providers or a form of abuse of dominance by leading players. Using a free service model, CMPs might exploit the fact that website owners may not realize that the service offered by the free CMP is not actually ensuring compliance with privacy laws. But in fact, CMPs ensure the monetization of personal data, as they nudge both users and websites to consent to more personal data flows as part of their business model. In addition, the CMPs unique legal position as ’data processors’ (not controllers) could provide incentives for the CMPs under the illusion of low legal obligations, to act aggressively compared to the website owner.
To explore the role of CMPs we developed a large-scale automated analysis of cookie notices that is able to interact with cookie notices, e.g., by navigating beyond the first layer settings. Our methods automatically navigate through cookie notices, observe declared data processing purposes and available consent options for users using natural language processing and machine learning, and compare the cookies websites actually use with those they declared in the notice. In contrast to previous studies, our methods are general enough to study almost any website, allowing us to sample the online environment without causing significant selection biases. We test our methods and report on a variety of potential violations on a set of 35k websites popular for EU residents in an aggregated form. We find that 67.5% of websites, offering a reject option, likely collect users’ data despite explicit negative consent. Similarly, websites use tracking cookies before users even interact with the cookie notice on 75.3%. We discuss several mechanisms of compliance and the policy implications of our fundings.
Amit Zac is a Postdoctoral Researcher at ETH Zurich and recently joined the Amsterdam Law School. Before joining ETH, Amit was a PhD student and a teaching assistant in Competition Law and Empirical Research Methods at The University of Oxford, Law Faculty. He obtained his LL.M. from Erasmus University Rotterdam and the University of Hamburg in Law and Economics with distinction. Amit also holds a Bachelor of Laws with Magna Cum Laude from the Hebrew University of Jerusalem in Israel. Before joining academia, Amit worked as a legal clerk in the Israeli Supreme Court, as a legal consultant at the Israeli Competition Authority (advising on the adaption of new regulatory tools in markets of food and household consumption), and as an antitrust lawyer in Tel-Aviv.
Mail to: t.t.butter@uva.nl