Skip to Main content Skip to Navigation
Conference papers

Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework

Célestin Matte 1 Nataliia Bielova 2, 1 Cristiana Santos 3
2 PRIVATICS - Privacy Models, Architectures and Tools for the Information Society
Inria Grenoble - Rhône-Alpes, CITI - CITI Centre of Innovation in Telecommunications and Integration of services
Abstract : As a result of the GDPR and the ePrivacy Directive, European users encounter cookie banners on almost every website. Many of such banners are implemented by Consent Management Providers (CMPs), who respect IAB Europe's Transparency and Consent Framework (TCF). Via cookie banners, CMPs collect and disseminate user consent to third parties. In this work, we systematically study IAB Europe's TCF and analyze consent stored behind the user interface of TCF cookie banners. We analyze the GDPR and the ePrivacy Directive to identify potential legal violations in implementations of cookie banners based on the storage of consent and detect such suspected violations by crawling 1 426 websites that contains TCF banners, found among 28 257 crawled European websites. With two automatic and semi-automatic crawl campaigns, we detect suspected violations, and we find that: 141 websites register positive consent even if the user has not made their choice; 236 websites nudge the users towards accepting consent by pre-selecting options; and 27 websites store a positive consent even if the user has explicitly opted out. Performing extensive tests on 560 websites, we find at least one suspected violation in 54% of them. Finally, we provide a browser extension to facilitate manual detection of suspected violations for regular users and Data Protection Authorities.
Document type :
Conference papers
Complete list of metadata

https://hal.inria.fr/hal-03117294
Contributor : Nataliia Bielova Connect in order to contact the contributor
Submitted on : Thursday, January 21, 2021 - 9:41:33 AM
Last modification on : Friday, December 10, 2021 - 1:16:03 PM
Long-term archiving on: : Thursday, April 22, 2021 - 6:18:09 PM

File

Matt-etal-20-SP.pdf
Files produced by the author(s)

Identifiers

Citation

Célestin Matte, Nataliia Bielova, Cristiana Santos. Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework. SP 2020 - IEEE Symposium on Security and Privacy, May 2020, San Francisco, United States. pp.791-809, ⟨10.1109/SP40000.2020.00076⟩. ⟨hal-03117294⟩

Share

Metrics

Les métriques sont temporairement indisponibles