Can I Opt Out Yet?: GDPR and the Global Illusion of Cookie Control

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI:10.1145/3321705.3329806

Iskander Sánchez-Rola, Matteo Dell'Amico, Platon Kotzias, D. Balzarotti, Leyla Bilge, Pierre-Antoine Vervier, I. Santos

{"title":"Can I Opt Out Yet?: GDPR and the Global Illusion of Cookie Control","authors":"Iskander Sánchez-Rola, Matteo Dell'Amico, Platon Kotzias, D. Balzarotti, Leyla Bilge, Pierre-Antoine Vervier, I. Santos","doi":"10.1145/3321705.3329806","DOIUrl":null,"url":null,"abstract":"The European Union's (EU) General Data Protection Regulation (GDPR), in effect since May 2018, enforces strict limitations on handling users' personal data, hence impacting their activity tracking on the Web. In this study, we perform an evaluation of the tracking performed in 2,000 high-traffic websites, hosted both inside and outside of the EU. We evaluate both the information presented to users and the actual tracking implemented through cookies; we find that the GDPR has impacted website behavior in a truly global way, both directly and indirectly: USA-based websites behave similarly to EU-based ones, while third-party opt-out services reduce the amount of tracking even for websites which do not put any effort in respecting the new law. On the other hand, we find that tracking remains ubiquitous. In particular, we found cookies that can identify users when visiting more than 90% of the websites in our dataset - and we also encountered a large number of websites that present deceiving information, making it it very difficult, if at all possible, for users to avoid being tracked.","PeriodicalId":189657,"journal":{"name":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","volume":"31 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2019-07-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"140","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1145/3321705.3329806","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 140

Abstract

The European Union's (EU) General Data Protection Regulation (GDPR), in effect since May 2018, enforces strict limitations on handling users' personal data, hence impacting their activity tracking on the Web. In this study, we perform an evaluation of the tracking performed in 2,000 high-traffic websites, hosted both inside and outside of the EU. We evaluate both the information presented to users and the actual tracking implemented through cookies; we find that the GDPR has impacted website behavior in a truly global way, both directly and indirectly: USA-based websites behave similarly to EU-based ones, while third-party opt-out services reduce the amount of tracking even for websites which do not put any effort in respecting the new law. On the other hand, we find that tracking remains ubiquitous. In particular, we found cookies that can identify users when visiting more than 90% of the websites in our dataset - and we also encountered a large number of websites that present deceiving information, making it it very difficult, if at all possible, for users to avoid being tracked.

查看原文本刊更多论文

我可以退出吗?: GDPR和Cookie控制的全球错觉

自2018年5月起生效的欧盟《通用数据保护条例》(GDPR)对处理用户个人数据进行了严格限制，从而影响了他们在网络上的活动跟踪。在本研究中，我们对欧盟内外的2000个高流量网站进行了跟踪评估。我们评估提供给用户的信息和通过cookie实现的实际跟踪;我们发现GDPR以一种真正全球性的方式直接或间接地影响了网站的行为:美国网站的行为与欧盟网站相似，而第三方选择退出服务甚至减少了对那些不努力遵守新法律的网站的跟踪量。另一方面，我们发现跟踪仍然无处不在。特别是，我们发现，当访问我们数据集中超过90%的网站时，cookie可以识别用户——我们还遇到了大量呈现欺骗性信息的网站，这使得用户很难避免被跟踪，如果可能的话。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security

自引率

0.00%

发文量