Crumbling Cookie Categories: Deconstructing Common Cookie Categories to Create Categories that People Understand

Abstract

Users of online services often encounter cookie banners that ask them to consent to different categories of cookies. Frequently, these categories are labelled using the four categories defined by the 2012 Cookie Guide from the UK's International Chamber of Commerce (ICC). However, prior research suggests that users have difficulty understanding what these category labels actually mean. We conducted a four-part study to identify labels that more intuitively convey the four cookie categories. First, we crowd sourced new category labels. We then evaluated users' comprehension and sentiment towards the labels in a series of surveys focused on definitions and hypothetical scenarios. Finally, we selected a new slate of category labels based on the results of the prior surveys, and conducted a between-subjects, online behavioral experiment to compare the new slate with the original labels. We ultimately recommend that the industry adopt the category label ``anonymous analytics cookies'' in lieu of the term ``performance cookies'' and ``extra functionality cookies'' instead of ``functional cookies.'' Adopting our recommended terms would both improve the usability of current cookie consent interfaces and any future privacy consent mechanisms that use the same categorization. We also recommend revisiting the categories themselves as the distinctions between these categories do not seem to be well understood and may not reflect useful distinctions for privacy decision making.