The Internet with Privacy Policies: Measuring The Web Upon Consent

TL;DR

This study introduces Priv-Accept, a web crawler that accepts privacy policies to accurately measure the impact of consent banners on web tracking and performance, revealing significant increases in trackers and load times after user consent.

Contribution

We developed Priv-Accept, a novel crawler that interacts with privacy banners, enabling more accurate measurement of web tracking and performance post-consent, addressing biases in previous measurements.

Findings

Acceptance of privacy policies increases trackers by up to 70.

Webpage load times slow down by 2x-3x after consent.

Measurements ignoring privacy banners provide biased views of the web.

Abstract

To protect users' privacy, legislators have regulated the usage of tracking technologies, mandating the acquisition of users' consent before collecting data. Consequently, websites started showing more and more consent management modules -- i.e., Privacy Banners -- the visitors have to interact with to access the website content. They challenge the automatic collection of Web measurements, primarily to monitor the extensiveness of tracking technologies but also to measure Web performance in the wild. Privacy Banners in fact limit crawlers from observing the actual website content. In this paper, we present a thorough measurement campaign focusing on popular websites in Europe and the US, visiting both landing and internal pages from different countries around the world. We engineer Priv-Accept, a Web crawler able to accept the privacy policies, as most users would do in practice. This let us compare how webpages change before and after. Our results show that all measurements performed not dealing with the Privacy Banners offer a very biased and partial view of the Web. After accepting the privacy policies, we observe an increase of up to 70 trackers, which in turn slows down the webpage load time by a factor of 2x-3x.