Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web

TL;DR

This paper presents the first automated analysis of cookiewalls, revealing their prevalence, deployment patterns, and impact on user tracking, along with tools and data for future research.

Contribution

It introduces an automated method to identify cookiewalls, quantifies their occurrence and tracking implications, and uncovers subscription platforms facilitating their deployment.

Findings

Cookiewalls appear on 0.6% of 45k websites.

European websites, especially Germany, have higher cookiewall deployment.

Websites with cookiewalls send significantly more tracking cookies.

Abstract

Privacy regulations have led to many websites showing cookie banners to their users. Usually, cookie banners present the user with the option to "accept" or "reject" cookies. Recently, a new form of paywall-like cookie banner has taken hold on the Web, giving users the option to either accept cookies (and consequently user tracking) or buy a paid subscription for a tracking-free website experience. In this paper, we perform the first completely automated analysis of cookiewalls, i.e., cookie banners acting as a paywall. We find cookiewalls on 0.6% of all queried 45k websites. Moreover, cookiewalls are deployed to a large degree on European websites, e.g., for Germany we see cookiewalls on 8.5% of top 1k websites. Additionally, websites using cookiewalls send 6.4 times more third-party cookies and 42 times more tracking cookies to visitors, compared to regular cookie banner websites. We also uncover two large Subscription Management Platforms used on hundreds of websites, which provide website operators with easy-to-setup cookiewall solutions. Finally, we publish tools, data, and code to foster reproducibility and further studies.