Measuring Compliance of Consent Revocation on the Web

TL;DR

This study evaluates how well top websites comply with GDPR requirements for consent revocation, revealing significant issues in interface usability, data deletion, and communication with third parties, highlighting the need for improved compliance.

Contribution

First comprehensive measurement of consent revocation compliance on the Web, identifying key deficiencies and legal violations in current implementations.

Findings

19.87% of websites make revocation difficult

20.5% require more effort to revoke than to accept

2.48% do not provide revocation options at all

Abstract

The GDPR requires websites to facilitate the right to revoke consent from Web users. While numerous studies measured compliance of consent with the various consent requirements, no prior work has studied consent revocation on the Web. Therefore, it remains unclear how difficult it is to revoke consent on the websites' interfaces, nor whether revoked consent is properly stored and communicated behind the user interface. Our work aims to fill this gap by measuring compliance of consent revocation on the Web on the top-200 websites. We found that 19.87% of websites make it difficult for users to revoke consent throughout different interfaces, 20.5% of websites require more effort than acceptance, and 2.48% do not provide consent revocation at all, thus violating legal requirements for valid consent. 57.5% websites do not delete the cookies after consent revocation enabling continuous illegal processing of users' data. Moreover, we analyzed 281 websites implementing the IAB Europe TCF, and found 22 websites that store a positive consent despite user's revocation. Surprisingly, we found that on 101 websites, third parties that have received consent upon user's acceptance, are not informed of user's revocation, leading to the illegal processing of users' data by such third parties. Our findings emphasise the need for improved legal compliance of consent revocation, and proper, consistent, and uniform implementation of revocation communication and data deletion practices.