Navigating Cookie Consent Violations Across the Globe

TL;DR

This paper introduces ConsentChk, an end-to-end system for detecting cookie consent violations across the globe, revealing regional differences and misconfigurations in cookie banner implementations affecting user privacy.

Contribution

The paper presents a formal model and system for systematically detecting and analyzing cookie consent violations on a large scale across multiple regions.

Findings

Cookie consent violations are prevalent and region-dependent.

Many cookie banners are misleading or incorrectly configured.

Regional privacy laws influence cookie banner behavior.

Abstract

Online services provide users with cookie banners to accept/reject the cookies placed on their web browsers. Despite the increased adoption of cookie banners, little has been done to ensure that cookie consent is compliant with privacy laws around the globe. Prior studies have found that cookies are often placed on browsers even after their explicit rejection by users. These inconsistencies in cookie banner behavior circumvent users' consent preferences and are known as cookie consent violations. To address this important problem, we propose an end-to-end system, called ConsentChk, that detects and analyzes cookie banner behavior. ConsentChk uses a formal model to systematically detect and categorize cookie consent violations. We investigate eight English-speaking regions across the world, and analyze cookie banner behavior across 1,793 globally-popular websites. Cookie behavior, cookie consent violation rates, and cookie banner implementations are found to be highly dependent on region. Our evaluation reveals that consent management platforms (CMPs) and website developers likely tailor cookie banner configurations based on their (often incorrect) interpretations of regional privacy laws. We discuss various root causes behind these cookie consent violations. The resulting implementations produce misleading cookie banners, indicating the prevalence of inconsistently implemented and enforced cookie consent between various regions.