Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies
Ali Rasaii, Ha Dao, Anja Feldmann, Mohammadmahdi Javid, Oliver Gasser, Devashish Gosain

TL;DR
This study uncovers a persistent tracking mechanism exploiting web cookies that bypass user consent, revealing that about half of top websites set intractable cookies, with privacy signals reducing this behavior by around 30%.
Contribution
The paper identifies and measures a covert, persistent cookie-based tracking method that circumvents consent, providing extensive empirical data on its prevalence and mitigation strategies.
Findings
Approximately 50% of websites send intractable cookies.
Global Privacy Control reduces intractable cookies by 30%.
Websites with CMP banners send 6.9 times more intractable cookies.
Abstract
In response to the ePrivacy Directive and the consent requirements introduced by the GDPR, websites began deploying consent banners to obtain user permission for data collection and processing. However, due to shared third-party services and technical loopholes, non-consensual cross-site tracking can still occur. In fact, contrary to user expectations of seemingly isolated consent, a user's decision on one website may affect tracking behavior on others. In this study, we investigate the technical and behavioral mechanisms behind these discrepancies. Specifically, we disclose a persistent tracking mechanism exploiting web cookies. These cookies, which we refer to as intractable, are initially set on websites with accepted banners, persist in the browser, and are subsequently sent to trackers before the user provides explicit consent on other websites. To meticulously analyze this covert…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
