short-paper

Open access

Your Consent Is Worth 75 Euros A Year - Measurement and Lawfulness of Cookie Paywalls

Authors:

Cristiana Santos,

Soheil HumanAuthors Info & Claims

WPES'22: Proceedings of the 21st Workshop on Privacy in the Electronic Society

Pages 213 - 218

https://doi.org/10.1145/3559613.3563205

Published: 07 November 2022 Publication History

Abstract

Most websites offer their content for free, though this gratuity often comes with a counterpart: personal data is collected to finance these websites by resorting, mostly, to tracking and thus targeted advertising. Cookie walls and paywalls, used to retrieve consent, recently generated interest from EU DPAs and seemed to have grown in popularity. However, they have been overlooked by scholars. We present in this paper 1) the results of an exploratory study conducted on 2800 Central European websites to measure the presence and practices of cookie paywalls, and 2) a framing of their lawfulness amidst the variety of legal decisions and guidelines.

References

[1]

Austrian DPA. 2018. Austrian DPA decision regarding the cookiewall of the Austrian newspaper "Der Standard".

[2]

Belgian DPA. 2020. Guidance Materials and FAQs on Cookies and Other Tracking Technologies.

[3]

BEUC. 2017. BEUC Position Paper, ?Proposal For A Regulation On Privacy And Electronic Communications (E-Privacy).

[4]

Ida Borberg, René Hougaard, Willard Rafnsson, and Oksana Kulyk. 2022. "So I Sold My Soul": Effects of Dark Patterns in Cookie Notices on End-User Behavior and Perceptions.

[5]

Andrea Carson. 2015. Behind the newspaper paywall -- lessons in charging for online content: a comparative analysis of why Australian newspapers are stuck in the purgatorial space between digital and print. Media, Culture & Society 37, 7 (Oct. 2015), 1022--1041. https://doi.org/10.1177/0163443715591669

[6]

CNIL. 22. Cookie walls : la CNIL publie des premiers critères d'évaluation.

[7]

Danish DPA. 2020. Guidance on the management of personal data about website visitors.

[8]

Datenschütz-behörde. 2022. FAQ zum Thema Cookies und Datenschutz.

[9]

Dutch DPA. 2019. Cookie walls.

[10]

EDPB. 2018. Statement of the EDPB on the revision of the ePrivacy Regulation and its impact on the protection of individuals with regard to the privacy and confidentiality of their communications.

[11]

EDPB. 2020. Guidelines 05/2020 on Consent under Regulation 2016/679.

[12]

EDPS. 2016. Guidelines on the protection of personal data processed through web services provided by EU institutions.

[13]

EDPS. 2017. EDPS Opinion 6/2017 on the Proposal for a Regulation on Privacy and Electronic Communications (ePrivacy Regulation).

[14]

European Data Protection Board. 2022. Statement on enforcement cooperation.

[15]

European Parliament. 2002. DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications).

[16]

European Parliament. 2016. General Data Protection Regulation.

[17]

European Parliament. 2021. Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications), Latest version of the Council.

[18]

Richard Fletcher and Rasmus Kleis Nielsen. 2017. Paying for Online News: A comparative analysis of six countries. Digital Journalism 5, 9 (Oct. 2017), 1173--1191. https://doi.org/10.1080/21670811.2016.1246373

[19]

Imane Fouad, Cristiana Santos, Feras Al Kassar, Nataliia Bielova, and Stefano Calzavara. 2020. On Compliance of Cookie Purposes with the Purpose Specification Principle. In 2020 International Workshop on Privacy Engineering, IWPE.

[20]

German DPA. 2019. Guidelines for Telemedia Providers.

[21]

Soheil Human and Florian Cech. 2021. A Human-Centric Perspective on Digital Consenting: The Case of GAFAM. In Human Centred Intelligent Systems (Smart Innovation, Systems and Technologies), Alfred Zimmermann, Robert J. Howlett, and Lakhmi C. Jain (Eds.). Springer, Singapore, 139--159.

[22]

Italian DPA. 2021. Guidelines on the use of cookies and other tracking tools.

[23]

F. J Zuiderveen Borgesius, S. Kruikemeier, S. C Boerman, and N. Helberger. 2017. Tracking Walls, Take-It-Or-Leave-It Choices, the GDPR, and the ePrivacy Regulation. European Data Protection Law Review 3, 3 (2017), 353--368. https://doi.org/10.21552/edpl/2017/3/9

[24]

Peter Jordan. 2005. Großgliederung Europas nach kulturräumlichen Kriterien. Europa Regional 4, 13 (2005), 162--173.

[25]

Oksana Kulyk, Nina Gerber, Annika Hilt, and Melanie Volkamer. 2020. Has the GDPR hype affected users' reaction to cookie disclaimers? Journal of Cybersecurity 6, 1 (12 2020). https://doi.org/10.1093/cybsec/tyaa022

[26]

Pierre Laperdrix, Nataliia Bielova, Benoit Baudry, and Gildas Avoine. 2020. Browser Fingerprinting: A Survey. ACM Transactions on the Web 14, 2 (April 2020), 1--33. https://doi.org/10.1145/3386040

Digital Library

[27]

Célestin Matte, Nataliia Bielova, and Cristiana Santos. 2019. Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework. arXiv:1911.09964 [cs] (Nov. 2019).

[28]

Merja Myllylahti. 2017. What Content is Worth Locking Behind a Paywall?: Digital news commodification in leading Australasian financial newspapers. Digital Journalism 5, 4 (April 2017), 460--471. https://doi.org/10.1080/21670811.2016.1178074

[29]

NOYB. 2021. News Sites: Readers need to "buy back" their own data at an exorbitant price?!

[30]

Panagiotis Papadopoulos, Peter Snyder, Dimitrios Athanasakis, and Benjamin Livshits. 2020. Another Brick in the Paywall: The Popularity and Privacy Implications of Paywalls. arXiv:1903.01406 [cs] (May 2020). http://arxiv.org/abs/1903.01406

[31]

Panagiotis Papadopoulos, Peter Snyder, Dimitrios Athanasakis, and Benjamin Livshits. 2020. Keeping out the Masses: Understanding the Popularity and Implications of Internet Paywalls. http://arxiv.org/abs/1903.01406

[32]

Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczy'ski, and Wouter Joosen. 2019. Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. In Proceedings 2019 Network and Distributed System Security Symposium. https://doi.org/10.14722/ndss.2019.23386

[33]

Cristiana Santos, Nataliia Bielova, and Célestin Matte. 2020. Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners. Technology and Regulation (2020), 91--135. https://doi.org/10.26116/techreg.2020.009

[34]

Felix M Simon and Lucas Graves. 2019. Pay Models for Online News in the US and Europe: 2019 Update. (2019), 16.

[35]

Spanish DPA. 2022. Guía sobre el uso de las cookies.

[36]

UK DPA. 2019. Guidance on the rules on use of cookies and similar technologies.

[37]

VeraWesselkamp, Imane Fouad, Cristiana Santos, Yanis Boussad, Nataliia Bielova, and Arnaud Legout. 2021. In-Depth Technical and Legal Analysis of Tracking on Health Related Websites with ERNIE Extension. In WPES 2021 - 20th Workshop on Privacy in the Electronic Society. Seoul, South Korea. https://doi.org/10.1145/3463676.3485603

Digital Library

[38]

WP29. 2011. Opinion 15/2011 on the definition of consent.

[39]

WP29. 2012. Opinion 04/2012 on Cookie Consent Exemption (WP 194).

[40]

WP29. 2013. Opinion 03/2013 on Purpose Limitation (WP203).

[41]

WP29. 2013. Working Document 02/2013 providing guidance on obtaining consent for cookies.

[42]

WP29. 2017. Guidelines on Consent under Regulation 2016/679.

[43]

Frederik Zuiderveen Borgesius, Joris van Hoboken, Ronan P Fahy, Kristina Irion, and Max Rozendaal. 2017. An Assessment of the Commission's Proposal on Privacy and Electronic Communications. Directorate-General for Internal Policies, Policy Department C: Citizen's Rights and Constitutional Affairs (2017).

Cited By

Naithani P(2024)Standardised cookie banner: a solution to the cookie consent problemInternational Review of Law, Computers & Technology10.1080/13600869.2024.2364995(1-18)Online publication date: 12-Jun-2024
https://doi.org/10.1080/13600869.2024.2364995
Park HOh HChoi J(2023)A Profit Maximization Model for Data Consumers with Data Providers’ Incentives in Personal Data Trading MarketData10.3390/data90100069:1(6)Online publication date: 25-Dec-2023
https://doi.org/10.3390/data9010006

Index Terms

Your Consent Is Worth 75 Euros A Year - Measurement and Lawfulness of Cookie Paywalls
1. Information systems
  1. World Wide Web
    1. Online advertising
2. Security and privacy
  1. Human and societal aspects of security and privacy
    1. Economics of security and privacy

Recommendations

Legitimate Interest is the New Consent - Large-Scale Measurement and Legal Compliance of IAB Europe TCF Paywalls
WPES '23: Proceedings of the 22nd Workshop on Privacy in the Electronic Society

Cookie paywalls allow visitors of a website to access its content only after they make a choice between paying a fee or accept tracking. European Data Protection Authorities (DPAs) recently issued guidelines and decisions on paywalls lawfulness, but it ...
Dark Patterns and the Legal Requirements of Consent Banners: An Interaction Criticism Perspective
CHI '21: Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems

User engagement with data privacy and security through consent banners has become a ubiquitous part of interacting with internet services. While previous work has addressed consent banners from either interaction design, legal, and ethics-focused ...
Cookie Banners, What's the Purpose?: Analyzing Cookie Banner Text Through a Legal Lens
WPES '21: Proceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society

A cookie banner pops up when a user visits a website for the first time, requesting consent to the use of cookies and other trackers for a variety of purposes. Unlike prior work that has focused on evaluating the user interface (UI) design of cookie ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

WPES'22: Proceedings of the 21st Workshop on Privacy in the Electronic Society

November 2022

227 pages

ISBN:9781450398732

DOI:10.1145/3559613

Program Chairs:
Yuan Hong
University of Connecticut, USA
,
Lingyu Wang
Concordia University, Canada

Copyright © 2022 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 07 November 2022

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Short-paper

Funding Sources

RENFORCE
Internet Foundation Austria (IPA)

Conference

CCS '22

Sponsor:

SIGSAC

CCS '22: 2022 ACM SIGSAC Conference on Computer and Communications Security

November 7, 2022

CA, Los Angeles, USA

Acceptance Rates

Overall Acceptance Rate 106 of 355 submissions, 30%

Upcoming Conference

CCS '24

Sponsor:
sigsac

ACM SIGSAC Conference on Computer and Communications Security

October 14 - 18, 2024

Salt Lake City , UT , USA

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

2
Total Citations
View Citations
814
Total Downloads

Downloads (Last 12 months)502
Downloads (Last 6 weeks)35

Reflects downloads up to 13 Sep 2024

Other Metrics

View Author Metrics

Citations

Cited By

Naithani P(2024)Standardised cookie banner: a solution to the cookie consent problemInternational Review of Law, Computers & Technology10.1080/13600869.2024.2364995(1-18)Online publication date: 12-Jun-2024
https://doi.org/10.1080/13600869.2024.2364995
Park HOh HChoi J(2023)A Profit Maximization Model for Data Consumers with Data Providers’ Incentives in Personal Data Trading MarketData10.3390/data90100069:1(6)Online publication date: 25-Dec-2023
https://doi.org/10.3390/data9010006

View Options

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

Media

Figures

Other

Tables

View Table of Contents