PaperlayerView exact revision on arXiv

Source-linked AI summary

Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework

Célestin Matte, Nataliia Bielova, Cristiana Santos

arXiv:1911.09964v2cs.CR

TL;DR

The paper asks whether TCF cookie banners store and transmit consent consistent with users’ choices and legal requirements. It analyzes consent behind banner interfaces through legal analysis, crawling, and consent interception, finding suspected violations on 54% of tested websites and providing a browser extension for further checks.

  • Problem

    Prior research had not compared cookie-banner interfaces with the consent they store and transmit, leaving this behavior obscure to website visitors.

  • Method

    The authors analyze GDPR and ePrivacy requirements and use automatic and semi-automatic crawls, consent interception, manual checks, and browser tools to detect suspected TCF-banner violations.

  • Results

    At least one suspected violation was detected on 54% of 1 426 European websites using TCF cookie banners.

  • Takeaways & Limitations

    Cookie Glasses helps users and Data Protection Authorities investigate suspected violations in TCF cookie banners.

  • Takeaways & Limitations

    The study is limited to IAB Europe’s TCF banners and does not observe TCF version 2 because it was not observed in the wild.

Abstract

from arXiv · show

As a result of the GDPR and the ePrivacy Directive, European users encounter cookie banners on almost every website. Many of such banners are implemented by Consent Management Providers (CMPs), who respect the IAB Europe's Transparency and Consent Framework (TCF). Via cookie banners, CMPs collect and disseminate user consent to third parties. In this work, we systematically study IAB Europe's TCF and analyze consent stored behind the user interface of TCF cookie banners. We analyze the GDPR and the ePrivacy Directive to identify legal violations in implementations of cookie banners based on the storage of consent and detect such violations by crawling 22 949 European websites. With two automatic and semi-automatic crawl campaigns, we detect violations, and we find that: 141 websites register positive consent even if the user has not made their choice; 236 websites nudge the users towards accepting consent by pre-selecting options; and 27 websites store a positive consent even if the user has explicitly opted out. Performing extensive tests on 560 websites, we find at least one violation in 54% of them. Finally, we provide a browser extension to facilitate manual detection of violations for regular users and Data Protection Authorities.

I. INTRODUCTION

The paper examines whether TCF cookie banners' stored and transmitted consent matches users' interface choices and legal requirements. It combines legal analysis, crawling, consent interception, and user-facing tooling to measure suspected violations.

  • Motivation: The GDPR and ePrivacy Directive require consent before non-mandatory data access or storage, typically presented through cookie banners offering users a choice.The study situates cookie banners within a tracking ecosystem built on continuous data collection.
  • Research gap: No prior study had compared cookie-banner interfaces with the consent they actually store and transmit to third parties.The authors frame this mismatch as unclear to website visitors and motivate questions about silent consent and acceptance nudges.
  • Framework: IAB Europe’s TCF structures consent collection and redistribution through Consent Management Providers, which collect consent from end users and pass it to advertisers.The framework includes registered CMPs and advertisers and provides a technical specification for consent exchange.
  • Scope: The TCF study targets European websites and analyzes consent storage and sharing to evaluate GDPR and ePrivacy Directive compliance.The paper focuses on TCF banners because they are more likely to be observed on EU websites.
  • Contributions: The study identifies four potential legal violations: consent stored before choice, no way to opt out, pre-selected choices, and non-respect of choice.It develops methods to detect these suspected violations on websites using TCF banners.
  • Contributions: The authors develop Cookinspect to crawl websites, log stored consent, and intercept third-party transmission, alongside Cookie Glasses for manual user and regulator checks.The tools support automatic and semi-automatic compliance measurement and inspection of whether choices reach advertisers.

A. Consent String

The TCF represents consent as a decodable string and supports several mechanisms for storing and sharing it. These mechanisms let CMPs and third parties retrieve consent across website and advertising contexts.

  • Consent String: A TCF consent string records consented advertisers, processing purposes, and the CMP identifier in a modified base64-like format.The paper decodes this format using a public IAB script.
  • Consent String: The decoded cmpId identifies the CMP, allowedPurposeIds identify the five predefined purposes, and allowedVendorIds identify advertisers in the Global Vendor List.Third parties can map cmpId to the public CMP list.
  • Consent Storage: The TCF does not require a specific browser-storage mechanism, but suggests a first-party service-specific cookie.The framework leaves implementation details of consent storage unspecified.
  • Consent Storage: The shared cookie stores euconsent on the consensu.org domain, allowing CMPs to share consent through delegated subdomains despite the Same-Origin Policy.CMPs can host scripts on their subdomains to read and modify the shared cookie.
  • Consent Sharing: Consent can be shared through standard APIs, a shared cookie, URL-based methods, or SafeFrames.Figure 3 organizes the mechanisms by how advertisers obtain a consent string.
  • Consent Sharing: Standard APIs expose __cmp() to first-party scripts and __cmpLocator to third-party iframes communicating through postMessage.The TCF v1.1 requires each CMP to implement these APIs.
  • Consent Sharing: URL-based methods transmit consent through the gdpr_consent GET parameter, redirects, or requests to consensu.org subdomains that leverage browser-attached cookies.These methods support third parties that cannot execute JavaScript.
  • Consent Sharing: SafeFrames are API-enabled iframes whose proxy obtains consent by calling the standard __cmp() function.The TCF presents SafeFrames as an additional non-standard sharing method.

III. GDPR AND EPRIVACY SUSPECTED VIOLATIONS

The legal analysis identifies four potentially unlawful TCF banner practices under the GDPR and ePrivacy framework: storing positive consent before or despite user choice, providing no opt-out, and preselecting choices.

  • Legal framework: Four potentially legal violations are identified for cookie banners implementing the IAB Europe TCF.The analysis draws on the GDPR, ePrivacy Directive, case decisions, DPA guidance, and EDPB guidelines.
  • Suspected violations: Consent stored before choice sends advertisers a positive consent string before the user clicks the banner.This conflicts with requirements to obtain consent before processing personal data and loading tracking technologies.
  • Suspected violations: No way to opt out prevents users from refusing consent through the banner.The paper associates this practice with requirements for unambiguous consent and user-friendly refusal mechanisms.
  • Suspected violations: Pre-selected choices mark purposes or vendors as accepted through pre-ticked boxes or enabled sliders.The cited legal sources treat preselected controls as ambiguous and invalid consent for non-essential cookies.
  • Suspected violations: Non-respect of choice stores positive consent even after the user explicitly refused consent.The paper links this practice to the GDPR lawfulness principle and the ePD requirement for consent as a legal ground.

C. Limitations of the Legal Analysis

The legal assessment identifies potentially unlawful practices but expressly limits its conclusions because the analysis has not been judicially sustained.

  • Legal scope: The legal analysis remains limited because only a judicial assessment with case-specific fact finding could provide final legal certainty.The authors preserve legal uncertainty despite relying on legislation, judicial decisions, and expert legal sources.
  • Study scope: The study targets suspected GDPR and ePrivacy Directive violations in TCF banners on websites originating from the European Union.EU websites are selected because TCF banners are more likely to be observed there.
  • Study scope: The crawl begins with 28 257 selected websites and successfully automatically crawls 22 949 websites.The final crawled set forms the basis for the investigations.
  • Detection scope: TCF banner detection relies on the presence of a __cmp() function after page loading.A preliminary crawl found that nearly all sites implementing __cmpLocator also implemented __cmp(), while 20.76% defined __cmp() without __cmpLocator.
  • Detection scope: The automatic detection campaign does not reload pages when no __cmp() function is detected.This operational rule limits subsequent inspection to sites where the CMP signal is present.

C. Intercepting a Consent String

Cookinspect intercepts consent strings through browser APIs, iframes, shared cookies, and network requests, then decodes them to inspect stored purposes and detect suspected violations.

  • Consent interception: Cookinspect intercepts consent strings through standard APIs, third-party iframe messaging, shared cookies, and URL-based network parameters.It uses browser extensions and a Python script to collect intercepted strings in a local database.
  • Consent interception: URL monitoring logs GET and POST requests containing the gdpr_consent parameter.The crawler captures consent transmitted through URL-based methods, including redirecting mechanisms using HTTP requests.
  • Consent interception: The crawler does not separately interfere with safeFrames because they obtain consent through a direct __cmp() call already covered by standard API interception.
  • Consent analysis: Decoding the consent string reveals the CMP identifier, which is mapped to IAB Europe’s public CMP list to retrieve the company name.
  • Consent analysis: The analysis focuses on accepted purposes rather than allowed advertisers, while excluding strings with empty advertiser arrays and non-empty purpose arrays.Consent strings contain arrays for allowed advertisers and accepted purposes; two websites with remaining vendor errors are also removed.
  • Violation detection: Consent stored before choice is detected automatically when a non-empty consent string is present before any user action.The criterion requires one or more accepted purposes out of five possible TCF purposes.
  • Violation detection: No opt-out and preselected choices are labeled manually, while non-respect of choice is tested through semi-automatic interaction on 560 websites.The latter test observes stored consent after a human operator refuses consent.

V. TWO MEASUREMENT CAMPAIGNS

The study uses two September 2019 measurement campaigns: a large automatic crawl of selected websites and a smaller semi-automatic crawl requiring human interaction with banners.

  • Campaign design: Two Cookinspect campaigns were conducted from France in September 2019: one large-scale automatic crawl and one smaller semi-automatic crawl.The source code and browser extensions were publicly released for users and DPAs.
  • Automatic crawl: The automatic campaign audited 22 949 selected websites without human intervention.It tested for TCF banners, consent stored before choice, shared-cookie access, and third-party requests before consent.
  • Automatic crawl: The automatic crawl took an average of 11.04s per website and was conducted on September 20th and 21st 2019.Crawling approximately 28 000 websites required more than 24 hours.
  • Semi-automatic crawl: The semi-automatic campaign sampled 560 websites from French-, Italian-, or English-speaking countries and selected TLDs.The sample was drawn from 1 426 websites containing TCF banners.
  • Semi-automatic crawl: Human interaction was used to test consent acceptance and refusal, opt-out availability, preselected parameters, and stored consent after refusal.The procedure stopped for websites with no banner or a broken banner.
  • Semi-automatic crawl: The semi-automatic crawl took around 30–40s per website because of reactive human manipulation.It was conducted from France between September 23rd and October 1st 2019.
  • Campaign limitations: Banner interaction could not be automated because the TCF does not specify the user interface or how to locate banner elements.

C. Verification Procedure

The study combines automatic and semi-automatic crawling with manual verification to identify TCF banners, inspect stored consent, and assess suspected violations. It covers European websites and CMP identification, while noting that TCF version 2 implementations were not found.

  • Verification procedure: Cookinspect automatically and semi-automatically visits websites, logs stored consent, and intercepts consent transmitted to third parties.Two human operators cross-checked choices and refusal options for selected suspected violations to limit errors.
  • Automatic crawl: 1,426 websites with TCF banners were identified among 28,257 crawled European and international-domain websites.The automatic crawl ran from September 20 to 23, 2019, and these websites became the target of subsequent automatic crawls.
  • CMP identification: CMP companies were identified for 298 websites in the automatic crawl and 511 websites in the semi-automatic crawl.Identification relied on consent strings, but some websites did not set strings and some strings contained incorrect CMP IDs.
  • TCF versions: No implementation of TCF version 2, released on August 20, 2019, was found.The crawls therefore did not observe version 2 implementations.

1) Overview of Suspected Violations:

The study quantifies suspected consent violations across TCF websites, including consent stored before user choice, unavailable refusal options, pre-selected choices, and disregard of explicit refusals. The findings show that violations occur across CMP implementations and publishers, with responsibility shared between CMPs and publishers.

  • Consent stored before choice: 141 websites registered positive consent before any user action, including 111 with all TCF purposes enabled.The authors describe this as occurring on more than 1 in 10 websites using the framework.
  • No way to opt out: 38 websites offered no option to refuse consent.The authors state that consent collected without a refusal option cannot be considered free as required by the GDPR.
  • Pre-selected choices: 236 of 508 tested websites pre-selected choices.The paper notes that the Planet49 decision treated such pre-selected choices as leading to invalid consent.
  • Non-respect of choice: 27 websites registered positive consent even after users refused consent.The authors characterize this as violating the user’s choice, the framework, and the GDPR.
  • CMP and publisher variation: Violations appeared on only some websites for many CMPs, indicating that CMPs offered banner versions with different behaviors.The paper further discusses joint responsibility between CMPs and publishers.
  • Publisher examples: Top-ranked violating publishers included msn.com, medicalnewstoday.com, w3schools.com, and softonic.com.The examples cover storing positive consent before choice, omitting refusal options, pre-selecting choices, and disregarding deselection or refusal.

B. Escalation of Suspected Violations with the Shared Consent Mechanism

The study examines whether consent violations propagate through shared consent mechanisms and whether tracking continues after refusal. It finds that global positive consent cookies can extend a violation across publishers, while third-party requests and mismatched CMP identifiers complicate interpretation.

  • Shared consent mechanism: A global positive consent cookie can reuse consent across publishers against the user’s decision.Because the shared consent is reused among different publishers, the authors describe this as escalating the privacy problem.
  • Network-transmitted consent: 26 additional websites showed non-respect of choice through consent strings obtained from GET and POST requests.This was in addition to the 27 websites identified through standard APIs and the shared cookie.
  • CMP attribution: CMP IDs in GET and POST requests differed from standard-API CMP IDs on 48 websites.In 37 cases both identifiers belonged to valid CMPs; in the remaining 11, IDs were 0, 1, or 4095 and absent from the public CMP list.
  • Third-party requests: Refusing consent increased third-party tracking requests, although the measured non-respect-of-choice cases did not explain the increase.The authors estimate that some scripts execute and include content before or independently of consent handling.
  • Tracking companies: Tracking domains after refusal included companies both inside and outside the IAB framework.The study matched tracking domains to company names and compared them with the Global Vendor List.
  • User-facing inspection: Cookie Glasses lets users inspect consent strings and compare stored consent with their choice.The extension decodes important consent-string information into a readable interface and works through the postMessage API on 79% of TCF websites.

X. LIMITATIONS

The study’s limitations concern coverage, semi-automatic crawl reliability, client-side observability, and the shared responsibility of CMPs and publishers.

  • Scope: TCF-only detection observes a subset of all cookie banners, and measured TCF prevalence is a lower bound because some implementations are missed.Examples include banners that omit __cmp() on first load or redirect users to another domain for consent.
  • Measurement reliability: Semi-automatic crawl results may contain errors because dark patterns can make refusal difficult to locate, despite cross-checking by three human operators.The authors argue that technically available but extremely difficult refusal mechanisms may still violate the GDPR.
  • Observability: Client-side analysis cannot detect consent-string exchanges occurring server-to-server through OpenRTB between ad exchanges and advertisers.The study therefore detects violations only in client-side consent strings.
  • Attribution: Responsibility for non-compliant banners is difficult to assign because CMPs offer customizable versions and publishers may modify CMP behavior.The paper argues that responsibility is shared, while customized violations may be attributable to publishers after case-by-case inspection.

C. Unclear purposes in IAB Europe’s TCF

The TCF’s defined purposes and consent-string design raise interpretive and implementation concerns, while the study documents forged strings and broader compliance findings.

  • Unclear purposes: The TCF’s five predefined purposes are left for legal discussion because the paper reports that CNIL characterized them as vague and imprecise.The authors do not resolve whether the purposes satisfy requirements that purposes be explicit and specific.
  • Framework evolution: TCF v2 introduced 12 purposes and more flexibility between consent and legitimate interest, but the study did not observe its application.The authors note that implementation-related violations might still occur on websites using TCF v2.
  • Consent-string integrity: 37 websites sent third-party requests containing consent strings suspected of being forged by non-CMP scripts.The strings contained CMP identifiers that did not correspond to the CMP present on the page.
  • Consent-string integrity: Consent strings provide weak proof because their format lacks cryptographic evidence tying creation to a CMP, website, or user choice.The paper states that anyone can forge such strings, as its observations demonstrate.
  • Compliance findings: 54% of websites had at least one suspected GDPR or ePD violation among the 1,426 European websites with TCF banners studied.The paper identifies four legal violations through systematic analysis conducted with legal-research collaboration.
  • Open governance issues: The TCF leaves open which actors must ensure that third parties respect consent, and the authors call for more active regulatory guidance or decisions.The paper also identifies unclear consent-string semantics as an issue for third-party interpretation and use.

APPENDIX A PURPOSES DEFINED IN IAB EUROPE’S TCF

The appendix documents the study’s reproducibility materials, website sampling, human refusal and acceptance procedures, and result presentation conventions.

  • TCF purposes: The appendix reproduces the purposes defined in IAB Europe’s TCF in Table IX.The table is identified as accessible through the IAB Europe consent-management registry.
  • Website selection: The study uses Tranco lists combining Alexa and Majestic, excluding DNS-based Cisco Umbrella and US-traffic-based Quantcast lists.Domains flagged as dangerous by Google Safe Browsing are also removed.
  • Website selection: The sample takes the first 1,000 websites for each European country TLD plus 1,000 sites from .com, .eu, and .org.The lists were collected on September 20th 2019 from Tranco’s top one million.
  • Human procedure: Human operators first attempt refusal by clicking refuse controls or disabling purpose options, then close the banner using the least tracking-indicating terminology.They follow linked refusal mechanisms when necessary and label preselection, non-functionality, and refusal availability.
  • Operational labeling: Pre-selected choices are classified from visual defaults such as pre-ticked boxes or acceptance-oriented sliders, while ambiguous defaults are excluded.Cases where neither acceptance nor denial is selected by default are not counted as violations.
  • Result presentation: Results are organized by country and CMP for providers seen at least five times, with some violation tables restricted to websites where refusal was possible.Automatic-crawl results are omitted because identifiable CMPs would introduce bias and cover only 21% of websites.

APPENDIX F UNUSUAL CASES

The appendix records diverse implementation anomalies, including inconsistent banners, difficult refusal paths, invalid consent data, unencrypted access, and third-party consent queries.

  • Banner variability: Two websites displayed multiple cookie banners, while other sites showed different banners across clean browser sessions.Kayak.fr displayed four variants, and public.fr displayed two variants with different configuration options.
  • Specification deviations: Some CMP implementations did not follow TCF specifications, returning empty objects or setting 24 purposes despite only five being defined.The examples are dominos.fr and express.co.uk.
  • User-flow anomalies: Some websites lacked a front-page banner, redirected users after refusal, or displayed consent-related pages on other domains.Examples include gamepedia.com, tvguide.co.uk, mon-programme-tv.be, and toro.it.
  • Invalid consent data: Invalid CMP IDs 1, 0, and 4095 appeared on 155, 45, and 3 websites, respectively.The paper notes that the public CMP identifier range was 2–265 as of September 2nd 2019.
  • Invalid consent data: 114 websites, or 20% of the semi-automatic crawl, stored consent for nonexistent vendors.The example CMP on mycanal.fr set vendor IDs up to 2,000 although the GVL maximum was 670 in September 2019.
  • Third-party access: 44% of websites had at least one unregistered tracker querying the CMP for consent.The study also monitored consent verification through direct calls, postMessages, and GET or POST requests.
Loading 1911.09964v2…