PaperlayerView exact revision on arXiv

Source-linked AI summary

Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework

Célestin Matte, Nataliia Bielova, Cristiana Santos

arXiv:1911.09964v2cs.CR

TL;DR

Cookie-banner compliance is difficult for visitors to assess because responsibility for legal compliance is left to publishers and remains obscure to users. The paper compares users’ choices with consent stored by TCF banners and analyzes legal requirements; it finds at least one suspected violation on 54% of 1,426 European websites using TCF banners.

  • Problem

    Visitors cannot readily assess cookie-banner compliance because responsibility for proper functionality and legal compliance is left to publishers and remains obscure to them.

    Source: §I · p. 1

  • Method

    The paper systematically compares users’ choices with consent stored by TCF CMPs and analyzes GDPR and ePrivacy Directive requirements to identify potential violations.

    Source: §I · p. 2

  • Results

    54% of 1,426 European websites using TCF cookie banners had at least one of four suspected GDPR and ePrivacy Directive violations.

    Source: §XIII · p. 14

  • Takeaways & Limitations

    Cookie Glasses gives users and Data Protection Authorities a way to investigate suspected violations, though it detects only some of them.

    Source: §I · p. 2, §XIII · p. 14

    The study covers only IAB Europe TCF banners, so its findings reflect a subset of all cookie banners.

    Source: §X · p. 12

Abstract

from arXiv · show

As a result of the GDPR and the ePrivacy Directive, European users encounter cookie banners on almost every website. Many of such banners are implemented by Consent Management Providers (CMPs), who respect the IAB Europe's Transparency and Consent Framework (TCF). Via cookie banners, CMPs collect and disseminate user consent to third parties. In this work, we systematically study IAB Europe's TCF and analyze consent stored behind the user interface of TCF cookie banners. We analyze the GDPR and the ePrivacy Directive to identify legal violations in implementations of cookie banners based on the storage of consent and detect such violations by crawling 22 949 European websites. With two automatic and semi-automatic crawl campaigns, we detect violations, and we find that: 141 websites register positive consent even if the user has not made their choice; 236 websites nudge the users towards accepting consent by pre-selecting options; and 27 websites store a positive consent even if the user has explicitly opted out. Performing extensive tests on 560 websites, we find at least one violation in 54% of them. Finally, we provide a browser extension to facilitate manual detection of violations for regular users and Data Protection Authorities.

I. INTRODUCTION · II. IAB EUROPE’S TRANSPARENCY AND CONSENT FRAMEWORK (TCF)

This work examines whether TCF cookie banners store and transmit the consent users actually choose, against the GDPR and ePrivacy Directive. It describes the TCF’s consent-sharing framework and measures suspected banner violations.

I. INTRODUCTION

  • Cookie banners should offer users a meaningful choice to accept or reject non-mandatory data collection, but their compliance is obscure to visitors and usually left to publishers.The ePrivacy Directive requires consent before access to or storage of non-mandatory data.Source: §I · p. 1

II. IAB EUROPE’S TRANSPARENCY AND CONSENT FRAMEWORK (TCF)

  • IAB Europe introduced the TCF in response to the GDPR, with CMPs collecting, storing, and redistributing end-user consent to advertisers.The study examines TCF version 1.1; although version 2 was published on August 21, 2019, the authors had not observed it in use.Source: §I · p. 1, §II · pp. 2–3

I. INTRODUCTION

  • The study makes the first systematic comparison of users’ banner choices with consent stored by CMPs and transmitted to website advertisers.The authors analyze the GDPR and ePrivacy Directive to identify four suspected violations: consent stored before choice, no way to opt out, pre-selected choices, and non-respect of choice.Source: §I · p. 2
  • 304 of 560 websites (54%) had at least one suspected violation.The study also found pre-selected options on 236 of 560 websites (47%), no means to refuse on 38 (7%), positive consent before user choice on 141 of 1,426 (10%), and acceptance despite explicit opt-out on 27 of 560 (5%).Source: §I · p. 2
  • 20 websites stored positive consent in a shared cookie despite explicit opt-out, while 3 stored positive consent before user action.Because other CMPs and publishers can reuse shared-cookie consent, these invalid records can spread non-compliance across websites.Source: §I · p. 2
  • Third parties received consent before user action from 69 websites and despite refusal from 38 websites.Consent transmitted to third parties did not necessarily originate from the CMP present on the website, and third-party tracking requests increased after both acceptance and refusal.Source: §I · p. 2
  • Cookinspect crawls websites to log stored consent and intercept its transmission, while Cookie Glasses lets users check whether CMPs correctly transmit their choices.The browser extension is publicly available for Chrome and Firefox.Source: §I · p. 2

II. IAB EUROPE’S TRANSPARENCY AND CONSENT FRAMEWORK (TCF)

  • The TCF requires CMPs and advertisers to register with IAB Europe, which maintains public lists of participants and vendors.As of October 25, 2019, the lists contained 117 CMPs and 550 advertisers; vendors declare which of five predefined data-processing purposes apply, which users usually see in banner interfaces.Source: §II · p. 3

A. Consent String · B. Consent Storage · C. Consent Sharing

The TCF defines a consent string to record user permissions and CMP identity, and describes ways for CMPs to store and share consent with third parties. Its sharing mechanisms include APIs, cookies, URL-based transfers, and SafeFrames.

A. Consent String

  • The consent string encodes the advertisers, data-processing purposes, and CMP identifier associated with a user's consent.It is a slightly modified base64 representation of an array of values.Source: A. Consent String · p. 3
  • The consent string's cmpId identifies the responsible CMP, while allowedPurposeIds and allowedVendorIds identify TCF purposes and advertisers.Third parties can match cmpId against the public CMP list [27].Source: A. Consent String · p. 3

B. Consent Storage

  • The TCF does not mandate a browser-storage mechanism; it suggests a “first-party service-specific cookie” without further details.Source: B. Consent Storage · p. 3
  • The TCF proposes storing consent in an euconsent cookie on consensu.org, with CMP subdomains able to read and modify it despite the Same-Origin-Policy.Each registered CMP can host scripts on its own subdomain, such as ad.consensu.org.Source: B. Consent Storage · p. 3

C. Consent Sharing

  • TCF v1.1 requires CMPs to implement APIs that let third-party advertisers check whether consent has been stored, using __cmp() or __cmpLocator with postMessage.First-party scripts can call __cmp() directly; third-party iframes communicate with __cmpLocator using the postMessage API and a __cmpCall parameter.Source: C. Consent Sharing · p. 3
  • Any CMP can read the shared euconsent cookie; when website-specific and shared cookies both exist, the website-specific cookie is used.Source: C. Consent Sharing · pp. 3–4
  • URL-based methods pass consent in a gdpr_consent GET parameter or through redirects that transfer the shared cookie to third parties without JavaScript.In the redirect method, a CMP subdomain receives the shared cookie and returns it in redirect parameters to the destination site.Source: C. Consent Sharing · p. 4
  • The TCF also proposes SafeFrames, whose proxy obtains consent by calling the standard __cmp() function.A SafeFrame is an API-enabled iframe that controls communication between webpage content and third-party ads.Source: C. Consent Sharing · p. 4

III. GDPR AND EPRIVACY SUSPECTED VIOLATIONS · A. Legal Background · B. Legal analysis of potential violations

The section applies GDPR and ePrivacy standards to identify four potential violations in IAB Europe TCF cookie banners, while noting that its legal analysis has limitations.

A. Legal Background

  • GDPR consent must be freely given, specific, informed, unambiguous, explicit, revocable, prior to data collection, and requested accessibly; ePrivacy requires consent for nonessential cookies.GDPR applies directly across European countries, while the ePrivacy Directive is implemented through national law.Source: A. Legal Background · p. 4
  • Legitimate interest is an alternative GDPR legal basis, but the EDPB does not consider it appropriate for tracking, profiling, or advertising.The alternative basis is the controller's or a third party's legitimate interest under Article 6(1)(f).Source: A. Legal Background · p. 4

III. GDPR AND EPRIVACY SUSPECTED VIOLATIONS

  • The analysis applies authoritative CJEU decisions, DPA and EDPB guidance, and GDPR and ePrivacy provisions and recitals to assess compliance.The section focuses on European data-protection and privacy law and acknowledges limitations to its analysis.Source: A. Legal Background · p. 4, §III · p. 4

B. Legal analysis of potential violations

  • A CMP may send advertisers a positive consent string before the user chooses, violating the requirement to obtain consent before personal-data processing and tracking.The analysis also notes that TCF policy says CMPs should generate consent signals only after a user's clear affirmative action.Source: B. Legal analysis of potential… · p. 4
  • A banner that offers no way to refuse consent violates the requirement for an unambiguous, affirmative choice and a user-friendly opportunity to decline.The authors posit that banners must offer users an option to accept or refuse consent.Source: B. Legal analysis of potential… · pp. 4–5
  • Pre-selected purposes or vendors, such as pre-ticked boxes or sliders set to accept, do not constitute valid, unambiguous consent.The cited legal guidance and the CJEU’s Planet49 judgment reject pre-checked choices that users must deselect to refuse consent.Source: B. Legal analysis of potential… · p. 5
  • A CMP that stores positive consent after a user explicitly refuses it violates the lawfulness requirement for processing.The EDPB states that processing after an individual decides against consent lacks a legal basis.Source: B. Legal analysis of potential… · p. 5

C. Limitations of the Legal Analysis … B. Detecting a TCF Cookie Banner

The study audits TCF cookie banners at scale, while treating its legal analysis as provisional pending judicial assessment. It successfully crawled 22,949 websites and detected TCF banners on 1,426.

C. Limitations of the Legal Analysis

IV. METHODOLOGY

  • Cookinspect, a Selenium-instrumented Chromium crawler, was used for large-scale automatic and semi-automatic audits of suspected GDPR and ePrivacy Directive violations on EU websites implementing TCF.Source: §IV · p. 5

A. Websites Selection and Reachability

B. Detecting a TCF Cookie Banner

  • Cookinspect identifies a TCF banner by checking for a __cmp() function, which the TCF v1.1 specification requires CMPs to implement.Source: B. Detecting a TCF Cookie Banner · p. 5
  • In a preliminary crawl of 21,000 websites, all but one site implementing __cmpLocator also implemented __cmp(), while 20.76% defined __cmp() without __cmpLocator.The authors therefore used __cmp() presence to conclude that a CMP was present.Source: B. Detecting a TCF Cookie Banner · p. 5
  • 1,426 websites had automatically detected TCF banners; websites without a detected banner were omitted from the rest of the paper.Source: B. Detecting a TCF Cookie Banner · p. 6

C. Intercepting a Consent String · D. Identifying the CMP Responsible for a TCF Banner · E. Detecting Suspected GDPR and ePD Violations

Cookinspect intercepts TCF consent strings through browser APIs, cookies and network requests, identifies CMPs from decoded strings, and applies automatic, manual and semi-automatic procedures to detect suspected violations. The checks focus on accepted purposes and exclude specified cases, while responsibility for suspected violations is shared by publishers and CMPs.

C. Intercepting a Consent String

  • Cookinspect retrieves strings through first- and third-party __cmp() calls and a shared cookie; safeFrames need no separate interception because they call __cmp().Scripts in the site origin call __cmp() directly, while injected scripts in eligible third-party iframes request the string from the __cmpLocator iframe.Source: C. Intercepting a Consent String · p. 6
  • POST requests carried consent strings on 399 of 1,426 TCF websites (28%), while GET requests did so on 764 (53.6%).Cookinspect monitors requests containing the gdpr_consent parameter, including POST requests as well as the GET requests specified by the TCF.Source: C. Intercepting a Consent String · p. 6

D. Identifying the CMP Responsible for a TCF Banner

E. Detecting Suspected GDPR and ePD Violations

  • Violation checks focus on accepted-purpose arrays, not allowed-advertiser arrays, and exclude strings with no advertisers but non-empty purposes and two legitimate-interests-only websites.The TCF directs advertisers to check both arrays; the study focuses on purposes because of their legal significance and leaves the legitimate-interests cases to DPAs.Source: E. Detecting Suspected GDPR and ePD… · pp. 6–7
  • Without user action, Cookinspect automatically flags a consent string with at least one accepted purpose as suspected consent stored before choice; an empty string is not a violation.This check runs while crawling 22,949 websites and considers accepted purposes out of the TCF’s five possible purposes.Source: E. Detecting Suspected GDPR and ePD… · p. 7
  • Manual opt-out checks click every banner button and link, then test refusal in the second layer, which may be hidden behind wording such as “learn more.”Source: E. Detecting Suspected GDPR and ePD… · p. 7
  • Manual checks flag pre-selected choices when a parameters page has at least one pre-selected purpose checkbox or enabled purpose slider.Source: E. Detecting Suspected GDPR and ePD… · p. 7
  • For non-respect of choice, operators refused consent on 560 French-, Italian-, or English-language websites, then Cookinspect logged strings; only strings with all five purposes accepted counted.The crawl covered France, the UK, Belgium, Ireland, Italy and .com websites, and required a language understood by at least one author. Requiring all five accepted purposes avoids treating purposes that users could not refuse as a violation where they may rely on legitimate interests.Source: E. Detecting Suspected GDPR and ePD… · p. 7

V. TWO MEASUREMENT CAMPAIGNS · A. Automatic Crawl · B. Semi-Automatic Crawl

The authors use two Cookinspect campaigns on EU websites, combining a large automatic crawl with a smaller semi-automatic crawl that requires human interaction with banners.

V. TWO MEASUREMENT CAMPAIGNS

  • The two campaigns ran from France in September 2019, and Cookinspect’s source code and extensions were made public for end users and DPAs to test compliance.Source: §V · p. 7

A. Automatic Crawl

  • The stateless automatic crawl audited 22 949 selected websites for TCF banners, consent stored before user choice, shared-cookie access, and third-party tracking requests before consent.Source: A. Automatic Crawl · p. 8
  • The automatic crawl checked for a defined __cmp() function after load and a 3-second delay, attempted to retrieve consent strings, logged third-party requests, and tested shared-cookie retrieval through __cmp() and postMessage.Source: A. Automatic Crawl · p. 8
  • The automatic crawl averaged 11.04 seconds per website, while the human-operated semi-automatic crawl took around 30–40 seconds per website.The automatic campaign ran September 20–21, 2019, and the semi-automatic campaign ran September 23–October 1, 2019, both from France.Source: A. Automatic Crawl · p. 8, B. Semi-Automatic Crawl · p. 8

B. Semi-Automatic Crawl

  • The semi-automatic crawl selected 560 websites from 1 426 with TCF banners, limiting selection to specified UK, French, Italian, Belgian, Irish, and .com domains based on languages the authors spoke fluently.Source: B. Semi-Automatic Crawl · p. 8
  • On banner-capable sites, operators refused consent in one session and accepted it in another, checking stored consent, shared cookies, trackers, refusal options, and consent-favoring preselection.Sites with no banner or a broken banner were excluded; after refusal, the page was refreshed after 3 seconds to log network requests and the consent string was checked again.Source: B. Semi-Automatic Crawl · p. 8
  • Because the TCF does not specify the user interface, the researchers could not locate banners and their elements well enough to automate interaction.Source: B. Semi-Automatic Crawl · p. 8

C. Verification Procedure … 1) Overview of Suspected Violations:

The study verifies suspected banner violations through human cross-checks, describes its crawl of TCF banners, and summarizes how it identifies CMPs and classifies suspected violations. The supplied passages do not provide the violation-prevalence counts from Table III.

C. Verification Procedure

  • Two operators cross-checked suspected Non-respect of choice and No way to opt out cases, with disagreements resolved by keeping the result showing fewer violations and retesting that CMP’s sites.The first operator conducted the semi-automatic crawl; the second tested selected suspected and comparison sites without knowing which were suspected, and a third repeated the procedure on a new pool.Source: C. Verification Procedure · p. 8

D. Ethical Considerations

  • The study involved no human subjects and was mostly passive, clicking only manually selected cookie-acceptance buttons, respecting robots.txt, and not tampering with distant systems.The authors state that the large-scale measurement presented no potential harm to websites and provided societal benefits.Source: D. Ethical Considerations · p. 8

VI. PREVALENCE OF TCF BANNERS IN EUROPE

  • 1,426 of 28,257 crawled websites (6.2%) had a TCF banner, and those sites became targets of subsequent automatic crawls.The automatic crawl covered 1,000 top Tranco websites for 31 European TLDs and .com, .org, and .eu domains from September 20 to 23, 2019.Source: §VI · p. 8
  • CMPs were identified for 298 automatic-crawl websites (20.9%) and 511 semi-automatic-crawl websites (92.9%); Quantcast was most encountered, ahead of OneTrust, Didomi, and Sourcepoint.Identification used consent strings, but some sites set none during the visit and some strings had an incorrect CMP ID.Source: §VI · p. 8, Figure 7 · p. 9
  • The researchers found no implementation of TCF version 2, released August 20, 2019.Source: §VI · p. 8

VII. QUANTIFICATION OF SUSPECTED VIOLATIONS

  • The suspected violations involve consent strings obtained through the standard API and shared cookie, with publishers and CMPs jointly responsible; GET and POST request cases are discussed separately because CMPs could not be attributed.Source: §VII · p. 9

1) Overview of Suspected Violations

  • Consent stored before choice cases were counted when 1 to 5 purposes were set in a consent string, while Non-respect of choice cases were counted only when all 5 purposes were set.Table III summarizes suspected-violation prevalence by the maximum number of purposes, but the supplied passage does not provide its cell values.Source: 1) Overview of Suspected Violations · p. 9

2) Quantification per Suspected Violation: · 3) Quantification per Publisher: · B. Escalation of Suspected Violations with the Shared Consent Mechanism

The study finds multiple suspected consent violations, including positive consent recorded without user action or against an explicit refusal. It also shows how shared consent cookies can spread these violations across publishers.

2) Quantification per Suspected Violation:

  • 141 websites stored positive consent before user action, including 111 with all TCF purposes; this occurred on more than 1 in 10 TCF-using websites.The TCF specification says the APIs used to detect consent strings should not return one before a user decision, unless consent is retrieved from existing cookies.Source: 2) Quantification per Suspected… · p. 9, Table V · p. 10
  • 38 websites offered no option to refuse consent, so the collected consent could not be considered free as required by the GDPR.Source: 2) Quantification per Suspected… · p. 9
  • 236 of 508 websites pre-selected choices, which the European Court of Justice later ruled lead to invalid consent in Planet49.Source: 2) Quantification per Suspected… · p. 9
  • 27 websites registered positive consent even though users refused consent.The paper characterizes this as violating user choice, the framework, and the GDPR.Source: 2) Quantification per Suspected… · p. 9
  • Violations varied across CMPs and often affected only some of their websites, indicating that CMPs offer banner versions that behave differently.Source: 2) Quantification per Suspected… · p. 9

3) Quantification per Publisher:

  • Examples include msn.com and medicalnewstoday.com storing consent before user choice and offering no opt-out, while softonic.com both pre-selected choices and disregarded user decisions.w3schools.com displayed pre-selected choices but registered positive consent even after users deselected them.Source: 3) Quantification per Publisher · p. 10

B. Escalation of Suspected Violations with the Shared Consent Mechanism

  • The only specification-compliant redirect domain observed, sddan.consensu.org, was used on 53 websites (9.5%), hinting that shared-cookie reading is common.Because some redirects used non-standard URL parameters, the estimate covers only specification-compliant cases.Source: B. Escalation of Suspected Violations… · p. 11
  • 3 websites set the shared cookie before user choice, while 20 (3.9%) disregarded user decisions; visiting them set global positive consent cookies against those decisions.Three sites also set the shared cookie in the non-respect-of-choice case with 5 purposes; the 20 sites did so with 1 to 5 purposes. Because the cookie is reused across publishers, these violations can escalate.Source: B. Escalation of Suspected Violations… · p. 11

VIII. MEASURING THIRD-PARTY REQUESTS: PRESENCE OF CONSENT STRINGS AND THIRD-PARTY TRACKERS · A. Third-Party Requests with Consent Strings · B. Third-party trackers

The section examines consent strings sent in third-party GET and POST requests and measures tracking requests and domains under different consent choices. It finds that refusing consent can still coincide with increased tracking requests, while request strings also reveal consent violations and suspicious CMP identifiers.

VIII. MEASURING THIRD-PARTY REQUESTS: PRESENCE OF CONSENT STRINGS AND THIRD-PARTY TRACKERS

A. Third-Party Requests with Consent Strings

  • 63 websites (12.4%) sent strings with all five purposes in third-party requests, including 26 additional websites beyond the 27 detected via standard APIs or shared cookies.The study identifies these strings as evidence of non-respect of choice.Source: A. Third-Party Requests with Consent… · p. 11
  • 48 websites had CMP IDs in third-party request strings that differed from those obtained via standard APIs; 11 used IDs 0, 1, or 4095, which are absent from the public CMP list.On 37 of the 48 websites, both CMP IDs were from valid CMPs; the remaining 11 had the listed non-existent IDs.Source: A. Third-Party Requests with Consent… · pp. 11–12

B. Third-party trackers

  • Tracking requests were measured before banner interaction and after accepting or refusing consent, on 508 websites where refusal was possible, with each measurement taken in one browser session and page load.The researchers extracted tracker domains using the Disconnect list.Source: B. Third-party trackers · p. 12
  • Refusing consent increased third-party tracking requests, and the observed rise was not explained by websites that stored positive consent after refusal; some scripts may wait for __cmp() to be defined before loading content.The study suggests this behavior may occur because scripts wait for the __cmp() function, which should be defined only after the user makes a choice.Source: B. Third-party trackers · p. 12, Table VII · p. 12
  • After consent refusal, tracking domains included companies outside the IAB framework, such as Google, Facebook, and Amazon, as well as TCF vendors including AppNexus, The Rubicon Project, and comScore.The study matched tracking domains to company names using the Disconnect list and checked TCF membership against the Global Vendor List, version 168.Source: B. Third-party trackers · p. 12

IX. BROWSER EXTENSION … B. Problem of shared consent across publishers

The paper presents Cookie Glasses for inspecting CMP-stored consent, while discussing limitations of its TCF-only, client-side study and risks created by consent shared across publishers. It also argues that responsibility for non-compliant banners is shared between CMPs and publishers.

IX. BROWSER EXTENSION

  • Cookie Glasses lets users inspect CMP-stored consent and read decoded consent-string information in a simple interface.The extension displays information about consent transmitted by CMPs to advertisers.Source: §IX · p. 12, Figure 8 · p. 12
  • The extension uses postMessage because browser security prevents direct __cmp() calls, and the API is used by 79% of TCF websites.For the remaining websites, the authors propose manually executing JavaScript to obtain the consent string, then decoding it with the extension.Source: §IX · p. 12

X. LIMITATIONS

  • The study detects only IAB Europe TCF banners, so its 17.1% detection on .fr websites is a lower bound, compared with 40.2% of European websites reported to have a cookie banner.Some TCF implementations were missed, including banners that do not define __cmp() on first load and consent walls displayed after a redirect. The client-side method also cannot observe consent-string exchanges between ad exchanges and advertisers through OpenRTB, though IAB provides extension fields.Source: §X · pp. 12–13
  • Dark patterns can make semi-automatic crawl results error-prone, although three human operators cross-checked banner responses.Some banners made opting out difficult, and the authors note that confusing designs may still have prevented all three operators from finding the proper opt-out method.Source: §X · p. 13

XI. DISCUSSION

  • The discussion reflects on the experiments and results and identifies open problems for legal professionals and Data Protection Authorities.The authors leave the question of whether CMPs and publishers might be co-controllers to lawyers.Source: §XI · p. 13, A. Who is responsible for violations… · p. 13

A. Who is responsible for violations in cookie banners?

  • The authors argue that responsibility for non-compliant banners is shared: CMPs cannot simply delegate it to publishers, who also bear responsibility when choosing non-compliant banners.Publishers bear responsibility when they customize a CMP script to change its original behavior; identifying this requires extensive case-by-case manual inspection.Source: A. Who is responsible for violations… · p. 13

B. Problem of shared consent across publishers

  • The TCF’s global cookie can let one publisher obtain consent set on another, as when letudiant.fr obtained the string previously set on senscritique.com.The authors say this may not itself violate the GDPR, but invisibly obtaining consent while showing another banner may be excessive, nontransparent, or deceptive; they call for further legal analysis. The CNIL described repeated consent requests as “bordering on harassment”, and Privacy International criticized users’ lack of awareness of global consent and the difficulty of opting out.Source: B. Problem of shared consent across… · p. 13
  • 3 websites set positive consent in the shared cookie before a choice, and 20 did so after users explicitly refused consent.The authors say this creates a TCF-wide problem if a publisher or CMP sets the shared cookie incorrectly.Source: B. Problem of shared consent across… · p. 13

C. Unclear purposes in IAB Europe’s TCF … XIII. CONCLUSIONS

The sections discuss uncertainty in TCF purposes and version 2, show that consent strings can be forged, review related work, and conclude that suspected violations are widespread and the framework has unresolved problems.

C. Unclear purposes in IAB Europe’s TCF

D. IAB Europe TCF version 2

  • The authors observed no TCF version 2 implementations, although the version announced in August 2019 introduced 12 purposes and more flexibility in choosing consent or legitimate interest as a legal basis.Because CMP and publisher implementation is responsible for the violations, the authors say violations might persist on sites using TCF v2.Source: D. IAB Europe TCF version 2 · p. 13

E. Consent strings can be created by anyone

  • On 37 websites, third-party requests carried suspected forged consent strings with mismatched CMP identifiers; the format lacks cryptographic proof tying strings to a CMP, website, or user choice.An online-advertising ecosystem actor flagged such strings as “consent fraud”.Source: E. Consent strings can be created by… · pp. 13–14

XII. RELATED WORK

  • Post-GDPR studies examined effects on cookie practices and banner prevalence and design, including user-location variation and dark patterns in TCF CMPs.Van Eijk et al. detected banners on 40.2% of European websites; Degeling et al. found 62.2% displayed banners and a 16% increase in adoption. Nouwens et al. estimated 11.8% of banners met minimum legal requirements and found that omitting a first-layer refuse button increased positive consent by about 22%.Source: §XII · p. 14
  • Earlier work measured opt-out availability and tracking before consent, while Sanchez et al. measured cookies after refusal; this study measures trackers before and after acceptance and refusal.Leenes and Kosta found no opt-out on 25% of 100 Dutch websites, while the Article 29 Working Party found it on 54% of the top 250 websites in eight EU countries. Prior tracking studies reported 29.5 trackers before consent, 18 third parties per website before consent, and profiling cookies on 49% of websites, with 80.5% of tracking-cookie sites not waiting for consent.Source: §XII · p. 14
  • Regulators and courts addressed consent and banner compliance: CNIL challenged TCF consent and pre-selection, Planet49 ruled pre-selected options noncompliant, and the ICO found TCF transparency and compliance shortcomings.The CNIL sued an ad company using TCF, issued draft cookie-banner guidelines and criticized TCF; the ICO examined TCF and Google’s framework.Source: §XII · p. 14

XIII. CONCLUSIONS

  • The study identifies four suspected legal violations on 1,426 European TCF-banner websites and finds at least one on 54%; Cookie Glasses detects some violations for users and DPAs.The authors developed Cookie Glasses to help users and Data Protection Authorities investigate suspected violations.Source: §XIII · p. 14
  • The conclusion identifies unclear consent-string semantics and uncertainty over which actors must ensure third parties respect consent, and calls for more active European regulatory guidance or enforcement.Source: §XIII · p. 14

APPENDIX A PURPOSES DEFINED IN IAB EUROPE’S TCF … APPENDIX E ALTERNATIVE PRESENTATIONS OF THE RESULTS

The appendices document the TCF purposes, research materials and website-selection methods, the human operators’ consent procedures, and country- and CMP-based presentations of crawl results.

APPENDIX A PURPOSES DEFINED IN IAB EUROPE’S TCF

APPENDIX B ATTACHMENTS

  • A public repository provides the full website lists for each suspected violation and videos showing examples.Source: Appendix B · p. 16

APPENDIX C DATA FOR REPRODUCIBLE RESEARCH

  • For reproducible site selection, the study uses Tranco’s Alexa and Majestic lists, excludes DNS-based Cisco Umbrella and US-only Quantcast, and removes Google Safe Browsing dangerous domains [37].The paper explains that the excluded lists may not represent web traffic in the study’s target context.Source: Appendix C · p. 16
  • From Tranco’s top million, the study selected the first 1,000 websites for each European-country TLD and 1,000 across .com, .eu, and .org on September 20, 2019.Source: Appendix C · p. 16

APPENDIX D PROCEDURE FOR THE HUMAN OPERATORS

  • Operators first tried direct refusal; otherwise they unticked every purpose option, including functional cookies, used “refuse all” when available, ignored vendor options, and searched linked privacy routes for up to 10 seconds.They closed the banner using the button whose terminology least indicated allowing tracking.Source: Appendix D · p. 16
  • Pre-ticked boxes or acceptance-set sliders counted as pre-selected choices violations, while ambiguous defaults counted as no violation; a site blocking access after refusal was marked “No way to opt out.”The access-blocking case occurred on healthline.com.Source: Appendix D · pp. 16–17
  • On a second browser session, operators accepted tracking via the “accept” button, or closed the banner if that was the only option; if absent on first load, they reloaded up to three times.The procedure specifies closing the banner in all cases.Source: Appendix D · p. 17

APPENDIX E ALTERNATIVE PRESENTATIONS OF THE RESULTS

  • Semi-automatic crawl results are presented by country and for CMPs seen at least five times; automatic-crawl results are omitted because identifiable CMPs covered only 21% of websites.The paper says this avoids introducing bias in the automatic-crawl presentation.Source: Appendix E · p. 17

APPENDIX F UNUSUAL CASES

The appendix documents unusual cookie-banner behavior, including inconsistent interfaces, difficult or misleading refusal paths, and consent data that did not follow TCF specifications. It also reports unusual third-party consent checks and cases that the crawlers could not detect or assess conclusively.

Multiple banners at once; Multiple banners on different loads

  • Some sites displayed two banners at once, while others showed different banner configurations across clean sessions, including four at kayak.fr and two at public.fr.The authors suggest the simultaneous banners may follow pre- and post-GDPR regulations, possibly because publishers forgot to remove the older ones.Source: Appendix F · p. 17

Specifications not followed; No implementation

  • Some CMP implementations violated or omitted TCF elements: express.co.uk set 24 purposes although only 5 were defined, while dominos.fr returned an empty JSON object.A classical OneTrust banner on dominos.fr had neither a __cmp() function nor a __cmpLocator iframe, so the automatic crawl could not detect this kind of missing implementation.Source: Appendix F · pp. 17, 19

Banner not displayed on front page; HTTP only; consensu.org’s page

  • Some banners were absent from front pages, and 95 (7%) of TCF websites provided HTTP access only.The main consensu.org pages displayed generic park pages, despite the domain’s role in global consent-cookie sharing and consent redirection through subdomains.Source: Appendix F · pp. 17, 19

Redirections upon refusal; Broken banner

  • Some sites redirected users only upon refusal, and on 6 websites a bug prevented either refusing or accepting consent.Examples included redirection to Wikipedia or to another domain’s privacy-policy page, and a banner on olympia.ie where consent choices were unavailable.Source: Appendix F · pp. 17, 19

Claiming GDPR does not apply

  • Many consent-passing queries set the gdpr parameter to 0, but the authors could not determine whether those claims that GDPR did not apply were founded.The specification uses the parameter to indicate whether GDPR applies, and the authors note there may be many reasons it would not apply to a given script.Source: Appendix F · p. 19

Unticked options ambiguity; No choice before acceptance; Extremely tiresome cases; Hidden parameters

  • Some banners made refusal difficult or ambiguous: users could receive positive consent unless they opened parameters, or see those parameters only after accepting.One banner presented 8 purposes and hundreds of vendors, with every vendor preticked; another hid refusal parameters in a visually indistinct link within a 12,000-word policy document.Source: Appendix F · p. 19

Wrong CMP id; Consent to nonexistent vendors

  • 155, 45, and 3 websites used invalid CMP IDs 1, 0, and 4095, respectively; 114 (20%) set consent for nonexistent vendors.The public CMP list ranged from IDs 2 to 265 as of September 2, 2019, and IAB Europe said CMP ID 1 should not be used [27].Source: Appendix F · p. 19

Unusual consent verification

  • At least one unregistered tracker queried CMP consent in 44% of websites, and an unregistered third party did so in 55%.The authors identify trackers using the Disconnect list and say it is unclear why vendors outside the framework verify consent.Source: Appendix F · p. 19
Loading 1911.09964v2…