Automating Cookie Consent and GDPR Violation Detection

Thu 19May2022
Since June 2016 you need to have a valid API key enabled to display Google maps, see plugin settings

Karel Kubíček, ETH Zürich

From 12.00 until 13.30

At CNB/F/110 (Lunch) + CAB H 52 (Seminar), ETH Zurich

CNB/F/110 (Lunch) + CAB H 52 (Seminar), ETH Zurich

Abstract:

The European Union's General Data Protection Regulation (GDPR) requires websites to inform users about personal data collection and request consent for cookies. Yet the majority of websites do not give users any choices, and others attempt to deceive them into accepting all cookies. We document the severity of this situation through an analysis of potential GDPR violations in cookie banners in almost 30k websites. We identify six novel violation types, such as incorrect category assignments and misleading expiration times, and we find at least one potential violation in a surprising 94.7% of the analyzed websites.

We address this issue by giving users the power to protect their privacy. We develop a browser extension, called CookieBlock, that uses machine learning to enforce GDPR cookie consent at the client. It automatically categorizes cookies by usage purpose using only the information provided in the cookie itself. At a mean validation accuracy of 84.4%, our model attains a prediction quality competitive with expert knowledge in the field. Additionally, our approach differs from prior work by not relying on the cooperation of websites themselves. We empirically evaluate CookieBlock on a set of 100 randomly sampled websites, on which it filters roughly 90% of the privacy-invasive cookies without significantly impairing website functionality.

Join us in CNB/F/110 (Lunch) + CAB H 52 (Seminar), or on Zoom at https://ethz.zoom.us/j/63555814728.

Download Event to Calendar