Pith. sign in

REVIEW 5 major objections 7 minor 74 references

Navigating Cookie Consent Violations Across the Globe

T0 review · 5 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Across eight regions, 96–98% of popular websites violate cookie consent choices.

desk verdict A solid cross-region cookie consent measurement whose headline violation rates lean on a circular ground truth and are likely inflated, but the regional-difference story and tooling are real contributions. read the letter →

arxiv 2506.08996 v2 pith:BHCEJRIP submitted 2025-06-10 cs.CR

Brian Tang , Duc Bui , Kang G. Shin This is my paper
classification cs.CR
keywords cookieconsentviolationsmanagementplatformsbannersGDPRCCPAgeolocationwebmeasurementChk
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that cookie consent is broken at scale: of 1,793 globally popular websites drawn from the top 20k, between 96.18% (EU) and 97.72% (US) had at least one cookie consent violation across eight English-speaking regions. It introduces ConsentChk, an automated auditor that opens cookie preference menus, rejects every rejectable cookie category, and compares the cookies actually sent to servers against the declarations in consent management platform (CMP) libraries. The central empirical discovery is that the same websites behave very differently by location: US sites average about 12 more cookies and 10 more violations per site than EU sites, and other non-EU regions show 5–8 more cookies and 5–7 more violations. If correct, this means user rejections are frequently ignored, especially outside the EU, and that CMP templates and developer configuration choices, more than the law itself, determine what actually happens to user consent.

What carries the argument

The load-bearing object is ConsentChk, an end-to-end cookie consent auditing system. ConsentChk combines a random-forest cookie-button extractor that finds and clicks the hidden elements that open consent preference menus, a cookie consent exerciser that rejects all rejectable categories and reads the CMP's recorded choices, and a violation classifier that labels each observed cookie by comparing it with the CMP declaration list under simple logical rules: a cookie used despite rejection is an Ignored Cookie Rejection; a cookie used without appearing in the declaration is Undeclared; a cookie placed in both an accepted and a rejected category is a Wrong Cookie Category violation. The system's formal model equates cookies by name, domain, and path, and treats the consent cookie's domain as the scope of consent. This machinery lets the authors attribute each violation to a concrete mismatch between users' expressed preference, the CMP's declared cookie library, and the cookies actually transmitted.

What would settle it

Manually inspect the CMP dashboards or source code of a random sample of, say, 100 of the studied sites and check whether the cookies ConsentChk labeled 'undeclared' actually appear in the developer's own cookie inventory or in a full CMP rescan; if most of them are known to developers, the undeclared-cookie violation counts would shrink substantially.

Watch

Extended reading notes

Core claim

The paper's central claim is that cookie consent violations are the norm rather than the exception, and that they are strongly geolocation-dependent. Using its ConsentChk crawler, the authors measured 1,793 websites with cookie banners from servers in Ireland, the UK, California, Michigan, Canada, South Africa, Singapore, and Australia. They report that 96.18% to 97.72% of sites contain at least one violation, dominated by undeclared cookies (cookies placed without appearing in the CMP's declared cookie list) and ignored cookie rejections (cookies used despite explicit rejection). The same websites, accessed from the US, carry on average almost 12 more cookies and 10 more violations per site than when accessed from the EU; Canada, Singapore, South Africa, and Australia sit between these extremes with 6–8 more cookies and 5–7 more violations. The authors attribute this to CMPs shipping regional templates and geolocation rulesets, plus developers failing to keep cookie libraries and script blocking updated, producing banners whose text, consent model, and actual cookie behavior differ by region.

Load-bearing premise

The whole violation count rests on treating the CMP's cookie declaration list as the ground truth for which cookies are 'declared'; a cookie that developers knew about but that the CMP's automatic scanner missed is counted as an undeclared cookie.

Editorial extensions

If this is right

  • If the claim holds, a user who clicks 'reject all' on a typical site cannot assume tracking has stopped: Google Analytics (_ga, _gid) and Meta (_fbp) cookies are among the most common consent-ignoring cookies.
  • Regulators outside the EU and UK face a larger compliance gap than GDPR-focused audits suggest, with undeclared cookies appearing on 90.19% to 94.15% of sites depending on region.
  • The EU and UK's higher rate of ignored rejections relative to undeclared cookies implies that better cookie declarations expose broken script blocking, so fixing declarations alone will not restore consent.
  • CMPs' regional templates and geolocation rulesets, not just developer sloppiness, are a primary driver of cross-region differences, making the CMPs a natural point of regulatory and standardization pressure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension is to run the same ConsentChk procedure from residential IP addresses; if the regional gaps persist, the result is about CMP rulesets rather than datacenter IP geolocation artifacts.
  • The inverse correlation between undeclared and ignored-rejection violations suggests a 'declaration compliance' trade-off that could be studied directly by instrumenting CMP dashboards to see which cookies developers consciously left uncategorized.
  • If violations continue to rise by one to three percentage points every three years, as the paper's comparison with prior work hints, then regulatory enforcement targeting CMPs could be evaluated by re-measuring the same 1,793 sites after any enforcement action.
  • The paper's personal-information detector could be turned into a continuous public audit: a recurring crawl of the same site list would yield an up-to-date, per-region violation index that regulators and users could consult.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper presents ConsentChk, an automated system that crawls websites, interacts with cookie banner preference menus, rejects cookie categories, and classifies three types of cookie consent violations (Ignored Cookie Rejection, Undeclared Cookies, Wrong Cookie Category) using a formal rule-based model. The system is deployed on 1,793 English-language websites using select consent management platforms (OneTrust, CookiePro, Cookiebot) across eight regions, with ten repeated measurements per site. The central empirical claims are that 96.18% to 97.72% of sites contain at least one violation, that US sites have roughly 12 more cookies and 10 more violations per site than EU sites, and that these regional differences are associated with CMP geolocation rulesets and regional privacy-law interpretations.

Significance. If the claims hold, this is a valuable cross-regional measurement contribution: it extends prior single-region cookie-compliance studies to eight jurisdictions with the same website set, quantifies violation types at the individual-cookie level, and offers a concrete root-cause discussion grounded in CMP documentation. Strengths include the reproducible design (code and data released, albeit with patent-related restrictions), the use of repeated crawls, and the explicit formal definitions of violation types. The regional comparison is a genuinely new angle relative to much of the prior work. However, the headline violation rate rests on several assumptions that are not fully validated in the manuscript, including the personal-information filter, the denominator of sites actually analyzable for violations, and the treatment of the CMP's cookie library as the ground truth for 'declared' cookies. These issues do not appear fatal, but they currently make the quantitative headline stronger than the evidence presented.

major comments (5)
  1. [§5.1 and Contribution list] The denominator for the headline violation rate is ambiguous. The text states that ConsentChk found 1,793 websites with cookie banners and consent settings but analyzed the cookie consent behavior of only 1,312 sites containing cookie preference menus. The contribution section and abstract report a violation rate over '1,793 websites,' and Table 6 reports '% Websites.' If violation detection requires a preference menu, the correct denominator is 1,312, and reporting 1,793 either understates the rate or mixes two populations. Please state explicitly which denominator is used for each percentage in Table 6 and in the abstract, and justify the choice.
  2. [§5.4 and Table 5] The pairwise regional comparisons in §6.2 (Finding 5) and §6.4 are claimed to be 'statistically significant,' but the only tests reported in Table 5 are omnibus Levene and Kruskal-Wallis tests. The Kruskal-Wallis H test does not identify which region pairs differ, and no pairwise test statistics, p-values, or multiple-comparison corrections are presented. The claim that 'all other regions, particularly the US, have a significant increase compared to the EU and UK' is therefore not supported by the reported analysis. Please add appropriate pairwise tests (e.g., Dunn's test or Mann-Whitney with a correction such as Holm) or soften the claim to describe only the omnibus result.
  3. [§5.2 and Table 6] The personal-information filter is load-bearing but unvalidated. Section 5.2 states that 'unless stated otherwise, the reported results only include cookies that were detected to have personal information,' and Table 6 and the headline violation percentages are based on these filtered cookies. The PI detector is a keyword/regex/zxcvbn heuristic, yet no precision, recall, or manual validation is reported for it. If the PI detector has nontrivial error, the violation counts and the 96.18–97.72% claim could change materially. Please provide a validation of the PI classifier (e.g., a hand-labeled sample) or report the main results for both PI-only and all cookies.
  4. [§4.6 and §7.1] The validation of Undeclared Cookies is partly circular, and the ground-truth definition should be clarified. The detector flags a cookie as undeclared when it is absent from the CMP's cookie library, and §4.6 says correctness was checked 'using the CMP and sites' storage objects, such as en.json'—the same source that defines the violation. The manual check of whether cookies were unspecified in the actual cookie banner is the appropriate independent test, but its results are not reported separately from the storage-object check. In addition, §7.1 acknowledges that CMP crawlers can miss context-dependent cookies; by the paper's definition those cookies are undeclared, which is consistent as a user-visible disclosure measure, but the paper should state this explicitly and discuss how much of the 90.19–94.15% undeclared-cookie site rate could be driven by CMP crawler incompleteness rather than by developer inaction.
  5. [§5.3] The use of a union across ten repeated measurements in Table 6 can inflate the per-site violation percentages. Section 5.3 states that 'in reporting total violation counts (Table 6), we report the union across the 10 measurements,' and the headline '% Websites' figures are likely derived from this union. Given the paper's own observation that cookie loading is non-deterministic, a site with a single one-off cookie in one crawl counts as a violator. Please also report the violation rate for a single crawl or the per-measurement consistency, so readers can assess whether the headline is dominated by rare, context-dependent cookies.
minor comments (7)
  1. [§3 and Table 3] The terminology is inconsistent: the text in §3 calls the third violation 'Wrong Cookie Category,' while Table 3 labels it 'Ambiguous Cookie Category Violation.' Please unify the naming.
  2. [§4.6] The sentence 'This roughly 90% FPR from manual validation or reproduction likely resulted...' mislabels the reported numbers as false positive rates; the preceding text reports precisions of 92.1%, 91.2%, and 87%, which are not FPRs. Please correct the terminology.
  3. [Table 5] The column header 'Levene's H-Test (p)' appears to conflate two different tests: the first value in each cell is the Levene p-value and the second is a Kruskal-Wallis H statistic with its p-value. Please split these into clearly labeled columns.
  4. [§5.1] The text says 'the five categories defined by cookie libraries we selected — OneTrust, CookiePro, and Cookiebot,' but only three CMPs are listed; please correct the count or specify what the five categories refer to.
  5. [§4.2] The description of cookie-name pattern matching is unclear: '_gaxxx or _ga### ... an x or # to match any single character. However, a single # at the end matches any alpha-numeric string.' Please give a precise grammar or examples for how wildcard characters are interpreted.
  6. [§6.3 and §6.4] The US per-site cookie averages are reported inconsistently: §6.3 says 'US sites average 46.5 first-party and 37.3 third-party cookies per site,' while Finding 2 in §6.2 reports 'roughly 35.4 (1st-party) and 29.03 (3rd-party) cookies per site' for US-MI. Please reconcile these numbers or clarify whether they refer to different subsets or measurement periods.
  7. [§3 and Abstract] The paper's own caveat in §3 that these behaviors 'may not violate the laws' sits uneasily with the abstract's language of 'non-compliant' cookie consent. Please align the wording so that the legal interpretation is stated as a possibility rather than a settled conclusion.

Circularity Check

1 steps flagged · score 6.0 of 10

Undeclared-cookie violations and their precision validation reduce by construction to the CMP's own cookie library (e.g., en.json); since undeclared cookies dominate the violation counts, the headline 96-98% rate is partly inflated, though independent violations remain.

  1. self definitional [Section 3 (Table 3), Section 4.5, Section 4.6; Section 7.1]
    "Undeclared Cookies Violation Cookie used without appearing in cookie library Undeclared ⇔ c ∉ Ac ∧ c ∉ Rc. ... Cookies placed without being declared in the cookie library set by the CMP are Undeclared Cookie Violations. ... We checked the correctness of the detected cookie consent violations using the CMP and sites' storage objects, such as en.json."

    By Table 3, an Undeclared Cookies violation is defined as a cookie absent from the CMP cookie library (Ac/Rc are derived from CMP declarations such as OneTrust en.json), and Section 4.5 classifies exactly that set difference. The precision validation in Section 4.6 then re-checks the same storage objects ('using the CMP and sites' storage objects, such as en.json'), so for the dominant violation type the ground truth and the detector share the same source; the reported >91% precision cannot detect false positives caused by CMP scanning gaps. Section 7.1 concedes that content loaded only in specific contexts can evade CMP auto-crawlers, so absence from en.json conflates developer nondisclosure with scanner failure.

full rationale

The paper's central empirical contribution is a measurement study, not a derived first-principles model, and most of its pipeline is not circular: cookie placement is observed via network traffic, consent choices are exercised through real banner interactions, and regional comparisons are based on repeated crawls rather than fitted parameters. The formal model in Table 3 is a pre-specified taxonomy, not a result derived from the data. There are no load-bearing self-citations or imported uniqueness theorems; the self-citations that appear are for minor methodological points (e.g., recall@k, contradictory-policy analysis) and do not carry the central claim. The one substantive circularity is the Undeclared Cookies definition and its validation. The violation is defined as absence from the CMP cookie library, the classifier implements that definition, and the precision check reuses the same library as ground truth. The paper's own Section 7.1 further admits that CMP crawlers can miss context-dependent cookies, so the set difference that constitutes 'undeclared' may include cookies that were never omitted by the developer but simply not scanned by the CMP. Because undeclared cookies form the largest share of the reported violations and drive the 96-98% headline, part of the central claim reduces by construction. I therefore assign a partial circularity score of 6, while noting that the ignored-rejection findings (over 80% of sites in every region) and the cross-region cookie-count differences are independently measured and would remain meaningful even if the undeclared-cookie counts were recalibrated.

Assumptions & free parameters 2 free parameters · 4 assumptions · 1 invented entities

The central claims rest on three sets of assumptions: the completeness of CMP cookie lists, the correctness of the consent-enforcement model, and the representativeness of cloud-IP crawls with random subpage navigation. The two free parameters are system design choices for the button extractor, not fitted physical constants. No new entities are introduced.

free parameters (2)
  • Button extractor threshold n_t=9 = 9 tokens
    Appendix A.2 states the token threshold was 'empirically selected using training set' for the cookie button classifier. It is a hand-tuned parameter that determines which buttons are considered candidates, but it does not enter the violation definitions.
  • Top-k candidate buttons k=5 = 5
    Section 5.1 states k=5 is a trade-off between coverage and time. It affects which cookie preference menus are found and thus which violations are detected, but it is a system design choice rather than a fitted physical quantity.
assumptions (4)
  • domain assumption CMP cookie declaration lists (e.g., OneTrust en.json) are a reliable ground truth for which cookies are declared or undeclared.
    The Undeclared Cookies violation is defined as a cookie used without appearing in the cookie library (Table 3), so the entire undeclared-cookie count depends on the completeness and accuracy of CMP lists. The paper itself notes in Section 7.1 that CMP crawlers can miss cookies loaded in specific contexts.
  • domain assumption The three consent-enforcement conditions (consent recorded, cookie matches, page in scope) correctly determine when a website should block a cookie after rejection.
    Section 4.2 posits these conditions for mapping consent preferences to cookies. If a CMP does not record consent in one of the expected storage objects, the tool may incorrectly classify a cookie as an ignored rejection or undeclared.
  • domain assumption Cloud provider IP addresses (AWS, DigitalOcean) are adequate proxies for the legal jurisdiction of real users in each region.
    Section 5.5 acknowledges that commercial IPs differ from residential IPs and that site behavior may depend on IP reputation. Geolocation rulesets may respond differently to datacenter IPs, potentially biasing the cross-region comparison.
  • domain assumption The random subpage navigation produces a representative sample of cookies used on the whole site.
    Section 4.6 states that cookies loaded on subpages are not deterministic, and the manual validation found that the same subpages may load different cookies across visits. Violation counts therefore vary by crawl iteration.
invented entities (1)
  • No new entities are introduced.
    purpose: N/A
    The paper does not postulate new particles, forces, or mechanisms. It introduces a new measurement tool, ConsentChk, which is a software artifact, not an invented entity in the sense of an explanatory construct.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Navigating Cookie Consent Violations Across the Globe." pith.science (2026). https://pith.science/paper/BHCEJRIP

@misc{pith2026250608996,
  author       = {Pith},
  title        = {Pith review of: Navigating Cookie Consent Violations Across the Globe},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BHCEJRIP}},
  note         = {Machine review of arXiv:2506.08996}
}
read the original abstract

Online services provide users with cookie banners to accept/reject the cookies placed on their web browsers. Despite the increased adoption of cookie banners, little has been done to ensure that cookie consent is compliant with privacy laws around the globe. Prior studies have found that cookies are often placed on browsers even after their explicit rejection by users. These inconsistencies in cookie banner behavior circumvent users' consent preferences and are known as cookie consent violations. To address this important problem, we propose an end-to-end system, called ConsentChk, that detects and analyzes cookie banner behavior. ConsentChk uses a formal model to systematically detect and categorize cookie consent violations. We investigate eight English-speaking regions across the world, and analyze cookie banner behavior across 1,793 globally-popular websites. Cookie behavior, cookie consent violation rates, and cookie banner implementations are found to be highly dependent on region. Our evaluation reveals that consent management platforms (CMPs) and website developers likely tailor cookie banner configurations based on their (often incorrect) interpretations of regional privacy laws. We discuss various root causes behind these cookie consent violations. The resulting implementations produce misleading cookie banners, indicating the prevalence of inconsistently implemented and enforced cookie consent between various regions.

Figures

Figures reproduced from arXiv: 2506.08996 by the authors.

Figure 1
Figure 1. A cookie banner menu allows users to set their [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. ConsentChk analyzes a website by activating the cookie preference menu and auditing cookie behavior. The dashed box represents an one-time manual step that creates a reusable consent setter for each consent library. We posit that a website should enforce a cookie consent preference and remove/prevent cookie placement if (1) the consent choice is recorded in the browser, (2) the cookie matches, and (3) the web page b… view at source ↗
Figure 3
Figure 3. Breakdown of sites evaluated in our study. [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Cookie counts measured in our study. Violation Type California (CA) Ireland (EU) United Kingdom (UK) Australia (AU) # Cookies % Websites # Cookies % Websites # Cookies % Websites # Cookies % Websites Ignored Cookie Rejection 83,036 88.41% 72,928 86.09% 44,605 84.75% 60…
Figure 5
Figure 5. Figure 5: Normalized average cookie violations per-website. [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: Normalized average per-website 3rd-party cookie violations. [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Pairwise website-level cookie banner implementa [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Relative website-level differences in total cookies. [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: Relative website-level differences in cookie viola [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 13
Figure 13. Figure 13: Pairwise CMP behavior differences. Group Examples Unigrams adchoice, adjust, change, choice, choose, configure, consent, cookie, customise, customize, manage, option, personal, pref￾erence, privacy, review, setting, update, view Bigrams configure consent, set preferen…
Figure 12
Figure 12. Figure 12: Pairwise cookie consent lifetime differences. [PITH_FULL_IMAGE:figures/full_fig_p019_12.png]
Figure 15
Figure 15. Figure 15: Top-k scores of 10-fold validation of ML models [PITH_FULL_IMAGE:figures/full_fig_p020_15.png]
Figure 16
Figure 16. Figure 16: Cookiebot developer interface for handling uncate [PITH_FULL_IMAGE:figures/full_fig_p020_16.png]
Figure 18
Figure 18. Figure 18: Onetrust developer interface for consent expiration [PITH_FULL_IMAGE:figures/full_fig_p020_18.png]
Figure 17
Figure 17. Figure 17: Cookiebot options for regional privacy law tem [PITH_FULL_IMAGE:figures/full_fig_p020_17.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

74 extracted references · 71 canonical work pages

  1. [1]

    A.T. v. Globe24h.com, 2017 FC 114 (CanLII), 2017. URL: https : / / www . canlii . org / en / ca / fct / doc / 2017 / 2017fc114/2017fc114.html

    work page 2017

  2. [2]

    The web changes everything: understanding the dynamics of web content

    Eytan Adar, Jaime Teevan, Susan T Dumais, and Jonathan L Elsas. The web changes everything: understanding the dynamics of web content. In Proceedings of the Second ACM International Conference on Web Search and Data Mining, 2009

    work page 2009

  3. [3]

    URL: https : / / my

    Adding, Editing, and Managing Cookie Consent Templates | MyOneTrust, 2024. URL: https : / / my . onetrust . com / s / article / UUID - e7563ab0 - d1f6 - 8a0f - a2c6 - 101b7e363fba ? language = en _ US & topicId = 0TO1Q000000ItTNWA0

    work page 2024

  4. [4]

    PolicyLint: Investigating Internal Privacy Pol- icy Contradictions on Google Play

    Benjamin Andow, Samin Yaseer Mahmud, Wenyu Wang, Justin Whitaker, William Enck, Bradley Reaves, Kapil Singh, and Tao Xie. PolicyLint: Investigating Internal Privacy Pol- icy Contradictions on Google Play. In 28th USENIX Secu- rity Symposium (USENIX Security 19), 2019. URL: https: //www.usenix.org/conference/usenixsecurity19/ presentation/andow

    work page 2019

  5. [5]

    Say hello to cookie auto-blocking

    Ashlea Cartee. Say hello to cookie auto-blocking. CookiePro

    work page

  6. [6]

    HTTP state management mechanism

    Adam Barth. HTTP state management mechanism. 2011. URL: https://tools.ietf.org/html/rfc6265 (visited on 12/31/2024)

    work page 2011

  7. [7]

    Puppeteer-extra-plugin-stealth

    Berstend. Puppeteer-extra-plugin-stealth. npm. 2021. URL: https://www.npmjs.com/package/puppeteer-extra- plugin-stealth (visited on 06/30/2024)

    work page 2021

  8. [8]

    The belgian DPA has im- posed a fine of C15000 on a website specialized in legal news | european data protection board

    European Data Protection Board. The belgian DPA has im- posed a fine of C15000 on a website specialized in legal news | european data protection board. 2019.URL: https://edpb. europa.eu/news/national-news/2019/belgian-dpa- has- imposed- fine- eu15000- website- specialized- legal-news_en (visited on 06/02/2024)

    work page 2019

Show all 74 references
  1. [9]

    Automating cookie consent and GDPR violation detection

    Dino Bollinger, Karel Kubicek, Carlos Cotrini, and David Basin. Automating cookie consent and GDPR violation detection. In 31st USENIX Security Symposium (USENIX Security 22) , 2022. URL: https : / / www . usenix . org / conference / usenixsecurity22 / presentation / bollinger

    2022

  2. [10]

    Automated, large-scale analysis of cookie notice compliance

    Ahmed Bouhoula, Karel Kubicek, Amit Zac, Carlos Cotrini, and David Basin. Automated, large-scale analysis of cookie notice compliance. In USENIX Security Symposium, 2023

    2023

  3. [11]

    A us-uk usabil- ity evaluation of consent management platform cookie con- sent interface design on desktop and mobile

    Elijah Robert Bouma-Sims, Megan Li, Yanzi Lin, Adia Sakura-Lemessy, Alexandra Nisenoff, Ellie Young, Eleanor Birrell, Lorrie Faith Cranor, and Hana Habib. A us-uk usabil- ity evaluation of consent management platform cookie con- sent interface design on desktop and mobile. In ...

    2023

  4. [12]

    Shin, Jong-Min Choi, and Jun- bum Shin

    Duc Bui, Yuan Yao, Kang G. Shin, Jong-Min Choi, and Jun- bum Shin. Consistency analysis of data-usage purposes in mobile apps. In ACM SIGSAC Conference on Computer and Communications Security (CCS), 2021

    2021

  5. [13]

    Privacy Compliance Usage Distribution in the Top 1 Million Sites

    BuiltWith. Privacy Compliance Usage Distribution in the Top 1 Million Sites. 2022. URL: https://web.archive. org / web / 20220528205303 / https : / / trends . builtwith.com/widgets/privacy-compliance (visited on 05/28/2024)

    2022

  6. [14]

    URL: https://www.oag.ca.gov/privacy/ccpa

    California Consumer Privacy Act (CCPA), 2025. URL: https://www.oag.ca.gov/privacy/ccpa

    2025

  7. [15]

    Make entire div clickable

    Chris Coyier. Make entire div clickable. CSS-Tricks. 2021. URL: https : / / css - tricks . com / snippets / jquery / make-entire-div-clickable/ (visited on 03/01/2024). 15

    2021

  8. [16]

    Goldenshores technologies, LLC, and erik m

    Federal Trade Commission. Goldenshores technologies, LLC, and erik m. geidl, in the matter of. Federal Trade Com- mission. 2013. URL: http : / / www . ftc . gov / legal - library / browse / cases - proceedings / 132 - 3087 - goldenshores - technologies - llc - erik - m - geidl...

    2013

  9. [17]

    Functions | The Cookiebot CMP solution, 2021

    Cookiebot. Functions | The Cookiebot CMP solution, 2021. URL: https : / / www . cookiebot . com / en / functions/ (visited on 08/03/2024)

    2021

  10. [18]

    New UK-GDPR law after Brexit, 2021

    Cookiebot. New UK-GDPR law after Brexit, 2021. URL: https://www.cookiebot.com/en/uk-gdpr/ (visited on 09/19/2024)

    2021

  11. [19]

    Cookiebot Set Up Guide - How to Install Cookiebot CMP,

  12. [20]

    OneTrust cookie auto-blocking™

    CookiePro. OneTrust cookie auto-blocking™. 2021. URL: https://community.cookiepro.com/s/article/UUID- c5122557- 2070- 65cb- 2612- f2752c0cc4aa (visited on 01/14/2025)

    2021

  13. [21]

    Automatic cookie blocking - how does it work? Cook- iebot Support

    Cybot. Automatic cookie blocking - how does it work? Cook- iebot Support. 2019. URL: https://support.cookiebot. com/hc/en- us/articles/360009063100- Automatic- Cookie - Blocking - How - does - it - work - (visited on 01/14/2025)

    2019

  14. [22]

    Cookiebot: check your ’unclassified cookies’

    Cybot. Cookiebot: check your ’unclassified cookies’. Cook- iebot Support. 2021. URL: https : / / bit . ly / 383S0aV (visited on 01/14/2025)

    2021

  15. [23]

    Developer - setting up cookiebot CMP

    Cybot. Developer - setting up cookiebot CMP. 2021. URL: https://www.cookiebot.com/en/developer/ (visited on 01/14/2025)

    2021

  16. [24]

    Duration of CookieConsent 2020

    Cybot. Duration of CookieConsent 2020. Cookiebot Sup- port. 2020. URL: https://bit.ly/3yWzpcE (visited on 08/16/2021)

    2020

  17. [25]

    France: CNIL fines société du figaro C50,000 for placing advertising cookies without user consent

    DataGuidance. France: CNIL fines société du figaro C50,000 for placing advertising cookies without user consent. DataGuidance. 2021. URL: https://www.dataguidance. com / news / france - cnil - fines - soci % C3 % A9t % C3 % A9- du- figaro- %E2%82%AC50000- placing (visited on 0...

    2021

  18. [26]

    We value your privacy

    Martin Degeling, Christine Utz, Christopher Lentzsch, Henry Hosseini, Florian Schaub, and Thorsten Holz. We value your privacy ... now take some cookies: measuring the GDPR’s impact on web privacy. In Proceedings 2019 Network and Distributed System Security Symposium, 2019

    2019

  19. [27]

    A large-scale study of cookie banner inter- action tools and their impact on users’ privacy.Proceedings on Privacy Enhancing Technologies, 2024

    Nurullah Demir, Tobias Urban, Norbert Pohlmann, and Chris- tian Wressnegger. A large-scale study of cookie banner inter- action tools and their impact on users’ privacy.Proceedings on Privacy Enhancing Technologies, 2024

    2024

  20. [28]

    The impact of user location on cookie notices (inside and outside of the european union)

    Rob van Eijk, Hadi Asghari, Philipp Winter, and Arvind Narayanan. The impact of user location on cookie notices (inside and outside of the european union). In Workshop on Technology and Consumer Protection (ConPro’19), 2019

    2019

  21. [29]

    TCF v2.0 - IAB europe

    IAB Europe. TCF v2.0 - IAB europe. https://iabeurope.eu/

  22. [30]

    Official Journal of the European Union , L119, 2016

    Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natu- ral persons with regard to the processing of personal data and on the free movement of such data, and repealing Direc- tive 95/46/EC (General Data Protection Regu...

    2016

  23. [31]

    Ghostery/autoconsent, 2022

    Ghostery. Ghostery/autoconsent, 2022. URL: https : / / github . com / ghostery / autoconsent (visited on 01/11/2025)

    2022

  24. [32]

    Compact Language Detector v3 (CLD3), 2021

    Google Inc. Compact Language Detector v3 (CLD3), 2021. URL: https : / / github . com / google / cld3(visited on 06/27/2021)

    2021

  25. [33]

    URL: https : / / www

    Guidelines on privacy and online behavioural advertising - Office of the Privacy Commissioner of Canada, 2021. URL: https : / / www . priv . gc . ca / en / privacy - topics / technology / online - privacy - tracking - cookies / tracking-and-ads/gl_ba_1112

    2021

  26. [34]

    Shin, and Karl Aberer

    Hamza Harkous, Kassem Fawaz, Rémi Lebret, Florian Schaub, Kang G. Shin, and Karl Aberer. Polisis: Automated Analysis and Presentation of Privacy Policies Using Deep Learning. In 27th USENIX Security Symposium (USENIX Security 18), 2018

    2018

  27. [35]

    Woods, and Rainer Böhme

    Maximilian Hils, Daniel W. Woods, and Rainer Böhme. Mea- suring the emergence of consent management on the web. In Proceedings of the ACM Internet Measurement Confer- ence, 2020. URL: https://doi.org/10.1145/3419394. 3423647

    2020 doi

  28. [36]

    Chrome DevTools Protocol, 2021

    Google Inc. Chrome DevTools Protocol, 2021. URL: https: / / chromedevtools . github . io / devtools - protocol/ (visited on 12/29/2024)

    2021

  29. [37]

    Swarm mode, 2021

    Docker Inc. Swarm mode, 2021. URL: https : / / docs . docker.com/engine/swarm/ (visited on 08/01/2021)

    2021

  30. [38]

    Johnny can’t revoke con- sent either: measuring compliance of consent revocation on the web

    Gayatri Priyadarsini Kancherla, Nataliia Bielova, Cristiana Santos, and Abhishek Bichhawat. Johnny can’t revoke con- sent either: measuring compliance of consent revocation on the web. arXiv preprint arXiv:2411.15414, 2024

    2024 arXiv

  31. [39]

    CookieEnforcer: Automated Cookie Notice Analysis and Enforcement

    Rishabh Khandelwal, Asmit Nayak, Hamza Harkous, and Kassem Fawaz. CookieEnforcer: Automated Cookie Notice Analysis and Enforcement. Technical report arXiv:2204.04221, arXiv, 2022. URL: http://arxiv.org/ abs/2204.04221 (visited on 05/31/2022)

    2022 arXiv

  32. [40]

    Section 11 Consent, justification and ob- jection - POPIA

    Accessible Law. Section 11 Consent, justification and ob- jection - POPIA. POPIA, 2020. URL: https : / / popia . co . za / section - 11 - consent - justification - and - objection

    2020

  33. [41]

    Section 5 Rights of data subjects - POPIA

    Accessible Law. Section 5 Rights of data subjects - POPIA. POPIA, 2019. URL: https://popia.co.za/section-5- rights-of-data-subjects

    2019

  34. [42]

    Tranco: a research-oriented top sites ranking hardened against manipulation

    Victor Le Pochat, Tom Van Goethem, Samaneh Ta- jalizadehkhoob, Maciej Korczy ´nski, and Wouter Joosen. Tranco: a research-oriented top sites ranking hardened against manipulation. In Proceedings of the 26th Annual Network and Distributed System Security Symposium, 2019. 16

    2019

  35. [43]

    Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy? Technical report arXiv:2202.00885, arXiv, 2022.URL: http: //arxiv.org/abs/2202.00885

    Zengrui Liu, Umar Iqbal, and Nitesh Saxena. Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy? Technical report arXiv:2202.00885, arXiv, 2022.URL: http: //arxiv.org/abs/2202.00885

    2022

  36. [44]

    Linking without an ’a’ tag

    Will Bontrager Software LLC. Linking without an ’a’ tag

  37. [45]

    Do cookie banners respect my choice? : measuring legal compli- ance of banners from IAB europe’s transparency and consent framework

    Célestin Matte, Nataliia Bielova, and Cristiana Santos. Do cookie banners respect my choice? : measuring legal compli- ance of banners from IAB europe’s transparency and consent framework. In 2020 IEEE Symposium on Security and Pri- vacy (SP), 2020

    2020

  38. [46]

    Microsoft/playwright-python, 2025

    Microsoft. Microsoft/playwright-python, 2025. URL: https: //github.com/microsoft/playwright-python (visited on 01/18/2025)

    2025

  39. [47]

    Ninja cookie. 2022. URL: https://ninja- cookie.com/ (visited on 01/21/2025)

    2022

  40. [48]

    URL: https://www.willmaster.com/library/ web- development/linking- without- an- a- tag.php (visited on 03/01/2024)

    2024

  41. [49]

    OneTrust cookies

    LLC OneTrust. OneTrust cookies. 2021. URL: https:// bit.ly/3nDfUAV (visited on 05/02/2024)

    2021

  42. [50]

    Data protection act, 2018, 2018

    IV PART. Data protection act, 2018, 2018

    2018

  43. [51]

    URL: https : / / sso

    Personal Data Protection Act 2012 - Singapore Statutes Online, 2025. URL: https : / / sso . agc . gov . sg / Act / PDPA2012?ProvIds=P14-P21-#pr16-

    2012

  44. [52]

    The UK GDPR, 2025

    Information Commissioner’s Office. The UK GDPR, 2025. URL: https://ico.org.uk/for- organisations/dp- at - the - end - of - the - transition - period / data - protection- and- the- eu- in- detail/the- uk- gdpr/ (visited on 01/19/2025)

    2025

  45. [53]

    Privacy online: fair information practices in the electronic marketplace: a federal trade commission report to congress

    Robert Pitofsky, Sheila F Anthony, Mozelle W Thompson, Orson Swindle, and Thomas B Leary. Privacy online: fair information practices in the electronic marketplace: a federal trade commission report to congress. Privacy Online: Fair Information Practices in the Electronic Marke...

    2000

  46. [54]

    Exploring the cookieverse: a multi-perspective anal- ysis of web cookies

    Ali Rasaii, Shivani Singh, Devashish Gosain, and Oliver Gasser. Exploring the cookieverse: a multi-perspective anal- ysis of web cookies. In International Conference on Passive and Active Network Measurement. Springer, 2023

    2023

  47. [55]

    URL: https: //www.oaic.gov.au/privacy/australian- privacy- principles / read - the - australian - privacy - principles

    Read the Australian Privacy Principles, 2025. URL: https: //www.oaic.gov.au/privacy/australian- privacy- principles / read - the - australian - privacy - principles

    2025

  48. [56]

    PIPEDA Fair Information Principle 3 – Consent - Office of the Privacy Commissioner of Canada, 2025. URL: https:// www.priv.gc.ca/en/privacy-topics/privacy-laws- in-canada/the-personal-information-protection- and - electronic - documents - act - pipeda / p _ principle/principle...

    2025

  49. [57]

    Cristiana Santos, Nataliia Bielova, and Célestin Matte. Are cookie banners indeed compliant with the law? : decipher- ing eu legal requirements on consent and technical means to verify compliance of cookie banners.Technology and Regula- tion, 2020, 2020. URL: https://techreg.o...

    2020

  50. [58]

    Consent management platforms under the gdpr: processors and/or controllers? In Annual Privacy Forum

    Cristiana Santos, Midas Nouwens, Michael Toth, Nataliia Bielova, and Vincent Roca. Consent management platforms under the gdpr: processors and/or controllers? In Annual Privacy Forum. Springer, 2021

    2021

  51. [59]

    Html2text, 2025

    Alireza Savand. Html2text, 2025. URL: https://github. com/Alir3z4/html2text (visited on 01/11/2025)

    2025

  52. [60]

    Can i opt out yet? GDPR and the global illusion of cookie control

    Iskander Sanchez-Rola, Matteo Dell’Amico, Platon Kotzias, Davide Balzarotti, Leyla Bilge, Pierre-Antoine Vervier, and Igor Santos. Can i opt out yet? GDPR and the global illusion of cookie control. In Proceedings of the 2019 ACM Asia Con- ference on Computer and Communications...

    2019

  53. [61]

    Towards more accurate retrieval of duplicate bug reports

    Chengnian Sun, David Lo, Siau-Cheng Khoo, and Jing Jiang. Towards more accurate retrieval of duplicate bug reports. In 2011 26th IEEE/ACM International Conference on Auto- mated Software Engineering (ASE 2011). IEEE, 2011

    2011

  54. [62]

    Sweepatic releases GDPR cookie violation de- tection feature, 2022

    Sweepatic. Sweepatic releases GDPR cookie violation de- tection feature, 2022. URL: https : / / blog . sweepatic . com/sweepatic- releases- gdpr- cookie- violation- detection/ (visited on 06/02/2022)

    2022

  55. [63]

    URL: https://www.oaic

    Targeted online marketing, 2025. URL: https://www.oaic. gov . au / privacy / your - privacy - rights / social - media - and - online - privacy / targeted - online - marketing

    2025

  56. [64]

    URL: https : / / www

    Solutions, 2025. URL: https : / / www . onetrust . com / solutions/#regulations

    2025

  57. [65]

    The European Parliament and the Council of the European Union. Regulation (EU) 2016/679 of the European Parlia- ment and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, a...

    2016

  58. [66]

    Automated li- brary recommendation

    Ferdian Thung, David Lo, and Julia Lawall. Automated li- brary recommendation. In 2013 20th Working conference on reverse engineering (WCRE). IEEE, 2013

    2013

  59. [67]

    Cookiepedia: all you need to know about cookies | cookiepedia

    One Trust. Cookiepedia: all you need to know about cookies | cookiepedia. 2025. URL: https://cookiepedia.co.uk/ (visited on 01/19/2025)

    2025

  60. [68]

    The European Parliament and the Council of the European Union. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on priv...

    2002

  61. [69]

    Zxcvbn: {low-budget} password strength estimation

    Daniel Lowe Wheeler. Zxcvbn: {low-budget} password strength estimation. In 25th USENIX Security Symposium (USENIX Security 16), 2016. 17 CA UK AU US SG CAN ZA 0 2 4 6 8 10Mean Difference in T otal Cookies per Site Mean Difference in T otal Cookies per Site Compared to EU Figur...

    2016

  62. [73]

    Cavi-au/Consent-O-Matic, 2025

    Aarhus University. Cavi-au/Consent-O-Matic, 2025. URL: https : / / github . com / cavi - au / Consent - O - Matic (visited on 01/17/2025)

    2025

  63. [2016]

    URL: https : / / eur - lex . europa . eu / eli / reg / 2016/679/oj

    2016

  64. [2019]

    URL: https://www.cookiepro.com/blog/cookie- auto-blocking/ (visited on 01/03/2025)

    2025

  65. [2021]

    URL: https://iabeurope.eu/tcf- 2- 0/ (visited on 01/13/2025)

    2025

  66. [2023]

    URL: https://www.cookiebot.com/en/manual- implementation

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.