Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies
🤖 AI Summary
This study identifies “stubborn cookies”—third-party cookies persisting in users’ browsers for over ten days after consent via a Consent Management Platform (CMP) banner—which are prematurely transmitted to trackers upon visiting non-consented sites, thereby circumventing GDPR/ePrivacy’s site-specific consent requirements.
Method: The authors design a state-aware, large-scale crawler and conduct phased experiments across the Tranco Top 20k domains, systematically interacting with CMP banners and injecting Global Privacy Control (GPC) signals.
Contribution/Results: This work is the first to systematically discover, characterize, and name this phenomenon. It demonstrates that stubborn cookies increase tracker requests by 6.9× compared to native banner sites; 50% of tested sites deploy them; GPC adoption reduces their transmission by 30%, while explicit banner rejection further reduces it by 32%; notably, cookie paywalls continue to inject stubborn cookies ubiquitously.
Application Category
📝 Abstract
In response to the ePrivacy Directive and the consent requirements introduced by the GDPR, websites began deploying consent banners to obtain user permission for data collection and processing. However, due to shared third-party services and technical loopholes, non-consensual cross-site tracking can still occur. In fact, contrary to user expectations of seemingly isolated consent, a user's decision on one website may affect tracking behavior on others. In this study, we investigate the technical and behavioral mechanisms behind these discrepancies. Specifically, we disclose a persistent tracking mechanism exploiting web cookies. These cookies, which we refer to as intractable, are initially set on websites with accepted banners, persist in the browser, and are subsequently sent to trackers before the user provides explicit consent on other websites. To meticulously analyze this covert tracking behavior, we conduct an extensive measurement study performing stateful crawls on over 20k domains from the Tranco top list, strategically accepting banners in the first half of domains and measuring intractable cookies in the second half. Our findings reveal that around 50% of websites send at least one intractable cookie, with the majority set to expire after more than 10 days. In addition, enabling the Global Privacy Control (GPC) signal initially reduces the number of intractable cookies by 30% on average, with a further 32% reduction possible on subsequent visits by rejecting the banners. Moreover, websites with Consent Management Platform (CMP) banners, on average, send 6.9 times more intractable cookies compared to those with native banners. Our research further reveals that even if users reject all other banners, they still receive a large number of intractable cookies set by websites with cookie paywalls.
Problem
Research questions and friction points this paper is trying to address.
Investigates non-consensual cross-site tracking via persistent cookies
Analyzes impact of banner interactions on covert tracking mechanisms
Measures prevalence and persistence of intractable cookies post-GDPR
Innovation
Methods, ideas, or system contributions that make the work stand out.
Stateful crawls analyze tracking cookie persistence
Global Privacy Control reduces intractable cookies
Consent Management Platforms increase tracking risks
🔎 Similar Papers
No similar papers found.
