Widely-used cookie walls are flouting GDPR rules

Only 12% of third-party consent-seeking banners and notifications meet minimum requirements

The majority of third-party cookie walls used by UK organisations to obtain consent from users contravene strict data protection laws, researchers claim.

Just 11.8% of the content management platforms (CMPs) deployed by UK websites to seek user consent and offer tracking controls meet minimum legal requirements under the General Data Protection Regulation (GDPR).

CMPs, including banners and pop-up windows, are automatically displayed when users visit a website and give a number of options pertaining to consent as well as advanced controls over elements like tracking.

These are designed and distributed by a handful of developers, including Cookiebot, Crownpeak, OneTrust, QuantCast and TrustArc, and used by organisations who prefer this to building their own. Approximately 20% of the top 10,000 UK websites use such a service.

Among the most widely-used CMPs, researchers with Cornell University found that implied consent is universal, as well as dark patterns that guide people into desired behaviour.

“The results of our empirical survey of CMPs today illustrates the extent to which illegal practices prevail, with vendors of CMPs turning a blind eye to - or worse, incentivising - clearly illegal configurations of their systems,” the researchers concluded.

“Enforcement in this area is sorely lacking.

“Designers might help here to design tools for regulators, rather than just for users or for websites. Regulators should also work further upstream and consider placing requirements on the vendors of CMPs to only allow compliant designs to be placed on the market.”

Researchers scraped designs of the five most popular consent-seeking interfaces deployed by the top 10,000 websites in the UK, finding that explicit consent was rare.

The extent of the scale of non-compliance is so broad that even the Information Commissioner's Office (ICO) admitted last year that its cookie wall was non-compliant.

To be fully GDPR-compliant, the researchers stated, cookie walls must offer explicit consent that’s clear and positive, and allow users to reject all options just as easy as it is to accept all options. These notifications must also contain no pre-ticked boxes.

Related Resource

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

A further in-depth study conducted with 40 participants, moreover, showed how tweaking CMP designs may significantly change the rates of consent.

Organisations, for example, that remove opt-out buttons from the first page of their cookie walls raised consent levels by 22 to 23%. Inversely, offering more granular controls on the first page decreased consent by 8 to 20%.

The key takeaway from the study, according to those involved, was that placing information or controls before the very first layer is almost pointless given it’s largely ignored by users.

Offering genuine controls, therefore, would require organisations to place everything on the first page of any cookie wall.

Alternatively, the design patterns of consent banners could be overhauled to allow for richer and more durable ways to set privacy settings. These would have to be legally binding, however, rather than self-regulatory.

This is difficult because intense lobbying around the EU’s draft ePrivacy Regulation has predominately involved adtech firms campaigning to prevent browsers from having legally-binding elements.

Mozilla is one example of a developer that’s taken action into its own hands, introducing a set of top-level privacy and anti-tracking controls for its Firefox browser last year. Microsoft’s renewed Edge browser, similarly, is packaged with default anti-tracking and baseline cookie blocking.

Featured Resources

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Simplify cluster security at scale

Centralised secrets management across hybrid, multi-cloud environments

Download now

The endpoint as a key element of your security infrastructure

Threats to endpoints in a world of remote working

Download now

2021 state of IT asset management report

The role of IT asset management for maximising technology investments

Download now

Most Popular

Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

21 Oct 2020
What is Neuralink?
Technology

What is Neuralink?

24 Oct 2020
Hackers demand ransom from therapy patients after clinic data breach
Security

Hackers demand ransom from therapy patients after clinic data breach

27 Oct 2020