[Submitted on 2 Feb 2022 (v1), last revised 28 Feb 2023 (this version, v2)]
Abstract: Data protection regulations, such as GDPR and CCPA, require websites and
embedded third-parties, especially advertisers, to seek user consent before
they can collect and process user data. Only when the users opt in, can these
entities collect, process, and share user data. Websites typically incorporate
Consent Management Platforms (CMPs), such as OneTrust and CookieBot, to solicit
and convey user consent to the embedded advertisers, with the expectation that
the consent will be respected. However, neither the websites nor the regulators
currently have any mechanism to audit advertisers’ compliance with the user
consent, i.e., to determine if advertisers indeed do not collect, process, and
share user data when the user opts out.
In this paper, we propose an auditing framework that leverages advertisers’
bidding behavior to empirically assess the violations of data protection
regulations. Using our framework, we conduct a measurement study to evaluate
two of the most widely deployed CMPs, i.e., OneTrust and CookieBot, as well as
advertiser-offered opt-out controls, i.e., National Advertising Initiative’s
opt-out, under GDPR and CCPA — arguably two of the most mature data protection
regulations. Our results indicate that user data is unfortunately still being
collected, processed, and shared even when users opt-out. Our findings suggest
that several prominent advertisers (e.g., AppNexus, PubMatic) might be in
potential violation of GDPR and CCPA. Overall, our work casts a doubt if
regulations are effective at protecting users’ online privacy.
Submission history
From: Zengrui Liu [view email]
[v1]
Wed, 2 Feb 2022 05:41:59 UTC (890 KB)
[v2]
Tue, 28 Feb 2023 23:13:48 UTC (5,299 KB)
