Privacy Preference Signals: Past, Present and Future
arXiv:2106.02283 · doi:10.2478/popets-2021-0069
Abstract
Privacy preference signals are digital representations of how users want their personal data to be processed. Such signals must be adopted by both the sender (users) and intended recipients (data processors). Adoption represents a coordination problem that remains unsolved despite efforts dating back to the 1990s. Browsers implemented standards like the Platform for Privacy Preferences (P3P) and Do Not Track (DNT), but vendors profiting from personal data faced few incentives to receive and respect the expressed wishes of data subjects. In the wake of recent privacy laws, a coalition of AdTech firms published the Transparency and Consent Framework (TCF), which defines an opt-in consent signal. This paper integrates post-GDPR developments into the wider history of privacy preference signals. Our main contribution is a high-frequency longitudinal study describing how TCF signal gained dominance as of February 2021. We explore which factors correlate with adoption at the website level. Both the number of third parties on a website and the presence of Google Ads are associated with higher adoption of TCF. Further, we show that vendors acted as early adopters of TCF 2.0 and provide two case-studies describing how Consent Management Providers shifted existing customers to TCF 2.0. We sketch ways forward for a pro-privacy signal.
References in corpus (10)
- Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites
- Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation
- Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence
- We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy
- Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR
- Privacy Policies over Time: Curation and Analysis of a Million-Document Dataset
- Uncovering the Flop of the EU Cookie Law
- Privacy Preference Signals: Past, Present and Future
- Security and Privacy Policy Languages: A Survey, Categorization and Gap Identification
- (Un)clear and (In)conspicuous: The right to opt-out of sale under CCPA