Ads, cookies, and the European privacy regulation

Daniel Tkacik

Jul 8, 2019

It’s been just over a year since the European Union’s (EU) General Data Protection Regulation (GDPR) went into effect, enforcing privacy rules on companies that deal with European citizens’ personal data.

How has the GDPR affected the use of cookies – those little text files that websites can place on a user’s computer to track their browsing behavior? A team of researchers from Carnegie Mellon, the University of Minnesota, and the University of Paris-Sud have been pondering just that, as well as its impact on websites that rely on cookies for revenue-generating ads. 

Their findings were presented at the Federal Trade Commission’s PrivacyCon conference held last month in Washington, D.C. 

“Before the GDPR was implemented, there was a lot of talk around the industry that it could be the end of the free web as we know it,” says Cristobal Cheyre, a postdoctoral research associate for Carnegie Mellon’s Heinz College and a co-author on the study. “Restricting the ability of the advertising industry to track users might make profitability of online advertising worse, leading some providers to go out of business or degrade their content.”

Cheyre and colleagues analyzed over 6,000 websites in the EU and the US to test whether this supposed Internet doomsday had materialized or not. In short, the answer they found was: no, at least not yet. 

“We haven’t observed major changes in terms of web traffic or quantity or quality of articles posted,” says Cheyre. “Maybe over time it will go down, but we don’t see that yet.”

The team observed a decline in the number third-party cookies – that is, cookies that are placed on your computer not by the domain you’re visiting (e.g. amazon.com) but by some other third party, say, an advertising company – after the GDPR went into effect. Most recently, though, they observed an uptick in the number of those cookies.

The GDPR may have created a cookie ‘spring cleaning’ effect last year.

Cristobal Cheyre, Postdoctoral associate, Heinz College

“The GDPR may have created a cookie ‘spring cleaning’ effect last year,” says Cheyre. “As with any spring cleaning, the clutter started accumulating again shortly after.”

Alternatively, the researchers suppose that some websites may have realized their ability to track users have been negatively affected by using too explicit consent mechanisms, and have decided to risk using consent forms that resemble implicit consent notices until enforcement becomes stricter. 

The team also observed a slight decline in the number of pageviews at EU websites, which they say might be the result of users turning away when they see privacy notices and consent requests, now required by the GDPR. They also saw that many US news websites seemingly decided to circumvent the GDPR completely by blocking Europeans from visiting them.

“Nearly one-fifth of the US-based news and media sites we considered in our study decided to block access from the EU,” Cheyre says.

The world will continue to see consequences of the GDPR over the next couple months or even years, Cheyre says.

“Until we don’t see any notorious enforcement that brings further clarity on how the GDPR should be implemented in the context of online advertising, we won’t fully know what the effect will be.”

Other researchers involved in Chayre's study included former CMU visiting researcher Vincent Lefrere, Engineering and Public Policy Ph.D. student Logan Warberg, CyLab and Heinz College professor Alessandro Acquisti, and University of Minnesota professor Veronica Marotta.

From an economic perspective, this incremental increase translates to eight thousandths of a cent per ad.

Alessandro Acquisti, Professor of Information Technology and Public Policy, Heinz College

Cheyre wasn’t the only Carnegie Mellon researcher at PrivacyCon talking about cookies. Acquisti presented findings from a preliminary study that show that ad publishers’ revenues when using cookies are only four percent higher than when users’ cookies aren’t available.

“There is a statistically significant increase in ad publisher revenues associated with the presence of users’ tracking data, but after accounting for other factors, this increase is not particularly large,” says Acquisti. “From an economic perspective, this incremental increase translates to eight thousandths of a cent per ad."

Other authors on Acquist's study included University of Minnesota professor Veronica Marotta and UC-Irvine professor Vebhanshu Abhishek.