Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners - Inria - Institut national de recherche en sciences et technologies du numérique
Preprints, Working Papers, ... Year : 2020

Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners

Abstract

In this work, we analyze the legal requirements on cookie banners as a consent mechanism in Web applications. We describe how banners are supposed to be implemented to be fully compliant with the ePrivacy Directive and the GDPR. Our contribution resides in the definition of 22 operational and fine-grained requirements on cookie banner design that are legally compliant, and moreover, we define whether and when the verification of compliance of each requirement is feasible. The definition of requirements emerges from a joint interdisciplinary analysis composed of lawyers and computer scientists in the domain of web tracking technologies. As such, while some requirements are provided by explicitly codified legal sources, others result from the domain-expertise of computer scientists. In our work, we match each requirement against existing cookie banners designs of websites. We exemplify each requirement with compliant and non-compliant cookie banners. For each requirement, we perform a technical assessment to decide if technical (with computer science tools), manual (with any human operator) or user studies (with a significant number of users) verification is needed to assess compliance of consent. We show that it's not possible to fully assess compliance with the law for the majority of requirements because of the current architecture of the Web. With this approach, we aim to support practically-minded parties (compliance officers, regulators, privacy NGOs, researchers, social and computer scientists) to assess compliance and detect violations in cookie banners' design and implementation, specially under the current revision of the EU ePrivacy framework.
Fichier principal
Vignette du fichier
Journal paper 19-6-2020.pdf (8.38 Mo) Télécharger le fichier
Origin Files produced by the author(s)
Loading...

Dates and versions

hal-02875447 , version 1 (19-06-2020)
hal-02875447 , version 2 (23-09-2020)

Identifiers

  • HAL Id : hal-02875447 , version 1

Cite

Cristiana Santos, Nataliia Bielova, Célestin Matte. Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners. 2020. ⟨hal-02875447v1⟩

Collections

UNIV-COTEDAZUR
2636 View
3040 Download

Share

More