Ads, cookies, and the European privacy regulation
Jul 8, 2019
It’s been just over a year since the European Union’s (EU) General Data Protection Regulation (GDPR) went into effect, enforcing privacy rules on companies that deal with European citizens’ personal data.
Their findings were presented at the Federal Trade Commission’s PrivacyCon conference held last month in Washington, D.C.
“Before the GDPR was implemented, there was a lot of talk around the industry that it could be the end of the free web as we know it,” says Cristobal Cheyre, a postdoctoral research associate for Carnegie Mellon’s Heinz College and a co-author on the study. “Restricting the ability of the advertising industry to track users might make profitability of online advertising worse, leading some providers to go out of business or degrade their content.”
RT @FTC "Cristobal Cheyre from @CarnegieMellon is presenting early results from work assessing the effects of #GDPR on the quantity and quality of online content. #PrivacyCon19 pic.twitter.com/W6yZRIGv0K"— CyLab (@CyLab) June 27, 2019
Cheyre and colleagues analyzed over 6,000 websites in the EU and the US to test whether this supposed Internet doomsday had materialized or not. In short, the answer they found was: no, at least not yet.
“We haven’t observed major changes in terms of web traffic or quantity or quality of articles posted,” says Cheyre. “Maybe over time it will go down, but we don’t see that yet.”
The team observed a decline in the number third-party cookies – that is, cookies that are placed on your computer not by the domain you’re visiting (e.g. amazon.com) but by some other third party, say, an advertising company – after the GDPR went into effect. Most recently, though, they observed an uptick in the number of those cookies.
The GDPR may have created a cookie ‘spring cleaning’ effect last year.Cristobal Cheyre, Postdoctoral associate, Heinz College
“The GDPR may have created a cookie ‘spring cleaning’ effect last year,” says Cheyre. “As with any spring cleaning, the clutter started accumulating again shortly after.”
Alternatively, the researchers suppose that some websites may have realized their ability to track users have been negatively affected by using too explicit consent mechanisms, and have decided to risk using consent forms that resemble implicit consent notices until enforcement becomes stricter.
The team also observed a slight decline in the number of pageviews at EU websites, which they say might be the result of users turning away when they see privacy notices and consent requests, now required by the GDPR. They also saw that many US news websites seemingly decided to circumvent the GDPR completely by blocking Europeans from visiting them.
RT @FTC "Alessandro Acquisti from Carnegie Mellon University argued that ads targeted with cookies generate only slightly more revenue for online publishers than ads targeted without cookies. #PrivacyCon19 pic.twitter.com/IVlRBBIwlO"— CyLab (@CyLab) June 27, 2019
“Nearly one-fifth of the US-based news and media sites we considered in our study decided to block access from the EU,” Cheyre says.
The world will continue to see consequences of the GDPR over the next couple months or even years, Cheyre says.
“Until we don’t see any notorious enforcement that brings further clarity on how the GDPR should be implemented in the context of online advertising, we won’t fully know what the effect will be.”
Other researchers involved in Chayre's study included former CMU visiting researcher Vincent Lefrere, Engineering and Public Policy Ph.D. student Logan Warberg, CyLab and Heinz College professor Alessandro Acquisti, and University of Minnesota professor Veronica Marotta.
From an economic perspective, this incremental increase translates to eight thousandths of a cent per ad.Alessandro Acquisti, Professor of Information Technology and Public Policy, Heinz College
Cheyre wasn’t the only Carnegie Mellon researcher at PrivacyCon talking about cookies. Acquisti presented findings from a preliminary study that show that ad publishers’ revenues when using cookies are only four percent higher than when users’ cookies aren’t available.
“There is a statistically significant increase in ad publisher revenues associated with the presence of users’ tracking data, but after accounting for other factors, this increase is not particularly large,” says Acquisti. “From an economic perspective, this incremental increase translates to eight thousandths of a cent per ad."
Other authors on Acquist's study included University of Minnesota professor Veronica Marotta and UC-Irvine professor Vebhanshu Abhishek.