Periodic Reporting for period 3 - COOKIES (Economic Consequences of Restrictions on the Usage of Cookies)
Berichtszeitraum: 2022-12-01 bis 2024-05-31
Tracking technologies like Cookies (or “HTTP cookies”) enable companies to collect and exchange extensive information about users. Advertisers often use this information to improve the performance of online advertising, which website publishers rely on in order to finance the “free” content to which their users have become accustomed. Yet, tracking leads to a loss of privacy. Accordingly, EU policy makers have put forward initiatives to restrict tracking technologies such as cookie usage (e.g. General Data Protection Regulation (GDPR), upcoming ePrivacy Regulation).
So far, hardly any empirical knowledge exists on the trade-off between user privacy and the economic value that website publishers, advertisers, and even users derive from tracking technologies such as cookies. As a result, policy makers have no way of telling whether their restrictions on tracking technologies have the intended positive consequences for user privacy, or whether any benefits are outweighed by negative effects on the profits of companies—which policy makers also seek to nurture.
This proposal’s vision is to eliminate the gap in knowledge regarding the economic consequences of restrictions on the usage of tracking technologies such as cookies. I propose four work packages (WP), each outlining the economic consequences of a specific type of restriction on a tracking technology, such as cookies.
In WP1, I look at the economic consequences of cookie lifetime restrictions. Such a restriction implements the users’ (human) right to be forgotten. Some EU member states such as Italy, France, and Spain have already enacted such restrictions. The European Union is considering such restrictions on top of the current privacy laws, for example, within the upcoming ePrivacy Regulation. Yet, the economic consequences for the online advertising industry are unclear, which motivates this working package.
In WP2, I look at the economic consequences of banning tracking technologies such as cookies or Apple’s Identifier for Advertisers (IDFA). The European Commission, browser providers, such as Firefox, and Apple with the App Tracking Transparency (ATT) nowadays reject tracking technologies (e.g. cookies or IDFA) by default. I examine how strongly such decisions reduce the tracking of users and the economic consequences for advertisers and publishers.
In WP3, I look at the economic consequences of enabling users to pay to avoid ads and tracking (e.g. via cookies). Many publishers, particularly in Germany, use “Pay-or-Consent” walls. So, they replace the current implicit exchange between users and publishers (“ads and information in exchange for free content”) by offering users to pay in order to avoid receiving ads and, thus, not using tracking technologies to exchange information (i.e. “no ads and information in exchange for paid content”). I look at how users respond to such “Pay-or-Consent” walls and the economic consequences.
In WP4, I study the economic consequences of obtaining users’ consent to use tracking technologies, such as cookies. In particular, I look at cookie consent banners, their design, the users’ reactions and their economic consequences.
In WP1-3, I analyze a proprietary and massive (60-65 TB) set of “cookie data” that includes 472 publishers, 842 advertisers, 2.8 billion cookies and the prices of >110 billion ad impressions. Furthermore, I collected and analyzed several other data sets (see Table 1).
In WP4, I collect “implementation data” to analyze the steps taken by thousands of the world’s most highly-trafficked websites to become GDPR-compliant. Furthermore, I collected and analyzed several other data sets (see Table 1). In particular, I assembled a panel data set to examine how the firms of the online advertising industry implemented the “Transparency and Consent Framework”, a prominent standard proposed by IAB Europe.
My results will provide a crucial empirical foundation for tracking restrictions in an industry worth more than €10 billion per year in the EU. They help to understand the economic effects of GDPR and major privacy initiatives, such as Apple’s ATT. Such an understanding is essential because publishers, in particular publishers of news, could suffer from strong negative economic effects. As a result, they could decrease their provision of high-quality news or hide it behind a paywall. This potential behavior might increase the widespread of fake-news providers. So, the consequences for society could be severe.
So far, hardly any empirical knowledge exists on the trade-off between user privacy and the economic value that website publishers, advertisers, and even users derive from tracking technologies such as cookies. As a result, policy makers have no way of telling whether their restrictions on tracking technologies have the intended positive consequences for user privacy, or whether any benefits are outweighed by negative effects on the profits of companies—which policy makers also seek to nurture.
This proposal’s vision is to eliminate the gap in knowledge regarding the economic consequences of restrictions on the usage of tracking technologies such as cookies. I propose four work packages (WP), each outlining the economic consequences of a specific type of restriction on a tracking technology, such as cookies.
In WP1, I look at the economic consequences of cookie lifetime restrictions. Such a restriction implements the users’ (human) right to be forgotten. Some EU member states such as Italy, France, and Spain have already enacted such restrictions. The European Union is considering such restrictions on top of the current privacy laws, for example, within the upcoming ePrivacy Regulation. Yet, the economic consequences for the online advertising industry are unclear, which motivates this working package.
In WP2, I look at the economic consequences of banning tracking technologies such as cookies or Apple’s Identifier for Advertisers (IDFA). The European Commission, browser providers, such as Firefox, and Apple with the App Tracking Transparency (ATT) nowadays reject tracking technologies (e.g. cookies or IDFA) by default. I examine how strongly such decisions reduce the tracking of users and the economic consequences for advertisers and publishers.
In WP3, I look at the economic consequences of enabling users to pay to avoid ads and tracking (e.g. via cookies). Many publishers, particularly in Germany, use “Pay-or-Consent” walls. So, they replace the current implicit exchange between users and publishers (“ads and information in exchange for free content”) by offering users to pay in order to avoid receiving ads and, thus, not using tracking technologies to exchange information (i.e. “no ads and information in exchange for paid content”). I look at how users respond to such “Pay-or-Consent” walls and the economic consequences.
In WP4, I study the economic consequences of obtaining users’ consent to use tracking technologies, such as cookies. In particular, I look at cookie consent banners, their design, the users’ reactions and their economic consequences.
In WP1-3, I analyze a proprietary and massive (60-65 TB) set of “cookie data” that includes 472 publishers, 842 advertisers, 2.8 billion cookies and the prices of >110 billion ad impressions. Furthermore, I collected and analyzed several other data sets (see Table 1).
In WP4, I collect “implementation data” to analyze the steps taken by thousands of the world’s most highly-trafficked websites to become GDPR-compliant. Furthermore, I collected and analyzed several other data sets (see Table 1). In particular, I assembled a panel data set to examine how the firms of the online advertising industry implemented the “Transparency and Consent Framework”, a prominent standard proposed by IAB Europe.
My results will provide a crucial empirical foundation for tracking restrictions in an industry worth more than €10 billion per year in the EU. They help to understand the economic effects of GDPR and major privacy initiatives, such as Apple’s ATT. Such an understanding is essential because publishers, in particular publishers of news, could suffer from strong negative economic effects. As a result, they could decrease their provision of high-quality news or hide it behind a paywall. This potential behavior might increase the widespread of fake-news providers. So, the consequences for society could be severe.
Table 2 summarizes all projects and assigns them to one of the four work packages. These projects led to publications, submissions to peer-reviewed journals and conference presentations. My team and I also invested significant efforts in collecting additional, partly proprietary data sets (see Table 1) and contributed to the better documentation of publicly available data sets.
In a project covering all work packages, we wrote the book, “The Impact of the General Data Protection Regulation (GDPR) on the Online Advertising Market”, published in February 2022. This book aims to provide an introduction to the consequences of privacy laws for the online advertising market, focusing on the European General Data Protection Regulation (GDPR) as the first of a handful of strict privacy laws initiated in Europe and worldwide. Specifically, this book begins by outlining how the online advertising industry operates, and providing a breakdown of how the different actors in this industry—primarily publishers and advertisers—leverage users’ personal data to pursue their respective goals. Next, it provides an overview of the contents of the GDPR, highlighting the most meaningful aspects to the advertising industry. In particular, it discusses the need for firms to supply a legal basis for data processing, which, in practice, entails obtaining users’ permission to process their data for specified purposes.
This book further provides detailed descriptions of the complex process of obtaining user permission for data processing, elaborating on the costs involved and the tools developed to assist firms in this process. One such tool is the Transparency and Consent Framework (TCF), a framework designed by Europe’s Internet Advertising Bureau to standardize the procedures through which firms formulate permission requests and transfer user data to other firms in a manner compliant with the GDPR.
The book also provides empirical insights into the complexity of obtaining permission for personal data processing, for industry actors and the users who respond to these requests. Notably, our estimates suggest that if, in line with the GDPR’s vision to put users in control of their data, users were indeed to make all possible decisions regarding the processing of their personal information, the average user would need to devote, on average, 78 minutes per day to making data processing–related decisions.
In a project covering all work packages, we wrote the book, “The Impact of the General Data Protection Regulation (GDPR) on the Online Advertising Market”, published in February 2022. This book aims to provide an introduction to the consequences of privacy laws for the online advertising market, focusing on the European General Data Protection Regulation (GDPR) as the first of a handful of strict privacy laws initiated in Europe and worldwide. Specifically, this book begins by outlining how the online advertising industry operates, and providing a breakdown of how the different actors in this industry—primarily publishers and advertisers—leverage users’ personal data to pursue their respective goals. Next, it provides an overview of the contents of the GDPR, highlighting the most meaningful aspects to the advertising industry. In particular, it discusses the need for firms to supply a legal basis for data processing, which, in practice, entails obtaining users’ permission to process their data for specified purposes.
This book further provides detailed descriptions of the complex process of obtaining user permission for data processing, elaborating on the costs involved and the tools developed to assist firms in this process. One such tool is the Transparency and Consent Framework (TCF), a framework designed by Europe’s Internet Advertising Bureau to standardize the procedures through which firms formulate permission requests and transfer user data to other firms in a manner compliant with the GDPR.
The book also provides empirical insights into the complexity of obtaining permission for personal data processing, for industry actors and the users who respond to these requests. Notably, our estimates suggest that if, in line with the GDPR’s vision to put users in control of their data, users were indeed to make all possible decisions regarding the processing of their personal information, the average user would need to devote, on average, 78 minutes per day to making data processing–related decisions.
The unique aspect of this project is that it looks at the economic consequences of more restrictions of tracking technologies, such as cookies but also Apple’s Identifier for Advertisers (IDFA). These insights will help to much better trade-off between user privacy and the economic value that website publishers, advertisers, and even users derive from tracking technologies such as cookies.
A unique aspect of the project is that it combines the economic, legal and technical perspectives (e.g. in the book or the comparison between the privacy laws of China (PIPL), Europe (GDPR) and California (CCPA).
We currently have several manuscripts under review in our field’s most prestigious journals. Note that the review process in my field is time-consuming, and it usually takes several years until the editor accepts a manuscript for publication.
We also gained access to several proprietary data sets and documented other publicly available data sets. This documentation enables other researchers to much better work with this data.
Two doctoral students (Julia Schmitt and Lennart Kraft) could already submit excellent dissertations.
A unique aspect of the project is that it combines the economic, legal and technical perspectives (e.g. in the book or the comparison between the privacy laws of China (PIPL), Europe (GDPR) and California (CCPA).
We currently have several manuscripts under review in our field’s most prestigious journals. Note that the review process in my field is time-consuming, and it usually takes several years until the editor accepts a manuscript for publication.
We also gained access to several proprietary data sets and documented other publicly available data sets. This documentation enables other researchers to much better work with this data.
Two doctoral students (Julia Schmitt and Lennart Kraft) could already submit excellent dissertations.