一句话:重新审视最新技术框架下 Web 站点 cookie banner 对 GDPR 与 CCPA 的合规性,并关注违规成因。
GDPR 与 CCPA 等隐私法规深刻影响了在线广告与追踪策略。为符合法规,网站需要展示同意管理界面(即 cookie banner),让用户表达对个人数据处理方式的同意。已有研究虽考察过 GDPR 下 cookie banner 的合规问题,但相关技术规范已发生显著变化,最新框架下的合规状况仍不明确;同时,CCPA 下的 banner 合规也缺乏系统研究。更重要的是,多数工作聚焦于检测法规违规,而对可能的责任方与成因了解甚少。CSChecker 旨在重新审视并系统分析 Web 上 GDPR/CCPA cookie banner 的合规性,并探索违规的可能来源与原因。
Privacy regulations like GDPR and CCPA have greatly affected online advertising and tracking strategies. To comply with the regulations, websites need to display consent management UIs (i.e., cookie banners) implemented under the corresponding technical frameworks, allowing users to specify consents regarding their personal data processing. Although prior works have investigated the cookie banner compliance problems with GDPR, the technical specification has significantly changed. The compliance status under the latest framework remains unclear. There also lacks a systematic study of CCPA banner compliance. More importantly, most work have focused on detecting the regulation violations, whereas little is known about the possible culprits and causes.