What is in your cookie box? Explaining ingredients of web cookies with knowledge graphs

2.1. Cookies and privacy

For many years, cookies have been viewed as a privacy-preserving mechanism [30]. However, the enforcement of the GDPR and its requirements for the lawful processing of personal data have highlighted the numerous privacy risks associated with them. According to Article 4(1) and Recital 30 of the GDPR, cookies and specifically cookie identifiers are viewed as personal data, which needs to be handled in compliance with the law. This also includes the need for informed consent request for each cookie. Santos et al. [51] present an in-depth analysis of how data-sharing information is presented via cookie consent dialogues. Following the legal requirements of the ePrivacy Directive (ePD) [18] and the GDPR, around 400 cookie banners presented on the most popular English-speaking websites were manually annotated. 89% of the cookie banners violated the applicable laws. More specifically, 61% of the banners violated the purpose specificity requirement by mentioning vague purposes, including “user experience enhancement” while further, 30% of banners used positive framing, breaching the freely given and informed consent requirements. In a similar study, Soe et al. [52] analysed 300 data collection consent notices from news outlets, which were built to ensure GDPR compliance. The analysis uncovered the use of a variety of dark patterns (i.e., deceptive design practices aimed at manipulating users’ actions) [22,34].

Sanchez-Rola et al. [49] explore users’ perception and reaction to cookie dialogues and conclude that users view cookie dialogues as an annoyance during their browsing time rather than an informative source. Although the users claimed to have privacy concerns regarding cookies and how they collect data, the study showed that the cookie disclaimers did not play a significant role in the users’ decision to continue navigating the website. Greater importance was given to factors such as the reputation of the website, which can also affect the users’ trust in its services [12,23].

In a similar study, Bechmann [3] shows that there exists a non-informed consent culture among social media platform users and that although none of the participants of the study had read the privacy policies, all have given consent. Joergensen et al. [29] further confirm that users rarely read the presented data-sharing terms and conditions before granting consent. Furthermore, statistics from countries within and outside the EU show that most users of social networking sites do not read the privacy policies of the sites or the third-party applications that use their data [3]. The studies confirm that for users, giving consent (in any form such as cookies) and being aware of what the action implies are often mutually exclusive [3,29,49].

2.2. Cookie visualisation

The lack of transparency about what accepting a cookie implies and the lack of accessible information about it further contribute to blindly given consent online. Ware [58], Rossi et al. [47] and Drozd et al. [16] highlight the importance of visualisation as a way to support the comprehension of the information that is being communicated to the end user. According to [58], the highest bandwidth channel of communication between humans and machines is provided by visual displays. The amount of information that can be transmitted makes data visualisation a highly appropriate method to communicate information to users.

Rossi et al. [47] emphasize the fact that the use of visualisation is explicitly suggested by the European Union (EU) in legislations such as the GDPR (Rec. 58, Art. 12(7)) as a way to improve comprehension of the information provided to data subjects. One can acknowledge that visual elements and visualisations in general play a crucial role in obtaining informed consent. In recent years there has been a rise in the attempts to build applications that provide more transparency regarding personal data processing through applying different visualisation approaches.

Steichen et al. [53] go deeper into the topic of information visualisation by taking into consideration the role of the individual cognitive style of the users in their ability to perceive the information being communicated in a visual form. Results show that the individual cognitive style plays a significant role in tasks related to information visualisation in general. Findings of the presented work also provide motivation for the development of personalised information visualisation systems based on the cognitive style of the individual users.

In this context, Drozd et al. [16] present the CoRe [15] and the Consent reqUest useR intErface (CURE) user interfaces (UIs), which have the main goal of easing the process of granting consent and providing more transparency into data sharing. The evaluation of the two UIs showed that, indeed, visualisations helped raise awareness of what consent is. However, issues such as information overload due to design complexity were still present. Similar solutions for consent visualisation include the work in [1] and [45], which focuses on raising data-sharing awareness with visualisations. All these studies show that there is a prominent need for consent solutions that support higher levels of transparency, focus on the needs of the users and on raising awareness regarding data sharing.

2.3. Cookies and the Semantic Web

One of the earliest and few studies on cookies through the lens of semantics is presented by Cox et al. [11]. The authors explore the application of the Semantic Web in the privacy field and propose an approach for enriching cookies with Resource Description Framework (RDF) fragments. The main goal of the created semantic cookies is to ease access to web services and give users full control over their data online while widening their participation in the Semantic Web. The study has shown promising results and highlights the benefits of machine-readable cookies for persistence stores to simplify access to services. Cox et al. are one of the first to discuss the use of an ontology as a tool that can align the various representations of cookies online, which can also support legal compliance. However, we were not able to identify any such existing publicly available ontology. Through the years most of the work has focused predominantly on consent. A systematic analysis of semantic models for consent and semantic-based visualisations tools that supports users’ comprehension of consent is presented in [33].

A more recent work that addressed cookies and online data-sharing privacy policies is presented in [2]. Audich et al. [2] propose an ontology for privacy policies, which also includes the concept of a cookie and combines it with natural language processing. The main goal of the approach is to improve the readability of online policies by identifying the key information in a policy for individuals to focus on. Cookies and instances such as do-not-track and web beacons (types of cookies) have been semantically represented as keywords that can be found within policy documents or cookie policies. The results of the study have proven the benefits of utilising an ontology (i.e., helping to align and simplify the complex and diverse legalese that is used) for text mining of privacy policies [2]. The study focused on privacy policies in general and legal terminology used by the Federal Trade Commission.7

Motivated by the lack of consent interoperability and transparency regarding data sharing online, Bless et al. [4] utilise both semantics (i.e., ontologies and KGs) and visualisations as key tools to support individuals’ comprehension of consent for data sharing. In comparison to the work in [15] and [16], the authors focus on visualising data-sharing flows after consent is given. The developed visualisation is based on a KG, which stores informed consent information in a GDPR-compliant manner and has helped to raise individuals’ awareness of data sharing significantly. Further, as shown in [10], the later version of the consent KG has also been successfully utilised for performing GDPR compliance verification and in supporting humans and machines in making sense of consent [32].

The use of ontologies for consent and GDPR compliance is also prominent in the work of Kirrane et al. [31], that shows success in utilisation of semantics to build more accurate models to detect security issues. Moreover, the meaningful interpretation of personal data that is exchanged between users and other entities on the web can be used to empower users to have better control over these interactions and therefore improve the way they manage their online privacy. The semantic approach can also bring advantages to companies through automation, which is enabled by the semantic machine-readable and machine-processable representation of data-related privacy policies. The main trends for utilisation of KGs in the security and privacy domains are further discussed in [10,31]. The benefits of semantics in the legal domain, especially for improving consent interoperability, are also discussed in [8,20,33,59].

Rasmusen et al. [46] present a KG-based interface that visualises consent request and utilises gamification to raise user engagement in data sharing. The main goal of the approach is to improve individual’s awareness of consent and the implications that follow in the context of automotive data. The UI presented follows an ontology that models GDPR knowledge about consent. Results from the user study conducted with participants that interact with the tool show that the UI helped raise the individuals awareness and willingness to consent.

The GDPR has set out specific requirements for requesting consent in an informed way through any medium including cookie dialogues. However, research has shown that there is a lack of standardisation with regard to the design of cookie dialogues and the information presented on them. There is currently a misalignment between law, technology and design when it comes to cookies and the underlying personal data that is collected and shared via them. The proposed work in [11] and [2] has called attention to the benefits of semantics in the privacy field concerning cookies. To our knowledge, there is currently no publicly available vocabulary or ontology that can align the knowledge spread across these domains in the context of GDPR. Cookies have become the go-to tool for many service providers when it comes to personal data collection online. Although this has raised privacy concerns due to the lack of transparency of cookie-based data collection and sharing, there is a lack of user-centered tools that support the comprehension of what cookies are and the implications of giving consent for them. To summarise, based on our research of related work, two main challenges have become evident – the lack of shared vocabulary of the cookie domain that can support knowledge exchange and data interoperability for legal compliance and the lack of support for users in making sense of cookie-based data sharing.

4.1. OntoCookie: A domain ontology for cookies

The OntoCookie4^,5 ontology (Fig. 2) is a formal representation of the cookie domain in the context of GDPR. The ontology was built as a response to the lack of openly available semantic models for cookies and the need for cookie consent compliance (from a design and implementation perspective). By following a top-down ontology engineering approach (see [37]), the main classes, sub-classes the relationships between them and their data properties were defined. When defining the subclasses, an “isA” constraint was followed (e.g., SessionCookie isA Cookie). OntoCookie was built with Protégé12

The class OntoCookie:Cookie represents several types of cookies that are widely used (e.g., session, host only, HTTP only, persistent, authentication, tracking). Definitions for each cookie type have been provided as well by reusing dc:description from the Dublin Core14

OPEN IN VIEWER

Fig. 2.

The OntoCookie ontology.

In order to adhere to GDPR regulations, the users are asked for their informed consent (i.e., users are explicitly asked whether they want their cookie data saved in the KG via a consent dialog). If consent is given, the action flow consists of 11 steps (numbered from 1 to 11 in Fig. 3). In step 1, the users are provided with details about the application. In step 2, the users can import the collected cookie data in JSON format into a designated text field for this purpose. Next, the users have the option to visualise their data. However, before continuing to the next step they are asked for consent via a consent dialog.

OPEN IN VIEWER

Fig. 3.

The action flow of the application.

In the case of consent, the action flow continues to step 3, where the JSON file with cookie data is directed to the NodeJS middleware. A SPARQL INSERT query is constructed by the middleware in step 4, where it is executed in the KG during step 5. Upon completion of the query, the middleware executes a SELECT query in steps 6 and 7, where it fetches all the uploaded cookie data by the current user. In step 8, the queried data is stored in a JSON format. In step 9, the data is processed and consequently visualised in step 10. In step 11, the users can view their cookies data in a human-readable format.

In case the users do not consent to have the cookies stored in the KG, the data will not be annotated to the KG. Users can import the cookies collected into the designated text field created for this purpose. After deciding not to consent (i.e., users have decided not to save the cookie data consumed in the KG), the data will be locally processed and accordingly visualised. In this case, cookie data imported through the Cookie Editor extension will be deleted once the application window is closed. The non-consent action flow follows steps A, B, C and D in succession (Fig. 3).

OPEN IN VIEWER

Fig. 4.

Main input page of the cookie visualisation tool.

The UI is organised in two parts. The first part is a general guide of six steps on how to use the visualisation tool (Fig. 4). Step 1 contains a link to the extension we use to export cookies in JSON format. Step 2 asks the user to enter their randomly generated ID, which is created at the start of our evaluation process. Steps 3 and 4 explain how the user should use the Cookie Editor browser extension to import their cookies into the visualisation tool. For each website, a separate import has to be done, as the browser extension loses the cookies of a website once the user navigates to a different website domain (e.g., navigating from “Wikipedia.org” to “Euronews.com”). Once the users click on the Visualise button, they are asked if they would like to consent to store their cookies on the KG for 10 days, as explained in Section 4.2.

Consequently, the second part of the UI displays all the cookie data, except the stored value, retrieved from the browser extension (Fig. 5). Here, the information is divided into four segments. Segment 1 lists all cookies with their domain, name, type and duration. Segment 2 contains a bar chart grouping the amount of cookies based on their duration. A pie chart containing the distribution of the cookies among all visited websites is visualised in segment 3. Charts were created with the help of the charts_flutter16

To build the back-end, we used NodeJS and also Express for the routing. This has made the creation of our application programming interface easy to use. As mentioned in previous sections, we have created a KG in order to save the information on cookies and their relations with each other. Our KG is contained in GraphDB, a graph database for KGs in RDF. The back-end is connected to GraphDB using the sparql-client library. In this way, we perform SELECT, INSERT and DELETE queries against a SPARQL endpoint via HTTP. All the source code can be found at our GitHub5 including the OntoCookie ontology and a link to try out the cookie visualisation tool.

OPEN IN VIEWER

Fig. 5.

Overview of the cookie visualisation statistics.

In order to get the time of execution of these SPARQL queries,17

5.1. Evaluation set up

To evaluate our solution, its usability and design, three questionnaires (on demographics, expectation, and realisation) were created using Google Forms. The evaluation was done in seven stages (Fig. 6). First, the participants were asked to generate a unique ID using the SHA118

OPEN IN VIEWER

Fig. 6.

Evaluation flow.

For the evaluation, 40 participants (25 male and 15 female) took part in the survey. The age of the participants varied between 18–35 years old where 92.5% were within the range of 18–30 years old and 7.5% were within the range of 30–35 years old. The participants were selected from different backgrounds (computer science students, non-computer science students, researchers, computer-science experts, non-computer science experts) and were based in different countries in Europe (namely, Austria, the Netherlands, Bulgaria and Albania). They were recruited via university network and personal connections. Out of the 40 participants, 20% acknowledged that their highest level of education completed was a high school degree. For 57.5%, the highest level of education obtained was a bachelor’s degree and for 22.5%, the highest level of education obtained was a master’s degree. 30% of the participants declared a very high-level Internet surfing competency, 47.5% a high level of competency, 20% declared an average Internet surfing level competency and 2.5% declared a low level of Internet surfing competency. 65% of our participants spend more than 4 hours per day on the Internet, 25% spend 3–4 hours per day and 10% spend 1–2 hours per day on the Internet.

5.2.1. Expectation vs. realisation

In order to measure the level of comprehension of the users in regards to the cookies collected during the browsing time of the four websites, we at first asked them about their expectation (i.e., how the users expected the results to be before using the application) and compared them with the personalised data (i.e., the factual results) which were visualised by the application. For this purpose, questions related to the amount, duration and source of the cookies collected were asked.

More specifically, to the question: “Which of the websites do you think has the highest amount of cookies?”, 80% of our participants expected it to be “Google.com”, 2.5% expected it to be “Wikipedia.org”, 5% expected “Euronews.com” and 12.5% expected “BBC.com” to have the highest of cookies (Fig. 7(a)). In contrast to the users’ expectations, the results showed that for 60% of the participants, the highest amount of cookies consumed was generated from “Euronews.com”, for only 30% the highest amount of cookies collected was from “Google.com” and for 10%, the highest amount of cookies collected was from “BBC.com” (Fig. 7(b)).

OPEN IN VIEWER

Fig. 7.

Survey results for the amount of cookies collected by each website.

To the question: “Which of the websites do you think has the least amount of cookies?”, 55% of the participants expected it to be the website “Wikipedia.org”, 27.5% expected it to be “Euronews.com”, 10% expected it to be “Google.com” and 7.5% expected to be “BBC.com” (Fig. 7(c)). Results showed that in 77.5% of the cases, “Wikipedia.org” had the least amount of cookies, in 10% of the cases “BBC.com” had the least amount of cookies collected, followed by “Google.com” and “Euronews.com” with 7.5% and 5% respectively (Fig. 7(d)).

When asked: “Which of the websites do you think has the longest lasting cookie?”, 80% of the participants expected it to be “Google.com”, 12.5% expected it to be “Wikipedia.org” and 7.5% expected that the longest lasting cookie originated from “BBC.com” (Fig. 8(a)). Meanwhile, the results obtained show that in 52.5% of the cases, “Google.com” had the longest lasting cookies, “BBC.com” had the longest lasting cookie in 27.5% of the cases and on 20% of the cases the longest lasting cookie belonged to “Euronews.com” (Fig. 8(b)).

OPEN IN VIEWER

Fig. 8.

Survey results for the duration of cookies collected by each website.

To the question: “Which website do you think has the shortest lasting cookie?”, 47.5% of the participants expected “Wikipedia.org” to have the shortest lasting cookie, 35% answered “Euronews.com”, 12.5% answered “BBC.com” and 5% expected the shortest lasting cookie to belong to “Google.com” (Fig. 8(c)). On the contrary, the realisation results showed that in 67.5% of the cases, “BBC.com” had the shortest lasting cookie, in 17.5% of the cases “Euronews.com” had the shortest lasting cookie, in 10% of the cases “Wikipedia.org” had the shortest lasting cookie while on 5% of the cases the shortest lasting cookie belonged to “Google.com” (Fig. 8(d)).

The claim that the users’ knowledge on cookie data is vague and insufficient was further strengthened by the significant differences detected between expectation and realisation, with respect to the total amount of cookies collected and their duration. More precisely, on average, the participants expected the total number of cookies collected during the two minutes of website browsing to be 267.4. Results from the realisation survey showed that, on average, a total amount of 70.8 cookies were collected during their surfing time, approximately 73% less than the users’ expectation (Fig. 9(a)). Regarding the duration of cookies collected, when asked: “How many days on average do you think cookies last?”, the response mean was 119.2 days. Results obtained from the realisation survey show that on average, the cookies collected during the session lasted 281.8 days, approximately 137% more than the expectation (Fig. 9(b)).

The question: “How carefully do you read the cookie notification banner before proceeding to give consent or not?” was numerically encoded on a scale from 1 (“Not carefully at all”) to 5 (“Very carefully”) and was asked to the participants before using the application. 82.5% said that they do not read the banner carefully at all or not carefully, while 17.5% were neutral, read the banner carefully, or very carefully (Fig. 10(a)). After the participants used the application, we asked the question: “How carefully will you be reading the cookie notification banner before agreeing to give consent or not?”. Participants responded that they were willing to be more careful when reading the cookie notification banner before agreeing to cookies, showing a significant increase in awareness related to the process of web cookie agreement. Specifically, 65% of the participants were neutral, willing to be careful, or willing to read very carefully the cookie notification banner and 35% of the participants confessed that they would continue not to be careful or not careful at all when agreeing to the cookie notification banner (Fig. 10(b)).

OPEN IN VIEWER

Fig. 9.

Comparison of expectation vs. realisation averages.

OPEN IN VIEWER

Fig. 10.

Comparison of results regarding the carefulness with which the participants read and will read the cookie notification banner before and after using the application.

5.3. Summary of the results

Evaluation results confirm that users (even proficient web surfers) lack detailed knowledge about cookies and the consequences of granting consent for them. For example, the duration of the cookies being stored, the amount of cookies collected during the browsing time and practices of different websites with regard to the cookies they use, commonly do not match the users’ expectations. The results also showed that the cookie visualisation tool presented helped to improve users’ comprehension of cookies and has raised awareness regarding data sharing on the web. More specifically, after being presented with the application, an increase of 47.5% in the users’ willingness to be more cautious when reading the cookie consent banner before giving consent was noticed. The outcome of the evaluation also confirms that users are ready to embrace an overview tool that helps them manage their cookies. 72.5% of the participants agreed that they would feel more confident about their privacy on the web if they were given such overview tool and 95% of the users admitted that they would feel more knowledgeable about cookies if an overview tool to manage cookies was at their disposal. In addition, we believe that this work helps breach the gap between the Semantic Web and the security and privacy domains.

Table 1 describes how our work compares with the existing work in this field in several aspects. It contains information on results, consent request medium, use of semantics, whether the work focuses on before or after consent is given, whether it includes usage of cookies, and lastly, limitations. Results from the table confirm that there is currently a lack of semantic approaches that describe online cookies in order to enhance the users’ understanding of the cookie data they consume on a personal level while surfing the Internet.