How the EU’s General Data Protection Regulation has Affected The Web

Over the course of their study, the research team analysed the privacy policies of the 500 most-frequented websites in each EU member state – 6,357 web pages in total – between January and June 2018. This includes, for example, search engines and online shops, as well as the websites of banks, universities, and governments.

Following the European General Data Protection Regulation, cookie notices have been integrated on many websites.

© RUB, Marquard

Approximately 74 per cent of the analysed websites did not have their respective privacy policies amended until shortly before 25 May 2018. “The analysis has moreover shown that a certain percentage of webpages in some of the countries did not have a policy of that sort at all; it was only integrated just before the GDPR came into force. Ultimately, approximately 85 per cent of the websites we analysed were able to produce a privacy policy by the deadline,” explains Martin Degeling.

Cookie notices on the rise

One of the most noteworthy results relates to the placement of cookie notices that inform users about the usage of cookies. Cookies are stored in the browser and are used by websites via analytics services to evaluate the browsing habits of visitors. After the GDPR came into force, approximately 62 per cent of the analysed websites provided cookie notices – 16 per cent more than in January 2018. Accordingly, cookie notices have been the crucial element that has been on an increase in connection with the implementation of the GDPR. For the most part, however, the notices do not meet the legal requirements, since they do not offer users the necessary options to deactivate cookies.

Second research phase to follow: focus on the user

“In conclusion, we can say that the GDPR has rendered data processing on the Internet more transparent on the one hand; on the other hand, there are no mechanisms yet in place to make the approval process comprehensible and usable for website visitors,” says Martin Degeling. In a second research phase, the researchers will focus on the end users in the context of the GDPR and will study those users’ attitude towards the new privacy policies and cookie notices.

Contacts and sources:
Dr. Martin Degeling
Ruhr-Universitaet-Bochum

Citation: Martin Degeling, Christine Utz, Christopher Lentzsch, Henry Hosseini, Thorsten Holz, Florian Schaub: We value your privacy … now take some cookies: measuring the GDPR’s impact on web privacy, 2018, pre-print online: https://arxiv.org/abs/1808.05096