Forum Numerica - Cristiana Santos: Your Consent Is Worth 75 Euros A Year – Measurement and Lawfulness of Cookie Paywalls
- Video
- Abstract
-
Most websites offer their content for free, though this gratuity often comes with a counterpart: personal data is collected to finance these websites by resorting, mostly, to tracking and thus targeted advertising. Cookie paywalls, used to retrieve consent for such tracking, recently generated interest from EU regulators and seemed to have grown in popularity. Cookie paywalls allow visitors of a website to access its content only after they make a choice between paying a fee or accept tracking. Several European Data Protection Authorities (DPAs), including the French DPA, recently ruled cases where cookie paywalls were deemed unlawful or issued guidelines imposing safeguards for these practices.
However, it is yet unknown whether websites comply with them. We aimed to investigate the presence, prevalence and whether regulatory positions are correlated with paywall practices.
In this talk I will present the results of our work on paywalls. Paywalls are not restricted to news any longer, they are spread into business, tech, and entertainment websites. Paywalls seem to have a reasonable cost - in average €3.34 euros, yet users prefer to consent to tracking. All found cookie paywalls use the controversial Interactive Advertising Bureau (IAB) Europe Transparency and Consent Framework (TCF) - the European-level association for the digital marketing and advertising ecosystem. Interestingly, the lawfulness of this framework is currently being argued at the Court of Justice of the EU and was considered illegal by the Belgian DPA. Cookie paywalls extensively rely on legitimate interest legal basis systematically conflated with con-sent. There is a lack of correlation between the presence of paywalls and legal decisions or guidelines by DPAs. - About the speaker
-
I am Cristiana Santos, Assistant Professor in Privacy and Data Protection Law, holding a permanent position at UU. I hold a joint international Doctoral Degree in Law, Science and Technology (University of Bologna) and a Ph.D. Degree in Computer Science (University of Luxembourg). My PhD thesis focused on modeling relevant legal information using computational ontologies. Currently, I am an expert of the Data Protection Unit, Council of Europe; expert for the implementation of the EDPB's Support Pool of Experts; and expert of the Digital Persuasion or Manipulation Expert Group. I hold a Inria International Chair Starting Career position (2023-2026) to work on technical and legal aspects of data protection. I am also invited as external expert evaluator of EU funded proposals. I collaborate closely with computer scientists from Inria PRIVATICS team on online privacy. Previously, I was a postdoc at Inria. Prior to joining academia, I was a lawyer and worked as a legal adviser and lecturer at the Portuguese Consumer Protection Organization-DECO.