In recent years, privacy laws have been drafted in various parts of the world to restrict the collection of data online. For Europe, this is done, among other things, by the GDPR, which means that websites often require you to give your consent and object to the processing of your data. These approvals typically run through a Consent Management Platform or CMP.

Three scientists, Zengrui Lui (Texas A&M University), Umar Iqbal (University of Washington) and Nitesh Saxena (Texas A&M University) developed a mechanism to test these CMP systems and found that they do not always deliver what they promise. Three of the most popular CMPs were tested: Didomi, Quantcast, Onetrust, and Cookiebot. You can read the full paper of their research here.

Known Vs. Unparalleled Interests

The test method was to create profiles with interests in 16 different niches (including computers, games, news, sports, adult) and visit the fifty most popular websites. An empty profile that had no interests was also used as a control.

At the same time, it was examined how intensively (through automated advertising systems) the various advertisements offered. In general, advertising systems for very targeted advertising about, for example, games, for a profile whose interest in games is known, are offered much brighter and better. The more data there is about the user, the more expensive it is, but it is also more interesting to reach him. This was tested with and without permission for data processing and with the blank profile.

Laws alone are not enough

The conclusion is that data is leaked by most players and used to profile you online, even if you specifically state that you do not want this to happen. Ideally, profiles that do not allow data processing should receive as few real-time bids as an empty profile, which is not the case.

The researchers themselves come to the conclusion that laws alone are not enough to protect people from trackers and data processing. Such systems are not monitored and are not watertight. The ideal solution is that you as a user also use your own tools like extensions that block ads and trackers, but since more work is expected from the user, they also suggest that regulators start taking action against CMP systems who violate the law.