Privacy consent signals often lost or ignored under iab global platform
One String to Rule Them All: Measuring Consent Under the IAB Global Privacy Platform
Cryptography and Security
Summary
Many websites follow laws that let people say no to tracking, but it's unclear if websites always pass those no-tracking choices to advertisers correctly. The authors checked how the IAB Global Privacy Platform shares these no-tracking signals and found the system often fails to send or respect users’ choices. This means advertisers sometimes ignore opt-out requests even when they should not. Their study points out problems with how this privacy system is put into practice on the web.
What this means in practice
- •For website operators: Check and improve how their sites send user opt-out signals to advertisers to comply with privacy rules.
- •For advertising technology teams: Ensure their systems recognize and respect opt-out consent signals transmitted through the IAB Global Privacy Platform.
Authors
Muhammad Abu Bakar Aziz, Christo Wilson
Abstract
Many privacy regulations, including the California Consumer Privacy Act (CCPA), require websites to honor users' opt-out choices. To facilitate this process, industry has introduced technical standards such as the IAB Global Privacy Platform (GPP), which aims to standardize collection and transmission of user consent information across multiple jurisdictions. However, it remains unclear whether these standards consistently and correctly transmit user opt-out choices, or whether opt-out choices are respected by advertisers. In this study, we conduct an in-depth analysis of consent propagation under the GPP framework. We collect data from four web crawls across four experimental settings to analyze how widely the standard is adopted, the extent to which opt-out signals propagate from publishers to third parties, and whether these signals reach and alter third-party advertiser behavior. Our analysis reveals several inconsistencies in the implementation and adoption of the standard that result in user consent signals being lost and user opt-out choices not being respected by the advertisers.