DeepAI
Log In Sign Up

Your Consent Is Worth 75 Euros A Year – Measurement and Lawfulness of Cookie Paywalls

09/20/2022
by   Victor Morel, et al.
WU (Vienna University of Economics and Business)
Utrecht University
0

Most websites offer their content for free, though this gratuity often comes with a counterpart: personal data is collected to finance these websites by resorting, mostly, to tracking and thus targeted advertising. Cookie walls and paywalls, used to retrieve consent, recently generated interest from EU DPAs and seemed to have grown in popularity. However, they have been overlooked by scholars. We present in this paper 1) the results of an exploratory study conducted on 2800 Central European websites to measure the presence and practices of cookie paywalls, and 2) a framing of their lawfulness amidst the variety of legal decisions and guidelines.

READ FULL TEXT VIEW PDF

page 1

page 2

page 3

page 4

05/07/2021

Did I delete my cookies? Cookies respawning with browser fingerprinting

Stateful and stateless web tracking gathered much attention in the last ...
07/02/2020

The use of personal data in French public services: e-mails, websites, apps

The study we carried out enabled us to extract some conclusions, which a...
07/02/2020

The use of personal data in French public services: applications, e-mails, websites, apps

The study we carried out enabled us to extract some conclusions, which a...
03/01/2021

IP-based Subject Access Requests Denied

Understanding the legal status of IP addresses is complex. In Europe, th...
04/19/2021

No comments: Addressing commentary sections in websites' analyses

Removing or extracting the commentary sections from a series of websites...
11/13/2017

Targeted Advertising Based on Browsing History

Audience interest, demography, purchase behavior and other possible clas...

1. Introduction

Most websites offer their content for free, though this gratuity often comes with a counterpart: the personal data of users is collected to finance these websites services by resorting, mostly, to tracking and thus targeted advertising. Websites may use cookie walls, also known as tracking walls or ”take it or leave it choices” (j_zuiderveen_borgesius_tracking_2017, ; edps_edps_2017, ) which condition the website access to the user’s acceptance of certain trackers on her device (computer or smartphone) (Sant-etal-20-TechReg, ), whereas data subjects are more likely to consent if given such take-it-or-leave options, even if they do not want to provide their personal data in exchange for visiting a website (j_zuiderveen_borgesius_tracking_2017, ). Websites also developed paywalls to enforce their subscription business models: a user who refuses to accept tracking is then obliged to provide a sum of money to access that website (cnil_cookie_22, ). A paywall thus consists of “various strategies that restrict content access until the user pay for them, possibly after allowing them to view some content for free” (papadopoulos_keeping_2020, ).

Paywalls have been questioned from a legal point of view by several non-academic stakeholders (noyb_news_2021, )(cnil_cookie_22, ) because consent to the processing of personal data must be given freely and unconditionally (Art. 7(4) GDPR), and consent is not ”freely given” if users cannot refuse tracking without adverse consequences, e.g., by paying a subscription. European Data Protection Authorities (DPAs) (cnil_cookie_22, ; datenschutz-behorde_faq_2022, ) recently consider paywalls legitimate, though there is some inconsistency in the positions taken on whether a paywall is legally compliant with the General Data Protection Regulation (GDPR) (european_parliament_general_2016, ) and with the ePrivacy Directive (ePD) (european_parliament_directive_2002, ).

Paywalls generally offer the possibility to give access to the content of the website without tracking, against payment or an account subscription, i.e. a paid tracking-free option. But the option of paying the subscription model is not actually free of charge or tracking-free because users might pay with their data, even though they initially paid for an ad-free and tracking-free version of the website. Papadopoulos et al. (papadopoulos_keeping_2020, ) report that users who pay for a subscription do not usually get a tracking-free version of the website since after purchasing a subscription, they face as much advertising and tracking-related resources as possible.

Simply put, paywalls present several novel problems and their cross analysis with cookie walls, coined cookie paywalls (an illustration of which can be found in Figure 1 in the Appendix), has not been analyzed yet. To address this research gap, we investigated the following research questions: (1) What are the different types of paywalls and cookie walls, and how do they articulate with each other? (2) What is the scale of these practices? (3) Are these practices lawful? Pursuant to these questions, we conducted an interdisciplinary and empirical study on the top of 150 websites in Central Europe which resulted in the following contributions: (1) a fine grained classification of paywalls: hard, soft, metered paywall, registration wall, cookie paywalls, and cookie wall, (2) a legal analysis of both cookie walls and paywalls, (3) a quantitative measurement of these practices: 61 of the 2800 websites studied use paywalls (2.72%), and 13 cookie paywalls (0.66%); (4) most cookie paywalls consist of news websites, (5) they do not track visitors prior to interaction, and (6) their prices are within average for newspaper subscription.

2. Background and Related Work

Legal requirements for online tracking. To comply with the GDPR and the ePD, websites must obtain consent from EU users when tracking their behavior (Art. 5(3) ePD) for concrete purposes (such as targeting advertising). Some other purposes are exempted of consent, e.g, functional or essential trackers (Recital 66 ePD). The only way to assess with certainty whether consent is required is to analyse the purpose of each tracer on a given website (EDPB-4-12, ; WP203, ; Foua-etal-20-IWPE, ). A valid consent must comply with several requirements: prior, freely given, specific, informed, unambiguous, readable, accessible, and revocable (Art. 4(11) and 7 GDPR) (Sant-etal-20-TechReg, ). Most relevant to this paper are the requirements of prior and freely given consent.

Prior consent. Before storing or reading the trackers on a user’s terminal, websites need to ask consent to users (Article 6(1) GDPR).

Freely given consent. The request for consent should imply a voluntary choice of the user to accept or decline some or all trackers, taken in the absence of any kind of pressure on the user to persuade her to give consent (wp29_opinion_2011, ; wp29_working_2013, ; wp29_guidelines_2017, ). Making the provision of website service or access thereto conditional on the acceptance of certain non-essential trackers can affect, in certain cases, the freedom of choice (cnil_cookie_22, ), and subsequently, the validity of consent (wp29_guidelines_2017, ).

Paywalls and cookie walls. Few scholars studied paywalls mostly from a business or a digital media point of view (carson_behind_2015, ; fletcher_paying_2017, ; myllylahti_what_2017, ), though the work of Papadopoulos et al. (papadopoulos_another_2020, )

is relevant to our paper since it is the first study investigating the privacy impact of paywalls. They classify paywalls into two categories: i)

hard paywalls ”require paid subscription before a user can access content”, and ii) soft or metered paywalls ”limit the number of articles a viewer can read before requiring a paid subscription”. This latter category is used indistinguishably. They found that 7,6% of websites world-wide used paywalls in 2019, and that most of them are news websites. Another finding is that subscribing to a paying offer does not significantly reduce tracking. Santos et al. (Sant-etal-20-TechReg, ) commented in 2020 that most stakeholders and regulators consider that a cookie wall violates a freely given consent. Outside of the academic scholarship, the Austrian NGO NOYB filed complaints against paywalls of seven major German and Austrian news websites in 2021 (noyb_news_2021, ) considering that consent is not freely given if the alternative to being tracked is to ”pay 100 times the market price of the user’s personal data”.

Consent management. Matte et al. (matte_cookie_2019, ) measured the compliance of IAB Europe’s Transparency and Consent Framework (TCF) is the main framework used by several actors on the web to manage consent. They found that out of 28 257 crawled websites, 1426 implemented the TCF, and further found consent may be stored prior to the user’s consent, or against their will. We build upon prior work and further address (1) the state of current paywall types, (2) the usage by the most visited websites from different countries, (3) the amount of money requested, and (4) how current positions from regulators shape paywall practices.

3. Methodology

Target Countries. We examined top websites of 13 countries that are categorised by (Jordan2005, ) as a part of “Central Europe”: Austria, Croatia, Czech Republic, Estonia, Germany, Hungary, Latvia, Lithuania, Luxembourg, Poland, Slovakia, Slovenia, and Switzerland, a highly interesting target region for our study: (1) they are in the same geographical region, though they show diversity in their language, culture, and economic situation, (2) the countries include former USSR republics, former eastern bloc countries, former western bloc countries, and neutral countries, as well as EU and non-EU countries, (3) these countries have various DPA positioning regarding cookie paywalls (in favor for Austria, critical for Germany, without official statement for some others). We aimed to investigate whether DPA positions is correlated with paywall practices.

Data collection. A list was constituted using Tranco (pochat_tranco_2019, ) and includes the top 1000 Austrian websites and the top 150 websites of each of the 12 other Central European countries (for a total of 2800) between 27th March and 25th April 2022. The reason for conducting a more representative analysis of Austrian websites relied on the fact that the Austrian DPA is the only one ruling in favour of paywall implementation (datenschutz-behorde_faq_2022, ) (see Table 2). We aimed to study whether such a decision impacted the rate or type of paywalls used in Austrian websites. For statistical reasons, the results restricted to the top 150 Austrian websites are presented distinctively (in parenthesis).

Annotation and analysis. Websites were inspected by three female students annotators which are native German speakers, and fluent in English. All non-German or non-English websites were translated using deepl.com. The annotation occurred between 19th May and 31th May 2022. The annotators used Firefox 102.0.1 (64-bit) on the OS Microsoft Windows, free of add-ons and with Standard privacy settings unchanged after installation. The following aspects were annotated: i) whether the website has a cookie wall or paywall, ii) paywall type, iii) website category, and iv) general notes (price /type of subscription, position of the wall on the screen). We initially based our paywall classification on (papadopoulos_another_2020, ) (explained in Section 2), but novel types of paywalls were identified (see Section 4.) The analysis of websites consisted in two rounds of annotations. The results were inscribed in a spreadsheet for each country. In rare cases of disagreements between the annotators, the annotators discussed the case verbally in online-calls until they reached a mutual agreement. The data was then merged into a single spreadsheet to allow the drawing of comparative analysis.

Tracking assessment of cookie paywalls. Since paywalls are claimed to propose an alternative to tracking, we analysed whether or not the websites implementing them were tracking their visitors before a user expresses their decision regarding payment by money (one-time or standing payment) or with their data (giving consent to tracking). A fourth annotator with technical knowledge first visited the annotated websites listed as cookie paywalls in the first round using Firefox 102 on Ubuntu 20.04 in incognito mode, with only the plugin Disconnect in monitoring and no-blocking mode. We recorded the cookies immediately after loading the page and without any previous user consent, and noted the number of trackers spotted by Disconnect. In a second step, the annotator consented to all personal data collection and processing, refreshed the web-page and recorded the cookies and the number of trackers.

Analysis of cookie walls and paywalls. The legal analysis is based on the GDPR and the ePD. We consulted the guidelines of both the European Data Protection Board ((EDPB – an EU advisory board on data protection) and the guidelines and decisions of DPAs, in particular, the very recent positions from 2022 of the French (cnil_cookie_22, ), Austrian (datenschutz-behorde_faq_2022, ) and Italian DPAs (ItalianDPA-cookiewall-2021, ).

4. Results and discussion

Total count Austria Croatia Czech Republic Estonia Germany Hungary Latvia Lithuania Luxembourg Poland Slovakia Slovenia Switzerland Total
Hard cookie paywall 5 (5) 1 6
Cookie wall 6 (1) 6 (1)
Soft paywall 7 (4) 2 3 3 1 4 1 2 1 3 1 6 34 (31)
Metered paywall 1 1 2
Hard paywall 1 (1) 2 1 1 1 6
Cookie paywall + soft paywall 7 7
Registration wall 1 1
Total 19 (11) 3 3 5 9 0 4 1 3 1 4 2 7 61 (53)
Table 1. Paywall count per country. The numbers in parenthesis only consider the first 150 Austrian websites.

4.1. The results of the legal analysis

Divergent positions on cookie walls and paywalls. Borgesius et al. (zuiderveen2017assessment, ), in their EU commissioned study on the Proposal for the ePrivacy Regulation, mentioned a non-exhaustive blacklist of circumstances in which cookie walls are banned: i) tracking on websites, apps and or locations that reveal information about special categories of data, ii) tracking by unidentified third parties for unspecified purposes, iii) tracking by all government funded services, iv) invalid consent (e.g. unequal balance of power) v) consent asked for processing for multiple purposes.

The Austrian DPA (datenschutz-behorde_faq_2022, ) stated that, in principle, it is permissible to ask payment for access to a website as an alternative to consent to tracking. It reiterates his position from 2018 (AustrianDPA-cookiewall-2018, ) wherein it indicated that paywalls give a degree of choice: i) accept tracking while accessing a website; ii) refuse tracking with limited access to a website; or iii) pay subscription fees without tracking.

The French DPA (cnil_cookie_22, ) states that the lawfulness of cookie walls and paywalls must be assessed on a case-by-case basis, depending on a set of five evaluation criteria:

Alternative to tracking. When users refuse consent to tracking purposes, websites need to show there is a ”real and fair” alternative way (by other websites) allowing access to the content, without consenting to data collection. Possible imbalances need to be considered, for example if the website: i) has exclusivity on the content/service offered; ii) is a dominant or essential service provider.

Reasonable price of a paywall. Paywalls are not prohibited, in principle, since it constitutes an alternative to consent to tracking. The paywall price must be reasonable. The threshold of the reasonable rate depends on a case-by-case analysis.

Account requirements. The creation of an account must pursue specific and transparent purposes for users (e.g., a subscription must be accessible on different terminals).

Paywalls is limited to fair remuneration. Paywall are limited to the purposes which allow fair remuneration for the service offered. If a publisher considers that the remuneration for its service depends on the income it could obtain from targeted advertising, only consent for this purpose should be necessary to access the service (refusing consent to, e.g., personalization of editorial content should not then prevent access to the content of the site).

Paywalls cannot impose acceptance of all trackers in a website. Websites may request the user’s consent on a case-by-case basis to deposit trackers when the latter is required to access content hosted on a third-party website.

Stakeholders Positioning on cookie walls and paywalls
EDPB (WPconsent2020, ; EDPB-Privacy2018, ), EDPS (EDPS-epriv-2016, ), BEUC (BEUC-ePriv-2017, ), Dutch (DutchDPA-cookiewall, ), German (GermanDPA-cookiewalls-2019, ), Danish (DanishDPA-cookiewall-2020, ), Belgian (BelgianDPA-cookiewall-2020, ) DPAs Cookie walls violate a freely given consent; access to services and functionalities must not be made conditional on the user consent to non-necessary tracking purposes
Italian (ItalianDPA-cookiewall-2021, ), Spanish (SpanishDPA-cookiewall-2022, ) DPAS Cookie walls are not valid. Exceptions: if i) users are informed, ii) alternative access is offered without requiring acceptance to tracking, iii) equivalent alternative service
French DPA (cnil_cookie_22, ) Paywalls assessed on a case by case analysis according to evaluation criteria: reasonable price, limited to fair remuneration, limited tracking
UK DPA (UKDPA-cookiewalls-2019, ) Unclear position regarding cookie walls. GDPR must be balanced against other rights, including freedom of expression and to conduct a business.
Austrian DPA (datenschutz-behorde_faq_2022, ) Paywalls consist of a valid consent
Table 2. Stakeholders positioning regarding *-walls.

Lawfulness. From the analysis of Table 2, we observe the following: i) several stakeholders present divergent positions regarding cookie walls and paywalls, which hamper the desired level playing field between websites in the EU, as well as legal uncertainty; ii) regulators tend to accept paywalls, according to a case by case analysis and evaluation criteria, (e.g. price that is ”reasonable”, or ”fair remuneration”). Such casuistic analysis blocks efforts for automated auditing from DPAs and other organizations and researchers to check compliance of website paywalls; iii) the concept of equivalent service offer needs criteria to assure a balanced offer; iv) paywalls are dependent on the fact that users are informed of alternative services, though several user studies report that users do not read or understand the content of consent banners (Kulyk20206-userreactiontocookiedisclaimer, ; Borberg2022, ); v) fundamental criteria regarding (a) the type of data that can be processed, (b) the retention period of such data, (c) limits on the purposes, (d) types of data subjects that might be affected (like children) are absent in any of these guidelines; vi) news sites might fall in the category of sites revealing information about special categories of data (Article 9(1) GDPR), since reading about certain topics could reveal one’s political opinion or health status (wesselkamp:hal-03241333, ). Also, information about people’s media use and reading habits is generally sensitive (zuiderveen2017assessment, ); vii) the future ePrivacy Regulation proposal (ePRegulationProposal-Council, ) (in Recitals 20aaaa and 21aa of the Council’s version) already includes the concept of an ”equivalent offer” to consent to tracking purposes and thus acknowledges the possibility of paywalls. It prohibits walls by public authorities, and service providers in a dominant position, alongside with the French DPA standpoint.

4.2. The results of the empirical study

Classification. Though we initially based our classification on the one developed presented in (papadopoulos_another_2020, ), it does not accurately represent the current state of paywalls because i) it does not differentiate soft and metered paywalls, ii) cookie walls and registration walls are absent of their classification despite their presence on the web, iii) different communities refer to the same practices by different terms. Hence, our classification follows: Hard paywall requires a one-time or a standing payment with money (i.e. subscription or enrolment) before any online content can be accessed (as defined by (papadopoulos_keeping_2020, )). Soft paywall presents the beginning of the content to generate interest, but the full content is restricted to payment. Metered paywall provides users with a certain contingent of articles free of charge that is time bounded. Registration wall provides users with only one option of creating an account on the website (otherwise users will have denied access). Cookie wall denies users access if they do not consent to all trackers present on that website, regardless of payment. Cookie paywall provides users with two choices: either 1) consent to tracking, and 2) payment/subscription (by money) to use the website tracking-free.

Prevalence of paywall categories. The analysis was conducted on 2800 websites (see Data collection in Section 3): a) 61 of which contained a paywall (2.72% of the analyzed websites), b) 13 contain a cookie paywall (0.66%), wherein 6 thereof had a hard paywall, and c) 7 embed a cookie paywall combined with a soft paywall. The results are summarized in Table 1. The percentage of paywalls is approximately three times lower than the percentage found by (papadopoulos_another_2020, ), which may indicate a decrease in popularity of this practice: paywalls are not a streamlined practice. However, this finding must be taken with a pinch of salt, notably because 1) the dataset is limited in terms of scope and size since it only comprises the 150 top websites of central European countries which may bias the general results; but also because 2) we observed that it is complex to measure the extent and the scale of this practice with this methodology: manual measurement is intrinsically unpredictable. Indeed, a second analysis lead to different results. This second round was conducted using Firefox 102 and Chrome 103 (Chromium flavored) on Ubuntu 20.04 in incognito mode. We observed discrepancies in real-time between the two browsers, and a general inconsistency of the results according to various parameters, such as the type of browser, the OS, and the IP address. For instance, on the 26th of July, for the same user using the same machine (OS and IP are therefore identical), the website https://dennikn.sk/ presents at the same time a cookie wall on Chrome and a soft paywall on Firefox (see Figure 2 in the Appendix). We draw two conclusions from these findings: i) the extent of these practices is intrinsically hard to measure, especially with a manual analysis; ii) web users are presented with different interfaces according to criteria unknown to them. An automatic and cross-validated large scale analysis may address this issue: an analysis performed by multiple crawlers (automatic) using different settings (cross-validation), to assess how each parameter may influence the presentation to end-users. 111Note that a possible technical manner for website to differentiate users is to collect a fingerprint of their web browser. Other parameters than the OS and the IP address can then be considered to classify users, such as the list of plugins (laperdrix_browser_2020, ). However, even if some reverse engineering may partially explain their working, the lack of transparency from these systems can be seen as deceptive to users. A large scale analysis can be combined with an automated tracking detection.

Types of websites using paywalls. A large majority of paywalls, and more specifically cookie paywalls, were found on news media websites which corroborates (papadopoulos_keeping_2020, )’s findings. One of the arguments in favor of this finding (e.g., in case of the Austrian DPA) is that traditional newspapers and magazines used to sell their printed products to their customers (readers) and this can justify the adoption of paywalls222The authors do not support this argument. Due to the fact that almost only news and magazine websites used a wall, we had decided to further divide this category into: i) daily newspaper, ii) weekly newspaper, iii) weekly magazine, iv) news magazine, v) news portal. The subject-specific magazines that have a cookie wall or paywall in their websites were assigned to the corresponding magazine category, for example, to the category ”technology magazine”. Daily newspapers and news portals use paywalls the most - namely a total of 31 daily newspapers and 14 news portals respectively. In third place are weekly magazines wherein only four weekly magazines with paywalls were found.

Prevalence of TCF framework. Our analysis confirms the prevalence of the TCF framework (introduced in Section 2). Websites using the TCF typically place a cookie named euconsent-v2 on the user’s device once consent has been obtained, and sometimes beforehand. The content of this cookie can be decoded at http://iabtcf.com/#/decode, and yields the purposes and vendors for which consent has been obtained (if any). We found out that 11 out of 13 cookie paywalls are using it.

No tracking prior to user consent. The same tracking assessment indicates compliance with the TCF framework: before any action (besides loading the page), no tracker has been stored (one has been found but on one website which does not use the TCF). Websites using the TCF systematically create a euconsent-v2 cookie (characteristic of the use of the TCF) after consent is given to all tracking purposes. A large scale analysis may lead to different results (see Matte et al. (matte_cookie_2019, )).

Prices of paywalls. All websites presenting cookie paywalls are subscription-based whereby a subscription buys an unlimited access to all content of the website for one user. Subscriptions are mostly offered per month (9 websites out of 13), but some propose a per-week subscription. We observe prices ranging from 2,99€ to 6,25€ per month (after normalization based on the price per year), which amounts to 36 to 75€ per year. These prices are reasonable compared to the average subscription to a newspaper (the average monthly price for an online newspaper is 14.06€  (simon_pay_2019, )). Table 3 in the Appendix presents the subscription prices of cookie paywalls normalized per month and per year.

Registration wall. Only one website (www.nzz.ch) was found that only requires registration (without payment) in order to see the full text of any article.

5. Conclusion and Future work

Cookie paywalls require more attention from both academia and the legislator: the former to provide more substantial technical and legal analyses, and the latter to level the playing field (see (european_data_protection_board_statement_2022, )) towards protective and viable business models across the EU, in line with the current practices and their fast evolution. Technically, large scale analyses and automated tracking detection would shed light on these opaque practices. Legally, case-by-case studies, potentially supported by a technical analysis, would facilitate informed decisions by regulators. Finally, future work includes user-centered studies answering questions such as: (1) Do users actually pay for subscriptions? (2) Which reasons motivate a possible payment? Generally speaking, are cookie paywalls yet another variation of a dark pattern used to nudge users (humanHumanCentricPerspectiveDigital2021, )?

DerStandard Krone Kurier Vol Vienna Spiegel Bild T-online Welt Zeit Heise Stern Rp-online
Price in €
(normalized over a year)
75 59.88 43.2 62.4 62.4 59.88 47.88 35.88 47.88 62.4 59.4 59.88 52
Price in €
(normalized over a month)
6.25 4.99 3.6 5.2 5.2 4.99 3.99 2.99 3.99 5.2 4.95 4.99 4.33
Notes
1€/month for 3 months
then 8€/month
4.99€/month 3.6€/month 1,2€/week 1,2€/week 4,99€/month 3,99€/month 2.99€/month 3,99€/month 1,2€/week 4,95€/month 4,99€/month 1€/week
Table 3. Prices of cookie paywalls
Acknowledgements.
This paper has been partially funded by the Internet Foundation Austria (IPA) within the netidee call (RESPECTeD-IoT Grant#5937). Cristiana Santos is funded by RENFORCE.

References

  • (1) Austrian DPA. Austrian DPA decision regarding the cookiewall of the austrian newspaper ”der standard”, 2018.
  • (2) Belgian DPA. Guidance materials and FAQs on cookies and other tracking technologies, 2020.
  • (3) BEUC. BEUC position paper, ‘proposal for a regulation on privacy and electronic communications (e-privacy), 2017.
  • (4) Borberg, I., Hougaard, R., Rafnsson, W., and Kulyk, O. ”so i sold my soul”: Effects of dark patterns in cookie notices on end-user behavior and perceptions.
  • (5) Carson, A. Behind the newspaper paywall – lessons in charging for online content: a comparative analysis of why Australian newspapers are stuck in the purgatorial space between digital and print. Media, Culture & Society 37, 7 (Oct. 2015), 1022–1041.
  • (6) CNIL. Cookie walls : la CNIL publie des premiers critères d’évaluation, May 22.
  • (7) Danish DPA. Guidance on the management of personal data about website visitors, 2020.
  • (8) Datenschütz-behörde. FAQ zum Thema Cookies und Datenschutz, 2022.
  • (9) Dutch DPA. Cookie walls, 2019.
  • (10) EDPB. Statement of the EDPB on the revision of the eprivacy regulation and its impact on the protection of individuals with regard to the privacy and confidentiality of their communications, 2018.
  • (11) EDPB. Guidelines 05/2020 on consent under regulation 2016/679, 2020.
  • (12) EDPS. Guidelines on the protection of personal data processed through web services provided by eu institutions, 2016.
  • (13) EDPS. EDPS Opinion 6/2017 on the Proposal for a Regulation on Privacy and Electronic Communications (ePrivacy Regulation), 2017.
  • (14) European Data Protection Board. Statement on enforcement cooperation, Apr. 2022.
  • (15) European Parliament. DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), 2002.
  • (16) European Parliament. General Data Protection Regulation, Apr. 2016.
  • (17) European Parliament. Proposal for a regulation of the european parliament and of the council concerning the respect for private life and the protection of personal data in electronic communications and repealing directive 2002/58/ec (regulation on privacy and electronic communications), latest version of the council, 2021.
  • (18) Fletcher, R., and Nielsen, R. K. Paying for Online News: A comparative analysis of six countries. Digital Journalism 5, 9 (Oct. 2017), 1173–1191.
  • (19) Fouad, I., Santos, C., Al Kassar, F., Bielova, N., and Calzavara, S. On Compliance of Cookie Purposes with the Purpose Specification Principle. In 2020 International Workshop on Privacy Engineering, IWPE (2020).
  • (20) German DPA. Guidelines for telemedia providers, 2019.
  • (21) Human, S., and Cech, F. A Human-Centric Perspective on Digital Consenting: The Case of GAFAM. In Human Centred Intelligent Systems (Singapore, 2021), A. Zimmermann, R. J. Howlett, and L. C. Jain, Eds., Smart Innovation, Systems and Technologies, Springer, pp. 139–159.
  • (22) Italian DPA. Guidelines on the use of cookies and other tracking tools, 2021.
  • (23) J Zuiderveen Borgesius, F., Kruikemeier, S., C Boerman, S., and Helberger, N. Tracking Walls, Take-It-Or-Leave-It Choices, the GDPR, and the ePrivacy Regulation. European Data Protection Law Review 3, 3 (2017), 353–368.
  • (24) Jordan, P. Großgliederung europas nach kulturräumlichen kriterien. Europa Regional 4, 13 (2005), 162–173.
  • (25) Kulyk, O., Gerber, N., Hilt, A., and Volkamer, M. Has the GDPR hype affected users’ reaction to cookie disclaimers? Journal of Cybersecurity 6, 1 (12 2020).
  • (26) Laperdrix, P., Bielova, N., Baudry, B., and Avoine, G. Browser Fingerprinting: A Survey. ACM Transactions on the Web 14, 2 (Apr. 2020), 1–33.
  • (27) Matte, C., Bielova, N., and Santos, C. Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework. arXiv:1911.09964 [cs] (Nov. 2019).
  • (28) Myllylahti, M. What Content is Worth Locking Behind a Paywall?: Digital news commodification in leading Australasian financial newspapers. Digital Journalism 5, 4 (Apr. 2017), 460–471.
  • (29) NOYB. News Sites: Readers need to ”buy back” their own data at an exorbitant price?!, Aug. 2021.
  • (30) Papadopoulos, P., Snyder, P., Athanasakis, D., and Livshits, B. Another Brick in the Paywall: The Popularity and Privacy Implications of Paywalls. arXiv:1903.01406 [cs] (May 2020).
  • (31) Papadopoulos, P., Snyder, P., Athanasakis, D., and Livshits, B. Keeping out the Masses: Understanding the Popularity and Implications of Internet Paywalls, May 2020.
  • (32) Pochat, V. L., Van Goethem, T., Tajalizadehkhoob, S., Korczyński, M., and Joosen, W. Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. In Proceedings 2019 Network and Distributed System Security Symposium (2019).
  • (33) Santos, C., Bielova, N., and Matte, C. Are cookie banners indeed compliant with the law? deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners. Technology and Regulation (2020), 91–135.
  • (34) Simon, F. M., and Graves, L. Pay Models for Online News in the US and Europe: 2019 Update. 16.
  • (35) Spanish DPA. Guía sobre el uso de las cookies, 2022.
  • (36) UK DPA. Guidance on the rules on use of cookies and similar technologies, 2019.
  • (37) Wesselkamp, V., Fouad, I., Santos, C., Boussad, Y., Bielova, N., and Legout, A. In-Depth Technical and Legal Analysis of Tracking on Health Related Websites with ERNIE Extension. In WPES 2021 - 20th Workshop on Privacy in the Electronic Society (Seoul, South Korea, Nov. 2021).
  • (38) WP29. Opinion 15/2011 on the definition of consent, 2011.
  • (39) WP29. Opinion 04/2012 on cookie consent exemption (WP 194), 2012.
  • (40) WP29. Opinion 03/2013 on purpose limitation (WP203), 2013.
  • (41) WP29. Working Document 02/2013 providing guidance on obtaining consent for cookies, 2013.
  • (42) WP29. Guidelines on Consent under Regulation 2016/679, Nov. 2017.
  • (43) Zuiderveen Borgesius, F., van Hoboken, J., Fahy, R. P., Irion, K., and Rozendaal, M. An assessment of the commission’s proposal on privacy and electronic communications. Directorate-General for Internal Policies, Policy Department C: Citizen’s Rights and Constitutional Affairs (2017).

Appendix A Additional Material

Figure 1 illustrates a typical example of a cookie paywall.

Figure 1. Example of a cookie paywall on the DerStandard website (https://www.derstandard.at/consent/tcf/), a leading Austrian newspaper and the highest ranked Austrian paywall. The left option proposes to consent to cookies for analytics and personalized advertising. The literal translation means: ”Continue reading with ads. Use derStandard.at with your consent to the use of cookies for web analytics and personalized advertising. Details can be found in the privacy policy. I agree”. The right option is a monthly subscription free of advertising and tracking. Its translation reads ”Subscribe to derStandard.at without any advertising or data tracking on all devices. It can be cancelled monthly at any time. Subscribe now.”

Figure 2 illustrates that for the same user using the same machine (OS and IP are therefore identical), the website https://dennikn.sk/ presents at the same time a cookie wall on Chrome and a soft paywall on Firefox: we observed discrepancies in real-time between two browsers according to various parameters such as the type of browser, the OS, and the IP address.

(a) The website Dennikn.sk presents a cookie wall to Chrome users.
(b) The website Dennikn.sk presents a soft paywall to Firefox users.
Figure 2. The same website presents different types of walls to the same user according to her web browser.