# Exploring the Enforcement of Cookie Notices across Continents: An Empirical Study

Jean Luc Intumwayase, Imane Fouad, Pierre Laperdrix, Romain Rouvoy

<figure><img src="image_1.png" /></figure>

## To cite this version:

Jean Luc Intumwayase, Imane Fouad, Pierre Laperdrix, Romain Rouvoy. Exploring the Enforcement of Cookie Notices across Continents: An Empirical Study. WPES 2025 - Workshop on Privacy in the Electronic Society, Oct 2025, Taipei, Taiwan. 10.1145/3733802.3764052. hal-05315594

HAL Id: hal-05315594

https://hal.science/hal-05315594v1

Submitted on 15 Oct 2025

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>
# Exploring the Enforcement of Cookie Notices across Continents: An Empirical Study

Jean Luc Intumwayase
intumwayase@gmail.com
Univ. Lille, CNRS, Inria
France

Pierre Laperdrix
pierre.laperdrix@inria.fr
CNRS, Univ. Lille, Inria
France

## Abstract

Regulatory frameworks, such as GDPR in Europe, CCPA in the United States, and LGPD in Brazil have made cookie notices a standard feature on the web. Websites display notices and sometimes seek user consent for their use of cookies and tracking technologies. However, the visibility and impact of these notices can vary based on the user's geographical location. In our study, we introduce a novel automated visual detection technique to explore the enforcement of cookie notices. This methodology outperforms previous techniques that depend on manual observations or inspection of HTML/CSS elements. Our analysis of 70, 390 web pages visited across five countries on different continents reveals geographical disparities in cookie notice visibility, with France exhibiting the highest prevalence at 69% and Japan the lowest at 27%. This variation in visibility correlates with the state of cookies and tracking. In further examination of interaction with cookie notices, we analyze 351, 950 web pages and find that third-party cookies increase when users interact with the notices, notably in the US. Conversely, France, with its stringent regulations, maintains the lowest number of third-party cookies. Tracking trends closely follow these patterns, highlighting a correlation between the visibility of cookie notices and user tracking. That correlation highlights the need for accurate detection of cookie notices in this domain, as we propose.

## CCS Concepts

* Information systems → World Wide Web; * General and reference → Empirical studies; * Security and privacy → Usability in security and privacy.

## Keywords

Web Cookies; Cookie Notices; User Consent; User Tracking; Web Privacy

## ACM Reference Format:

Jean Luc Intumwayase, Imane Fouad, Pierre Laperdrix, and Romain Rouvoy. 2025. Exploring the Enforcement of Cookie Notices across Continents: An Empirical Study. In *Proceedings of the 2025 Workshop on Privacy in the

Imane Fouad
imane.fouad@um6p.ma
Mohammed VI Polytechnic University
Morocco

Romain Rouvoy
romain.rouvoy@univ-lille.fr
Univ. Lille, CNRS, Inria
France

Electronic Society (WPES '25), October 13–17, 2025, Taipei, Taiwan. ACM, New York, NY, USA, 10 pages. https://doi.org/10.1145/3733802.3764052

## 1 Introduction

The advent of the *General Data Protection Regulation* (GDPR) in Europe, the *California Consumer Privacy Act* (CCPA) in the United States, and the *Protection of Personal Information* (POPI) Act in South Africa has led to a significant increase in the prevalence of cookie consent notices on websites. These notices, which request the user consent for the use of cookies and other tracking technologies, have become a ubiquitous part of the online experience [15]. However, the visibility and the impact of these notices can vary significantly depending on the geographic location of the user [49].

The methodologies in previous studies on the prevalence of cookie consent notices have relied on manual observations of small numbers of websites [2, 16, 26], or the inspection of HTML/CSS elements to detect those notices at scale [3, 20, 22, 28, 33, 37, 47]. There is a question of whether the presence of those elements on the web page guarantees the visibility of consent notices. In some cases, the notice is disabled if the user is visiting the website from a non-regulated area. Another challenge is the limited use of languages to understand the content of a banner to declare it a cookie consent notice. We conduct automatic visual detection of banners to investigate the visibility of consent notices in five countries from different continents. To address the limitation of languages, we use automatic translation to decide on the type of the banner. We, furthermore, examine the geographical impact of those consent notices on the state of cookies and tracking in those countries. Our study sheds light on the following research questions:

* RQ1 How does the visibility of cookie consent notices vary across continents?

* RQ2 How does the state of cookies get impacted by regional variation in cookie notice visibility?

* RQ3 How does the state of tracking get impacted by regional variation in cookie notice visibility?

To examine the variability in the visibility of cookie consent notices across continents, its impact on cookies and tracking, we introduced a novel technique for automated visual detection of these notices. With automatic translation, we addressed language limitations in identifying banner types. We further crawled 14, 078 domains from five countries on different continents, under various

<figure><img src="image_3.png" /></figure>

This work is licensed under a Creative Commons Attribution 4.0 International License. WPES '25, Taipei, Taiwan

© 2025 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-1898-4/2025/10 https://doi.org/10.1145/3733802.3764052
scenarios, to answer the above research questions. Our newly introduced automated visual detection technique has proven to be considerably more effective than previous methods for identifying cookie consent notices. Traditional techniques, such as inspecting HTML/CSS elements or relying on manual observations, often face challenges. They might not accurately detect cookie notices, especially when these are disabled in non-regulated regions. For instance, past research using these traditional methodologies reported a 47% prevalence of banners in Europe [33]. In contrast, our visual approach detected a prevalence of 69% in France. Such differences highlight the precision of our methodology. Moreover, our in-depth exploration across various web pages offers insights into the state of cookies and tracking, emphasizing the relationship between the visibility of cookie notices and user tracking.

In the following sections, we discuss the related work and our methodology. We then present our data collection process, our findings, and discuss their implications. We also present the threats to validity of our approach before concluding the paper.

# 2 Related Work

Early studies cast doubt on the ability of privacy regulations to change the behavior of websites beyond requiring them to display notices [8, 42]. There is a question of what happens when users are located in countries that are not covered by these policies. Sørensen et al. reported that privacy regulations do not affect user tracking activities [43]. More studies have reported that tracking activities remain unhindered despite the prevalence of regulations [31, 45, 46]. In this paper, we investigate the impact of geolocation on the enforcement of cookie notices across countries, focusing on techniques to identify these notices and interacting with them.

## 2.1 Identifying cookie consent notices

Previous related studies fall into manual observation and automatic detection methodologies.

**Manual observation** Studies often focus on learning design patterns and legal compliance of cookie consent notices to regulatory policies. For example, Gray *et al.* identified interface designs that lead users into consenting to cookie notices unknowingly or unwillingly [15]. Santos *et al.* determined vague language and technical jargon designed to impede the user's ability of making an informed choice [38]. While this approach is straightforward, it is time-consuming and does not scale well for large datasets.

**Automatic detection** Previous studies rely on filter lists [40] and patterns of consent management platforms (CMP) [18] to automatically detect the presence cookie notice on the web page [20, 23]. Nouwens *et al.* reverse engineer the CMPs to detect cookie consent notices using adversarial interoperability [28]. The success of these approaches rely on known filter lists or CMP patterns, which restricts their ability to identify cookie notices in the wild.

Bollinger *et al.* proposed a technique using machine learning to detect cookie notices in the wild based on a model trained on CMP patterns [3]. While this study demonstrates high accuracy in controlled test scenarios, the model was difficult to implement in the wild. Differences in website interfaces, language and wording of cookie notices rendered the model ineffective.

Rasaii *et al.* used a z-index approach to automatically detect cookie notices from different geographic locations [33]. The z-index approach present limitations in detecting cookie notices due to page dynamicity. As observed by Nouwens *et al.*, cookie notices load and appear at random times as most web pages are dynamic. The DOM tree must be traversed at the right moment for each web page or else the approach fails to detect the cookie notice. This is a complex task for a large scale study. In Section 3.1, we introduce a novel approach for automatic visual detection of cookie notices, thereby addressing the limitations of relying solely on manual observation, CMPs, tree traversal, or web page elements.

While these studies offer valuable insights, they either do not investigate various geographical regions or rely on manual observation of cookie notices. Consequently, they have a small data set to conclude, or they are limited in accurately detecting the presence or absence of the cookie notices. Our study bridges this gap by examining the visibility of cookie notices across five countries from five continents. We do not only analyze the prevalence of these notices but also investigate the subsequent state of cookies and tracking based on user interactions with those notices.

<figure><img src="image_4.png" /><figcaption>**Figure 1:** A comparison of the success rate of interaction (% of domains on which the extension interacted with a cookie notice as expected), through either acceptance or rejection of cookies, by different Firefox browser extensions. The results are based on a sample experiment conducted on 100 domains, aiming to decide on suitable extensions for our analysis of the state of cookies and tracking, which required not removing cookies or blocking HTTP requests.</figcaption></figure>
## 2.2 User interaction with cookie consent banners

Previous studies have also relied on manual and automatic techniques to interact with the cookie notices. Utz *et al.* analyzed the design of cookie notices in a study where 80,000 users interacted with cookie notices [48]. O'Connor *et al.* conducted a user study to understand how websites comply with the California Consumer Privacy Act (CCPA) [29].

Santos *et al.* conducted an interdisciplinary study to evaluate cookie notices focusing on their textual content [37]. Their approach to interact with cookie notices involved heuristics and tree traversal of web pages. Other studies relied on patterns in CMPs to interact with cookie notices [26, 30, 36, 47, 53].

User interaction with cookie notices in the wild remains a difficult problem to solve. Prior studies leverage filter lists or known CMP patterns, but their interaction capabilities are limited and do not achieve perfect accuracy. The difficulty is compounded by the fact that often web pages deviate from established design conventions or do not use filter lists or CMPs. The primary focus of this study was on detecting cookie notice visibility and analyzing its variations across countries. Implementing user interaction with cookie notices was outside our scope. We nevertheless leveraged existing works to investigate the status of cookies and user tracking upon various user interaction scenarios. In Section 3.2, we discuss our choices in user interaction with cookie notices.

## 2.3 Geographical landscape of web cookies

Iordanou *et al.* analyzed cross-border tracking flows in relation to the geolocation of users [19]. The authors collected data from the interactions of 350 users with cookie notices. They found that most tracking flows within the EU remain confined within the GDPR jurisdiction, suggesting that EU data protection laws effectively regulate these flows. However, the study does not discuss the prevalence of cookie consent notices and the state of tracking in websites across countries, regardless of the geolocation of the web trackers.

Kampanos *et al.* provided insights into the prevalence of cookie notices in Greece and the UK, revealing a significant presence in both countries [20]. However, their study was limited to these two regions. Rasaii *et al.* expanded the geographical scope by analyzing the prevalence in the EU and non-EU regions, highlighting the influence of GDPR on cookie notice prevalence [33].

The variation in user tracking across countries with different levels of privacy regulations has been reported on previously [14]. However, the methodology used to measure the prevalence of cookie consent notice enforcement and user interaction with those notices has not been comprehensively addressed. Studies on this topic have limited geographic coverage and do not consider the interplay of tracking across locations for the same users. We considered the challenges in the studies above when designing our approach to user interaction with cookie consent notices, which we discuss in detail in Section 3.2.

# 3 Methodology

Our goal is to investigate differences within the same website when a cookie notice is not enforced versus when it is. For that, we introduce a novel approach to examine the prevalence of cookie notices

across countries. Our methodology hinges on a visual detection technique that identifies cookie notices more effectively than traditional methods reliant on web page elements or manual checks. We structured our study in three main phases: detecting cookie notices visually, interacting with them, and capturing regulatory effects from five countries: France (GDPR), the United States (CCPA), Brazil (LGPD), Japan, and South Africa.

## 3.1 Visual detection of cookie notices

The primary challenge in detecting cookie notices is distinguishing them from other banners or popups. Rather than relying on patterns in elements of the web page, which can be unreliable due to dynamic content or geolocation-based rendering, we use a visual detection approach as follows:

* First, for each visited website, we capture screenshots during crawls using OPENWPM [9], a privacy measurement framework built on Firefox. We then analyze these screenshots to detect potential inclusion of cookie banners using OPENCV [4], an open-source computer visual library.

* We convert each image to grayscale, then to a binary image, and we focus on structural patterns in the image. Figure 3 illustrates this process. We use contour analysis to detect rectangular shapes in the binary image, typically characteristic of cookie notices, without limiting assumptions on their position and background [44]. We treat all rectangles as potential banners.

* Finally, we apply optical character recognition (OCR) to extract text within the rectangular shapes on original images using Tesseract <fnref n="1" />. During this step, we detect the language used on each website using Google Cloud Translation API <fnref n="2" /> to ensure handling of language nuances due to region variations.

This approach helps us simulate user behavior when detecting cookie banners, providing a more accurate assessment of the presence of these banners.

### 3.1.1 Classification of banners.
To identify cookie notices, we classify the extracted text with a Term Frequency-Inverse Document Frequency (TF-IDF) model [25, 32] and convert it into vectors that highlight key terms. We group these vectors using k-means clusters [39]. We test 2 to 10 clusters and select the best cluster using silhouette score. For each cluster, we extract the top three terms (e.g. "use", "cookie", "accept"). This is effective even for non-English words as text is already translated. We flag clusters with cookie-related terms as cookie notices.

### 3.1.2 Evaluating our classification.
To test the reliability of our classification method, we chose a sample of 380 websites from our crawls across Brazil (BR), France (FR), Japan (JP), South Africa (ZA), and the United States (US). This sample included diverse regulations, languages, and design styles necessary for testing our visual detection approach in the wild. We applied our automated pipeline to the 380 websites. The pipeline involves visual detection with OPENCV, language-aware OCR with TESSERACT, and text classification with TF-IDF and k-means clusters. Subsequently, we manually

<footnote n="1">¹https://tesseract-ocr.github.io</footnote>

<footnote n="2">²https://cloud.google.com/translate</footnote>
Eventually, we had to use two extensions instead of one, IDCAC for accepting cookie notices and Consent-O-Matic for rejecting them.

Despite these challenges, our methodology accounted for the reality of cookie notices on the web. There are instances where websites impose a minimum set of functional cookies that cannot be rejected [21]. Furthermore, dark patterns in cookie notice interfaces often make it difficult to fully reject cookies or obfuscate the process of doing so [17, 41]. In our approach, using IDCAC to accept cookies and Consent-O-Matic to reject them helped us interact better with the cookie notices during our study. However, we recognize that this approach does not capture every detail that our visual approach can.

## 3.3 Connecting to countries

To simulate user geolocation, we connected our crawlers to the five target countries using HOXX VPN<sup>13</sup>. We selected HOXX for its flexibility after testing multiple providers. We verified connection authenticity by manually visiting websites and running sample crawls, to ensure that our measurements were local. We go in further details about our data collection process in the following section.

## 4 Analysis

After setting up our pipeline, it was time to collect data and conduct our analysis on the prevalence of cookie notices and the state of cookies and tracking. We ran thirty crawls in total, six for each country that we studied namely, Brazil (BR), France (FR), Japan (JP), South Africa (ZA), and the United States (US). The six crawls per country consisted of two crawls without interaction with the cookie notices, two crawls where we used IDCAC to accept the cookie notice notices, and finally two crawls where Consent-O-Matic rejected them. The dual crawl in the no interaction, accept, and reject scenarios in each of the five countries permitted us to understand the state of cookies and tracking by looking at the same page and the same country.

### 4.1 Data collection

We used the TRANCO list to choose the domains to crawl. We chose the TRANCO list as its ranking of website popularity surpasses other sources of web traffic analysis [24]. We also chose TRANCO due to the fact that it integrates other rankings, such as the Chrome User Experience Report<sup>14</sup> and Cloudflare Radar<sup>15</sup> and the fact that it was possible to configure local TRANCO rankings for our target countries [35]. Aqeel et al. have also questioned the representativeness of measurement studies that rely only on landing pages and no internal pages, citing a difference in structure and content between the landing page and the internal pages [1]. This was not a concern for our study as our objective was to assess the prevalence of cookie notices and their impact on cookies and tracking, and home pages are by default where those notices are triggered.

Due to the need to conduct a uniform, yet representative, study taking into account the impact of cookie notices on local domains, we configured local TRANCO top 10k lists from BR, FR, JP, ZA, and

<table><caption>Table 1: Comparison of the number of domains displaying cookie consent banners and their corresponding prevalence percentages in five countries: Brazil (BR), France (FR), Japan (JP), South Africa (ZA), and the United States (US), as identified by two different detection methods - our automated visual approach and the z-index approach.</caption><thead><tr><th>Country</th><th>Approach</th><th>Domains with banners</th><th>Banner Prevalence</th></tr></thead><tbody><tr><td rowspan="2">BR</td><td>visual</td><td>4,932</td><td>35%</td></tr><tr><td>z-index</td><td>3,788</td><td>27%</td></tr><tr><td rowspan="2">FR</td><td>visual</td><td>9,723</td><td>69%</td></tr><tr><td>z-index</td><td>7,467</td><td>53%</td></tr><tr><td rowspan="2">JP</td><td>visual</td><td>3,801</td><td>27%</td></tr><tr><td>z-index</td><td>2,919</td><td>21%</td></tr><tr><td rowspan="2">ZA</td><td>visual</td><td>5,849</td><td>43%</td></tr><tr><td>z-index</td><td>4,492</td><td>33%</td></tr><tr><td rowspan="2">US</td><td>visual</td><td>4,435</td><td>32%</td></tr><tr><td>z-index</td><td>3,406</td><td>25%</td></tr></tbody></table>

the US. We combined those lists to make a single list of 50,000 domains, from which we eventually got a list of 14,078 unique domains. We crawled the homepage of each of those domains six times from each country, collecting twice the data for scenarios when (1) the user does not interact with the cookie notice, (2) the user accepts the cookie notice, and (3) the user rejects the cookie notice. In total, we crawled the homepages of 14,078 domains thirty times.

**Summary.** We crawled 14,078 unique top domains from Brazil (BR), France (FR), Japan (JP), South Africa (ZA), and the United States (US). Each domain was visited 30 times across three different states, with six crawls per country.

### 4.2 Prevalence of cookie notices

We apply our cookie banner detection methodology, as described in Section 3, to the studied 14,078 domains. In this section, we present the results of our detection across these websites.

**Visual detection is advancing cookie banner detection.** We ran benchmarks comparing our automated visual approach for detecting cookie notices on the selected set of 14,078 domains against the z-index approach. This comparison was due to the wide use of the z-index approach in prior studies and its limitations as discussed in Section 2.1. In the z-index approach, we examined layered components on a web page for potential cookie notices by checking for elements with higher z-index values, which often indicate overlaying elements like banners. We further incorporated text matching, searching specifically for the words we had obtained, using the banner classification process, within these elements. By contrasting the z-index and text matching method against our automated visual approach, we aimed to assess the effectiveness of each technique in identifying cookie notices. Table 1 summarizes the results of the comparison of each method in detecting cookie notices. The discrepancy between the two approaches can be attributed to the limited capability of the z-index approach to

<footnote n="13"><sup>13</sup>https://hoxx.com</footnote>

<footnote n="14"><sup>14</sup>https://developer.chrome.com/docs/crux/methodology/</footnote>

<footnote n="15"><sup>15</sup>https://radar.cloudflare.com</footnote>
<figure><img src="image_5.png" /><figcaption>Figure 4: Distribution of third-party cookies across websites for different countries. The two plots on the left illustrate the number of third-party cookies served to the user when no cookie notice is shown and when the user has not interacted with the notice yet, while the two plots on the right illustrate the number of cookies after accepting or rejecting cookie notices, respectively.</figcaption></figure>

comprehend the complexity of the code used to display the cookie
notice.

**Regulations are driving the adoption of cookie banners.**

The results of our automated visual approach in detecting cookie
notices show a variation in the prevalence of those notices. Out of
the crawled 14,078 websites, France had the highest prevalence of
cookie notices at 69%, more than twice that of the United States,
which had 32%, while Japan had the lowest prevalence at 27%. While
France and Japan sit on both ends of the spectrum, we observed the
lower ends occupied by South Africa at 43%, Brazil at 35%, and the
United States. The high prevalence of cookie notices in France is due
to the strict data protection regulations enforced in the European
Union (EU). The EU's GDPR and ePrivacy Directive necessitate
explicit user consent for the use of cookies on websites, explaining
the high percentage of domains with cookie notices [50, 54]. Previ-
ous GDPR fines have also contributed to the higher prevalence of
cookie notices in France [34].

Despite Japan’s introduction of the Amended Act on the Pro-
tection of Personal Information, the exact scope and enforcement
level of this legislation remains unclear, possibly contributing to
the lower prevalence of cookie notices observed. Unlike the well-
established and strictly enforced data protection regulations in the
EU, Japan’s regulatory framework may not yet exert a strong influ-
ence on the practices of website operators regarding cookie consent.
This situation might explain the 27% prevalence of domains dis-
playing cookie notices in Japan, as compared to the 69% prevalence
in France. The uncertainty surrounding the enforcement and the
breadth of the Amended Act could lead to less adoption of cookie
notices in Japan. This is also the case for the US which does not
have a federal law regulating the use of cookies, but state-level
laws like the California Consumer Privacy Act (CCPA) and Virginia
Consumer Data Protection Act (CDPA) consider cookies as per-
sonal information [6, 12]. While this may contribute to an elevated
prevalence of cookie notices on websites operating or having a
significant user base in these states, it remains unclear how those
state-level laws can be enforced for a wider impact.

A slightly higher prevalence of cookie notices in South Africa
compared to Brazil, the US, and Japan, may be explained by the *Pro-
tection of Personal Information* (POPI) Act that applies to businesses
operating within South Africa [7]. POPI mandates data protec-
tion measures including cookie notices. While the enforcement

clarity may not be entirely apparent, it instills a level of caution
among website developers to avoid potential legal repercussions.
The presence of cookie and personal data protection guidelines
under Brazil's LGPD is acknowledged, yet effective compliance and
enforcement have been scrutinized in several studies [5, 10, 11].
This might be a contributing factor to the observed low prevalence
of cookie notices in Brazil. The regulatory landscape in the five
countries significantly influences the prevalence of cookie notices.
Effectiveness in stringency and enforcement drives higher preva-
lence while the opposite drives down the prevalence. These results
underscore the importance of understanding regional nuances in
cookie policies across countries and their impact.

**Summary.** Using our approach, we achieved a detection of cook-
ies banners with a higher accuracy than previous work across dif-
ferent countries. The highest increase was observed in South Africa
(ZA), with a 30.30% increase compared to the z-index approach. We
also show that regulation plays a significant role in the adoption of
cookie banners, with the highest adoption observed in France (FR),
likely due to the influence of GDPR.

## 4.3 State of cookies

Our results, as shown in Figure 4 indicate that before interaction,
users in the US are served with the highest number of third-party
cookies, more than double the number of other countries such as
Brazil, Japan, and South Africa. Users in France are served the least
number of third-party cookies. The high number of third-party
cookies in the US may be explained by the fact that online ad-
vertising is often the business model of websites operating in or
targeting users from the US [52]. As we have previously mentioned,
this often means including third-party cookies to enable targeted
advertising. In France, in addition to GDPR, the low amount of
third-party cookies may be explained by the oversight of third-
party cookies and other trackers by the country's data protection
authority, CNIL <fnref n="16" />. Given this oversight, websites that operate in
France or target French users tend to adopt a more conservative ap-
proach [27, 51]. Specifically, they may limit their use of third-party
cookies to ensure that they remain compliant with local regulations
and avoid potential penalties [13]. This proactive compliance can

<footnote n="16">¹⁶https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/que-dit-la-loi</footnote>
<figure><img src="image_6.png" /><figcaption>Figure 5: Comparative analysis of cookies set during the crawl across five countries: Brazil (BR), France (FR), Japan (JP), South Africa (ZA), and the United States (US). “TP” stands for third-party cookies, and “FP” stands for first-party cookies.</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>Figure 6: Prevalence of cookie notices, ID cookies, sites serving ID cookies, third-party requests, and tracking requests in different scenarios: No Cookie Notice, No Interaction, Accept, and Reject.</figcaption></figure>

explain the low amount of third-party cookies served to users in France compared to other countries.

To avoid bias during the analysis of the state of cookies after interaction with cookie notices, it was necessary to determine common websites where the extensions, IDCAC and Consent-O-Matic, had worked to accept and reject the cookie notices. Out of 14,078 domains that we crawled, the extensions had both worked on 3,082 domains (21.9%). Thus, our further analysis of the state of cookies after interaction with cookie notices focused on those 3,082 websites. Most of the disparity in the distribution of third-party cookies remains after interaction with cookie notices, both in the *accept* and *reject* cases, especially in the case of the US having the highest number of third-party cookies being served and France having the least. It is worth noting, however, that although the overall number remains the lowest, third-party cookies increase in France when the user interacts with the cookie notice. For the 3,082 websites where interaction with cookie notices was possible, average cookies per website in France ranged from 4.89 before interaction to 6.03 and 6.00 after the “accept” and “reject” scenarios respectively. This shows in a 23% increase in third-party cookies per website after user interaction with cookie notices in France. This is not

the case in other countries. Figure 5 illustrates the state of cookies across countries before and after interacting with cookie notices. The number of third-party cookies remains almost the same after user interaction with the cookie notice, despite the fact that it is measured with a far smaller dataset. That indicates a surge in third-party cookies after user interaction with the cookie notice. This prevalence of third-party cookies shows an interest by the website operators in tracking user behaviors across different websites.

This trend, along with the reliance on granular data by tracking mechanisms, led us to the topic of ID cookies. ID cookies are special because they are designed to provide distinct identifiers that can be used for tracking, especially for advertisers and data analytics platforms seeking to understand user behavior and preferences. To understand the prevalence of these ID cookies in our study, we used the methodology introduced by Wesselkamp et al. [53]. Compared to the vast number of cookies shown in Figure 5, ID cookies appear to be less prevalent. However, as shown by Figure 6, when users interact with cookie notices (*accept* and *reject*), the number of ID cookies triples in each country except South Africa where it quadruples. That is the same case with websites serving those ID cookies. That increase in both cases can be linked to the
<figure><img src="image_8.png" /><figcaption>Figure 7: Comparative analysis of HTTP requests made during the crawl across five countries: Brazil (BR), France (FR), Japan (JP), South Africa (ZA), and the United States (US).</figcaption></figure>

use of dark patterns in the design of interfaces for cookie notices. Dark patterns trick users into making decisions they might not necessarily want to make, such as placing the "Accept All" button in a more prominent position or misleading users into thinking they have rejected cookies when they have not. The extensions that we rely on may not be equipped to deal with advanced dark patterns in cookie banners.

**No Cookie Notice.** The observations above raise the question: what happens when there is no cookie notice? Figure 6 illustrates the state of cookies in the No Interaction plot. However, the scenario of No Interaction differs from the situation where no cookie notice is shown. To examine that later situation, we checked for websites where cookie notices were accepted and rejected in France but no cookie notice was shown on those websites in any other country. We found 429 such websites. The No Cookie Notice plot in Figure 5 illustrates the distribution of third-party cookies on those websites. Contrary to the trend in other plots where the US has the highest number of third-party cookies, half of these 409 websites show an unusually high number of third-party cookies with South Africa being on top. Figure 6 also corroborates this trend where South Africa has the highest prevalence of ID cookies and websites that serve ID cookies when no cookie notice was shown. This suggests that cookie notices present restraint to website operators who only unleash the majority of tracking when the user interacts with the cookie notice. On the contrary, in regions where the regulations or their enforcement is not clear, users are targeted by a high number of cookies and tracking.

## 4.4 State of tracking

Figure 7 illustrates the analysis of HTTP(S) requests during our crawls across the five countries. The substantial volume of requests can be attributed to essential HTTP(S) requests that websites need to function properly. In general, when a website displays the cookie notice, HTTP(S) requests tend to have a similar pattern whether it is third-party or tracking requests except for the US. Before interaction with the cookie notice, our results indicate that most third-party requests sent by the websites in the US are also tracking requests. This changes after interaction with the cookie notice, where there is a surge of both third-party requests in the accept and reject cases. This indicates dense activities upon user consent and suggests that websites do not necessarily honor the user's choice of consent.

When there is no cookie notice displayed, tracking mechanisms across countries seem to be uninhibited as seen in Figure 7. This suggests that in the absence of regulations or enforcement, website operators rely heavily on third-party tools and tracking mechanisms. Similar to our previous discussion concerning the prevalence of the cookie notices, the high number of HTTP(S) requests including third-party and tracking in the US can be attributed to the advertising industry and the lack of a federal data protection regulation like GDPR in Europe. State-specific regulations such as California's CCPA do not specifically require explicit consent upfront. On the contrary, South Africa's POPI Act is similar to GDPR but its enforcement is not as stringent, hence the increase in HTTP(S) requests and tracking.

## 5 Discussion

We explored the enforcement of cookie notices across continents, providing an overview of their adoption and implementation. One key observation from our study is the role of cookie notices in notifying users about the use of cookies and other related disclaimers. Cookie notices serve as a "garde fou" for website operators, essentially acting as a safety net. Instead of immediately initiating tracking, operators await user engagement. This works in regions with stringent regulations on data protection and user privacy, compelling website operators to secure user consent before conducting intrusive activities such as tracking. On the contrary, when users visit websites from areas without such regulations, website operators often do not always seek upfront consent.

Consequently, these websites revert to their older behavior patterns, relying heavily on third-party tools and tracking mechanisms. This differentiation in approach highlights disparity in user experience based on their geographical location and the regulatory environment. Furthermore, our study highlights economic incentives behind the adoption of certain tracking mechanisms. The reliance on third-party tools and tracking mechanisms, particularly in unregulated regions, might be driven by the potential gains from targeted advertising and data sharing. This economic angle warrants further exploration to understand the trade-offs between user privacy and revenue generation. In conclusion, while cookie notices have become a ubiquitous feature of the modern web, their enforcement and impact vary widely across regions. Striking a balance between regulatory compliance, user experience, and economic incentives remains a challenging task for website operators.
# 6 Threats to validity

A primary concern regarding the validity of our study is the reliance on the k-Means clustering technique that we used. While the method is robust, no clustering technique is error-free. The potential for misclassification, even if minimal, exists. Such misclassifications, however subtle, could introduce deviations in our data, thereby influencing the cookie notice prevalence discussed in our study. Additionally, our reliance on the Google Translation API introduces another layer of potential complexity. Though this API offers efficiency, it might not always capture the nuances of every language perfectly. This could lead to potential misinterpretations of cookie notices, especially when analyzing the wording and intent across diverse linguistic landscapes. Furthermore, the use of cookies and HTTP(S) requests in our study can also be influenced by regional, cultural, or local intricacies in designing websites and creating content. Different regions might have unique design philosophies, content creation standards, or user engagement strategies, which could inadvertently affect the way cookies are utilized or HTTP requests are made.

# 7 Conclusion

Our study provides a comprehensive analysis of cookie notices on a global scale, emphasizing the impact of regional regulations on website behavior. Through automated visual detection across a vast dataset of web pages, we identified disparities in the enforcement and visibility of cookie notices based on geographical location. The findings indicate that while many regions have adopted cookie notices as a tool for transparency, their implementations vary. This variability can lead to differing user experiences and perceptions about online privacy. These disparities highlight the need for harmonized web privacy norms and more stringent, universally applicable regulations.

# References

[1] Waqar Aqeel, Balakrishnan Chandrasekaran, Anja Feldmann, and Bruce M. Maggs. 2020. On Landing and Internal Web Pages: The Strange Case of Jekyll and Hyde in Web Performance Measurement. In *Proceedings of the ACM Internet Measurement Conference (IMC '20)*. ACM, New York, NY, USA, 680–695.

[2] Carlos Bermejo Fernandez, Dimitris Chatzopoulos, Dimitrios Papadopoulos, and Pan Hui. 2021. This Website Uses Nudging: MTurk Workers' Behaviour on Cookie Consent Notices. *Proceedings of the ACM on Human-Computer Interaction 5*, CSCW2 (Oct. 2021), 1–22. doi:10.1145/3476087

[3] Dino Bollinger, Karel Kubicek, Carlos Cotrini, and David Basin. 2022. Automating Cookie Consent and GDPR Violation Detection. In *31st USENIX Security Symposium (USENIX Security 22)*. USENIX Association, Boston, MA, 2893–2910. https://www.usenix.org/conference/usenixsecurity22/presentation/bollinger

[4] G. Bradski. 2000. The OpenCV Library. *Dr. Dobb's Journal of Software Tools* (2000).

[5] Edna Dias Canedo, Angelica Toffano Seidel Calazans, Ian Nery Bandeira, Pedro Henrique Teixeira Costa, and Eloisa Toffano Seidel Masson. 2022. Guidelines adopted by agile teams in privacy requirements elicitation after the Brazilian general data protection law (LGPD) implementation. *Requirements Engineering* 27, 4 (2022), 545–567.

[6] Preeti S Chauhan and Nir Kshetri. 2021. 2021 state of the practice in data privacy and security. *Computer* 54, 8 (2021), 125–132.

[7] Michelle De Bruyn et al. 2014. The protection of personal information (POPI) act-impact on South Africa. *International Business & Economics Research Journal (IBER)* 13, 6 (2014), 1315–1340.

[8] Martin Degeling, Christine Utz, Christopher Lentzsch, Henry Hosseini, Florian Schaub, and Thorsten Holz. 2018. We value your privacy... now take some cookies: Measuring the GDPR's impact on web privacy. *arXiv preprint arXiv:1808.05096* (2018).

[9] Steven Englehardt and Arvind Narayanan. 2016. Online tracking: A 1-million-site measurement and analysis. In *Proceedings of ACM CCS 2016*.

[10] Abigayle Erickson. 2018. Comparative Analysis of the EU's GDPR and Brazil's LGPD: Enforcement Challenges with the LGPD. *Brook. J. Int'l L.* 44 (2018), 859.

[11] Khyara F Passos. 2021. Compliance with brazil's new data privacy legislation: What us companies need to know. In *Compliance with Brazil's New Data Privacy Legislation: What US Companies Need to Know: F. Passos, Khyara.* [S]. SSRN.

[12] Heather Federman. 2021. Examining Virginia's New Data Protection Law. *Risk Management* 68, 6 (2021), 8–9.

[13] Imane Fouad, Cristiana Santos, Feras Al Kassar, Nataliia Bielova, and Stefano Calzvara. 2020. On compliance of cookie purposes with the purpose specification principle. In *2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)*. IEEE, 326–333.

[14] Nathaniel Fruchter, Hsin Miao, Scott Stevenson, and Rebecca Balebako. 2015. Variations in tracking in relation to geographic location. *arXiv preprint arXiv:1506.04103* (2015).

[15] Colin M. Gray, Cristiana Santos, Nataliia Bielova, Michael Toth, and Damian Clifford. 2021. Dark Patterns and the Legal Requirements of Consent Banners: An Interaction Criticism Perspective. In *Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems*. ACM, Yokohama Japan, 1–18. doi:10.1145/3411764.3445779

[16] Hana Habib, Megan Li, Ellie Young, and Lorrie Cranor. 2022. "Okay, whatever": An Evaluation of Cookie Consent Interfaces. In *CHI Conference on Human Factors in Computing Systems*. ACM, New Orleans LA USA, 1–27. doi:10.1145/3491102.3501985

[17] Philip Hausner and Michael Gertz. 2021. Dark Patterns in the Interaction with Cookie Banners. *arXiv:2103.14956* [cs.HC]

[18] Maximilian Hils, Daniel W Woods, and Rainer Böhme. 2020. Measuring the emergence of consent management on the web. In *Proceedings of the ACM Internet Measurement Conference*. 317–332.

[19] Costas Iordanou, Georgios Smaragdakis, Ingmar Poese, and Nikolaos Laoutaris. 2018. Tracing cross border web tracking. In *Proceedings of the internet measurement conference 2018*. 329–342.

[20] Georgios Kampanos and Siamak F. Shahandashti. 2021. Accept All: The Landscape of Cookie Banners in Greece and the UK. *CoRR* abs/2104.05750 (2021). arXiv:2104.05750 https://arxiv.org/abs/2104.05750

[21] Farzaneh Karegar, John Sören Pettersson, and Simone Fischer-Hübner. 2020. The Dilemma of User Engagement in Privacy Notices: Effects of Interaction Modes and Habituation on User Attention. *ACM Transactions on Privacy and Security* 23, 1 (Feb. 2020), 1–38. doi:10.1145/3372296

[22] Rishabh Khandelwal, Asmit Nayak, Hamza Harkous, and Kassem Fawaz. 2023. Automated Cookie Notice Analysis and Enforcement. In *32nd USENIX Security Symposium (USENIX Security 23)*. USENIX Association, Anaheim, CA, 1109–1126. https://www.usenix.org/conference/usenixsecurity23/presentation/khandelwal

[23] Rishabh Khandelwal, Asmit Nayak, Hamza Harkous, and Kassem Fawaz. 2023. Automated cookie notice analysis and enforcement. In *32nd USENIX Security Symposium (USENIX Security 23)*. 1109–1126.

[24] Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Koczyński, and Wouter Joosen. 2019. Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. In *Proceedings of the 26th Annual Network and Distributed System Security Symposium (NDSS 2019)*. doi:10.14722/ndss.2019.23386

[25] Qing Liu, Jing Wang, Dehai Zhang, Yun Yang, and NaiYao Wang. 2018. Text features extraction based on TF-IDF associating semantic. In *2018 IEEE 4th international conference on computer and communications (ICCC)*. IEEE, 2338–2343.

[26] Célestin Matte, Nataliia Bielova, and Cristiana Santos. 2019. Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework. *arXiv preprint arXiv:1911.09964* (2019).

[27] Paarth Naithani. 2022. Curtailing the cookie monster through data protection by default. *Tilburg Law Review* 27, 1 (2022), 22–36.

[28] Midas Nouwens, Rolf Bagge, Janus Bager Kristensen, and Clemens Nylandsted Klokmose. 2022. Consent-o-matic: Automatically answering consent pop-ups using adversarial interoperability. In *CHI Conference on Human Factors in Computing Systems Extended Abstracts*. 1–7.

[29] Sean O'Connor, Ryan Nurwono, Aden Siebel, and Eleanor Birrell. 2021. (Un) clear and (In) conspicuous: The right to opt-out of sale under CCPA. In *Proceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society*. 59–72.

[30] Emmanouil Papadogiannakis, Panagiotis Papadopoulos, Nicolas Kourtellis, and Evangelos Markatos. 2021. User tracking in the post cookie era: How websites bypass gdpr consent to track users. In *Proceedings of the web conference 2021*. 2130–2141.

[31] Panagiotis Papadopoulos, Nicolas Kourtellis, and Evangelos Markatos. 2019. Cookie synchronization: Everything you always wanted to know but were afraid to ask. In *The World Wide Web Conference*. 1432–1442.

[32] Juan Ramos et al. 2003. Using tf-idf to determine word relevance in document queries. In *Proceedings of the first instructional conference on machine learning*, Vol. 242. Citeseer, 29–48.

[33] Ali Rasaii, Shivani Singh, Devashish Gosain, and Oliver Gasser. 2023. Exploring the Cookieverse: A Multi-Perspective Analysis of Web Cookies. http://arxiv.org/ abs/2302.05353 arXiv:2302.05353 [cs].
[34] Jukka Ruohonen and Kalle Hjerppe. 2020. Predicting the Amount of GDPR Fines. arXiv:2003.05151 [cs.CY]

[35] Kimberly Ruth, Deepak Kumar, Brandon Wang, Luke Valenta, and Zakir Dumerovic. 2022. Toppling top lists: Evaluating the accuracy of popular website lists. In *Proceedings of the 22nd ACM Internet Measurement Conference*. 374–387.

[36] Iskander Sanchez-Rola, Matteo Dell'Amico, Platon Kotzias, Davide Balzarotti, Leyla Bilge, Pierre-Antoine Vervier, and Igor Santos. 2019. Can I opt out yet? GDPR and the global illusion of cookie control. In *Proceedings of the 2019 ACM Asia conference on computer and communications security*. 340–351.

[37] Cristiana Santos, Arianna Rossi, Lorena Sanchez Chamorro, Kerstin Bongard-Blanchy, and Ruba Abu-Salma. 2021. Cookie banners, what's the purpose? analyzing cookie banner text through a legal lens. In *Proceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society*. 187–194.

[38] Cristiana Santos, Arianna Rossi, Lorena Sanchez Chamorro, Kerstin Bongard-Blanchy, and Ruba Abu-Salma. 2021. Cookie banners, what's the purpose? analyzing cookie banner text through a legal lens. In *Proceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society*. 187–194.

[39] Kristina P Sinaga and Miin-Shen Yang. 2020. Unsupervised K-means clustering algorithm. *IEEE access* 8 (2020), 80716–80727.

[40] Peter Snyder, Antoine Vastel, and Ben Livshits. 2020. Who filters the filters: Understanding the growth, usefulness and efficiency of crowdsourced ad blocking. *Proceedings of the ACM on Measurement and Analysis of Computing Systems* 4, 2 (2020), 1–24.

[41] Than Htut Soe, Cristiana Teixeira Santos, and Marija Slavkovik. 2022. Automated detection of dark patterns in cookie banners: how to do it poorly and why it is hard to do it any other way. arXiv:2204.11836 [cs.LG]

[42] Jannick Sørensen and Sokol Kosta. 2019. Before and after gdpr: The changes in third party presence at public and private european websites. In *The World Wide Web Conference*. 1590–1600.

[43] Jannick Kirk Sørensen and Hilde Van den Bulck. 2020. Public service media online, advertising and the third-party user data business: A trade versus trust dilemma? *Convergence* 26, 2 (2020), 421–447.

[44] Satoshi Suzuki et al. 1985. Topological structural analysis of digitized binary images by border following. *Computer vision, graphics, and image processing* 30, 1 (1985), 32–46.

[45] Tobias Urban, Dennis Tatang, Martin Degeling, Thorsten Holz, and Norbert Pohlmann. 2018. The unwanted sharing economy: An analysis of cookie syncing and user transparency under GDPR. *arXiv preprint arXiv:1811.08660* (2018).

[46] Tobias Urban, Dennis Tatang, Martin Degeling, Thorsten Holz, and Norbert Pohlmann. 2020. Measuring the impact of the gdpr on data sharing in ad networks. In *Proceedings of the 15th ACM Asia Conference on Computer and Communications Security*. 222–235.

[47] Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz. 2019. (Un) informed consent: Studying GDPR consent notices in the field. In *Proceedings of the 2019 acm sigsac conference on computer and communications security*. 973–990.

[48] Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz. 2019. (Un) informed consent: Studying GDPR consent notices in the field. In *Proceedings of the 2019 acm sigsac conference on computer and communications security*. 973–990.

[49] Rob Van Eijk, Hadi Asghari, Philipp Winter, and Arvind Narayanan. 2021. The impact of user location on cookie notices (inside and outside of the European Union). *arXiv preprint arXiv:2110.09832* (2021).

[50] W Gregory Voss. 2017. First the GDPR, now the proposed ePrivacy regulation. *Journal of Internet Law* 21, 1 (2017), 3–11.

[51] Asma Al Vranaki and Francesca Farmer. 2022. The Decline of Third-Party Cookies in the AdTech Sector: Of Data Protection Law and Regulation (I). *Available at SSRN 4414566* (2022).

[52] Xinfei Wang. 2020. A survey of online advertising click-through rate prediction models. In *2020 IEEE International Conference on Information Technology, Big Data and Artificial Intelligence (ICIBA)*, Vol. 1. IEEE, 516–521.

[53] Vera Wesselkamp, Imane Fouad, Cristiana Santos, Yanis Boussad, Nataliia Bielova, and Arnaud Legout. 2021. In-depth technical and legal analysis of tracking on health related websites with ernie extension. In *Proceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society*. 151–166.

[54] Frederik J Zuiderveen Borgesius, Sanne Kruikemeier, Sophie C Boerman, and Natali Helberger. 2017. Tracking walls, take-it-or-leave-it choices, the GDPR, and the ePrivacy regulation. *Eur. Data Prot. L. Rev.* 3 (2017), 353.

## A Appendices

All resources used in this study including the code for our novel automated visual detection technique can be found at https://github.com/intumwa/cookie-notices