Automatic Classification of Legal Violations in Cookie Banner Texts (2022)

Abstract: Cookie banners are designed to request consent from website visitors for their personal data. Recent research suggest that a high percentage of cookie banners violate legal regulations as defined by the General Data Protection Regulation (GDPR) and the ePrivacy Directive. In this paper, we focus on language used in these cookie banners, and whether these violations can be automatically detected, or not. We make use of a small cookie banner dataset that is annotated by five experts for legal violations and test it with state of the art classification models, namely BERT, LEGAL-BERT, BART in a zero-shot setting and BERT with LIWC embeddings. Our results show that none of the models outperform the others in all classes, but in general, BERT and LEGAL-BERT provide the highest accuracy results (70%-97%). However, they are influenced by the small size and the unbalanced distributions in the dataset.

## introduction cookie banners are a part of everyday life for eu-based users while browsing the web. to comply with the general data protection regulation (gdpr) @xcite and the eprivacy directive (epd-09), website operators have to inform eu users and ask for their consent for the processing of their personal data for 'unnecessary purposes', i.e. data that is not needed for the website to function, such as user-targeted advertising (article 29 working party, 2012). accordingly, eu users have to navigate through a cookie banner and decide on whether to consent to their personal information being collected via cookies or other tracking technologies that the site embeds. a consent request needs to be unambiguous, clear, concise, and informative, and consent needs to be freely given (articles 4(11) and 7(2) @xcite ). research has found that 89% of cookie banners violate applicable laws @xcite @xcite . the legal study by @xcite focused on processing purposes of cookie banners and confirmed that 89% of the cookie banners violated at least one legal requirement applied to the text of the stated purposes; they further detected the use of vagueness, framing, misleading wording, and technical jargon. @xcite noted that the text to explain the purpose of data collection was typically expressed in generic terms, and use of technical jargon was not understandable properly by the average data subject. studies furthermore confirmed that the prevalence of "affirmative" options and positive framing could nudge users toward consenting to tracking @xcite . the language used in cookie banners is often formulated in a way that can confuse and impact users' privacy decisions, steering them to accept consent to tracking. regulators, policymakers and scholars @xcite @xcite @xcite , confirm that certain textual strategies such as the use of motivational language and humor (european data protection board, 2022; frobrukerrådet, 2018), shame @xcite , guilt @xcite , blame @xcite , fear @xcite or uncertainty (european data protection board, 2020) influence users' online decisions. such textual expressions can violate the legal requirements for consent. consent, if not obtained in compliance with the gdpr, provides invalid grounds for data processing, rendering the processing activity illegal (article 6(1)(a) gdpr)). there is a need to identify such textual violations and develop tools that can automatically de-tect such textual dark patterns @xcite in order to provide proof of such practices (and legal evidence) to support the legal proceedings of enforcement authorities in their auditing efforts. regulators are presently overwhelmed by the novelty and sheer scale at which such patterns are being deployed online. however, only a few studies have investigated automatic detection of legal violations in cookie banner text. @xcite used feature extraction and ensembles of decision trees for their cookie purpose classifier with which they developed a browser extension to remove cookies according to user preferences. @xcite used a fine-tuned bert base-cased model to discover and force cookie settings to disable all non-essential cookies. these studies focus on enhancing the usability of websites for the users. in this paper, we focus on automatic detection of legal violations in cookie banner texts. we work with a dataset that is annotated by five experts for such violations, and test the performance of four state of the art deep neural network models, bert, bert with liwc, legal-bert and bart in a zero-shot setting. our aim is to understand if large, pretrained language models can be used with little or no finetuning for auditing purposes by policymakers or consumer protection organisations. to that end, we document the shortcomings of the models to provide insight on the problems and challenges of such a classification task. our results suggest that no model outperforms all the others in all classification tasks, suggesting a need for more data annotation in this domain, as well as signalling a potential for models which are specifically trained or fine-tuned on the task at hand. ## methodology in this section we first describe the dataset, discuss the annotation and classification based on manual labels. lastly, we describe the classification models we have used. ## results and discussion overall, bart does not perform well, but contrary to the bert models, the incorrect classifications are not due to choosing the majority class. occurrence distribution: studying the classes and their corresponding misclassifications and the f1 scores, we observe that the data distribution affects the accuracy. classification labels that have a low amount of occurrences in the data are almost always wrongly classified, even after the application of a stratified split for training and validation (see implications: the challenges of automatic classification of cookie banners are due to purposefully confusing wording, lack of classified data by experts, and the shortness of cookie banners themselves. the obtained results show that using use a state of the art classification model off the shelf or with minimal fine-tuning will not yield reliable results for auditing or helping policymakers. ## conclusion and future work in this paper, we used a cookie banner dataset previously annotated by five experts that detected legal violations. we test state of the art deep learning models such as bert, legal-bert and bart for automatic classification of such violations in this dataset. we also combined a dictionary based approach, i.e. liwc embeddings with bert, and checked if this improves performance or not. our approach aimed to give more insight into automatic detection of legal violations of cookie banners texts by comparing frequently used models. our results suggest that there is not one model that outperforms all the others for all classes that need to be detected. in general, bert and legal-bert work well for all classes; however, a closer look reveals that these models are also affected by the skewed data distribution for certain classes. in contrast, bart performs worst for most of the classes, but is not affected by the small size of the data set, and by class imbalance. we further add to the limited amount of studies on automatic detection of textual legal violations of cookie banners and laying a foundation for further research on this topic. since the language and style of the cookie banners change rapidly, we need robust algorithms that can adapt to changes both in the legal domain and in the manner of adoption of new regulations by website operators. hence, it is crucial to develop an efficient annotation pipeline to speed up human-in-the-loop annotation and automatic classification. our initial tests give insight into which model performs well for which challenges, and can be used further to build such a pipeline in the future.