Do Opt-Outs Really Opt Me Out?
By Duc Viet Bui, Brian Tang, Kang G. Shin. 2022
19 citations recorded by the source corpus.
Online trackers, such as advertising and analytics services, have provided users with choices to opt out of their tracking and data collection to mitigate the users' concerns about increased privacy risks. While opt-out choices of online services for the cookies placed on their own websites have been examined before, the choices provided by trackers for their third-party tracking services on publisher websites have been largely overlooked. There is no guarantee that a tracker's opt-out options would faithfully follow the statements in its privacy policy. To address this concern, we develop an automated framework, called OptOutCheck, that analyzes (in)consistencies between trackers' data practices and the opt-out choice statements in their privacy policies. We create sentence-level classifiers, which achieve ≥ 84.6% precision on previously-unseen statements, to extract the opt-out policies that state neither tracking nor data collection for opted-out users from trackers' privacy-policy documents. tOptOutCheck analyzes both tracker and publisher websites to detect opt-out buttons, perform the opt-out, and extract the data flows to the tracker servers after the user opts out. Finally, we formalize the opt-out policies and data flows to derive logical conditions to detect the inconsistencies. In a large-scale study of 2.9k popular trackers, OptOutCheck detected opt-out choices on 165 trackers and found 11 trackers who exhibited data practices inconsistent with their stated opt-out policies. Since inconsistencies are violations of the trackers' privacy policies and demonstrate data collection without user consent, they are likely to lose users' trust in the online trackers and trigger the necessity of an automatic auditing process.
Subfields: Clinical Psychology, Information Systems, Sociology and Political Science, Privacy & Security
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Information Systems
- Irene Solaiman
- Marie-Therese Png
- Zeerak Talat
- Yacine Jernite
- Alexandra Sasha Luccioni
- Jesse Dodge
- Su Lin Blodgett
- Margaret Mitchell
In Sociology and Political Science
- Irene Solaiman
- Marie-Therese Png
- Zeerak Talat
- Yacine Jernite
- Alexandra Sasha Luccioni
- Su Lin Blodgett
- Margaret Mitchell
In Privacy & Security
Citations in the corpus
- Evaluating the Social Impact of Generative AI Systems in Systems and Society (2023, background): “Upholding privacy regulations requires engagement from multiple affected parties [189] and can protect individuals but fail at loopholes, as seen with tracking continuing when an individual opts-out [42] from data collection [140].”