COnSeNT 2022: 2nd International Workshop on Consent Management in Online Services, Networks and Things

Motivation

As people and businesses increasingly rely on the Web as a medium for communication, interaction, provision of information, and deployment of innovative services, such intense data sharing triggers the application of existing data protection and privacy laws (e.g. ePrivacy Directive - [leg_ePrivacyDir], GDPR - [leg_GDPR], and CCPA/CPRA). These laws govern how valid consent should be obtained and used for personal data management, laying down strict requirements. Yet again, with the upcoming ePrivacy Regulation - [leg_ePrivacyReg], the Digital Services Act - [leg_DigServAct], the Data Governance Act - [regDataGov] and the Data Act - [regDataAct], the data economy will be changed. Pursuant to such requirements, both research, policy making and industry move towards increasing transparency, user empowerment and usability, accountability, and privacy by design to ensure the required legal compliance framework. This demanding setting has led to new consent proposals, disciplines, actors and roles. Standardised user centric consent proposals such as the Consent Receipt Specification - [kantaraCRS], the Internet Advertising Bureau’s Transparency and Consent Framework (TCF) standard - [IABTCF], ISO/IEC 29184 Online Privacy Notices and Consent - [ISOconsent], the Global Privacy Control (GPC) specification - [GPCspec], and recently the Advanced Data Protection Control (ADPC) specification - [ADPCspec]. Consent Management as a discipline is only now becoming prominent as an emerging result of the many challenges across various disciplines, among the legal, technological, sociological, UI/UX and HCI, privacy, and security domains. Current consent implementation and its management on the Web is still in its infancy when intersecting concomitant actors and their roles, such as average (and vulnerable) users, their devices, publishers, consent management platforms, content providers, third-parties, regulators, and information itself. The Workshop on Consent Management in Online Services, Networks and Things (COnSeNT) provides a dedicated venue for researchers, practitioners, and all stakeholders to discuss and present investigations, critiques, and advances related to consent and privacy preferences.

Recent Debates, Events and Trends

In the period of 2021–2022, consent has raised many debates and several events occurred that have the potential to affect how consenting takes place in the online and digital world.

For COnSeNT 2022, the call for papers specifically referred to the following currently discussed:

• Phasing out 1^st/3^rd Party Cookies

• Privacy-preserving advertising based on consent

• Consenting in/with novel proposals e.g. Google’s FLOC

• User interactions and consent for automation (i.e. AI)

• Internet/Web protocols and standards for Consent

• Role of web browsers in adopting consent mechanisms

The following events and trends of 2021–2022 are particularly relevant and impactful:

Cross-Disciplinarity

COnSeNT is a cross-disciplinary workshop and serves as a forum for talks and discussions from diverse perspectives, as online consent management has numerous dimensions. Online consent management first and foremost poses legal and technological challenges, but also raises questions in other areas such as psychology, linguistics, human computer interaction, communication studies, and economics.

Law. Current and incoming EU data protection and privacy regulations impact consent management in online services. The GDPR imposes strict requirements for a valid consent request: it must be freely given, prior to any data collection, informed, specific, unambiguous, readable and accessible and revocable (Articles 4(11) and 7 - [cristianacookies].

A recent decision - [BelgianDecision] by the Belgian Data Protection Authority (APD) highlights some of the most pressing legal challenges regarding consent. This decision hold that the Interactive Advertising Bureau Europe’s Transparency & Consent Framework (IAB TCF) - [IABTCF], a consent industry standard, does not fully satisfy ePrivacy and GDPR requirements in its current form (also cf. - [cristianacookies], [MBS2020], [VealeBorgesius], [CNTBR2021], [CNILdec], [PolishDPA], [CNIL-Google], [ICOadtechRTB]). The decision asserts IAB Europe’s status as a "controller" of personal data jointly with the participants of the TCF: publishers, CMPs and ad-tech vendors for the collection and sharing of the TC string and for subsequent processing of personal data, as part of OpenRTB. It also ruled that the current form of the TCF is insufficient for: the purposes of providing transparency to data subjects, for obtaining consent to adtech processing and to establish legitimate interests as a legal basis for processing data subjects’ personal data for profiling - [VNSimpossible].

Regarding incoming legislative initiatives, the current ePrivacy Regulation proposal – facing trilogue negotiations, is yet to define relevant aspects of online privacy. For example, whether browsers, and other software placed on the market permitting electronic communications ( such as automatic privacy signals) will, by default, be set to prevent tracking individuals’ digital footsteps - [leg_ePrivacyReg]. It will also determine whether the use of tracking walls will permissible. The EU Parliament recently voted on the proposed Digital Services Act [leg_DigServAct] to include a “ban on dark patterns” relating to consent and to offer options based on “tracking-free advertising” in case consent is refused or withdrawn to avoid coercion via tracking walls.

Technology. Consent is a challenge that stems from technology and, necessarily, approaches for its effective management will necessarily require novel technologies. Notably, managing consent is not simply managing the collection point but should involve the whole lifecycle of personal data. At the moment, we can see three main approaches that are, likely, complimentary rather than self-sufficient, at least in the absence of regulations. The first approach consists of the Consent Management Providers (CMPs), whose role and responsibilities have been questioned - [cristianacookies]. The key strategy is to display a prominent consent request that asks for user action in an unambiguous (e.g., by clicking a button) and, in principle, halts data collection until the user’s notification. The second approach, which is sponsored by CCPAs, is to use simple notifications, or "signals" such as the Global Privacy Control (GPC), sent directly from the user agent (often a browser) and, commonly, which can be asynchronously to a notice (see a comprehensive overview on consent signals in - [PPFsignals]). The third approach is to rely on an authenticated user artefact, such as a Consent Receipt - [jesusharsh3022], that enables management of the consent lifecycle thus removing the focus from the point of collection and bringing to the front accountability and transparency.

Technology is not only crucial for consent implementation. Technological approaches can provide deep insights into the consent ecosystem and can allow for automated compliance checks: For example, scrapers and crawlers can be used to collect data on cookie banners on large numbers of of websites - [MaxMeasuring] - [darkpatternsscrape]. The NGO noyb uses automated website-scans to enforce the compliance of cookie banners with the GDPR on a large scale - [noybterror].

Other social sciences. Unraveling consent also calls for social science perspectives other than the legal. Facilitating truly informed consent requires providing online users with information they are not only able to perceive and understand but also willing to absorb. To design functioning consent dialogues that attract online users’ attention and promote an informed decision, it is necessary to consider psychological and linguistic aspects, and to carry out empirical user studies on users’ perception and interaction with consent dialogues (cf. - [comicsinfographics], [BotesRossi2021]). Furthermore, economic research can provide valuable insights into the consent ecosystem and contribute to solutions for improving privacy online. As the processing of personal data for targeted advertising promises to increase revenues, consent signals might be monetisable, creating incentives to collect as much consent as possible - [commodification]. Law and economics can provide an approach to proposals for regulatory frameworks that improve online users’ privacy - [externalities].

COnSeNT 2022

The program of COnSeNT 2022 comprises paper presentations, a keynote, and a panel discussion. At the time of writing, the list of panelists and the panel description are not yet finalised. This section, therefore, provides an overview of the accepted papers and the keynote only.

Papers to be presented at COnSeNT 2022

The three submissions accepted for presentation at COnSeNT 2022 discuss aspects of consent from the empirical, conomics and law, and technical perspective.

In their empirical paper “Conciseness, interest, and unexpectedness: user attitudes towards infographic and comic consent mediums” - [comicsinfographics] Xengie Cheng Doan, Annika Selzer, Arianna Rossi, Wilhelmina Maria Botes, and Gabriele Lenzini examine how users perceive consent mediums beyond plain text information. Through structured interviews with 24 internet users in Germany, the authors found significant differences in users’ attitudes towards a consent comic on the one hand and a consent infographic on the other hand. The authors identify infographics as more promising for consent especially as they enable users to prioritise information and skim. Based on the interviewees’ widely varying attitudes towards the comic, the authors emphasise the importance of audience fit and tone for presenting information to users.

Nils Wehkamp, in his paper “Internalization of privacy externalities through negotiation: Social costs of third-party web-analytic tools and the limits of the legal data protection framework” - [externalities], scrutinises third-party web-analytic tools from a economics and law analysis. The author interprets the data collection and sharing for web-analytics as externalities, arguing that website owners benefit of the use of third-party tools, while the data processing negatively impacts users especially where their data are further used for targeted advertising. The further analysis explores possibilities for users to negotiate about the use of such tools in a semi-automated way through cookie banners. The author points out that, albeit existing data protection law in theory gives users control over their data, effective negotiation in practice does not take place.

Laurens Debackere, Pieter Colpart, Ruben Taelman, and Ruben Verborgh present “A Policy-Oriented Architecture for Enforcing Consent in Solid” - [ConsentSolid], a specification for access control over decentrally stored data - [solidproject]. To obtain informed consent in compliance with the GDPR based on the existing web access model in Solid, the authors propose a layered architecture comprising two components: an Access Management App that uses digital signatures to ensure integrity of data controllers’ requests and users decisions, and an Authorisation Agent. Through the Access Management App data controllers shall create specific Processing Requests for which online users shall grant and revoke access to their data, while the authorisation Agent matches access requests with users’ decisions.

Keynote

The Keynote speaker of COnSeNT’22 is Robin Berjon, a long standing computer scientist working in Computer Privacy and Data protection. Among other works, the speaker was the editor of the HTML5 specification and, more recently, co-author of the Global Privacy Control specification at W3C. His keynote addresses the interplay between informed consent, that necessarily builds on voluntariness, and the hyper-monetisation that currently drives the Web of Personal Data. The talk will explore ethical conflicts, the misalignment of procedures and incentives, and the constraints users see, starting with usability and human interfaces.

Previous Edition: COnSeNT 2021

The 1st edition of CoNSeNT¹ was successfully held at IEEE Euro S&P 2021² conference on 7^th September 2021. The program of the full-day virtual workshop with approximately 40 participants from diverse fields and professional backgrounds comprised six paper presentations, a keynote, and a panel discussion.

The paper presentations provided diverse perspectives on different aspects of consent and encouraged vivid interdiscplinary discussions. The workshop started with interdisciplinary talks with a focus on regulation. Paulina Jo Pesch shared findings from interviews with members of the Global Vendor List (GVL) - [IABGVL], shedding light on “Drivers and Obstacles for the Adoption of Consent Management Solutions by Ad-Tech Providers” - [pjpvendors] against the background of legal issues of the TCF - [IABTCF]. This was followed by Vitor Jesus’ position paper “Pragmatic Online Privacy: the SftE Approach” - [Jesus2021], in which the speaker proposed a “Start-from-the-End" regulatory approach to re-empower online users. Two papers focused on the translation of legal requirements to technical solutions. The paper “Representing Consent and Policies for Compliance” - [BonattiSauroLangens2021] by Piero A. Bonatti, Luigi Sauro and Jonathan Langens explored a machine-understandable policy language for consent solutions and algorithms for checking compliance with the GDPR and providing users with explanations. Beatriz Esteves, Harshcardhan J. Pandit and Víctor Rodríguez-Doncel described an extension to Solid’s - [solidproject] Access Control Language ACL) based on the Open Digital Rights Language (ODRL) in their paper “ODRL Profile for Expressing Consent through Granular Access Control Policies in Solid” - [EstevesPanditRodD2021]. Two papers approached consent from a social science perspective. Maria Wilhelmina Botes and Arianna Rossi, with their paper “Visualisation Techniques for Consent: Finding Common Ground in Comic Art with Indigenous Populations”³ - [BotesRossi2021] evaluated a low-tech informed consent solution in form of a comic. Soheil Human and Mandan Kazzazi, in their paper “Contextuality and Intersectionality of E-Consent: A Human-centric Reflection on Digital Consenting in the Emerging Genetic Data Markets” - [humankazzazi2021] proposed and applied an interdiscplinary and human-centric approach to consent solutions.

The keynote, titled “Consent ‘spam’ and the undermining of European data protection law” was given by Dr Johnny Ryan (FRHistS) – a Senior Fellow at the Irish Council for Civil Liberties⁴ (ICCL). The speaker was previously the Chief Policy & Industry Relations Officer at Brave (the web browser), and is well-known for exposing the problems of internet-based surveillance ad-industry and its implications for competition, anti-trust, and privacy.

The talk presented an in-depth and approachable explanation of how RTB-based ad mechanisms work, who the actors are, and the involvement of problematic sensitive personal data. In particular, it focused on the perceived incompatibilities of such mechanisms with the underlying principles and obligations of GDPR. The keynote was presented between Dr. Ryan’s complaint to the Belgian DPA and its decision in 2022 - [BelgianDecision]. As such, it led to an interesting series of discussions during the Q&A session with the attendees, which included the CEO of IAB Europe. They keynote was recorded and is available for viewing online⁵.

Accompanying the keynote and diverse topics presented through papers, the workshop also featured a panel consisting of experts and stakeholder representatives discussing “Does Consent work? If not Consent, what else?”. The panel consisted of:

• Armand Heslot (CNIL): Head of technology experts department at CNIL and member of EDPB’s Technology subgroup.

• Irene Kamara (Tilburg university): Assistant Professor of Cybersecurity Governance at Tilburg, and an expert in standardisation with prior experience at EDPS, CEN and CENELEC, and a member of the ENISA Experts List.

• Mark Lizar (Kantara Initiative): Co-inventor of the Kantara Consent Receipt specification, active member of standardisation processes as representative of Canada.

• Robin Berjon (New York Times): VP of Data Governance at New York Times, established expertise in developing and driving standardisation efforts in W3C, editor of HTML Specification, and co-author of the Global Privacy Control specification.

• Rob van Eijk (Future of Privacy Forum): FPF’s Managing Director for Europe, previously member of the Dutch Data Protection Authority (DPA) for 10 years, involved in Article 29 Working Party’s discussions on Do Not Track, and with a recent PhD focusing on online advertising (real-time bidding).

• Townsend Feehan (IAB Europe): CEO of Interactive Advertising Bureau (IAB) Europe, and previously Microsoft Legal & Corporate Affairs in Brussels.

The panelists discussed the current state of consenting on the web in terms of cookie and consent dialogues, the issues surrounding it, how it relates to the legal requirements (in particular the GDPR), and the disparities between using consent and legitimate interests within online advertising mechanisms. While there was no formal conclusion to the panel, there was a general agreement at the end regarding known issues and necessity to produce solutions that fix and improve the situation.

They panel was recorded and is available for viewing online⁶.