Legitimate Interest is the New Consent -- Large-Scale Measurement and Legal Compliance of IAB Europe TCF Paywalls (2309.11625v3)

Abstract: Cookie paywalls allow visitors of a website to access its content only after they make a choice between paying a fee or accept tracking. European Data Protection Authorities (DPAs) recently issued guidelines and decisions on paywalls lawfulness, but it is yet unknown whether websites comply with them. We study in this paper the prevalence of cookie paywalls on the top one million websites using an automatic crawler. We identify 431 cookie paywalls, all using the Transparency and Consent Framework (TCF). We then analyse the data these paywalls communicate through the TCF, and in particular, the legal grounds and the purposes used to collect personal data. We observe that cookie paywalls extensively rely on legitimate interest legal basis systematically conflated with consent. We also observe a lack of correlation between the presence of paywalls and legal decisions or guidelines by DPAs.

Analysis of Legitimate Interest and Consent Commingling in IAB Europe TCF Paywalls

The paper "Legitimate Interest is the New Consent -- Large-Scale Measurement and Legal Compliance of IAB Europe TCF Paywalls" presents a comprehensive analysis of the implementation of cookie paywalls across the top one million websites, with specific attention to legal compliance concerns. The paper gives particular focus to the reliance on the Interactive Advertising Bureau Europe Transparency and Consent Framework (TCF), examining how it conflates consent with the legitimate interest as legal grounds for data collection.

Core Findings

The researchers developed an automated crawler to identify cookie paywalls, uncovering 431 paywalls in total, all utilizing the TCF. A striking detail is the geographical concentration of these paywalls in Germany, a country explicitly critical of them legally. This distribution is particularly interesting given the nuanced positioning of Data Protection Authorities (DPAs) in countries such as Germany, France, and Austria, reflecting broader ambiguities in regulatory stances across Europe.

A focal point of the paper is the analysis of how the TCF is utilized by these paywalls, specifically regarding the legal basis for data tracking and processing. The paper notes that there is a prevalent reliance on legitimate interest alongside consent. This raises significant legal and ethical questions since under the General Data Protection Regulation (GDPR), the legal basis for processing data for personalized advertising is consent.

The financial model of cookie paywalls is another area of investigation. The paper finds that while paywalls typically cost between €2 and €4 per month, the vast majority of users (99.9%) opt to give consent and thus be tracked, rather than pay the fee, highlighting potential issues of user coercion.

Technical and Legal Implications

The paper highlights significant inadequacies in the TCF system's ability to ensure compliance with GDPR requirements, particularly regarding the conflation of consent and legitimate interest. This finding suggests that further technical improvements and regulatory clarifications are required. Moreover, the paper divulges that even paid users can still be tracked under the guise of legitimate interests, sometimes under vague and inappropriate purposes such as "Develop and improve products."

Future Implications and Developments

Considerations for future research and policy are extensive. From a technical standpoint, there is a need to develop mechanisms to accurately distinguish between different legal bases used within the TCF. Legal frameworks might benefit from more harmonized DPAs positions or guidance from the European Data Protection Board (EDPB) regarding the lawfulness and pricing strategies of cookie paywalls.

The paper’s results bolster a call for improved oversight mechanisms and clear differentiation between consent and legitimate interest to protect user privacy effectively. The looming update of the TCF to version 2.2, which aims to address some of these compliance issues, will be a development worth scrutinizing.

Conclusion

This paper provides a critical examination of the nuanced practices surrounding cookie paywalls and highlights substantial areas where legal compliance could be improved. The findings underscore the importance of ongoing research into more granular technical and legal solutions to align online tracking frameworks with European privacy laws more closely. As the regulatory environment evolves, these insights will be instrumental in defining new boundaries in digital privacy rights and technological implementation.