arXiv subjects

Vincent Toubiana

Publications and source records attributed to Vincent Toubiana.

4 recordsLinked to original sources

arXiv2026

A history of GDPR cookie banner compliance: the roles of publishers, regulators and CMPs

Since the introduction of the GDPR in 2018, cookie banners have become the primary mechanism for users to express preferences on online tracking and advertising. Consequently, their visual design and the options they present significantly influence user choice. Over time, the cookie banner landscape has evolved under the influence of key players, including publishers (website owners), regulators, and Consent Management Platforms (CMPs). This paper presents an in-depth analysis of the roles of these three key actors and an examination of their impact on cookie banners' design and implementation within the context of EU law. Our results, based on a historical evaluation of 11364 websites across 30 countries, indicate a positive evolution in the privacy landscape, with the compliance rate for websites featuring a "reject all" button increasing from 2.94% in 2018 to 30.66% in 2024. We analyze Data Protection Authority (DPA) activity and find a clear correlation between higher compliance rates and stronger regulatory action and guidance. Our experiments further show that compliance improvements are primarily driven by website owners, with CMPs showing little response to regulatory action or (indirect) influence on compliance rates. Our findings highlight the importance of more uniform collaboration and guidance among EU-level regulators to reduce interpretive divergence and simplify cookie banner compliance, as well as the need for regulatory oversight of CMPs, which in turn could significantly enhance privacy for many websites and users. Our work provides a foundation for academics, regulators, and industry to develop more effective strategies to motivate key players and promote greater user privacy.

cs.CY↗

arXiv2012

A Critical Look at Decentralized Personal Data Architectures

While the Internet was conceived as a decentralized network, the most widely used web applications today tend toward centralization. Control increasingly rests with centralized service providers who, as a consequence, have also amassed unprecedented amounts of data about the behaviors and personalities of individuals. Developers, regulators, and consumer advocates have looked to alternative decentralized architectures as the natural response to threats posed by these centralized services. The result has been a great variety of solutions that include personal data stores (PDS), infomediaries, Vendor Relationship Management (VRM) systems, and federated and distributed social networks. And yet, for all these efforts, decentralized personal data architectures have seen little adoption. This position paper attempts to account for these failures, challenging the accepted wisdom in the web community on the feasibility and desirability of these approaches. We start with a historical discussion of the development of various categories of decentralized personal data architectures. Then we survey the main ideas to illustrate the common themes among these efforts. We tease apart the design characteristics of these systems from the social values that they (are intended to) promote. We use this understanding to point out numerous drawbacks of the decentralization paradigm, some inherent and others incidental. We end with recommendations for designers of these systems for working towards goals that are achievable, but perhaps more limited in scope and ambition.

cs.CY↗

arXiv2011

TrackMeNot: Enhancing the privacy of Web Search

Most search engines can potentially infer the preferences and interests of a user based on her history of search queries. While search engines can use these inferences for a variety of tasks, including targeted advertisements, such tasks do impose an serious threat to user privacy. In 2006, after AOL disclosed the search queries of 650,000 users, TrackMeNot was released as a simple browser extension that sought to hide user search preferences in a cloud of queries. The first versions of TrackMeNot, though used extensively in the past three years, was fairly simplistic in design and did not provide any strong privacy guarantees. In this paper, we present the new design and implementation of TrackMeNot, which address many of the limitations of the first release. TrackMeNot addresses two basic problems. First, using a model for characterizing search queries, TrackMeNot provides a mechanism for obfuscating the search preferences of a user from a search engine. Second, TrackMeNot prevents the leakage of information revealing the use of obfuscation to a search engine via several potential side channels in existing browsers such as clicks, cookies etc. Finally, we show that TrackMeNot cannot be detected by current search bot detection mechanisms and demonstrate the effectiveness of TrackMeNot in obfuscating user interests by testing its efficiency on a major search engine.

cs.CR↗

arXiv2011

Show Me Your Cookie And I Will Tell You Who You Are

With the success of Web applications, most of our data is now stored on various third-party servers where they are processed to deliver personalized services. Naturally we must be authenticated to access this personal information, but the use of personalized services only restricted by identification could indirectly and silently leak sensitive data. We analyzed Google Web Search access mechanisms and found that the current policy applied to session cookies could be used to retrieve users' personal data. We describe an attack scheme leveraging the search personalization (based on the same SID cookie) to retrieve a part of the victim's click history and even some of her contacts. We implemented a proof of concept of this attack on Firefox and Chrome Web browsers and conducted an experiment with ten volunteers. Thanks to this prototype we were able to recover up to 80% of the user's search click history.

cs.CR↗