A team of researchers at University of Wisconsin-Madison and Google say they have found a way to use artificial intelligence to neutralize manipulative cookie consent pop-ups that have become ubiquitous on the web.

The project, revealed this month and dubbed CookieEnforcer, has the goal of automating the clicking through of choices in these online consent forms to disable all non-essential cookies on a website. The resulting software can therefore spare netizens from having to [1]manually reject cookies presented by a website.

When confronted with cookie popups, which are required by European law and other legislation, many users simply click "accept all," despite the fact that unnecessary cookies may compromise privacy, the project's [2]paper stated . Some of the organizations forced to implement these pop-ups have designed them specifically to be tricky to navigate, or use dark patterns to fool someone into selecting the opposite desired option, to discourage people from disabling tracking cookies.

[3]

It's such a problem, in fact, that France fined Google and Facebook €200 million in January for designing their pages so that declining cookies was harder than accepting them.

A smarter way to sniff out cookies

The CookieEnforcer team set out to put an end to dealing with cumbersome consent forms, which it said took users an average of 12 clicks to disable non-essential cookies. These forms change in layout from site to site, typically, so the software needs to be capable of automatically detecting and deciding which controls need to be selected. Instead of using previous methods, which the team said largely rely on manual analysis and configuration, the team went with a machine-learning model it said is far more scalable to the "breadth and depth of cookie notices."

Once taught how to successfully manipulate cookie controls on a website, the software works in three stages: when you visit a webpage, the trained software detects the location of the cookie notice; it then predicts the actions needed to flip the controls to disable non-essential cookies; and then it does so, simulating the user's mouse clicks. CookieEnforcer does all of this in the background "without impacting the user experience."

[4]German court rules cookie preference service that shared IP addresses with US firm should be halted

[5]That's the way the cookies crumble: Consent banners up 16% since GDPR

[6]Google resumes shoveling stuff into its 'Privacy Sandbox'

[7]European watchdog: All data collected about users via ad-consent popup system must be deleted

Cookie form detection is done by modeling the problem as a [8]sequence-to-sequence task that turns cookie and website data into a set of clicks that disable tracking cookies. Finally, CookieEnforcer was rolled up into a Chrome extension.

When testing, the team said it found that CookieEnforcer was 91 percent effective at automatically disabling cookies on more than 500 top websites, as ranked by Tranco. CookieEnforcer's error rate was quite low as well, we're told: Of the 500 domains it was tested against, 250 of which had a cookie notice, 247 were identified as having cookie notices, and only one of those was a false positive. A few domains were missed due to irregular practices, such as putting the cookie notice in a special site element or automatic blocking of automated tools.

[9]

If you're hoping to try CookieEnforcer, bad news: It's not publicly available yet. Rishabh Khandelwal, one of the members of the research team, said he and his associates are preparing the browser extension for general release, but he didn't give a specific date. ®

Get our [10]Tech Resources



[1] https://www.theregister.com/2018/08/21/boffins_say_cookie_consent_banners_up_16_postgdpr/

[2] https://arxiv.org/abs/2204.04221

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YlZK9g@0Sby5YT3JxtqeVgAAANA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://www.theregister.com/2021/12/08/germany_cookie_service/

[5] https://www.theregister.com/2018/08/21/boffins_say_cookie_consent_banners_up_16_postgdpr/

[6] https://www.theregister.com/2022/03/29/google_privacy_sandbox/

[7] https://www.theregister.com/2022/02/02/europe_iab_decision/

[8] https://blog.keras.io/a-ten-minute-introduction-to-sequence-to-sequence-learning-in-keras.html

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YlZK9g@0Sby5YT3JxtqeVgAAANA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[10] https://whitepapers.theregister.com/