Academic Journal of Science and Technology ISSN: 2771-3032 | Vol. 4, No. 1, 2022 23 Targetd Analysis of Cookie Consent Management Platform Companies Siqing Zhang1, a, Si Chen1 1Taiyuan Normal University, Jinzhong City, Shanxi Province, 030619, China azhangsiqing@tynu.edu.cn Abstract: The General Data Protection Regulation (GDPR) which turned into effective in 2018 asks any companies who collects, saves, processes or transfers users’ privacy data have to meet its strictest requirement. Under this circumstance, cookie consent managers are essential for the publishers who collect and use user’s cookie. However, cookie consent manager has only recently attracted the attention of researchers, and there are not many related studies about it. This report gives a comprehensive understanding of CMP industry and CPMs. Different data sets are involved and analysed in this project. Competitive analysis is applied to cookie notices from customer group, product property and business competitiveness perspectives. The results show that CMPs with better end-user experience normally have a larger quantity of customers. And customers tend to choose a local CMP with regional advantages instead of a global widely used CMP with high exposure score. Keywords: GDPR, CMP, Data Privacy. 1. Introduction The General Data Protection Ordinance (GDPR) came into force in May 2018 in the European Union and collects and stores personal data about European citizens. According to GDPR, consent requests are crucial to a website, which should specify which data to process, what the purpose of processing is, what processing will be performed, where and when data will be stored, and whether or not it will not be shared with others. Many websites have to adjust their data processing processes, consents and privacy policies to meet the transparency requirements of GDPR. In this case, the GDPR compliance manager company can provide cookie consent management platform (CMP) to help these sites meet the requirements of GDPR. Because of the huge number of websites affected by GDPR, a large number of websites need to update their Cookie consent notifications to comply with EU regulations, otherwise they will face huge fines. Therefore, the GDPR compliance manager company has an important market, but so far, few studies have focused on CMP company. 2. Background 2.1. Cookie and consent Cookie, a piece of data sent from the website while the user is browsing, is used to record stateful information and user browsing activities in the past. There are mainly two kinds of cookies: authentication cookies and tracking cookies. Authentication cookies are used by the Web servers for identifying whether the users are logged in and which account they are logged in with. Tracking cookies, especially third- party tracking cookies, are common ways to record the browsing histories of individuals. European law requires that all websites targeting European Union member states gain "informed consent" from users before storing non-essential cookies on their device. The informed consent, also called Cookie Consent, is a JavaScript pop-up window to alert users about the use of cookies. It can notify users about the cookie policy and enable them to quickly choose whether they agree the use of cookies or not. Figure 1. Main types of cookie consent notice and interaction designs 24 2.2. GDPR and related requirements The General Data Protection Regulation (GDPR) aims to integrate data privacy laws across Europe, giving individual users more control and transparency over personal privacy data, and raising the threshold for publishers, advertisers and other relevant parties to legally process user personal information[7]. GDPR requires that organizations have a consent management mechanism covering the entire consent lifecycle, meanwhile they should prove the validity of the consent collected and enable data subjects to exercise their rights. The major functions provided by these strategies mainly are: 1st- Party and 3rd-Party consent controls; operationalizing Data Protection Impact Assessment (DPIA) and privacy by design; providing data flow mapping to standardize and operationalize the mapping process of customers and organizations data flows; meeting EU privacy cookie compliance requirements; reviewing and remediating vendor risks; providing a data subject rights request portal; providing a framework for consent management; preparing an incident reporting & breach management workflow. 3. Data collection 3.1. Crawl data for global Top500 and regional Top100 sites The data set covers the list of cookie consent notice type and consent management platform used by Alexa top 500 websites worldwide (Alexa.com, 2019) and top 100 websites in 5 specific European countries. Th regional top 100 websites can be used to analysis if there are CMPs with regional characteristics that are not included in the world's top500 websites. Cookie consent notice type of each site was checked and divided into four categories which are represented by 0(No notice), 1(Agree-only notice), 2(Notice with choices), and 3(Offline at that moment) in the data set. 3.2. Public Database This paper also chose a public database of Nerdydata.com, which covers source code of over 350 million websites including Alexa top 1 million websites. Search the database to get lists of each target CMP customers and the ranking of each website. Then the distributed region and the industry category of each website are also collected. 4. Analysis As mentioned earlier, these consents notices are divided into four categories. The figure 2(a) shows that over half of top 500 websites have not had cookie consent interaction design yet, which imply there is a huge potential business market waiting expanded. The figure 2(b) shows all CMPs used by Alexa global top500 sites can be divided into the CMPs built by websites themselves and third-party companies’ CMP solutions. The self-built CMPs includes varieties of methods, such as the website's own developed consent management tool, plug-ins or CMP built with open source code and group’s unified platform used by large publishers (e.g. eBay and Yahoo). The object of this paper is the third-party CMPs; therefore, the CMP providers taken up 55% should be the next focus. Figure 2. Distribution of CMPs used among Alexa Top 500 sites Onetrust, Evidon, TrustArc, Didomi, Quantcast, Cookiebot and Iubenda are selected to next step research. Based on the integrated analysis, the advantages and disadvantages that each CMP company may can be derived, therefore possible recommendation will be advised to promote above- mentioned CMP companies to achieve better commercial performance. 25 Figure 3. Customer quantity of each CMP in 17 countries From figure 3 it can be conducted to several results. 1) Most of popular online business locates in US, and they own a large number of third-party domains in each first-party domain which results in the large proportion of US users in each CMP. 2) Quantcast's customers are characterized by the widest span of countries. 3) Customer quantity of Iubenda in Italy displays a noticeable bar. The traffic proportion of Iubenda of Italy is also high, which would evidence that Iubenda is an Italy-specific CMP provider. Thus, it can be inferred that customers still tend to choose region-specific company with more regional advantages. Understanding customers’ needs is also helpful to attract more customers in their industry with more targeted exposure. The websites are divided into 16 categories according to Alexa classification. The result shows that CMP companies' largest customer base is in the fields of art, business and computing. During the inspection phase of cookie notice data collection, properties of each CMP are recorded and compared. The properties can be categorized as interaction design, technology and functional features. Cookiebot has the most comprehensive functions with the relatively affordable pricing plan, and it provides free versions with fewer functions. This finding is consistent with its largest number of customers. TrustArc has a unique slide button design. It also can be obtained that comparing average time customer spend on consent notice, basically CMPs with a low average time have more customers, providing better user experience and more user-friendly. Table 1. Competitor analysis table for CMPs Onetrust Evidon TrustArc Didomi Quantcast Cookiebot Iubenda Ownership onetrust Crownpeak TrustArc Didomi Quantcast Cybot Iubenda Sector Privacy compliance management Privacy compliance management Privacy compliance management Privacy compliance management Marketing analytics and audience insights Pure-play CMP Legal compliance tools & software exposure Score 901.6383 233.1393 194.7707 136.8567 1305.4601 1063.9543 576.2478 Client Quantity 1319 344 271 164 1765 1790 897 Dominant Region US,GB US,GB US,GB ES,FR US,FR US,GB IT,US Dominant Industry Business Science Business Art Computer Computers Computers User Experience Rank 7 5- 4 2 3 1 5- Strength High client quantity/ high exposure score. Has Parent company. Has special slide button. Good user experience. High client quantity/ high exposure score/good user experience/ Have a marketing business sector. High client quantity/ high exposure score/good user experience. Dominate the Italian market/ high client quantity. According to table 1, Cookiebot, as the leading brand, has high performance in many aspects. It is worth mentioning that its customer satisfaction is also in the first position. It has the most comprehensive functions with a relatively affordable pricing plan. And it’s the only pure CMP company. Close behind are Quantcast and Onetrust. Although Onetrust has a high number of customers and exposure scores, its end-user satisfaction ranking is relatively backward, and its user experience needs to be improved. CMP companies' largest customer base is in the fields of art, business and computing. 5. Conclusion Main conclusions are as below: Global top 500 sites, only 26 15.6% websites equipped with CMPs of which 55% are powered by third-party CMP companies. Compared with other CMP’s customers, if CMP companies want more customers and spread its competitive landscape, they could apply following advice: 1.Make functions comprehensive; 2.Set a relatively affordable pricing plan as well; 3. Increase exposure to end-users; 4. Get use of regional advantages; 5. Enhance the degree of internationalization; 6. Target customer based in the fields of art, business and computing, which have more business potential. 6. Limits 1) There are several problems occurred when crawling data and the results may not accurate. Firstly, high-ranking sites normally have more sophisticated anti-spider tools to change their response when it detects a spider or an IP address on its blocklist. In addition, some websites refused direct requests and CAPTCHA questions have to be answered correctly before entering the real sites. Last, for some international websites, it’s necessary to select region and language before entering the site. 2) The data sets used in this project are all static. In the future, data at a certain time interval can be collected for dynamic analysis and comparison. References [1] E. & I. S. Department for Business, “Using personal data in your business or organisation if there's no Brexit deal,” GOV.UK, 06-Feb-2019. [Online]. [2] L. Elluri and K. P. Joshi, “A Knowledge Representation of Cloud Data Controls for EU GDPR Compliance,” 2018 IEEE World Congress on Services (SERVICES), pp. 45–46, 2018. [3] C. Boniface, I. Fouad, N. Bielova, C. Lauradoux, and C. Santos, “Security Analysis of Subject Access Request Procedures,” Privacy Technologies and Policy Lecture Notes in Computer Science, pp. 182–209, Mar. 2019. [4] J. Bourgeois, G. Kortuem, and F. Kawsar, “Trusted and GDPR- compliant research with the internet of things,” Proceedings of the 8th International Conference on the Internet of Things - IOT 18, 2018. [5] M. Degeling, C. Utz, C. Lentzsch, H. Hosseini, F. Schaub, and T. Holz, “We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPRs Impact on Web Privacy,” Proceedings 2019 Network and Distributed System Security Symposium, 2019. [6] J. A. Obar and A. Oeldorf-Hirsch, “The Biggest Lie on the Internet:Ignoring the Privacy Policies and Terms of Service Policies of Social Networking Services,” Information, Communication & Society, pp. 1–20, Jul. 2018. [7] R. Nokhbeh Zaeem and K. S. Barber, “A Study of Web Privacy Policies Industries,” Journal of Information Privacy and Security, pp. 1–17, Nov. 2017. [8] M. Pelteret and J. Ophoff, “A Review of Information Privacy and Its Importance to Consumers and Organizations,” Informing Science: The International Journal of an Emerging Transdiscipline, vol. 19, pp. 277–301, 2016. [9] M. Bergen and M. A. Peteraf, “Competitor identification and competitor analysis: a broad-based managerial approach,” Managerial and Decision Economics, vol. 23, no. 4-5, pp. 157– 169, 2002.