Internet users are often bombarded with pop-ups asking for their consent to collect and use their data: “Do you accept cookies from this website?” Most of us just click “yes” and continue browsing, without paying much attention to the details and implications of our choice. These requests are the result of recent data protection and privacy regulations, such as the EU’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA). These regulations aim to limit the collection and sharing of user data by websites and third parties, and to give users more control over their own information.
However, these regulations may not be as effective as intended, and may even have unintended consequences for user privacy and competition online. Our research, based on the analysis of over 10,000 websites, has found that opt-in policies actually increase the use of third parties that access user data, and decrease the diversity and quality of websites available to users.
What are opt-in policies and why are they problematic?
Opt-in policies are a type of privacy regulation that require websites to obtain explicit and informed consent from users before collecting, processing, or sharing their data. For example, under the GDPR, websites have to provide clear and specific information about the purposes and legal basis of data collection, the types and categories of data collected, the recipients and transfers of data, the retention period of data, and the rights and choices of users regarding their data. Users have to actively agree to these terms before any data activity can take place.
While opt-in policies may seem to protect user privacy by giving them more control and transparency, they also have some drawbacks. First, opt-in policies impose a high cognitive and behavioral burden on users, who have to read and understand complex and lengthy privacy notices, and make decisions about their data preferences. Most users do not have the time, interest, or expertise to do so, and may suffer from “consent fatigue” or “banner blindness”, leading them to simply click “yes” without much deliberation. This reduces the effectiveness of opt-in policies, as users may not be fully aware of the consequences of their consent, and may end up giving away more data than they intended.
Second, opt-in policies create a strategic incentive for websites to manipulate user consent, by using various design techniques and psychological tricks to influence user behavior. For example, websites may use pre-selected checkboxes, default options, dark patterns, nudges, or framing effects to steer users towards consenting to data collection and sharing. Websites may also use vague or misleading language, or hide important information in long and complex privacy policies, to obscure the true nature and extent of data practices. These tactics exploit the bounded rationality and limited attention of users, and undermine the notion of free and informed consent.
Third, opt-in policies have a negative impact on the online ecosystem, by affecting the revenue and competition of websites. Websites rely on user data to generate income from advertising, analytics, or other services. By requiring user consent, opt-in policies reduce the amount and quality of user data available to websites, and thus lower their revenue potential. This affects the profitability and sustainability of websites, especially small and medium-sized ones, that may not have the resources or reputation to cope with the regulatory costs and compliance risks. As a result, opt-in policies may reduce the diversity and quality of websites and content available to users, and create a market advantage for large and dominant platforms that can leverage their network effects and user loyalty to obtain consent.
How can we improve user privacy and competition online?
As our research has found, opt-in policies are counterproductive in addressing third-party data-sharing concerns and can harm competition. Instead, we recommend using a mix of policies that are more effective and precise, rather than the currently preferred one-size-fits-all policies. Some of these policies are:
- Opt-out policies: Opt-out policies are a type of privacy regulation that allow websites to collect and use user data by default, unless users explicitly object or withdraw their consent. Opt-out policies reduce the cognitive and behavioral burden on users, and avoid the consent manipulation and banner fatigue problems of opt-in policies. Opt-out policies also preserve the revenue and competition of websites, by allowing them to access user data without requiring consent. However, opt-out policies also have some drawbacks, such as the lack of transparency and control for users, and the potential for privacy violations and data misuse. Therefore, opt-out policies should be used with caution, and only for data practices that are necessary, legitimate, and expected by users, such as security, functionality, or personalization. For data practices that are more intrusive, sensitive, or unexpected, such as tracking, profiling, or targeting, opt-in policies should still be applied.
- Privacy by design and by default: Privacy by design and by default are principles that require websites to embed privacy considerations into the design and development of their products and services, and to adopt the most privacy-friendly settings and options as the default choice for users. Privacy by design and by default can enhance user privacy and trust, by ensuring that websites respect user preferences and minimize data collection and sharing. Privacy by design and by default can also reduce the reliance on user consent, and thus avoid the problems of opt-in policies. However, privacy by design and by default also have some challenges, such as the difficulty of defining and implementing privacy standards, the trade-off between privacy and functionality, and the potential for user dissatisfaction or confusion. Therefore, privacy by design and by default should be used with flexibility, and allow users to modify or override the default settings if they wish.
- Data minimization and anonymization: Data minimization and anonymization are techniques that limit the amount and identifiability of user data collected and shared by websites and third parties. Data minimization means that websites and third parties should only collect and use user data that is relevant, necessary, and proportionate to the purposes of data processing. Data anonymization means that websites and third parties should remove or alter any information that can directly or indirectly identify a user, such as name, email, IP address, or cookie ID. Data minimization and anonymization can protect user privacy and reduce the risk of data breaches, leaks, or abuse. Data minimization and anonymization can also mitigate the need for user consent, and thus avoid the problems of opt-in policies. However, data minimization and anonymization also have some limitations, such as the loss of data quality and utility, the difficulty of achieving effective and irreversible anonymization, and the possibility of re-identification or linkage attacks. Therefore, data minimization and anonymization should be used with caution, and complemented by other measures, such as encryption, access control, or audit.
