{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T13:04:08Z","timestamp":1760101448842,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":39,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,11,26]],"date-time":"2023-11-26T00:00:00Z","timestamp":1700956800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Wallenberg AI, Autonomous Systems and Software Program (WASP) funded by the Knut and Alice Wallenberg Foundation,"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,11,26]]},"DOI":"10.1145\/3603216.3624966","type":"proceedings-article","created":{"date-parts":[[2023,11,23]],"date-time":"2023-11-23T01:38:42Z","timestamp":1700703522000},"page":"153-158","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Legitimate Interest is the New Consent - Large-Scale Measurement and Legal Compliance of IAB Europe TCF Paywalls"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9482-8906","authenticated-orcid":false,"given":"Victor","family":"Morel","sequence":"first","affiliation":[{"name":"Chalmers University, G\u00f6teborg, Sweden"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0712-2038","authenticated-orcid":false,"given":"Cristiana","family":"Santos","sequence":"additional","affiliation":[{"name":"Utrecht University, Utrecht, Netherlands"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-2914-9569","authenticated-orcid":false,"given":"Viktor","family":"Fredholm","sequence":"additional","affiliation":[{"name":"Chalmers University, G\u00f6teborg, Sweden"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-4008-9308","authenticated-orcid":false,"given":"Adam","family":"Thunberg","sequence":"additional","affiliation":[{"name":"Chalmers University, G\u00f6teborg, Sweden"}]}],"member":"320","published-online":{"date-parts":[[2023,11,26]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Retrieved","author":"AEPD.","year":"2023","unstructured":"AEPD. 2023. La AEPD actualiza su Gu\u00eda sobre el uso de cookies para adaptarla a las nuevas directrices del Comit\u00e9 Europeo de Protecci\u00f3n de Datos. es. (July 2023). Retrieved July 20, 2023 from."},{"key":"e_1_3_2_1_2_1","volume-title":"Decision on the merits 21\/2022 of","author":"Belgian DPA.","year":"2022","unstructured":"Belgian DPA. 2022. Decision on the merits 21\/2022 of 2 February 2022 Complaint relating to Transparency & Consent Framework. (2022). https:\/\/www.au toriteprotectiondonnees.be\/publications\/decision-quant-au-fond-n-21--2022- english.pdf."},{"unstructured":"Article 29Working Party. 2013. Opinion 03\/2013 on purpose limitation (WP203). (2013).","key":"e_1_3_2_1_3_1"},{"key":"e_1_3_2_1_4_1","volume-title":"IAB Europe case: The Market Court refers preliminary questions to the Court of Justice of the EU | Autorit\u00e9 de protection des donn\u00e9es - Gegevensbeschermingsautoriteit. (Sept","author":"Belgian DPA.","year":"2022","unstructured":"Belgian DPA. 2022. IAB Europe case: The Market Court refers preliminary questions to the Court of Justice of the EU | Autorit\u00e9 de protection des donn\u00e9es - Gegevensbeschermingsautoriteit. (Sept. 2022). Retrieved Aug. 1, 2023 from https:\/\/www.dataprotectionauthority.be\/iab-europe-case-the-market-courtrefers- preliminary-questions-to-the-court-of-justice-of-the-eu."},{"unstructured":"Brussels Markets Court. 2022. IAB Europe (C-604\/22). (Sept. 2022). Retrieved Aug. 1 2023 from https:\/\/www.iccl.ie\/wp-content\/uploads\/2022\/09\/English-Ju dgement-Markets-Court-07-09--2022_Redacted.pdf.","key":"e_1_3_2_1_5_1"},{"key":"e_1_3_2_1_6_1","volume-title":"Retrieved","author":"CNIL.","year":"2022","unstructured":"CNIL. 2022. Cookie walls : la CNIL publie des premiers crit\u00e8res d'\u00e9valuation | CNIL. fr. (May 2022). Retrieved July 21, 2022 from https:\/\/www.cnil.fr\/fr\/cooki es-et-autres-traceurs\/regles\/cookie-walls\/la-cnil-publie-des-premiers-criter es-devaluation."},{"key":"e_1_3_2_1_7_1","first-page":"629","article-title":"Judgment in Case C-40\/17 Fashion ID GmbH and Co.KG v Verbraucherzentrale NRW eV","volume":"2019","author":"European Union Court","year":"2019","unstructured":"Court of Justice of the European Union. 2019. Judgment in Case C-40\/17 Fashion ID GmbH and Co.KG v Verbraucherzentrale NRW eV. ECLI:EU:C:2019:629. (2019).","journal-title":"ECLI:EU:C"},{"key":"e_1_3_2_1_8_1","first-page":"317","article-title":"Judgment in Case C-131\/12 Google Spain SL and Google Inc. v Agencia Espa\u00f1ola de Protecci\u00f3n de Datos (AEPD) and Mario Costeja Gonz\u00e1lez","volume":"2014","author":"European Union Court","year":"2014","unstructured":"Court of Justice of the European Union. 2014. Judgment in Case C-131\/12 Google Spain SL and Google Inc. v Agencia Espa\u00f1ola de Protecci\u00f3n de Datos (AEPD) and Mario Costeja Gonz\u00e1lez. ECLI:EU:C:2014:317. (2014).","journal-title":"ECLI:EU:C"},{"volume-title":"Retrieved","year":"2023","unstructured":"Cyren. 2023. Website URL Category Check. en. (2023). Retrieved May 26, 2023 from http:\/\/www.cyren.com\/security-center\/ip-reputation-check.","key":"e_1_3_2_1_9_1"},{"volume-title":"Retrieved","year":"2023","unstructured":"Cyren. 2023. Website URL Category Check. en. (2023). Retrieved July 31, 2023 from http:\/\/www.cyren.com\/security-center\/ip-reputation-check.","key":"e_1_3_2_1_10_1"},{"key":"e_1_3_2_1_11_1","volume-title":"DPSN International Data Protection Day work-in-progress event on Friday 27th","author":"Law Scholar Network Data Protection","year":"2023","unstructured":"Data Protection Law Scholar Network. 2023. DPSN International Data Protection Day work-in-progress event on Friday 27th January 2023 online. en. Section: post. (Jan. 2023). Retrieved Aug. 1, 2023 from https:\/\/dataprotectionsc holars.network\/post\/dpd2023-registrations\/."},{"key":"e_1_3_2_1_12_1","volume-title":"Retrieved","author":"Lower Saxony Data Protection","year":"2023","unstructured":"Data Protection Lower Saxony. 2023. Decision of the Data Protection of Lower Saxony regarding der Standard. Tech. rep. Retrieved July 20, 2023 from https: \/\/noyb.eu\/sites\/default\/files\/2023-07\/11VerwarnungPurAboModellfinalgesc hwrztp_Redacted.pdf."},{"volume-title":"Retrieved","year":"2023","unstructured":"Datatilsynet. 2023. Cookie walls. da. (2023). Retrieved July 20, 2023 from https: \/\/www.datatilsynet.dk\/hvad-siger-reglerne\/vejledning\/cookies\/cookie-walls.","key":"e_1_3_2_1_13_1"},{"key":"e_1_3_2_1_14_1","volume-title":"Request for a preliminary ruling from the Oberlandesgericht D\u00fcsseldorf (Germany) lodged on","author":"ECJ.","year":"2021","unstructured":"ECJ. 2021. Case C-252\/21: Request for a preliminary ruling from the Oberlandesgericht D\u00fcsseldorf (Germany) lodged on 22 April 2021 - Facebook Inc. and Others v Bundeskartellamt. en. (2021). Retrieved Aug. 1, 2023 from."},{"key":"e_1_3_2_1_15_1","volume-title":"Guidelines on Consent under Regulation 2016\/679. Tech. rep. (Apr","author":"EDPB.","year":"2020","unstructured":"EDPB. 2020. Guidelines on Consent under Regulation 2016\/679. Tech. rep. (Apr. 2020)."},{"key":"e_1_3_2_1_16_1","volume-title":"Retrieved","author":"EDPB","year":"2022","unstructured":"EDPB - EDPS. 2022. EDPB-EDPS Joint Opinion 2\/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act). Tech. rep. (May 2022). Retrieved July 31, 2023 from."},{"unstructured":"European Data Protection Board (EDPB). 2007. EDPB Opinion 4\/2007 on the concept of personal data (WP 136) adopted on 20.06.2007. (2007).","key":"e_1_3_2_1_17_1"},{"unstructured":"WP29. 2012. Opinion 04\/2012 on cookie consent exemption (WP 194). (2012).","key":"e_1_3_2_1_18_1"},{"unstructured":"European Data Protection Board (EDPB). 2019. Guidelines 2\/2019 on the processing of personal data under article 6(1)","key":"#cr-split#-e_1_3_2_1_19_1.1"},{"unstructured":"(b) gdpr in the context of the provision of online services to data subjects. (2019).","key":"#cr-split#-e_1_3_2_1_19_1.2"},{"unstructured":"European Data Protection Board (EDPB). 2014. Opinion 06\/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95\/46\/EC (WP 217). https:\/\/ec.europa.eu\/justice\/article-29\/documentation\/opinion-reco mmendation\/files\/2014\/wp217_en.pdf. (2014).","key":"e_1_3_2_1_20_1"},{"volume-title":"Austria challenges EU newspapers' pay-or-cookie walls. en-GB. www.euractiv.com, (Apr","year":"2023","unstructured":"Euractiv. 2023. Austria challenges EU newspapers' pay-or-cookie walls. en-GB. www.euractiv.com, (Apr. 2023). Section: Media. Retrieved Aug. 1, 2023 from https:\/\/www.euractiv.com\/section\/media\/news\/austria-challenges-eu-news papers-pay-or-cookie-walls\/.","key":"e_1_3_2_1_21_1"},{"key":"e_1_3_2_1_22_1","volume-title":"DIRECTIVE 2002\/58\/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of","author":"Parliament European","year":"2002","unstructured":"European Parliament. 2002. DIRECTIVE 2002\/58\/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). (2002)."},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_23_1","DOI":"10.1109\/EuroSPW51379.2020.00051"},{"key":"e_1_3_2_1_24_1","volume-title":"Retrieved","author":"German","year":"2023","unstructured":"German DPA. 2023. DPA decision on \"Der Standard\". Tech. rep. Retrieved July 20, 2023 from https:\/\/noyb.eu\/sites\/default\/files\/2023-04\/Standard_Besch eid_geschw%C3%A4rzt.pdf."},{"key":"e_1_3_2_1_25_1","volume-title":"Accessed","author":"Europe IAB","year":"2023","unstructured":"IAB Europe. 2023. IAB Europe transparency and consent framework. https: \/\/iabeurope.eu\/transparency-consent-framework\/. Accessed: Dec. 12, 2022. (2023)."},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_26_1","DOI":"10.14722\/ndss.2019.23386"},{"key":"e_1_3_2_1_27_1","volume-title":"Retrieved","author":"Matte C\u00e9lestin","year":"2020","unstructured":"C\u00e9lestin Matte, Nataliia Bielova, and Cristiana Santos. 2020. Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework. arXiv:1911.09964 [cs]. (Feb. 2020). Retrieved Jan. 30, 2023 from http:\/\/arxiv.org\/abs\/1911.09964."},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_28_1","DOI":"10.1007\/978--3-030--551"},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_29_1","DOI":"10.1145\/3559613.3563205"},{"volume-title":"Retrieved","year":"2023","unstructured":"noyb. 2023. \"Pay or Okay\" - the beginning of the end? en. (2023). Retrieved July 20, 2023 from.","key":"e_1_3_2_1_30_1"},{"volume-title":"Retrieved","year":"2023","unstructured":"noyb. 2023. \"Pay or Okay\" on tech news site heise.de illegal, decides German DPA. en. (2023). Retrieved July 20, 2023 from.","key":"e_1_3_2_1_31_1"},{"volume-title":"Retrieved","year":"2021","unstructured":"noyb. 2021. News Sites: Readers need to \"buy back\" their own data at an exorbitant price?! en. (Aug. 2021). Retrieved July 26, 2022 from https:\/\/noyb.eu \/en\/news-sites-readers-need-buy-back-their-own-data-exorbitant-price.","key":"e_1_3_2_1_32_1"},{"key":"e_1_3_2_1_33_1","volume-title":"Keeping out the Masses: Understanding the Popularity and Implications of Internet Paywalls. en. arXiv:1903.01406 [cs]. (May","author":"Papadopoulos Panagiotis","year":"2020","unstructured":"Panagiotis Papadopoulos, Peter Snyder, Dimitrios Athanasakis, and Benjamin Livshits. 2020. Keeping out the Masses: Understanding the Popularity and Implications of Internet Paywalls. en. arXiv:1903.01406 [cs]. (May 2020). Retrieved Feb. 8, 2023 from http:\/\/arxiv.org\/abs\/1903.01406."},{"doi-asserted-by":"publisher","unstructured":"Cristiana Santos Nataliia Bielova and C\u00e9lestin Matte. 2020. Are cookie banners indeed compliant with the law? deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners. Technology and Regulation 91--135. https:\/\/doi.org\/10.26116\/techreg.2020.009.","key":"e_1_3_2_1_34_1","DOI":"10.26116\/techreg.2020.009"},{"key":"e_1_3_2_1_35_1","volume-title":"Retrieved","author":"TCF.","year":"2023","unstructured":"TCF. 2023. TCF 2.2 Launches! All You Need To Know - IAB Europe. (2023). Retrieved July 20, 2023 from https:\/\/iabeurope.eu\/all-news\/tcf-2--2-launches-a ll-you-need-to-know\/."},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_36_1","DOI":"10.71265\/0ccteg67"},{"key":"e_1_3_2_1_37_1","volume-title":"Retrieved","author":"Opinion","year":"2011","unstructured":"WP29. 2011. Opinion 15\/2011 on the definition of consent. (2011). Retrieved Aug. 1, 2022 from https:\/\/ec.europa.eu\/justice\/article-29\/documentation\/opini on-recommendation\/files\/2011\/wp187_en.pdf."},{"key":"e_1_3_2_1_38_1","volume-title":"Retrieved","author":"Working Document","year":"2013","unstructured":"WP29. 2013. Working Document 02\/2013 providing guidance on obtaining consent for cookies. (2013). Retrieved Aug. 1, 2022 from https:\/\/ec.europa.eu\/ju stice\/article-29\/documentation\/opinion-recommendation\/files\/2013\/wp208 _en.pdf."}],"event":{"sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"acronym":"CCS '23","name":"CCS '23: ACM SIGSAC Conference on Computer and Communications Security","location":"Copenhagen Denmark"},"container-title":["Proceedings of the 22nd Workshop on Privacy in the Electronic Society"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3603216.3624966","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3603216.3624966","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T22:49:11Z","timestamp":1750286951000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3603216.3624966"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,26]]},"references-count":39,"alternative-id":["10.1145\/3603216.3624966","10.1145\/3603216"],"URL":"https:\/\/doi.org\/10.1145\/3603216.3624966","relation":{},"subject":[],"published":{"date-parts":[[2023,11,26]]},"assertion":[{"value":"2023-11-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}