{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T16:08:12Z","timestamp":1772122092080,"version":"3.50.1"},"reference-count":55,"publisher":"Association for Computing Machinery (ACM)","issue":"3","funder":[{"name":"SERICS","award":["PE00000014"],"award-info":[{"award-number":["PE00000014"]}]},{"name":"MUR National Recovery and Resilience Plan funded by the European Union\u2014NextGenerationEU"},{"name":"\u201cNational Center for HPC, Big Data and Quantum Computing\u201d","award":["CN00000013"],"award-info":[{"award-number":["CN00000013"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Web"],"published-print":{"date-parts":[[2025,8,31]]},"abstract":"<jats:p>In response to growing concerns about user privacy, legislators have introduced new regulations and laws, such as the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA), which force websites to obtain user consent before activating any personal data collection. The cornerstone of this consent-seeking process involves the use of Privacy Banners, the technical tools to collect users\u2019 approval for data collection practices. Consent management platforms (CMPs) have emerged as practical solutions to simplify the configuration and management of such privacy banners for website administrators, allowing them to outsource the complexities of managing user consent and activating advertising features.<\/jats:p>\n          <jats:p>\n            This article presents a detailed and longitudinal analysis of the evolution of CMPs spanning 9 years. We take a twofold perspective: firstly, thanks to the HTTP Archive dataset, we provide insights into the growth, market share, and geographical spread of CMPs. Noteworthy observations include the substantial impact of the GDPR on the proliferation of CMPs in Europe, where more than 40% of websites currently adopt a CMP. Secondly, we analyse millions of user interactions with a medium-sized CMP present in thousands of websites worldwide. We observe how even small changes in the design of Privacy Banners have a critical impact on the user\u2019s giving or denying one\u2019s consent to data collection. For instance, over 60% of users do not consent when offered a simple \u201cone-click reject-all\u201d option. Conversely, when opting out requires more than one click, about 90% of users prefer to simply give their consent. This hints that their main objective is to eliminate the annoying privacy banner rather than make an informed decision. Curiously, we observe that iOS users exhibit a higher tendency to accept cookies compared with Android users, possibly indicating greater confidence in the privacy offered by Apple devices. We believe that the findings of this article contribute to a deeper understanding of the multifaceted interactions between privacy regulations, technological solutions and user choices in the evolving Web ecosystem. We also show that the availability of large open datasets, although not explicitly designed and collected for our goals, is fundamental to exploring different angles of the internet evolution over time. For this, we make the data and code used in this work available to the community.\n            <jats:xref ref-type=\"fn\">\n              <jats:sup>1<\/jats:sup>\n            <\/jats:xref>\n          <\/jats:p>","DOI":"10.1145\/3725737","type":"journal-article","created":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T10:03:14Z","timestamp":1743501794000},"page":"1-25","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["Privacy Policies and Consent Management Platforms: Growth and Users' Interactions over Time"],"prefix":"10.1145","volume":"19","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7533-4051","authenticated-orcid":false,"given":"Nikhil","family":"Jha","sequence":"first","affiliation":[{"name":"Politecnico di Torino","place":["Torino, Italy"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4258-4679","authenticated-orcid":false,"given":"Martino","family":"Trevisan","sequence":"additional","affiliation":[{"name":"Universit\u00e0 degli Studi di Trieste","place":["Trieste, Italy"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1859-6693","authenticated-orcid":false,"given":"Marco","family":"Mellia","sequence":"additional","affiliation":[{"name":"Politecnico di Torino","place":["Torino, Italy"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6535-6540","authenticated-orcid":false,"given":"Daniel","family":"Fernandez","sequence":"additional","affiliation":[{"name":"illow","place":["Miami, United States"]}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-6050-6910","authenticated-orcid":false,"given":"Rodrigo","family":"Irarrazaval","sequence":"additional","affiliation":[{"name":"illow.io","place":["Miami, United States"]}]}],"member":"320","published-online":{"date-parts":[[2025,8,22]]},"reference":[{"key":"e_1_3_3_2_2","unstructured":"2024. AdGuard. Retrieved March 18 2025 from https:\/\/adguard.com\/"},{"key":"e_1_3_3_3_2","unstructured":"2024. EasyPrivacy. Retrieved March 18 2025 from https:\/\/easylist.to\/easylist\/easyprivacy.txt"},{"key":"e_1_3_3_4_2","unstructured":"2024. HTTP Archive. Retrieved March 18 2025 from https:\/\/httparchive.org\/"},{"key":"e_1_3_3_5_2","unstructured":"2024. HTTP Archive Open Dataset used for CMP Analysis. Retrieved March 18 2025 from https:\/\/smartdata.polito.it\/consent-management-platforms-growth-and-users-interactions-over-time\/"},{"key":"e_1_3_3_6_2","unstructured":"2024. Wappalyzer. Retrieved March 18 2025 from https:\/\/www.wappalyzer.com\/"},{"key":"e_1_3_3_7_2","unstructured":"2024. WhoTracks.me. Retrieved March 18 2025 from https:\/\/whotracks.me\/"},{"key":"e_1_3_3_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660347"},{"key":"e_1_3_3_9_2","article-title":"Exploring the relationships between privacy by design schemes and privacy laws: A comparative analysis","author":"Aljeraisy Atheer","year":"2022","unstructured":"Atheer Aljeraisy, Masoud Barati, Omer Rana, and Charith Perera. 2022. Exploring the relationships between privacy by design schemes and privacy laws: A comparative analysis. arXiv preprint arXiv:2210.03520 (2022).","journal-title":"arXiv preprint arXiv:2210.03520"},{"key":"e_1_3_3_10_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.tele.2017.04.013"},{"key":"e_1_3_3_11_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2021.106729"},{"key":"e_1_3_3_12_2","unstructured":"Brazilian President of the Republic. 2018. Lei Geral de Prote\u00e7\u00e3o de Dados Pessoais. Retrieved March 18 2025 from http:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/L13709compilado.htm"},{"key":"e_1_3_3_13_2","unstructured":"California State Legislature. 2018. California Consumer Privacy Act of 2018. Retrieved March 18 2025 from https:\/\/leginfo.legislature.ca.gov\/faces\/billTextClient.xhtml?bill_id=201720180AB375"},{"key":"e_1_3_3_14_2","unstructured":"Council of European Union. 2009. Directive 2009\/136\/EC Amending Directive 2002\/22\/EC on Universal Service and Users\u2019 Rights Relating to Electronic Communications Networks and Services Directive 2002\/58\/EC Concerning the Processing of Personal Data and the Protection of Privacy in the Electronic Communications Sector and Regulation (EC) No 2006\/2004 on Cooperation between National Authorities Responsible for the Enforcement of Consumer Protection Laws. Retrieved March 18 2025 from http:\/\/eur-lex.europa.eu\/legal-content\/en\/TXT\/?uri=CELEX:32009L0136"},{"key":"e_1_3_3_15_2","doi-asserted-by":"publisher","DOI":"10.3389\/fpsyg.2016.01341"},{"key":"e_1_3_3_16_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-15986-3_17"},{"key":"e_1_3_3_17_2","unstructured":"Data Protection Authorities of Germany. 2024. Orientierungshilfe der Konferenz der unabh\u00e4ngigen Datenschutzaufsichtsbeh\u00f6rden des Bundes und der L\u00e4nder vom 20. Dezember 2021. Retrieved March 18 2025 from https:\/\/www.datenschutzkonferenz-online.de\/media\/oh\/20211220_oh_telemedien.pdf"},{"key":"e_1_3_3_18_2","doi-asserted-by":"publisher","DOI":"10.47975\/IJDL.magalhaes.v.2.n.2"},{"key":"e_1_3_3_19_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00287-019-01201-1"},{"key":"e_1_3_3_20_2","unstructured":"Deloitte. 2020. Cookie Benchmark Study. Retrieved March 18 2025 from https:\/\/www2.deloitte.com\/content\/dam\/Deloitte\/nl\/Documents\/risk\/deloitte-nl-risk-cookie-benchmark-study.pdf (2020)."},{"key":"e_1_3_3_21_2","volume-title":"Workshop on Technology and Consumer Protection (ConPro\u201919)","author":"Eijk Rob van","year":"2019","unstructured":"Rob van Eijk, Hadi Asghari, Philipp Winter, and Arvind Narayanan. 2019. The impact of user location on cookie notices (inside and outside of the European Union). In Workshop on Technology and Consumer Protection (ConPro\u201919)."},{"key":"e_1_3_3_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978313"},{"key":"e_1_3_3_23_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2016.12.016"},{"key":"e_1_3_3_24_2","unstructured":"European Parliament and Council of European Union. 2016. Directive 95\/46\/EC. General Data Protection Regulation. Retrieved March 18 2025 from http:\/\/data.consilium.europa.eu\/doc\/document\/ST-5419-2016-INIT\/en\/pdf"},{"key":"e_1_3_3_25_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-77366-5_31"},{"key":"e_1_3_3_26_2","doi-asserted-by":"publisher","DOI":"10.1145\/3491102.3501985"},{"key":"e_1_3_3_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/3313831.3376511"},{"key":"e_1_3_3_28_2","article-title":"Dark patterns in the interaction with cookie banners","author":"Hausner Philip","year":"2021","unstructured":"Philip Hausner and Michael Gertz. 2021. Dark patterns in the interaction with cookie banners. arXiv preprint arXiv:2103.14956 (2021).","journal-title":"arXiv preprint arXiv:2103.14956"},{"key":"e_1_3_3_29_2","doi-asserted-by":"publisher","DOI":"10.1145\/3419394.3423647"},{"key":"e_1_3_3_30_2","unstructured":"Italian Data Protection Authority. 2024. Chiarimenti in merito all\u2019attuazione della normativa in materia di cookie. Retrieved March 18 2025 from https:\/\/www.garanteprivacy.it\/web\/guest\/home\/docweb\/-\/docweb-display\/docweb\/4006878"},{"key":"e_1_3_3_31_2","doi-asserted-by":"publisher","DOI":"10.23919\/TMA58422.2023.10198936"},{"key":"e_1_3_3_32_2","doi-asserted-by":"publisher","DOI":"10.1145\/3555352"},{"key":"e_1_3_3_33_2","doi-asserted-by":"publisher","DOI":"10.1145\/3466722"},{"key":"e_1_3_3_34_2","volume-title":"Proceedings of 2022 Symposium on Usable Security and Privacy","author":"Kulyk Oksana","year":"2022","unstructured":"Oksana Kulyk, Willard Rafnsson, Ida Marie Borberg, and Rene Hougard Pedersen. 2022. \u201cSo I Sold My Soul\u201d: Effects of dark patterns in cookie notices on end-user behavior and perceptions. In Proceedings of 2022 Symposium on Usable Security and Privacy. Internet Society."},{"key":"e_1_3_3_35_2","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2020-0004"},{"key":"e_1_3_3_36_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00076"},{"key":"e_1_3_3_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.47"},{"key":"e_1_3_3_38_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-17172-2_8"},{"key":"e_1_3_3_39_2","unstructured":"National Assembly of Qu\u00e9bec. 2021. An Act to Modernize Legislative Provisions as Regards the Protection of Personal Information. Retrieved March 18 2025 from https:\/\/www.publicationsduquebec.gouv.qc.ca\/fileadmin\/Fichiers_client\/lois_et_reglements\/LoisAnnuelles\/en\/2021\/2021C25A.PDF"},{"key":"e_1_3_3_40_2","doi-asserted-by":"publisher","DOI":"10.1145\/3313831.3376321"},{"key":"e_1_3_3_41_2","doi-asserted-by":"publisher","DOI":"10.1080\/1369118X.2018.1486870"},{"key":"e_1_3_3_42_2","first-page":"2130","volume-title":"User Tracking in the Post-Cookie Era: How Websites Bypass GDPR Consent to Track Users","author":"Papadogiannakis Emmanouil","year":"2021","unstructured":"Emmanouil Papadogiannakis, Panagiotis Papadopoulos, Nicolas Kourtellis, and Evangelos P. Markatos. 2021. User Tracking in the Post-Cookie Era: How Websites Bypass GDPR Consent to Track Users. ACM, New York, NY, 2130\u20132141."},{"key":"e_1_3_3_43_2","unstructured":"Parliament of Canada. 2000. Personal Information Protection and Electronic Documents Act. An Act to Modernize Legislative Provisions as Regards the Protection of Personal Information. Retrieved March 18 2025 from https:\/\/laws-lois.justice.gc.ca\/eng\/acts\/p-8.6\/"},{"key":"e_1_3_3_44_2","unstructured":"Parliament of Canada. 2023. An Act to Enact the Consumer Privacy Protection Act the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to Make Consequential and Related Amendments to other Acts. Retrieved March 18 2025 from https:\/\/www.parl.ca\/legisinfo\/en\/bill\/44-1\/c-27"},{"key":"e_1_3_3_45_2","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815705"},{"key":"e_1_3_3_46_2","doi-asserted-by":"publisher","unstructured":"European Commission Joint Research Centre N. Rodr\u00edguez-Priego and R. v. Bavel. 2016. Testing the effect of the cookie banners on behaviour. Publications Office. DOI:10.2791\/22197","DOI":"10.2791\/22197"},{"key":"e_1_3_3_47_2","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2021-0004"},{"key":"e_1_3_3_48_2","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329806"},{"key":"e_1_3_3_49_2","doi-asserted-by":"publisher","DOI":"10.1145\/3549015.3555675"},{"key":"e_1_3_3_50_2","doi-asserted-by":"publisher","DOI":"10.1080\/15332861.2011.558454"},{"key":"e_1_3_3_51_2","doi-asserted-by":"publisher","DOI":"10.1145\/3419249.3420132"},{"key":"e_1_3_3_52_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2015.09.038"},{"key":"e_1_3_3_53_2","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0023"},{"key":"e_1_3_3_54_2","doi-asserted-by":"publisher","DOI":"10.1287\/isre.1090.0260"},{"key":"e_1_3_3_55_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354212"},{"key":"e_1_3_3_56_2","doi-asserted-by":"publisher","DOI":"10.1145\/948005.948057"}],"container-title":["ACM Transactions on the Web"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3725737","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T15:27:00Z","timestamp":1755876420000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3725737"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8,22]]},"references-count":55,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2025,8,31]]}},"alternative-id":["10.1145\/3725737"],"URL":"https:\/\/doi.org\/10.1145\/3725737","relation":{},"ISSN":["1559-1131","1559-114X"],"issn-type":[{"value":"1559-1131","type":"print"},{"value":"1559-114X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,8,22]]},"assertion":[{"value":"2024-01-29","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-09-22","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-08-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}