{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,7,13]],"date-time":"2025-07-13T16:40:03Z","timestamp":1752424803737,"version":"3.41.2"},"reference-count":0,"publisher":"Privacy Enhancing Technologies Symposium Advisory Board","issue":"4","license":[{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["PoPETs"],"abstract":"<jats:p>The EU General Data Protection Regulation (GDPR) requires websites to facilitate the right to revoke consent from Web users. Prior works have examined consent management by auditing that user choices are correctly stored, and comparing cookies set upon acceptance versus rejection to assess compliance. While these studies measured compliance of consent with respect to the various consent requirements, no prior work has studied consent revocation on the Web. Therefore, it is unclear how difficult it is to revoke consent on the websites\u2019 interfaces, and whether the revoked consent is properly stored and communicated behind the user interface. Our work aims to fill this gap by measuring compliance of consent revocation on the Web on Tranco\u2019s top-200 websites. We found that 19.87% of websites make it difficult for users to revoke consent throughout different interfaces, 20.5% of websites require more effort than acceptance, and 2.48% do not provide consent revocation at all, thus violating EU legal requirements for valid consent. 57.5% websites do not delete the cookies after consent revocation enabling continuous illegal processing of users\u2019 data. Further, we analyzed 281 websites implementing the IAB Europe Transparency &amp; Consent Framework, and found 22 websites that store a positive consent despite user\u2019s revocation. Surprisingly, we found that on 101 websites, third parties that have received consent upon user\u2019s acceptance, are not informed of revocation, leading to the illegal processing of users\u2019 data by such third parties according to EU laws. Our findings emphasize the need for improved legal compliance of consent revocation, and proper, consistent, and uniform implementation of revocation communication to third-parties.<\/jats:p>","DOI":"10.56553\/popets-2025-0133","type":"journal-article","created":{"date-parts":[[2025,7,13]],"date-time":"2025-07-13T15:58:27Z","timestamp":1752422307000},"page":"329-347","source":"Crossref","is-referenced-by-count":0,"title":["Johnny Can\u2019t Revoke Consent Either: Measuring Compliance of Consent Revocation on the Web"],"prefix":"10.56553","volume":"2025","author":[{"given":"Gayatri Priyadarsini","family":"Kancherla","sequence":"first","affiliation":[{"name":"Indian Institute of Technology Gandhinagar"}]},{"given":"Nataliia","family":"Bielova","sequence":"additional","affiliation":[{"name":"Inria Centre at University C\u00f4te d'Azur"}]},{"given":"Cristiana","family":"Santos","sequence":"additional","affiliation":[{"name":"Utrecht University"}]},{"given":"Abhishek","family":"Bichhawat","sequence":"additional","affiliation":[{"name":"Indian Institute of Technology Gandhinagar"}]}],"member":"35752","published-online":{"date-parts":[[2025,10]]},"container-title":["Proceedings on Privacy Enhancing Technologies"],"original-title":[],"deposited":{"date-parts":[[2025,7,13]],"date-time":"2025-07-13T15:58:31Z","timestamp":1752422311000},"score":1,"resource":{"primary":{"URL":"https:\/\/petsymposium.org\/popets\/2025\/popets-2025-0133.php"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10]]},"references-count":0,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2025,10]]}},"alternative-id":["10.56553\/popets-2025-0133"],"URL":"https:\/\/doi.org\/10.56553\/popets-2025-0133","relation":{},"ISSN":["2299-0984"],"issn-type":[{"type":"electronic","value":"2299-0984"}],"subject":[],"published":{"date-parts":[[2025,10]]}}}