Blog

Following the cookie crumbs: discrimination as a result of online tracking

Every day, people use a multitude of websites for shopping their favorite brands, online banking, and accessing other services. When online browsing, we leave behind traces of information that are stored by cookies. A cookie is essentially a randomly generated identification number assigned to your device by a website, and it records activity and preferences. Cookies can make online browsing more convenient for us, for instance, by remembering our language and currency preferences. There is, however, a price for such convenience, as the ‘crumbs’ we leave behind could lead to our exclusion  as a result of discrimination.

Currently, cookie tracking is legal only when website operators obtain users’ consent – hence the cookie banners we have become familiar with. Ensuring that website operators’ use of cookies is legal has direct relevance for individuals. Illegal collection of data through cookies can lead to advertising companies using third-party cookies to track users across websites, which might ultimately result in discriminatory effects. For example,  while scrolling on a job-hunting website, John, who is of Roma ethnicity might not see certain job offers due to his ethnic origin. Information related to ethnic origin, sexual orientation, etc., can be recorded by cookies in the course of online browsing. For instance, if John visited a website dedicated to expats from the Roma community, this information and much more  is stored on his system by a cookie. Profiles of users can then be created which indicate that the user of that device, John, is probably of Roma origin. When John browses a recruitment website, the website may, on the basis of cookies, only display certain job offers based on his inferred ethnicity. The fact that he can then not see certain job opportunities occurs without his knowledge of the possible consequences (i.e. exclusion from certain employment opportunities). It is challenging to assess the possibly discriminatory nature of the content we are provided with. Browsing online is not like watching television or reading the newspaper, where all individuals receive the same information. In online browsing, we are all interacting with different content, which is highly personalised to our personal characteristics, such as age group, gender, and socio-economic background.

According to new research on the practices of cookie tracking, it is impossible to check if cookie banners are actually obtaining users’ valid consent. It is not hard to imagine why – we can all recall having, at least once, clicked on ‘accept all cookies’ without reading further. But is this how the cookie crumbles? We need to make sure that the use of cookies is legal in order to diminish the risk of discrimination. Generally, society complies with legal rules if these are monitored and enforced. However, website operators tend to have the power to decide their practices and this leads users to have ‘take it or leave it’ conditions. This imbalance of power between website operators and users is made worse by the fact that users have limited time, will or expertise to monitor the cookie practices of every single website they visit. Moreover, the authorities responsible for monitoring such practices are often understaffed, which could mean they choose to prioritise other matters that receive more attention from the public.

The solution to this issue could be to embed cookie law requirements in technology, what is also known as techno-regulation. Rather than rely on users’ consent, techno-regulation aims to ensure that website operators’ use of cookies becomes compliant with the law by default. The benefit of such an approach would be its efficiency given the abundance of websites and the limited monitoring capacities of individuals and the authorities. An important drawback relates to the reduced agency on the part of the website operators to decide how to use cookies.

Reflections on the legality and risks posed by cookie tracking are very timely, given that the European legislator is drafting new laws that govern the use of cookies. It will be interesting to see how the law develops to respond to new challenges.

Ana and Mariana are both finishing their Masters degrees in Law and Technology at Tilburg University, specialising in privacy and data protection.

Authors

Ana-Maria Hriscu,

Mariana Evram