[Paper Review] CookieEnforcer: Automated Cookie Notice Analysis and Enforcement

Rishabh Khandelwal, Asmit Nayak+2 more|arXiv (Cornell University)|Apr 8, 2022

Privacy, Security, and Data Protection4 citations

TL;DR

CookieEnforcer is a browser extension that automatically detects cookie notices, analyzes their settings via a fine-tuned T5 sequence-to-sequence model, and enforces privacy-preserving configurations by disabling non-essential cookies. It achieves 91% end-to-end accuracy in generating correct click sequences and significantly reduces user effort in managing cookie consent.

ABSTRACT

Online websites use cookie notices to elicit consent from the users, as required by recent privacy regulations like the GDPR and the CCPA. Prior work has shown that these notices use dark patterns to manipulate users into making website-friendly choices which put users' privacy at risk. In this work, we develop CookieEnforcer, a new system for automatically discovering cookie notices and deciding on the options that result in disabling all non-essential cookies. In order to achieve this, we first build an automatic cookie notice detector that utilizes the rendering pattern of the HTML elements to identify the cookie notices. Next, CookieEnforcer analyzes the cookie notices and predicts the set of actions required to disable all unnecessary cookies. This is done by modeling the problem as a sequence-to-sequence task, where the input is a machine-readable cookie notice and the output is the set of clicks to make. We demonstrate the efficacy of CookieEnforcer via an end-to-end accuracy evaluation, showing that it can generate the required steps in 91% of the cases. Via a user study, we show that CookieEnforcer can significantly reduce the user effort. Finally, we use our system to perform several measurements on the top 5k websites from the Tranco list (as accessed from the US and the UK), drawing comparisons and observations at scale.

Motivation & Objective

• To address the growing complexity and privacy-invasive defaults in cookie notices that hinder user control.
• To develop a scalable, automated system that identifies and enforces privacy-respecting cookie settings without manual configuration.
• To reduce user effort in managing cookie consent by replacing manual navigation with automated enforcement.
• To enable regulatory compliance by detecting websites that enable non-essential cookies by default.
• To provide a machine-readable representation of cookie controls for building more usable privacy interfaces.

Proposed method

• A machine-learning classifier uses rendering and textual features to detect cookie notices on web pages.
• An interactive UI simulator extracts all clickable elements and their states (selected/not selected) via programmatic tabbing and event simulation.
• A fine-tuned T5 text-to-text Transformer model maps the text and state of cookie settings to a sequence of actions required to disable non-essential cookies.
• The system generates a JavaScript snippet based on the predicted action sequence, which is injected into the browser via a Chrome extension to enforce settings automatically.
• The system supports dynamic re-evaluation if cookie notices change, ensuring long-term reliability.
• User feedback is incorporated via a summary UI that displays changes before enforcement, preserving informed consent.

Experimental results

Research questions

• RQ1 Can an automated system accurately detect and extract cookie notice controls across diverse websites?
• RQ2 Can a sequence-to-sequence model effectively predict the correct sequence of clicks to disable non-essential cookies?
• RQ3 To what extent does automated enforcement reduce user effort compared to manual configuration?
• RQ4 How prevalent are websites that enable non-essential cookies by default, especially in regulated regions?
• RQ5 How does the system perform across different regions (e.g., US vs. UK) under varying privacy regulations?

Key findings

• CookieEnforcer achieved 91% end-to-end accuracy in generating the correct sequence of actions to disable non-essential cookies across tested websites.
• In a user study, CookieEnforcer reduced the average number of clicks required to disable cookies from 12 to just 1, significantly lowering user effort.
• 16.7% of websites in the UK and 22% in the US enabled at least one non-essential cookie by default, indicating widespread non-compliance with privacy standards.
• The system successfully detected and enforced privacy-preserving settings on 91% of cookie notices, demonstrating strong generalization across diverse implementations.
• The use of a T5-based sequence-to-sequence model outperformed keyword-based or rule-based approaches in handling the high linguistic and structural diversity of cookie notices.
• The system’s reliance on tabbing and accessibility features allowed robust detection of interactive elements, though rare edge cases with non-standard implementations were observed.