# Crumbled Cookies: Exploring E-commerce Websites’ Cookie Policies with Data
Protection Regulations

Nivedita Singh<EMAIL_ADDRESS>0000-0001-6225-3669 Sungkyunkwan
UniversitySeobu-ro, Jangan-guSouth Korea2066 ,  Yejin Do<EMAIL_ADDRESS>Sungkyunkwan UniversitySeobu-ro, Jangan-guSouth Korea ,  Yongsang Yu
<EMAIL_ADDRESS>0009-0004-6790-6488 Sungkyunkwan UniversitySeobu-ro,
Jangan-guSouth Korea ,  Imane Fouad<EMAIL_ADDRESS>Inria, Univ
LilleFrance ,  Jungrae Kim<EMAIL_ADDRESS>Sungkyunkwan UniversitySeobu-ro,
Jangan-guSouth Korea and  Hyoungshick Kim<EMAIL_ADDRESS>Sungkyunkwan
UniversitySeobu-ro, Jangan-guSouth Korea

(2018)

###### Abstract.

Despite stringent data protection regulations such as the General Data
Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and
other country-specific regulations, many websites continue to use cookies to
track user activities. Recent studies have revealed several data protection
violations, resulting in significant penalties, especially for multinational
corporations. Motivated by the question of why these data protection
violations continue to occur despite strong data protection regulations, we
examined 360 popular e-commerce websites in multiple countries to analyze
whether they comply with regulations to protect user privacy from a cookie
perspective. We were interested in whether the cookie policies of websites
differ from country to country and whether the strictness of data protection
rules in a country affects the cookie policies of websites in that country.
Our investigation explored cookie attributes and their links to potential
security and privacy breaches, such as cross-site scripting (XSS) and cross-
site request forgery (CSRF). We found that approximately 84% of all examined
cookies are susceptible to XSS attacks. While preventive mechanisms against
CSRF attacks lie at the mercy of browsers, our results are concerning,
revealing that 81% of cookies are prone to these attacks. We also discovered
masquerading cookies, where third-party cookies pose as first-party cookies,
making it difficult to distinguish them from first-party cookies. These
deceptive cookies can track users without their knowledge or consent. To our
knowledge, we are the first study to analyze how well e-commerce websites in
different countries uphold the GDPR/CCPA and country-specific regulations. Our
findings suggest that many websites still use insecure cookie policies.
Therefore, there is an urgent need for uniform and consistent cookie policies.
This need also underscores the importance of enacting stringent regulations
that define the attributes associated with cookies.

Web security; privacy; cookie; GDPR; CCPA; tracking.

††copyright: acmcopyright††journalyear: 2018††doi: XXXXXXX.XXXXXXX††price:
15.00††isbn: 978-1-4503-XXXX-X/18/06††ccs: Security and privacy Privacy
protections††ccs: Security and privacy Social aspects of security and privacy

##  1\. Introduction

Cookies are an intrinsic element of web applications, initially designed to
streamline the state between client and server, but their use has expanded as
application needs have evolved. While some cookies are essential for the
proper functioning of the website, a majority of them are used for user
tracking and advertisement (Bollinger et al., 2022). Recently, web user
tracking has garnered substantial attention from the public due to its
proliferation in data privacy incidents. These cookies are under scrutiny
because of their covert acquisition of extensive user information,
subsequently monetized by the ad tech sectors, often leading to notable
incidents such as the Cambridge Analytica scandal (Wong, 2019).

In 2019, it was reported that about 90% of all the websites use tracking
cookies (Solomos et al., 2019). As a result, they have become a focal point in
ongoing legislative endeavors. Concerns over user privacy arising from the
mismanagement of cookies have been voiced over the years in several press
media outlets, research publications, and prominent academic conferences
(News, 2021c). Consequently, a more comprehensive examination of this topic
has emerged, encompassing diverse perspectives (News, 2021b). This exploration
delves into technical considerations related to cookie syncing (Fouad et al.,
2018) among web entities, as well as legislative measures governing user
privacy and behavior.

Third-party sources inject JavaScript code to enhance user experiences and
ensure websites run smoothly. Nonetheless, this cross-domain inclusion of
third-party JS code invites privacy and security risks making them an
essential nuisance (Chen et al., 2021). In an online web context, third-party
tracking and breaches are unarguably the most persistent intrusion in users’
data. Though several efforts have been made to restrict these third-party
cookies tracking, not much attention has been paid to how first-party cookies
are also engaged in user tracking and other breaches (Roesner et al., 2012).

To restrict these violations, the European Union introduced the General Data
Protection Regulation (GDPR), (Regulation, 2016), which enforces strict
guidelines on the collection and retention of personal data, requiring
companies to obtain informed consent. Similarly, the California Consumer
Privacy Act (CCPA) (of 2018, 2018) provides consumers with more control over
the personal information that businesses collect. Recognizing the urgent need
for data protection rules, several countries are racing to implement/revise
their own data protection regulations, such as PIPA for South Korea (of
Korea), 2023), while others have yet to do so, such as the PDP bill, India
(Ministry of Electronics & Information Technology, 2022).

To our interest, we selected various e-commerce platforms because they are
among the most visited websites in the world, and unfortunately, they carry
security weaknesses (Pagey et al., 2023). Businesses benefit from ad-tech
organizations such as Google Analytics, which often contain blocklists such as
Criteo. However, these gains often come at the price of potential personal
data breaches affecting consumers. To make matters worse, some major players
(e.g., Amazon and AliExpress) offer services in various parts of the globe but
often fail to adhere to country-specific data protection rules. This non-
compliance has resulted in regulatory authorities inflicting significant fines
on many leading organizations for enabling advertisement cookies even before
users choose their consent (TechNews, 2021; Goetzen, 2021). These players
create sophisticated tracking mechanisms in collaboration with major ad-tech
companies by enabling cross-site data transfer (Fouad et al., 2022). Our
findings revealed that their pervasive cookies constantly monitor user choices
and preferences even when these major players operate within specific
countries. This observation highlights the extensive influence of these
cookies, which transcends geographical boundaries. We are motivated to
explore, despite the existence of strict data protection rules, how platforms
find loopholes to infringe. To this end, we explore various cookie attributes
contributing to security breaches and privacy violations. We raise the
following research questions:

  * •

RQ1: Do e-commerce platforms comply with GDPR, CCPA, and other privacy
legislations?

  * •

RQ2: How vulnerable are user profiles on shopping websites? If so, to what
extent?

  * •

RQ3: To what extent do cookies violate the rules?

To address these research questions, we developed a tool called
CookieCruncher. Figure 1 shows an overview of CookieCruncher, which takes an
e-commerce website as input, searches for a consent management platform (CMP)
if one exists, waits for user consent, collects cookies, and then analyzes
their behavior. CookieCruncher used this process to crawl 11,223 cookies from
real-world websites and assess their attributes. Our analysis highlights how
third-party cookies can lead to potential breaches.

Figure 1. Overview of CookieCruncher.

Overview of work

Our contributions First, CookieCruncher collected and analyzed 11,223 cookies
from e-commerce platforms, finding potential security and privacy violations
of 84% and 81% against XSS and CSRF attacks, respectively. Of the 11,000
cookies, 37% are third-party cookies, of which 67% are tracking cookies. For
example, we found that nearly 65% of the top 20 third-party cookies from 18
countries were ad trackers, and some of them were even blocklisted cookies
(e.g., Criteo, Adnxs).

CookieCruncher also evaluated that approximately 40% of cookies transcend
their lifecycle, which could help construct comprehensive user profiles to
unveil behaviors and interests. While earlier investigations focused on
identifying violations and user tracking cases, CookieCruncher emphasizes
uncovering the underlying causes of these infringements. We believe that
addressing violations demands more than just identifying the means; it
necessitates a thorough examination of their characteristics, primarily
referred to as cookie attributes. For example, CookieCruncher evaluated how
third-party cookies track users in the first party’s name by hiding their true
identity. We discovered these types of cookies as masquerading cookies. Our
findings could prompt legislators to rethink cookie policies, with an emphasis
on their process of creation, sharing, and dissemination across websites.

##  2\. Background

Before we dive into how various cookies can be abused, we first provide basic
information about cookies (Carmi, 2017).

###  2.1. Cookies

Cookies are diminutive text files strategically embedded in web browsers to
maintain user states during browsing sessions, enabling websites to store and
manage user-specific information across multiple sessions. Figure 2 shows the
attributes of an example cookie. Common cookie attributes include:

⬇

{

”domain”: ”.360yield.com”,

”expires”: 1697000572.987183,

”httpOnly”: false,

”name”: ”tuuid_lu”,

”path”: ”/”,

”priority”: ”Medium”,

”sameParty”: false,

”sameSite”: ”None”,

”secure”: true,

”session”: false,

”size”: 18,

”sourcePort”: 443,

”sourceScheme”: ”Secure”,

”value”: ”1689224572”

}

Figure 2. Third-party cookie on Amazon.

Third-party cookie on Amazon (Top shopping website of the USA).

  1. (1)

domain: This attribute specifies the domain for which the cookie is valid. In
Figure 2, a 360yield.com (third-party) cookie is placed on the website
www.amazon.com.

  2. (2)

expires: Represents cookie lifecycle in Unix timestamp.

  3. (3)

httpOnly: This means the cookie is exclusively accessible through the HTTP or
HTTPS protocol; setting it to ”true” limits access to HTTP(S) requests,
preventing client-side script access..

  4. (4)

name: Identify the purpose of the cookie.

  5. (5)

path: This attribute specifies the URL path within the domain for which a
particular cookie is valid. In Figure 2, ‘/’ specifies that for cookie
‘tuuid_lu,’ all pages of the domain are valid.

  6. (6)

priority: Determines the priority.

  7. (7)

sameParty: Determines whether the cookie belongs to the domain, the user
visit, or a different domain. In Figure 2, it is set as ‘false’ as the
particular cookie belongs to third party.

  8. (8)

sameSite: This attribute, controls or prevents the cookie when it is sent with
cross-origin requests. This attribute is responsible for preventing cross-site
forgery attacks. In Figure 2, it is set as ‘None,’ which means it can be sent
on cross-origin requests.

  9. (9)

secure: This attribute defines whether the cookie is only transmitted over
secure HTTPS connections or not.

  10. (10)

session: Categorising cookies into session or persistent.

  11. (11)

size: This attribute represents the size of the cookie.

  12. (12)

sourcePort: This attribute specifies the source port from which the cookie was
created and shared.

  13. (13)

sourceScheme: This attribute indicates the source scheme used to set the
cookie.

  14. (14)

value: This attribute in the cookie determines the specific content or data
associated with the cookie. In Figure 2, it is given in the form of a unique
identifier or code.

These cookies enable ad-tech companies to trace users’ cross-site behaviors
adeptly, rooted in their visited sites and inferred interests. Subsequently,
this insight fuels the delivery of tailor-made advertisements, enriching the
user experience. In a recent study, it has been reported that 91% of an
average users’ browsing history could be traced successfully (Bashir and
Wilson, 2018). This highly intimidating revelation prompts a compelling need
for technical discourse and immediate interventions.

###  2.2. Legislation for cookies and data privacy

In this tangled scenario, various regulatory bodies have crafted strict
legislation to create a cookie ecosystem that preserves and respects user
choices. Recital 30 of GDPR mentions cookies as online identifiers for
profiling and identification (GDPR, 2022). Likewise, within the California
region of the USA, the California Consumer Privacy Act (CCPA) (of 2018, 2018)
elevates privacy rights and safeguards for residents of California, mandating
that businesses furnish consumers with notifications regarding their privacy
protocols. These data protection rules force companies and businesses to
obtain consent before processing cookies. It is worth noting that CCPA is a
state law for the California region but is applicable outside of California.
For the USA, there is a proposal for federal law ‘American Data Privacy
Protection Act (ADPPA)’ 2023 (Congress.Gov, 1 22; Reports, 2023).

In line with GDPR, most countries formulated their own data protection rules
to safeguard users’ privacy. For instance, PIPA for the Republic of Korea (of
Korea), 2023), New Zealand Privacy Act 2020 (Legislation, 2020), Brazil-
General data protection (LGPD) 2020 (Buck, 2021), etc. Nevertheless, many
countries are addressing user privacy by building upon existing regulations
and creating new ones. For instance, in India, user protection is anchored in
the Information Technology Act of 2000, while a fresh data protection bill is
being formulated (Ministry of Electronics & Information Technology, 2022).
Conversely, countries like Australia, governed by the Australian Federal
Privacy Act of 1988, have introduced a novel data protection law focused on
consumers known as the Consumer Data Right (CDR) (Australian Government, 2020;
Labs, 2020).

##  3\. Methodology

CookieCruncher generated a dataset by crawling the top 20 revenue-generating
e-commerce platforms globally from 18 different countries (360 websites), and
analyzed 11,223 cookies in total. We chose high-revenue e-commerce websites in
a specific country, maintaining consistency by selecting sites recommended by
Statista (www.statista.com) and Similarweb (www.similarweb.com). This
procedure has strengthened our belief in the sustained popularity and
stability of these domains. With the intention of obtaining a global dataset
for our research, we employed a virtual private network (VPN) to retrieve
information directly from its source. To achieve this, we utilized Proton VPN
(www.protonvpn.com) to establish a connection via a designated country’s proxy
server.

We implemented our cookie analysis framework on top of a custom crawler which
is based on the open-source web browser Chromium (version 113.0.5672.126
(Official Build) (64-bit)). We used a server based on Ubuntu/VMware Virtual
Platform, 2 CPU cores with 13th Gen Intel(R) Core(TM) i9-13900KF. The
experiment was performed in July 2023.

Figure 3. Third-party cookie occurrences for all 18 countries.

Top twenty-third party organizations.

###  3.1. Countries selection

Although there may have been other bifurcations, for our studies, we have
deliberately chosen 18 countries and categorized them into two groups based on
their compliance with data protection regulations. The initial category
consists of countries with more stringent rules, 7 European nations that
adhere to GDPR and ePrivacy directive guidelines, and the USA (CCPA).
Countries that make up our EU’s list, are France, Germany, Italy, Netherlands,
Poland, Spain, and Sweden. We specifically selected these EU countries based
on the presence of maestro e-commerce platforms. Here the maestro
organizations are those organizations that establish a presence globally such
as Amazon, Alibaba, etc. In the subsequent list, we have designated 10
additional countries, namely Australia, Brazil, Canada, Chile, India, Japan,
New Zealand, the Republic of Korea, and Switzerland. The rationale behind
selecting these particular countries is their enforcement of rigorous data
protection regulations akin to GDPR or their active efforts toward
implementing stringent data protection measures (Kawintiranon and Liu, 2021;
Johnson, 2022).

###  3.2. Crawler and handling CMP platform

CookieCruncher have used a selenium-based crawler (Jha et al., 2022) and
collected the data after establishing a proxy connection to each country.
According to the GDPR, CCPA, and other data protection rules, user data can
only be collected after getting the consent of the user. Regulations require
websites to seek user consent before processing their data, which is why CMPs
have become necessary. During our experiment, CookieCruncher discovered, that
employment of CMP for GDPR-like countries was limited, while CMP was properly
inbuilt for most of the GDPR/CCPA countries. For instance, Australia contains
CMP for only two websites among 20, Bigw and Theiconic, while for France, all
20 platforms contain CMP except Amazon, carrefour, e.lecerc, Groupon and
zalando.

For CMP selection, we intentionally click on the ‘Accept all’ button to find
the top third-party organization for a particular country, later used to study
their behavior. Apparently, in GDPR-like countries, where many of the websites
do not contain the CMP, we sincerely collect the cookies data and analyze it.
Our crawler collects in three instances- the first being when it lands on any
website, the second, cookies after clicking CMP (if any), and finally, the
cookies on the second visit after clicking the consent button. We collected a
total of 11k cookies from the visited 360 websites.

###  3.3. Data analysis

The crawler is fed with the aforementioned e-commerce list, loads the relative
web pages, and the test browser collects all the cookies. Next, the
comprehensive examination of cookies commences by closely examining their
overall characteristics. In the post-analysis, we discovered that there is a
significant presence of third-party cookies. Our experimental and empirical
data analysis revealed several interesting features; specifically, 90% of our
crawler generated were at the optimum risk. Our attributes-based analysis
revealed that a good number of the third-party cookies appear to belong to
giant ad tech and mostly blocklisted advertising organizations.

##  4\. Analysis of real-world websites

To address RQ1, we use CookieCruncher to examine the attributes of cookies,
regardless of whether they are first-party or third-party, and based on the
findings, we report the instances of potential security breaches and privacy
violations.

###  4.1. Complex web of third-party and tracker cookies

Cookies were not created with malicious intent. They were initially designed
to help websites remember information about users, such as login credentials,
user preferences, and items in a shopping cart. However, over time, cookies
have been morphed into a tool for tracking users across the web, which has led
to concerns about privacy and security (Cahn et al., 2016a; Hu and Sastry,
2020). In the big-data era, third-party cookies are intentionally deployed by
data brokerage firms, online ad agencies, and tracking applications (e.g.,
DoubleClick, 360yield, Criteo) (Bollinger, 2021). Third-party cookies can be
used to track users’ browsing behavior and later assist ad-tech agencies in
creating user profiles, thereby challenging users’ privacy.

We scrutinized the crawled third-party cookies and found that most of them
were global trackers. The abundance of third-party cookies, including
persistent cookies, poses challenges for users in tracking and controlling
their online presence.

####  4.1.1. Cookies pervasiveness

For our analysis, CookieCruncher filtered out the first-party cookie and
third-party cookie by considering the cookie domain name (See Figure 3). We
now detail the list of all 18 countries in Appendix A.

Though cookie’s pervasiveness is evident in both the category of our chosen
list, there is a mark difference in their proportions. The proportion of
cookies in our GDPR-like countries list easily surpasses the GDPR/CCPA
countries. Evidently, in our GDPR-like countries data set, the majority of the
countries have third-party cookies proportion in the range of around 40-about
50%, while it hardly reaches about 40% maximum in the USA (strict category).
Though countries in our GDPR/CCPA category comply with uniform regulations,
they show a variation among themselves. Particularly the cookies proportion of
Germany is the least while Poland tops the list with the USA as an exception.
The reduced third-party cookies proportion of Germany among EU countries is in
line with the previous reports on an average number of trackers per website
(Jha et al., 2022). Less surprisingly, these trackers are in excess proportion
in GDPR-like countries. Though our analysis presents that countries with
GDPR/CCPA rules have better data protection, nonetheless, it does not ensure
complete protection in safeguarding privacy. At the same time, there is much
to do for our GDPR-like countries.

####  4.1.2. Cookie before and after analysis

CookieCruncher analyzed the cookie appearance behaviors for those websites
that contain CMP. Understanding the factors that third-party cookies are often
deployed to run the advertisement business, but in many instances user has no
choice but to give his consent. For instance, in theiconic.com (Australia), 22
third-party cookies (including Adnxs, doubleclick. net, criteo,360yield, etc.)
appeared before the user gave consent, while the other cookies either first-
party or third-party, appeared after the user feed his consent to CMP. The
issue of concern is whether these cookies are linked to the potential security
breaches that we address in the following section.

Figure 4. Top 20 tracker cookies from third-party list.

Top 20 third-party appearances from all 18 countries in our dataset.

####  4.1.3. Analysis by GDPR-like countries

We now analyze the occurrence of third-party cookies and their variations
among our GDPR-like countries list (See Figure 27 (Appendix)). For these
countries, out of total cookies, 43% are third-party cookies, consinting
mostly trackers discussed further in the next section. This analysis showcases
the name of some targeted ad agencies, particularly ‘Adnxs,’ which redirects
the browsers to add unwanted browser extensions, malicious software updates,
adult sites, online web games, and other illegitimate content. It is highly
dangerous that it is popularly called “Tracking the tracker’s data” (Geary and
Hughes, 2012), (Cahn et al., 2016b). Out of the top 20 third-party cookies,
Bing occupies the top position with 5.06% occurrence while adsrvr the lowest
(1.54%). In our in-depth analysis, we found that widerplanet is a predominant
active tracker cookie in South Korean websites which is a targeting
advertising service based on a big data source pool.

####  4.1.4. Analysis by GDPR/CCPA countries

Third parties, which remain dominant in GDPR-like countries, prove their
global presence by appearing in GDPR/CCPA countries as well, but with a
slightly reduced proportion (19%) (see Figure 28 (Appendix)). For instance,
Bing (occurrence 5.06%) in the GDPR-like countries appears with somehow the
same occurrence (5.07%) in GDPR/CCPA countries.

####  4.1.5. Analysis by all countries

To keep an eye on the pervasiveness of the third-party cookies across all the
countries, we generated a combined plot of all 18 countries considering 360
websites (see Figure 29 (Appendix)). Our analysis revealed that third-party
cookies more or less follow the same pattern globally. For instance, Adnxs, a
concerning tracker, exhibited a presence of 4.36% in GDPR-like scenarios,
4.36% in GDPR/CCPA countries, and thus an overall occurrence of 4.46% in the
third-party tracker list. Among a total of 11k cookies, CookieCruncher
evaluated 37% cookies are third-party cookies, and these cookies are
accessible to all pages of specific platforms. In further investigation, we
evaluated that 98% of third-party cookies can trace every page by setting its
path attribute as ‘/’

####  4.1.6. Tracker cookies, among third-party cookies

CookieCruncher performed analysis on the third-party cookie list using
filterlist (github, [n. d.]) and filtered out cookies set by a tracker,
resulting in 67% of the total tracking cookies, to track user over different
websites. bidswitch and Adnxs are the top two trackers in our dataset (see
Figure 4).
Our recommendation \- Enforcing rigorous policies to limit the usage of third-
party tracker cookies and their associated attributes is imperative.

###  4.2. Misconfiguration of third-party cookie attributes

CookieCruncher investigated three cookie attributes from the third-party list,
namely, ‘httpOnly,’ ‘secure,’ and ‘session.’ Knowing the fact that for the
proper functioning of a website, some flags are intentionally set as false. So
to check the potential abuses, CookieCruncher used only third party, including
the tracker and advertisement cookies, to evaluate further. The flags of these
cookies can be either set as ‘true’ or ‘false,’ which has a different
implication on the security and privacy of the website and users. ‘httpOnly’
attributes are considered as a defense in depth strategy (Zhou and Evans,
2010). Enabling this flag as ‘true’ acts as a safeguard against cross-site
scripting (XSS) attacks. However, research indicates that while they don’t
completely eradicate XSS attacks, they do render them significantly more
challenging by thwarting cookie theft. From Figure 5, it is evident that
‘httpOnly’ flags are, in general, set to ‘false’ in high proportion,
approximately 84% for all the cookies (RQ2 and RQ3). This situation can
potentially attract intruders to inject malicious code that might initiate an
XMLhttp request using the TRACE method, thereby possibly obtaining the
‘httpOnly’ cookie in the message echoed back by the server (Grossman, 2003).

The ‘secure’ attribute setting to true can not prevent the possibility of an
XSS attack as observed jointly by the httpOnly attribute (see Figure 5).

We took these three attributes into consideration as this combination to find
the possibility of XSS attacks. In summary, our analysis of these three
attributes from all 18 countries shows their susceptibility to potential
security attacks (RQ2).
Our recommendation \- A combination of these three attributes must be
judiciously handled to ensure user security.

Figure 5. Third-party cookie attributes set to ‘true’ or ‘false.’

Cookie attributes set to ‘true’ or ‘false’ and respective trends for all
countries

###  4.3. Invitation to CSRF attack

Cross-site request forgery, popularly known as a one-click attack, is an
exploit of a website where unauthorized actions are unintentionally submitted
by a user resulting in financial loss or performing other sensitive
operations. In 2016, the ‘sameSite’ attribute of the cookie was introduced to
prevent CSRF attacks to add an additional security layer as a defense
mechanism. The ‘sameSite’ attribute for cookies has three possible flags.
‘Strict,’ ‘Lax,’ and ‘None.’ ‘Strict’ ensures the cookie is only sent with
same-site requests, providing maximum security but potentially breaking some
cross-site functionality. ‘Lax’ allows the cookie to be sent with same-site
and top-level navigation requests, striking a balance between security and
compatibility. ‘None’ allows the cookie to be sent with all requests,
including cross-site, which is the very least secure. Cookie rules (Google,
2019b)proposed that browsers should treat the lack of the ‘sameSite’ attribute
as lax. In a further refinement in 2020 (Google, 2020), cookies with
sameSite=None were additionally required to use the ‘secure’ flag. From our
analysis (see Figure 30 (Appendix)), we found that in the most dangerous CSRF
attack, strict cookies’ best armor has been least implemented, creating a
welcoming door for this attack. Particularly in GDPR-like countries, this
cookie proportion is lower compared to the GDPR/CCPA countries list. Our data
aligns with a recent report showing that only a few websites safeguard their
authentication cookies by enabling strict or lax (Compagna et al., 2021).
Though this SSC- a key defense against CSRF only came to the limelight when
Chrome browser adopted it in 2020 (M.west google, 2016; Status, 2020; News,
2021a).

Figure 6. sameSite attribute for three lists (GDPR-like countries, GDPR/CCPA
countries, and all 18 countries together).

sameSite attribute for three lists (GDPR-like countries, GDPR/CCPA countries,
and all 18 countries together).

Moving to the other attribute, ‘None,’ CookieCruncher found a high proportion
of cookies are set to none in GDPR-like countries compared to GDPR/CCPA
countries (RQ2). Initially, if the ‘sameSite’ attribute was set as blank or
with an invalid value (we defined it as default), the browser was compelled to
handle such cookies as if they were tagged with sameSite=None. While this
scenario was advantageous for websites minimally impacted by the
implementation of ‘sameSite,’ it resulted in the new security measure
remaining dormant by default. However, in a follow-up draft in 2019, browsers
were mandated to interpret the absence of ‘sameSite’ attribute as sameSite=lax
(Google, 2019a). In another subsequent refinement in 2020, the browsers were
prescribed to use the ‘secure’ flag to the cookies configured with
sameSite=None (Google, 2019a). At this juncture, it is quite obvious that
nations adhering to strict data protection regulations, similar to our
category list of GDPR/CCPA countries, exhibit a slightly lower prevalence of
cookies labeled with sameSite=None compared to their counterparts.
Nevertheless, when considering a comprehensive analysis of all cookies across
countries, a notable portion of cookies marked with sameSite=None could raise
concerns about user privacy, warranting apprehension. Another feature that
draws our attention is the maximum number of cookies tagged with
sameSite=default. Leaving the ‘sameSite’ attribute as default places the
burden on the browser to determine how the flag for this attribute is
configured (see Figure 6). However, it is important to highlight that if this
attribute’s flag is set to its default value, the corresponding cookie must
also possess a specific ‘secure’ field set to ‘true.’ Our examination reveals
for potential security breach, underscoring the need for a reevaluation of
this attribute (RQ2).

Table 1. ‘sameSite’ attribute with default flag (out of total cookie available for particular country’s twenty e-commerce platforms) and respective ‘secure’ attribute with ‘false’ flag (FF). Index | Country | Default | ‘secure’ (FF)
---|---|---|---
1 | Australia | 39% | 86%
2 | Brazil | 42% | 91%
3 | Canada | 40% | 76%
4 | Chile | 38% | 95%
5 | China | 42% | 91%
6 | India | 45% | 86%
7 | Japan | 32% | 87%
8 | New Zealand | 43% | 84%
9 | Republic of Korea | 28% | 98%
10 | Switzerland | 48% | 70%
11 | France | 75% | 73%
12 | Germany | 64% | 69%
13 | Italy | 75% | 65%
14 | Netherlands | 64% | 69%
15 | Poland | 56% | 75%
16 | Spain | 68% | 71%
17 | Sweden | 69% | 67%
18 | The USA | 46% | 74%

Table 1 illustrates a disconcerting scenario. In the second column, which
represents the default, we observe the total count of cookies lacking the
‘sameSite’ attribute, thereby shifting the responsibility to browsers for
defining this field. However, as elucidated earlier, in such instances, the
‘secure’ field must be set to ’true’.

In the fourth column of the same table, we find a worrisome trend. Among the
total cases under the default case, a certain percentage is marked as ‘false’,
giving rise to concern. For instance, considering France as an example, 75% of
cookies for that specific country are set as default, and within this subset,
a substantial 73% (RQ3) have their ‘secure’ field flag set to ‘false’. Another
inference from the same table could about Chile, where 38% cookies were set as
default while 98% of them carry a ‘false’ flag for ‘secure’ attribute. This
pattern holds ‘true’ for other countries as well. The situation is even more
troubling for GDPR/CCPA countries. Despite their lower cookie count, the
alignment with Figure 30 (Appendix)) is evident. This figure indicates that in
the case of GDPR/CCPA countries, a higher proportion of cookies are left to
the browser’s discretion, resulting in a significant number of these cookies
having their ‘secure’ field set as ‘false.’ These cookies are susceptible to
CSRF attacks. To find a security vulnerability in this case, CookieCruncher
considered all cookies as these abuses can be invited either first-party or
third-party. When the user browses any e-commerce, even if he rejects all
third-party cookies, still vulnerable to these attacks by first-party cookies.
Our recommendation \- The ‘sameSite’ attribute assumes a pivotal role in
managing CSRF attacks, representing a significant milestone in deterring such
perilous security breaches. Our investigation highlights persisting gaps in
attribute implementation, underscoring the need for heightened legislative
focus to address these intricacies effectively.

Figure 7. Average lifecycle of cookies on top visited e-commerce websites in
each country.

Average lifecycle of cookies on top visited shopping websites in each country

###  4.4. Cookies transcending their age

According to the regulation, the websites declare the expiration time of
personal information, which also applies to cookie (InfoCuria, 2019). It is
crucial to verify the duration cookie. You may gather the impression that our
conversation revolves around none other than the lifecycle of cookies. A
cookie containing user interest related information should be retained for a
designated duration, which is why a cookie with a brief lifespan is regarded
as more secure. The eDirective Privacy specifies the cookie life span for not
more than 12 months (GDPR.EU, 2020). This means the persistent cookies (the
cookie that declares its lifespan) should not remain for more than 12 months.
Our analysis results in Figure 7 and (see Table 2) raise concerns for users’
data privacy. They depict many instances of violations regarding the cookie’s
lifespan. In our analysis, we have chosen the average lifespan of cookies
available from the prominent e-commerce/shopping websites without the session
cookies. As it is now well established that cookies store critical information
like website visits, hobbies, interests, and purchasing trends. Such humongous
user data collection through cookies deployment leaves personal information
vulnerable (Pisano et al., 2022). Despite this, several countries have paid
less heed to cookie’s lifespan (Bird&Bird, 2023), hence we took GDPR/ePrivacy
Directive to compare the violations for all countries in our dataset. However,
several research reports strictly advocate on the lifespan of cookies must be
established (Naithani, 2022). Here we don’t bring any discussion on the nature
of cookies simply to avoid ambiguity on the type of cookies to be essential,
persistent, or strictly necessary. We straightforwardly focus on the cookies
transcending their lifespan and their potential implications on data privacy.
Before delving into further discussion, we highlight that to plot (see Figure
7), we have chosen the top revenue-generating e-commerce of each country in
the category. On the very first preliminary inspection, it is clear that the
majority of the countries violating the cookie’s life span fall in our
GDPR/CCPA countries category list such as Spain, Germany, Italy, and France
(RQ1 and RQ2). It is quite contradictory that GDPR/CCPA countries are
violating their own strict rules. This trend is not too far to guess, thanks
to the maestro organization in these countries. Unfortunately, even after
paying a huge fine in the past by maestro companies (GDPRFonAmazon, 2022).

Table 2. Cookie lifecycle (‘Expire’) potential violation GDPR-like country | Violation |  GDPR/CCPA country | Violation
---|---|---|---
Australia | 41% |  France | 36%
Brazil | 42% |  Germany | 32%
Canada | 44% |  Italy | 31%
Chile | 42% |  Netherlands | 32%
China | 40% |  Poland | 43%
India | 43% |  Spain | 36%
Japan | 52% |  Sweden | 38%
New Zealand | 43% |  The USA | 40%
South Korea | 38% |  – | –
Switzerland | 42% |  – | –

our results reveal a persistent trend. On the contrary, several countries in
the GDPR-like countries category (their top-revenue e-commerce platform)
perform better in terms of cookies’ lifespan violation.

Table 2 illustrates the number of cookies in each country that exceed one year
rule for cookie lifespan. For instance, among the entirety of cookies present
on twenty shopping websites in Australia, 41% of these cookies are in breach
of the rule, and this pattern continues for other countries as well. Cookies
lifespan violation is as little as 31.4% and highest at 52.41% for Italy and
Japan, respectively (see Table 2). It is essential to mention here that more
the lifespan a cookie possesses, more vulnerable it will be. As a rule of
thumb, these transcending cookies are more vigilant to user interest.
Our recommendation \- Our investigation has unveiled instances where cookies
exceeded a one-year duration, providing ample time for the compilation of
comprehensive user profiles encompassing interests, behaviors, and decision-
making patterns. We earnestly appeal to policymakers to place a heightened
emphasis on crafting stringent regulations to govern cookie lifespans
precisely.

Figure 8. Overview of masquerading cookies.

Masquerading cookie example.

###  4.5. Maestro websites and their masquerading cookies

In this section, we elucidate how maestro websites employ their Masquerading
cookie to weave a complex cookie ecosystem, tragically placing users’ privacy
at risk. While crawling, we landed up finding a third-party cookie behaving
like a first-party and thus assisting in users’ behavior tracking, to these
cookies, we coined the name Masquerading Cookie. For example, while crawling
to collect our cookies data from Shein.fr- a top revenue-generating company in
France, we found cookies from Shein.com- a top Asian e-commerce organization
(see Figure 8). In order to authenticate our findings, we conducted website
crawls with a ‘Reject all’ approach, followed by subsequent data analysis. Our
investigation uncovered a noteworthy discovery: despite the rejection of
third-party cookies, deceptive masquerading cookies persist within the
e-commerce platform. Afterward CookieCruncher conducted the investigation of
other attributes of the same cookies, and those were aligned with our
findings, such as for these cookies the attribute ‘SameParty’ carries a False
flag ensuring these cookies do not belong to the same domain or first party.
Hence these masquerading cookies are conflicting third-party cookies
camouflaged as first-party cookies. The ubiquitous nature of maestro websites
on the one hand benefits the user by their services very efficiently but at
the stake of consumers’ privacy. On the other hand, these maestro websites are
the root origin of these masquerading cookies. It is obvious that these
conflicting cookies may go unnoticed in many instances, making it challenging
to distinguish between first-party and third-party cookies. (see table 3
(Appendix)) Our empirical investigation revealed a significant occurrence of
this phenomenon, particularly among globally serving maestro websites.
CookieCruncher answered our question that we initially introduced.

Our recommendation \- Our findings expose the perilous possibility of third-
party tracking under the guise of a first-party due to domain conflicts. This
underscores a significant security concern. We hold the expectation that
policymakers will thoroughly address this matter, reconsidering the precise
delineation of first-party and third-party entities.

##  5\. Discussion and Limitations

Our comprehensive examination of cookie attributes reveals a prevalent
occurrence of intricate networks involving intermediaries or third parties on
web pages. These cookies, originating from diverse domains, are subsequently
employed for user tracking and security breaches. Contemporary data protection
regulations are earnestly striving to safeguard user privacy, despite the
occasional presence of undesirable content on web pages. While one perspective
reveals that the implementation of these rigorous data protection regulations
will establish a barrier-like framework to curtail non-essential data exchange
among third parties, our stance contends that a more nuanced approach, holds
the potential to uncover the underlying causes behind these incidents.
Currently, a lack of established guidelines exists for defining individual
cookie attributes. Each attribute of a cookie and its correlation with another
attribute, such as the ‘sameSite’ attribute requiring the ‘secure’ attribute
to be set as ’true,’ holds significance in thwarting malicious attacks. These
interconnected attributes with their respective flags weave a complex
interconnected cookies network making it nearly impossible for users to evade
the abuses. Therefore, a distinct legal framework is imperative to
meticulously address every cookie attribute and its interrelations. We believe
our research suggests that lawmakers will likely institute more rigorous
regulations to precisely delineate cookie attributes. This is essential, as
cookies play a pivotal role in user tracking and monitoring online activities.
Thus advocating for an urgent standard cookie policy.
Our work has a few limitations. Firstly, in identifying tracker cookies, we
used a filterlist mechanism instead of more advanced methods. Secondly, in
some of our studies, we adopted GDPR rules as a standard without analyzing
nation-specific regulations, which we plan to explore in future research.

##  6\. Related work

Cookies are among the simplest arsenals used in tracking mechanisms.

Sanchez-Rola et al. (Sanchez-Rola et al., 2021) defined a set of roles in the
cookie ecosystem scenario related to cookie creation and sharing. This study
highlights that cookies form a complex network of interconnections between
organizations that could share the cookies at the end of a complex chain
involving a middleman. In another instance, Sanchez-Rola et al. (Sanchez-Rola
et al., 2019) analyzed EU websites and surprisingly found that cookie tracking
remains ubiquitous. In this study, they revealed that though GDPR has impacted
how data is being processed globally, nearly 90 percent of web visits remained
traceable. Likweise, Bollinger et al. (Bollinger, 2021), through their
studies, found many instances of GDPR violations. Fouad et al. (Fouad et al.,
2018) through their studies revealed that even the most popular tracking
detection methods, such as EasyList and EasyPrivacy, miss a significant
portion of cookie trackers, specifically failing to detect 25.22% and 30.34%
of identified trackers, respectively. While these studies have demonstrated
several occasions of violation of data protection rules, our study is the
first of its type where we tried to analyze the cause of security and privacy
violations for privacy regulation-owning countries.

To summarize, our research stands apart in two key ways. Initially, we
identified the potential security and privacy breaches stemming from the
presence of these cookies carrying undesired attributes and their linked
flags. Secondly, we endeavored to delve into the intricate reasons behind the
challenging nature of mitigating tracking cookies, primarily due to their
conflicting identities.

##  7\. Conclusion

Our studies revealed that the major culprit for cookie-related violations and
breaches is cookie attributes rather than the cookies themselves, which have
been unfairly blamed in the past. In this paper, we performed a comprehensive
measurement campaign and highlighted possible violations and breaches beyond
the GDPR and CCPA. Our in-depth analysis demonstrates the potential for global
third parties to track users and expose their profiles to vulnerabilities. Our
findings indicate that cookie attributes and settings of false or None could
be the reasons for XSS and CSRF attacks. These vulnerabilities compromise
cookie security and increase the risk of unauthorized access and data
interception. These attacks can be even more risky if the cookies are long-
lived or if they are masquerading cookies.

At this juncture, we urge policymakers to rethink the standardization of
cookie policy, focusing on ways to improve the creation, sharing, and
dissemination of cookies across websites.

In our future work, we aim to develop a tool to enhance security and privacy
during web browsing. This tool will take a URL as input and strive to provide
users with a URL devoid of tracking cookies. It will also evaluate and modify
potentially harmful cookie attributes. The tool will first check for a cookie
consent banner and consider the user’s choice (acceptance or rejection). If no
consent banner is found, the tool will proceed autonomously.

## References

  * (1)
  * Australian Government (2020) The Treasury Australian Government. 2020.  _New Australia Data Protection Law: Consumer Data Right (CDR)_.  Retrieved August 17, 2023 from https://treasury.gov.au/policy-topics/economy/consumer-data-right#:~:text=The%20Consumer%20Data%20Right%20%28CDR%29%20is%20a%20secure,data%20being%20shared%20with%20trusted%20accredited%20third%20parties.
  * Bashir and Wilson (2018) Muhammad Ahmad Bashir and Christo Wilson. 2018.  Diffusion of User Tracking Data in the Online Advertising Ecosystem.  _Proc. Priv. Enhancing Technol._ 2018, 4 (2018), 85–103.
  * Bird&Bird (2023) Bird&Bird. 2023.  _Global Cookie Review 2023_.  Retrieved August 10, 2023 from https://www.twobirds.com/-/media/new-website-content/pdfs/insights/2022/global/bird-bird-global-cookies-review-winter-2022-final.pdf
  * Bollinger (2021) Dino Bollinger. 2021.  _Analyzing cookies compliance with the GDPR_.  Master’s thesis. ETH Zurich.
  * Bollinger et al. (2022) Dino Bollinger, Karel Kubicek, Carlos Cotrini, and David Basin. 2022.  Automating Cookie Consent and $\\{$GDPR$\\}$ Violation Detection. In _31st USENIX Security Symposium (USENIX Security 22)_. 2893–2910.
  * Buck (2021) Rick Buck. 2021.  _Complete Guide to LGPD: Brazil’s Data Privacy Law_.  Retrieved August 9, 2023 from https://wirewheel.io/blog/lgpd-brazil-data-privacy-law-guide/
  * Cahn et al. (2016a) Aaron Cahn, Scott Alfeld, Paul Barford, and Shanmugavelayutham Muthukrishnan. 2016a.  An empirical study of web cookies. In _Proceedings of the 25th international conference on world wide web_. 891–901.
  * Cahn et al. (2016b) Aaron Cahn, Scott Alfeld, Paul Barford, and S Muthukrishnan. 2016b.  What’s in the community cookie jar?. In _2016 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM)_. IEEE, 567–570.
  * Carmi (2017) Elinor Carmi. 2017.  cookies–more than meets the eye.  _Theory, Culture & Society_ 34, 7-8 (2017), 277–281.
  * Chen et al. (2021) Quan Chen, Panagiotis Ilia, Michalis Polychronakis, and Alexandros Kapravelos. 2021.  Cookie swap party: Abusing first-party cookies for web tracking. In _Proceedings of the Web Conference 2021_. 2117–2129.
  * Compagna et al. (2021) Luca Compagna, Hugo Jonker, Johannes Krochewski, Benjamin Krumnow, and Merve Sahin. 2021.  A preliminary study on the adoption and effectiveness of SameSite cookies as a CSRF defence. In _2021 IEEE European Symposium on Security and Privacy Workshops (EuroS &PW)_. IEEE, 49–59.
  * Congress.Gov (1 22) Congress.Gov. 2021-22.  _American Data Privacy and Protection Act_.  Retrieved August 17, 2023 from https://www.congress.gov/bill/117th-congress/house-bill/8152
  * Fouad et al. (2018) Imane Fouad, Nataliia Bielova, Arnaud Legout, and Natasa Sarafijanovic-Djukic. 2018.  Missed by filter lists: Detecting unknown third-party trackers with invisible pixels.  _arXiv preprint arXiv:1812.01514_ (2018).
  * Fouad et al. (2022) Imane Fouad, Cristiana Santos, Arnaud Legout, and Nataliia Bielova. 2022.  My Cookie is a phoenix: detection, measurement, and lawfulness of cookie respawning with browser fingerprinting. In _PETS 2022-22nd Privacy Enhancing Technologies Symposium_.
  * GDPR (2022) GDPR. 2022.  _ePrivacy Directive and GDPR impact cookie law - 2022_.  Retrieved August 9, 2023 from https://www.gdpreu.org/eprivacy-directive-and-gdpr-impact-cookie-law/
  * GDPR.EU (2020) GDPR.EU. 2020.  _Cookies, the GDPR, and the ePrivacy Directive_.  Retrieved August 10, 2023 from https://gdpr.eu/cookies/
  * GDPRFonAmazon (2022) GDPRFonAmazon. 2022.  _French Council of State upholds Amazon’s 35M euro cookie fine_.  Retrieved August 10, 2023 from https://iapp.org/news/a/french-council-of-state-upholds-amazons-35m-euro-eprivacy-fine/
  * Geary and Hughes (2012) Joanna Geary and Nicola Hughes. 2012.  _Adnxs (AppNexus): What is it and what does it do?_ Retrieved August 9, 2023 from https://www.theguardian.com/technology/2012/apr/23/adnxs-tracking-trackers-cookies-web-monitoring
  * github ([n. d.]) github. [n. d.].  _disconnectme/disconnect-tracking-protection_.  Retrieved October 12, 2023 from https://github.com/disconnectme/disconnect-tracking-protection/blob/master/services.json
  * Goetzen (2021) Nina Goetzen. 2021.  _Amazon fined heavily for violating GDPR by using unconsented data for ad targeting_.  Retrieved August 11, 2023 from https://iapp.org/news/a/french-council-of-state-upholds-amazons-35m-euro-eprivacy-fine/
  * Google (2019a) M.West Google. 2019a.  _Incrementally Better Cookies draft-west-cookie-incrementalism-00_.  Retrieved August 10, 2023 from https://datatracker.ietf.org/doc/html/draft-west-cookie-incrementalism-00
  * Google (2019b) M. West Google. 2019b.  _Incrementally Better Cookies draft-west-cookie-incrementalism-00_.  Retrieved August 10, 2023 from https://datatracker.ietf.org/doc/html/draft-west-cookie-incrementalism-00
  * Google (2020) M. West Google. 2020.  _Incrementally Better Cookies draft-west-cookie-incrementalism-01_.  Retrieved August 10, 2023 from https://datatracker.ietf.org/doc/html/draft-west-cookie-incrementalism-01
  * Grossman (2003) Jeremiah Grossman. 2003.  Cross-site tracing (XST): The new techniques and emerging threats to bypass current Web security measures using TRACE and XSS.
  * Hu and Sastry (2020) Xuehui Hu and Nishanth Sastry. 2020.  What a tangled web we weave: Understanding the interconnectedness of the third party cookie ecosystem. In _Proceedings of the 12th ACM Conference on Web Science_. 76–85.
  * InfoCuria (2019) InfoCuria. 2019.  _JUDGMENT OF THE COURT (Grand Chamber)?_ Retrieved August 11, 2023 from https://curia.europa.eu/juris/document/document.jsf?docid=218462&doclang=EN
  * Jha et al. (2022) Nikhil Jha, Martino Trevisan, Luca Vassio, and Marco Mellia. 2022.  The internet with privacy policies: measuring the web upon consent.  _ACM Transactions on the Web (TWEB)_ 16, 3 (2022), 1–24.
  * Johnson (2022) Garrett Johnson. 2022.  Economic research on privacy regulation: Lessons from the GDPR and beyond.  (2022).
  * Kawintiranon and Liu (2021) Kornraphop Kawintiranon and Yaguang Liu. 2021.  Towards automatic comparison of data privacy documents: a preliminary experiment on gdpr-like laws.  _arXiv preprint arXiv:2105.10117_ (2021).
  * Labs (2020) Ground Labs. 2020.  _Australian Data Protection Laws: An Introduction_.  Retrieved August 17, 2023 from https://www.groundlabs.com/blog/australia-data-protection/
  * Legislation (2020) New Zealand Legislation. 2020.  _New Zealand Legislation Privacy Act 2020_.  Retrieved August 9, 2023 from https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.html
  * Ministry of Electronics & Information Technology (2022) Government of India Ministry of Electronics & Information Technology. 2022.  _Draft Digital Personal Data Protection Bill, 2022_.  Retrieved August 14, 2023 from https://www.meity.gov.in/content/digital-personal-data-protection-bill-2022
  * M.west google (2016) Inc M.west google. 2016.  _Same-site Cookies draft-west-first-party-cookies-07_.  Retrieved August 10, 2023 from https://datatracker.ietf.org/doc/pdf/draft-west-first-party-cookies-07.pdf
  * Naithani (2022) Paarth Naithani. 2022.  Curtailing the cookie monster through data protection by default.  _Tilburg Law Review_ 27, 1 (2022), 22–36.
  * News (2021a) BBC News. 2021a.  _Bypassing SameSite cookie restrictions_.  Retrieved August 10, 2023 from https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions
  * News (2021b) BBC News. 2021b.  _EU Cookie Law_.  Retrieved August 9, 2023 from https://www.cookiebot.com/en/cookie-law/#:~:text=What%20does%20the%20EU%E2%80%99s%20ePrivacy%20Directive%20say%20about,as%20user-friendly%20a%20way%20as%20possible%2C%20More%20items
  * News (2021c) BBC News. 2021c.  _Privacy group targets website ’cookie terror_.  Retrieved August 9, 2023 from https://www.bbc.com/news/technology-57306802
  * of 2018 (2018) California Consumer Privacy Act of 2018. 2018.  _SB-1121 California Consumer Privacy Act of 2018_.  Retrieved August 9, 2023 from https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1121
  * of Korea) (2023) Personal Information Protection Act (Republic of Korea). 2023.  _2023 Amendment to PIPA_.  Retrieved August 14, 2023 from http://koreanlii.or.kr/w/index.php/2023_Amendment_to_PIPA
  * Pagey et al. (2023) Rohan Pagey, Mohammad Mannan, and Amr Youssef. 2023.  All Your Shops Are Belong to Us: Security Weaknesses in E-commerce Platforms. In _Proceedings of the ACM Web Conference 2023_. 2144–2154.
  * Pisano et al. (2022) Mark Pisano, Robert A Smith, and Kauther S Badr. 2022.  The Evolving Landscape of International Consumer Data Privacy Compliance.  _ACET Journal of Computer Education & Research_ 16, 1 (2022).
  * Regulation (2016) General Data Protection Regulation. 2016.  _REGULATION (EU) 2016/… OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL_.  Retrieved August 9, 2023 from https://data.consilium.europa.eu/doc/document/ST-5419-2016-INIT/en/pdf
  * Reports (2023) EmBO Reports. 2023.  _U.S. Data Privacy Protection Laws: A Comprehensive Guide_.  Retrieved August 17, 2023 from https://www.forbes.com/sites/conormurray/2023/04/21/us-data-privacy-protection-laws-a-comprehensive-guide/?sh=4357c1ef5f92
  * Roesner et al. (2012) Franziska Roesner, Tadayoshi Kohno, and David Wetherall. 2012.  Detecting and Defending Against Third-Party Tracking on the Web. In _9th USENIX Symposium on Networked Systems Design and Implementation (NSDI 12)_. USENIX Association, San Jose, CA, 155–168.  https://www.usenix.org/conference/nsdi12/technical-sessions/presentation/roesner
  * Sanchez-Rola et al. (2021) Iskander Sanchez-Rola, Matteo Dell’Amico, Davide Balzarotti, Pierre-Antoine Vervier, and Leyla Bilge. 2021.  Journey to the Center of the Cookie Ecosystem: Unraveling Actors’ Roles and Relationships. In _2021 IEEE Symposium on Security and Privacy (SP)_. IEEE, 1990–2004.
  * Sanchez-Rola et al. (2019) Iskander Sanchez-Rola, Matteo Dell’Amico, Platon Kotzias, Davide Balzarotti, Leyla Bilge, Pierre-Antoine Vervier, and Igor Santos. 2019.  Can I opt out yet? GDPR and the global illusion of cookie control. In _Proceedings of the 2019 ACM Asia conference on computer and communications security_. 340–351.
  * Solomos et al. (2019) Konstantinos Solomos, Panagiotis Ilia, Sotiris Ioannidis, and Nicolas Kourtellis. 2019.  Clash of the trackers: Measuring the evolution of the online tracking ecosystem.  _arXiv preprint arXiv:1907.12860_ (2019).
  * Status (2020) Chrome Platform Status. 2020.  _Cookies default to SameSite=Lax_.  Retrieved August 10, 2023 from https://chromestatus.com/feature/5088147346030592
  * TechNews (2021) TechNews. 2021.  _Amazon hit with record E.U. data privacy fine_.  Retrieved August 10, 2023 from https://www.nbcnews.com/tech/tech-news/amazon-hit-record-eu-data-privacy-fine-rcna1566
  * Wong (2019) Julia Carrie Wong. 2019.  _The Cambridge Analytica scandal changed the world – but it didn’t change Facebook_.  Retrieved August 9, 2023 from https://www.theguardian.com/technology/2019/mar/17/the-cambridge-analytica-scandal-changed-the-world-but-it-didnt-change-facebook
  * Zhou and Evans (2010) Yuchen Zhou and David Evans. 2010.  Why aren’t HTTP-only cookies more widely deployed.  _Proceedings of 4th Web_ 2 (2010).

##  Appendix A Third-party information and cookie attributes

This section illustrates the occurrence of third-party entities across 18
different countries (see Figures 9 through 26). Analyzing these visual
representations provides insight into the predominant third-party entities in
specific nations. Implementing certain limitations on these entities might
contribute to safeguarding user privacy to a certain degree. Also, we include
the proportion of the SameSite attribute showing distribution for three flags
(See Figure 30).

##  Appendix B Instances of Masquerading cookies

We provide instances of masquerading cookies in our experiment (see Table 3).

Table 3. Instances of enumerated masquerading results

Masquerading cookie | First-party domain
---|---
AliExpress.com | AliExpress.nl(Netherlands)
Amazon.com | Amazon.fr(France), and Amazon.de(Germany)
Asos.com | Asos.fr(France)
Boohoo.com | nz.Boohoo(New Zealand)
eBay.com | eBay.ch(Switzerland), eBay.es(Spain), and eBay.pl(Poland)
H&M.com | H&M.de(Germany), H&M.nl(Netherlands), H&M.in(India), and H&M.se(Sweden)
Shein.com | Shein.de(Germany), Shein.it(Italy), Shein.nl(Netherlands), Shein.pl(Poland), Shein.es(Spain), Shein.fr(France), and Shein.au(Austrailia)
Zara.com | Zara.de (Germany), Zara.it (Italy), Zara.nl (Netherlands), Zara.es(Spain), Zara.se(Sweden), and Zara.fr(France)

Figure 9. Third-party cookies distribution in Australia. On a global scale,
the prominent trackers ‘bing’ and ‘doubleclick’ hold the top positions among
trackers in Australia.

Third-party cookies distribution in Australia.

Figure 10. Third-party cookies distribution in Brazil. On a global scale, the
prominent trackers ‘bing’ and ‘adnxs’ are top two trackers.

Third-party cookies distribution in Brazil.

Figure 11. Third-party cookies distribution in Canada. ‘Bing’ and ‘Yahoo’ are
the top two trackers for this country with 6% and 5% cookies available
respectively.

Third-party cookies distribution in Canada.

Figure 12. Third-party distribution in Chile. ‘Clarity’ and ‘creativecdn’ are
top two trackers, positioning ‘adnxs’ in the third position.

Third-party cookies distribution in China.

Figure 13. Third-party distribution in China. For this country, ‘Mediavine’ is
positioned at the top, with ‘Bing’ in the second position.

Third-party cookies distribution in China.

Figure 14. Third-party distribution in India. ‘smartadserver’ and ‘adnxs’ are
among the top third-party cookies with 6% both. The concerning issue is the
dangerous, ‘adnxs’ prevalent tracker in this country.

Third-party cookies distribution in India.

Figure 15. Third-party distribution in Japan. ‘Yahoo’ and ‘mediavine’ are
among the top third-party cookies with 6% and 4% respectively.

Third-party cookies distribution in Japan.

Figure 16. Third-party distribution in New Zealand.‘Bing’ and ‘doubleclick’
are among the top third-party cookies, with 8% both. Social networking cookies
like TikTok and Snapchat are also prevalent in this country.

Third-party cookies distribution in New Zealand.

Figure 17. Third-party cookies distribution in the Republic of Korea. The most
concerning issue for this country is the top tracker ‘widerplanet’, a targeted
advertising service based on big data. The cookie prevalence is as much high
in comparison to other countries, having 10% of cookies in 20 e-commerce
platforms.

Third-party cookies distribution in the Republic of Korea.

Figure 18. Third-party cookies distribution in Switzerland. ‘bidswitch’ and
‘smartadsrver’ are among the top third-party tracker cookies.

Third-party cookies distribution in Switzerland.

Figure 19. Third-party cookies distribution in France. Due to strict GRPR
regulations, third-party cookies are less in comparison to other countries.

Third-party cookies distribution in France.

Figure 20. Third-party cookies distribution in Germany. Due to GDPR rule,
third-party prevalence is less in comparison to less-stricter rule countries.

Third-party cookies distribution in Germany.

Figure 21. Third-party cookies distribution in Italy. Remarkably, this
illustration depicts the diversity in the implementation of GDPR rules across
different countries.

Third-party cookies distribution in Italy.

Figure 22. Tracker cookies distribution in the Netherlands. ’LinkedIn’ and
‘bidswitch’ are the top two trackers.

Third-party cookies distribution in the Netherlands.

Figure 23. Tracker cookies distribution in Poland. ‘Clarity’ and ‘onnet’ are
the top two trackers, with 12% and 8% cookies.

Third-party cookies distribution in Poland.

Figure 24. Third-party cookies distribution in Spain. ‘Clarity’ and
‘creativecdn’ are the top two trackers.

Figure 25. Third-party cookies distribution in Sweden.

Third-party cookies distribution in Sweden.

Figure 26. Third-party cookies distribution in the USA. ‘Demdex’ and ‘adsrvr’
are among the top third-party tracker.

Third-party cookies distribution in the USA

Figure 27. Top 20 third-party cookies from GDPR-like countries.

Top twenty third-party organizations

Figure 28. Top 20 third-party cookies from GDPR/CCPA countries. bidswitch is
the top occuring third-party with 5.62%.

Top 20 third-party appearances from GDPR/CCPA countries. bidswitch is the top
occuring third-party with 5.62%

Figure 29. Top 20 third-party appearances from all 18 countries in our
dataset. Bing appears as the top occurring third-party with 5.06% while
bidswitch appeares with 4.41%.

Top 20 third-party appearances from all 18 countries in our dataset. Bing
appears as the top occurring third-party with 5.06% while bidswitch appeares
the second most with 4.41%

Figure 30. sameSite attribute flag proportion from all 18 countries. Figure
shows very less adoption of strict flag and high adoption of flag by GDPR/CCPA
country. GDPR-like countries adoptd none flag as maximum.

Samesite attribute for all countries