Do you click ‘Reject all’ or painstakingly toggle off every cookie option when on a new website? Well, you in may be revealing more information about yourself than if you just ‘Accept all cookies’, says new research.
Cookies are (as you probably know at this point in internet history) not delicious chewy treats, but rather pieces of data. These data are stored on our devices for various purposes, including remembering our login details so we don’t need to type them in every time we return to a website. Cookies can also track our online behaviour so that companies can tailor adverts to us individually.
Many people do not want this – whether because they want their personal information private or because they don’t want companies using it to sell them things.
But new research, announced at NeurIPS 2023 (one of the largest artificial intelligence conferences in the world), reveals that there is a particular demographic who do this more than other people – and the advertisers know this. That means cookie-rejectors may not really be keeping their identity hidden at all.
So who is in this group? Cookie acceptance tends to depend on which country you live in and what age you are. Turns out, if you live in America and are over 34 years old, this is likely to be you – which means you are more likely to be giving your data away unintentionally.
“The advertisers might have five pieces of information from one person who's accepted the cookies and only two pieces of information from the person who's declined it (the website they're on currently, and the fact that they've declined it). But there's more information encoded in that decision,” one of the study’s authors Dr Elizabeth Daly, an IBM research scientist, told BBC Science Focus.
If you click ‘Reject all’, the algorithm assumes you are part of this demographic and applies what’s called ‘collaborative filtering’ to tailor content to you. It notes what other users in this group search for and then offers you the same.
Privacy for some, but not for all
The researchers think that this demographic is more likely to reject cookies because older people are less trusting of tech companies. In fact, according to earlier research, only 28 per cent of older Americans say they accept cookies when visiting a new website. That's compared to the 40 per cent of younger Americans (under 34 years old) who usually accept cookies.
This means if a younger American wants to reject cookies, their decision is more likely to have the intended effect – shielding their identity – than for an older person. “That's not fair, from a goal of preserving privacy,” said Daly.
Also, the USA doesn’t have the same data protection laws as the EU – so US users may be aware that their information is less robustly protected. The highest rate of cookie acceptance in the world is actually in Poland, where 64 per cent of people of any age say that they usually click ‘Accept all cookies’.
The authors hope that their research will inform policymakers when it comes to creating rules for regulating new technology like AI. “They really need to understand that the control mechanisms are very complicated – and they may not have the desired impact when they're in use,” Daly said.
So… is there any point in rejecting cookies?
The researchers also hope that the discovery helps people understand how to better protect their privacy.
“We want to illustrate to users that the impact of their privacy decisions is not as straightforward as it may seem,” the paper’s first author Dr Erik Miehling told BBC Science Focus.
“Many modern advertising techniques use all available user information — including their privacy decisions — to construct more accurate user profiles. Users should be aware that their decision to accept or decline cookies can have counterintuitive effects on how much the system knows about them.”
So what should you do? Is it better just to accept cookies? According to Daly, the point is this information is so out of our control that there is not much we can do.
Nevertheless, Daly suggests making the decision randomly to confuse the algorithm – a method she practises herself. “It's whatever mood I'm in the day that determines whether I accept or reject.”
Miehling recommends using more privacy-conscious browsers (such as Brave). Plus, he suggests we all “support stronger privacy laws and regulations that require more transparency around how your information will be used.”
About our experts
Dr Elizabeth Daly is a computer research scientist who leads the Interactive AI Group at the IBM Research Laboratory, Dublin. She is also an adjunct assistant professor at Trinity College Dublin, and her research has been published in Frontiers in Artificial Intelligence and the Journal of Artificial Intelligence Research.
Dr Erik Miehling is a research scientist at IBM Research. His research has been published in Advances in Neural Information Processing Systems, and at the American Control Conference (ACC) and the International Conference on Decision and Game Theory for Security.
Read more: