# We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy

arXiv: https://arxiv.org/abs/1808.05096 · HTML: https://mlsanity.com/paper/1808.05096/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Aug 2018.

## Built on by (most cited first, 15 of 15)

- [PolicyGPT: Automated Analysis of Privacy Policies with Large Language Models](https://mlsanity.com/paper/2309.10238/) (2023)
- [Privacy Policies Across the Ages: Content and Readability of Privacy Policies 1996--2021](https://mlsanity.com/paper/2201.08739/) (2022)
- [Collaborative filtering to capture AI user's preferences as norms](https://mlsanity.com/paper/2308.02542/) (2023)
- [Entailment-Driven Privacy Policy Classification with LLMs](https://mlsanity.com/paper/2409.16621/) (2024)
- [A Longitudinal Measurement of Privacy Policy Evolution for Large Language Models](https://mlsanity.com/paper/2511.21758/) (2025)
- [Convenience vs. Control: A Qualitative Study of Youth Privacy with Smart Voice Assistants](https://mlsanity.com/paper/2601.04399/) (2026)
- [PrivPRISM: Automatically Detecting Discrepancies Between Google Play Data Safety Declarations and Developer Privacy Policies](https://mlsanity.com/paper/2603.09214/) (2026)
- [Automated Detection of GDPR Disclosure Requirements in Privacy Policies using Deep Active Learning](https://mlsanity.com/paper/2111.04224/) (2021)
- [Mapping the Empirical Evidence of the GDPR (In-)Effectiveness: A Systematic Review](https://mlsanity.com/paper/2310.16735/) (2023)
- [Using Salient Object Detection to Identify Manipulative Cookie Banners that Circumvent GDPR](https://mlsanity.com/paper/2510.26967/) (2025)
- [From Fragmentation to Integration: Exploring the Design Space of AI Agents for Human-as-the-Unit Privacy Management](https://mlsanity.com/paper/2602.05016/) (2026)
- ["Are You Sure?": An Empirical Study of Human Perception Vulnerability in LLM-Driven Agentic Systems](https://mlsanity.com/paper/2602.21127/) (2026)
- [Privacy and Safety Experiences and Concerns of U.S. Women Using Generative AI for Seeking Sexual and Reproductive Health Information](https://mlsanity.com/paper/2603.16918/) (2026)
- [PrivSTRUCT: Untangling Data Purpose Compliance of Privacy Policies in Google Play Store](https://mlsanity.com/paper/2604.22157/) (2026)
- [A Systematic Evaluation of Traditional Privacy Policy Analysis Tools Against LLMs](https://mlsanity.com/paper/2607.17075/) (2026)

## Abstract (arXiv)

The European Union's General Data Protection Regulation (GDPR) went into effect on May 25, 2018. Its privacy regulations apply to any service and company collecting or processing personal data in Europe. Many companies had to adjust their data handling processes, consent forms, and privacy policies to comply with the GDPR's transparency requirements. We monitored this rare event by analyzing the GDPR's impact on popular websites in all 28 member states of the European Union. For each country, we periodically examined its 500 most popular websites - 6,579 in total - for the presence of and updates to their privacy policy. While many websites already had privacy policies, we find that in some countries up to 15.7 % of websites added new privacy policies by May 25, 2018, resulting in 84.5 % of websites having privacy policies. 72.6 % of websites with existing privacy policies updated them close to the date. Most visibly, 62.1 % of websites in Europe now display cookie consent notices, 16 % more than in January 2018. These notices inform users about a site's cookie use and user tracking practices. We categorized all observed cookie consent notices and evaluated 16 common implementations with respect to their technical realization of cookie consent. Our analysis shows that core web security mechanisms such as the same-origin policy pose problems for the implementation of consent according to GDPR rules, and opting out of third-party cookies requires the third party to cooperate. Overall, we conclude that the GDPR is making the web more transparent, but there is still a lack of both functional and usable mechanisms for users to consent to or deny processing of their personal data on the Internet.