# Mapping the Empirical Evidence of the GDPR (In-)Effectiveness: A Systematic Review

arXiv: https://arxiv.org/abs/2310.16735 · HTML: https://mlsanity.com/paper/2310.16735/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 14 of its 135 references that are in the map.
- First posted on arXiv 25 Oct 2023.

## Builds on (most cited first, 14 of 14)

- [Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence](https://mlsanity.com/paper/2001.02479/) (2020)
- [(Un)informed Consent: Studying GDPR Consent Notices in the Field](https://mlsanity.com/paper/1909.02638/) (2019)
- [Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites](https://mlsanity.com/paper/1907.07032/) (2019)
- [Operationalizing the Legal Principle of Data Minimization for Personalization](https://mlsanity.com/paper/2005.13718/) (2020)
- [We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy](https://mlsanity.com/paper/1808.05096/) (2018)
- [Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework](https://mlsanity.com/paper/1911.09964/) (2019)
- [Circumvention by design -- dark patterns in cookie consents for online news outlets](https://mlsanity.com/paper/2006.13985/) (2020)
- [Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR](https://mlsanity.com/paper/1908.10048/) (2019)
- [Consent Management Platforms under the GDPR: processors and/or controllers?](https://mlsanity.com/paper/2104.06861/) (2021)
- [Quality Assessment of Online Automated Privacy Policy Generators: An Empirical Study](https://mlsanity.com/paper/2002.05341/) (2020)
- [Are we there yet? Understanding the challenges faced in complying with the General Data Protection Regulation (GDPR)](https://mlsanity.com/paper/1808.07338/) (2018)
- [The GDPR Enforcement Fines at Glance](https://mlsanity.com/paper/2011.00946/) (2020)
- [A Fait Accompli? An Empirical Study into the Absence of Consent to Third-Party Tracking in Android Apps](https://mlsanity.com/paper/2106.09407/) (2021)
- [Obtaining personal data and asking for erasure: Do app vendors and website owners honour your privacy rights?](https://mlsanity.com/paper/1602.01804/) (2016)

## Abstract (arXiv)

In the realm of data protection, a striking disconnect prevails between traditional domains of doctrinal, legal, theoretical, and policy-based inquiries and a burgeoning body of empirical evidence. Much of the scholarly and regulatory discourse remains entrenched in abstract legal principles or normative frameworks, leaving the empirical landscape uncharted or minimally engaged. Since the birth of EU data protection law, a modest body of empirical evidence has been generated but remains widely scattered and unexamined. Such evidence offers vital insights into the perception, impact, clarity, and effects of data protection measures but languishes on the periphery, inadequately integrated into the broader conversation. To make a meaningful connection, we conduct a comprehensive review and synthesis of empirical research spanning nearly three decades (1995- March 2022), advocating for a more robust integration of empirical evidence into the evaluation and review of the GDPR, while laying a methodological foundation for future empirical research.