Global Web, Local Privacy? An International Review of Web Tracking

1. Problem Statement

The fundamental tension addressed in this paper is the conflict between the global nature of the web and the local nature of privacy laws. While the internet allows seamless cross-border data flows, privacy regulations (such as the GDPR, CCPA, and LGPD) are jurisdiction-specific.

• The Challenge: It is unclear how effective these local laws are in practice when applied to a global ecosystem. Do "opt-in" regimes (requiring user consent before tracking) significantly reduce tracking compared to "opt-out" regimes (tracking by default)?
• The Gap: Previous studies often focused on single jurisdictions or lacked a comparative framework between global popular sites and locally popular sites across diverse legal environments. There is a need to quantify the "Brussels Effect" (EU laws influencing global practices) versus the "Brussels Shield" (EU laws protecting only EU users).

2. Methodology

The authors conducted a large-scale, controlled, cross-country web crawling experiment to measure tracker exposure.

• Scope:

  • Countries: 10 countries across all continents (except Antarctica): Australia, Brazil, Canada, Germany, India, Singapore, South Africa, South Korea, Spain, and the US (California).
  • Datasets:
    1. Common Top 525: The 525 most globally popular sites (all .com domains).
    2. Country-specific Top 525: The 525 most popular sites specific to each country (identified by country-code top-level domains, e.g., .de for Germany).
  • Total Sample: 9,975 site visits (covering 5,250 unique sites).

• Technical Setup:

  • Infrastructure: Ten identically provisioned Virtual Machines (VMs) located in the respective countries (via Google Cloud Platform) to ensure the crawler appeared as a local user, triggering jurisdiction-specific legal responses.
  • Browser/Tools: Firefox Nightly with Enhanced Tracking Protection disabled, automated via Selenium WebDriver.
  • Measurement Tool: The Privacy Pioneer browser extension (open-source) was used to monitor HTTP requests in real-time. It classifies third-party connections into three categories: Advertising, Analytics, and Social.
  • Data Collection: Each site was observed for 60 seconds. The crawler recorded all HTTP requests and responses, logging them to a local MySQL database.
  • Cookie Banner Analysis: Screenshots were taken to detect the presence of cookie banners. For a subset of sites, the authors manually interacted with banners (consenting vs. inactivity) to measure the impact of user choice.

• Metrics:

  • Tracker Connections: The number of HTTP requests to third-party domains.
  • Entries: Unique records of HTTP requests for a specific purpose (e.g., advertising).
  • Compliance: Presence of cookie banners and the reduction in trackers when users do not interact with them.

3. Key Contributions

1. Comparative Framework: A systematic evaluation of web tracking across 10 diverse jurisdictions, distinguishing between "opt-in" (e.g., EU, Brazil, India) and "opt-out" (e.g., US, Australia, Canada) legal regimes.
2. Global vs. Local Analysis: Differentiating tracking behaviors on globally popular sites versus locally popular sites, revealing that local sites often exhibit higher variance in tracking intensity.
3. Quantification of the "Brussels Effect": Measuring the extent to which EU laws force global sites to adopt privacy-protective measures for all users versus only EU users.
4. Enforcement Correlation: Linking the level of regulatory enforcement (High, Medium, Low) to actual tracking metrics, demonstrating that laws without active enforcement have limited impact.

4. Key Results

A. Geographic Location Drives Tracker Exposure

• Opt-Out vs. Opt-In: Users in opt-out jurisdictions (Australia, US/California) faced the highest tracking levels.
  • US (CA): ~11.7 average tracker entries per site.
  • Australia: ~11.2 average entries.
• Opt-In Jurisdictions: Users in opt-in jurisdictions (Germany, Spain) faced significantly lower tracking.
  • Germany: ~4.2 average entries.
  • Spain: ~5.3 average entries.
• EU Impact: Common Top 525 sites accessed from EU countries had 50.5% fewer average tracker connections compared to non-EU countries.

B. Global vs. Local Site Behavior

• Global Sites (Common Top 525): Exhibit a narrower range of tracking (4.2 to 11.7 entries) but generally higher baseline tracking than local sites in strict jurisdictions.
• Local Sites (Country-specific Top 525): Show extreme variance.
  • In Australia, 96% of local sites connected to trackers.
  • In Germany, only 44.6% of local sites connected to trackers.
  • Australia's local sites had 14x more average entries than Germany's local sites.

C. Cookie Banners and Compliance

• Deployment: Germany and Spain had the highest banner deployment rates (~73%). Non-EU countries had much lower rates (36–46%).
• The "Brussels Effect" (Moderate): 28% of Common Top 525 sites displayed cookie banners in all 10 countries, suggesting some global operators simplify compliance by applying EU standards globally.
• The "Brussels Shield" (Dominant): For many sites, banners were only shown in EU countries. The EU law acts as a shield for EU users but does not improve privacy for the rest of the world.
• Non-Compliance: Sites without cookie banners in the Common Top 525 set had 26.3% more tracker entries than sites with banners, suggesting that the absence of a banner often correlates with higher non-compliance (silent tracking).

D. Impact of User Inactivity

• In Germany (Opt-in), simply not interacting with a cookie banner (effectively refusing consent) reduced tracker connections by 48.5%.
• In the US (Opt-out), inactivity only reduced trackers by 21.1%, as tracking continues by default until the user actively opts out.

E. Enforcement Matters

• High Enforcement (Germany, Spain): Strong correlation between law and practice (low tracking, high banner compliance).
• Low Enforcement (Brazil, India, Singapore, South Africa): Despite having laws similar to the GDPR (e.g., Brazil's LGPD), tracking levels remained high, and banner deployment was low. This indicates that enforcement is the critical driver, not just the existence of legislation.

5. Significance and Implications

• Policy Effectiveness: The study proves that privacy laws are only effective when paired with active enforcement. Laws like Brazil's LGPD, while textually similar to the GDPR, currently fail to reduce tracking due to a lack of regulatory follow-through.
• User Experience: The "Brussels Shield" creates a fragmented web where EU users enjoy significantly better privacy, while users elsewhere are subjected to the permissive US ad-tech model.
• Industry Response: The "Brussels Effect" is present but limited; global sites often adopt a bifurcated strategy (strict compliance for EU, permissive for others) rather than a unified global standard.
• Future Directions: The authors argue for the adoption of privacy preference signals (like Global Privacy Control - GPC) to automate consent and reduce "consent fatigue." They also suggest that web standards should be updated to inherently block tracking by default, moving beyond the current "notice and consent" model which relies on user action.

Conclusion

The paper concludes that while the EU's GDPR and ePrivacy Directive have successfully reduced tracking within their borders (acting as a shield), they have not yet fundamentally altered the global ad-tech ecosystem. The web remains a "patchwork" where a user's privacy is dictated by their geographic location and the strength of local enforcement, rather than a universal standard. Strong, active enforcement is identified as the single most important factor in increasing user privacy.