Automating Cookie Consent and GDPR Violation Detection [CONFERENCE PAPER]
Dino Bollinger, Karelcc Kubicek, Carlos Cotrini, Davidcc Basin
USENIX Security Symposium 2022, Boston, MA, USA; 10–12 August 2022
Abstract
The European Union’s General Data Protection Regulation (GDPR) requires websites to inform users about personal data collection and request consent for cookies. Yet the majority of websites do not give users any choices, and others attempt to deceive them into accepting all cookies. We document the severity of this situation through an analysis of potential GDPR violations in cookie banners in almost 30k websites. We identify six novel violation types, such as incorrect category assignments and misleading expiration times, and we find at least one potential violation in a surprising 94.7% of the analyzed websites. We address this issue by giving users the power to protect their privacy. We develop a browser extension, called CookieBlock, that uses machine learning to enforce GDPR cookie consent at the client. It automatically categorizes cookies by usage purpose using only the information provided in the cookie itself. At a mean validation accuracy of 84.4%, our model attains a prediction quality competitive with expert knowledge in the field. Additionally, our approach differs from prior work by not relying on the cooperation of websites themselves. We empirically evaluate CookieBlock on a set of 100 randomly sampled websites, on which it filters roughly 90% of the privacy-invasive cookies without significantly impairing website functionality.
Year: 2022
Privacy and Informational Self-determination through Informed Consent: the Way Forward [CONFERENCE PAPER]
Privacy and Informational Self-determination through Informed Consent: the Way Forward [CONFERENCE PAPER]
Mohamad Gharib
International Workshop on SECurity and Privacy Requirements Engineering (SECPRE), 4 January 2022
Open Access
Abstract
“I have read and agree to the Privacy Policy”. This can be described as one of the biggest lies in the current times, and that is all what a service provider needs to acquire what can be called “informed consent”, which allows it to do as it pleases with your Personal Information (PI). Although many developed countries have enacted privacy laws and regulations to govern the collection and use of PI as a response to the increased misuse of PI, these laws and regulations rely heavily on the concept of informational self-determination through the “notice” and “consent/choice” model, which as we will see is deeply flawed. Accordingly, the full potential of these privacy laws and regulations cannot be achieved without tackling these flaws and empowering individuals to take an active role in the protection of their PI. In this paper, we argue that to advance informational self-determination, a new direction should be considered. In particular, we propose a model for informed consent and we introduce a proposed architecture that aims at tackling existing limitations in current approaches.
Informed Consent: A Monthly Review
___________________________
January 2022
This digest aggregates and distills key content addressing informed consent from a broad spectrum of peer-reviewed journals and grey literature, and from various practice domains and organization types including international agencies, INGOs, governments, academic and research institutions, consortiums and collaborations, foundations, and commercial organizations. We acknowledge that this scope yields an indicative and not an exhaustive digest product.
Informed Consent: A Monthly Review is a service of the Center for Informed Consent Integrity, a program of the GE2P2 Global Foundation. The Foundation is solely responsible for its content. Comments and suggestions should be directed to:
Editor
Paige Fitzsimmons, MA
Associate Director, Center for Informed Consent Integrity
GE2P2 Global Foundation
paige.fitzsimmons@ge2p2global.org
PDF Version: GE2P2 Global_Informed Consent – A Monthly Review_January 2022
Consent or Public Reason? Legitimacy of Norms Applied in ASPD and COVID-19 Situations
Consent or Public Reason? Legitimacy of Norms Applied in ASPD and COVID-19 Situations
Original Article
Elvio Baccarini
Philosophy and Society, 30 November 2021; 32(4) pp 674–694
Open Access
Abstract
This paper extends Alan John Simmons’s conceptual distinction between Lockean (or consent) and Kantian (or justificatory) conceptions of legitimacy that he applied to the question of the legitimacy of states, to the issue of legitimacy of public decisions. I criticise the consent conception of legitimacy defended by Simmons, and I defend the Rawlsian version of the justificatory conception of legitimacy from his objection. The approach of this paper is distinctive because the two conceptions are assessed by investigating, using the method of reflective equilibrium, their respective prescriptions concerning the treatment of antisocial personality disorder (ASPD) and epidemiologic measures. I argue that the method of reflective equilibrium does not support the consent conception. Considering the issues of treatment of ASPD and of epidemiologic measures, I argue that the consent conception of legitimacy is not well-equipped for the evaluation of norms that are not strictly self-regarding. This causes a deficit of prescriptions for relevant social responses. Further, by considering the case of responses to epidemics, I argue that such a conception can avoid harmful consequences only by recurring to additional, and independent, premises. This does not cause incoherence but reduces the coherence of a normative system. Finally, the consent conception is not equipped to support social cooperation in an optimal way, which has proved to be necessary in critical conditions, like a pandemic. On the other hand, I argue that the method of reflective equilibrium supports the Rawlsian version of justificatory conception of legitimacy, because of its advantages in handling the indicated issues. In addition, I maintain that this justificatory conception is respectful of freedom and equality of agents as moral self-legislators, and, thus, it is not vulnerable to Simmons’s main criticism.
Implementing two-stage consent pathway in neonatal trials
Implementing two-stage consent pathway in neonatal trials
Short Report
Eleanor Mitchell, Sam J Oddie, Jon Dorling, Chris Gale, Mark John Johnson, William McGuire, Shalini Ojha
Archives of Disease in Childhood – Fetal and Neonatal Edition, 23 December 2021
Abstract
Perinatal trials sometimes require rapid recruitment processes to facilitate inclusion of participants when interventions are time-critical. A two-stage consent pathway has been used in some trials and is supported by national guidance. This pathway includes seeking oral assent for participation during the time-critical period followed by informed written consent later. This approach is being used in the fluids exclusively enteral from day one (FEED1) trial where participants need to be randomised within 3 hours of birth. There is some apprehension about approaching parents for participation via the oral assent pathway. The main reasons for this are consistent with previous research: lack of a written record, lack of standardised information and unfamiliarity with the process. Here, we describe how the pathway has been implemented in the FEED1 trial and the steps the trial team have taken to support sites. We provide recommendations for future trials to consider if they are considering implementing a similar pathway…
Informed consent and assent guide for paediatric clinical trials in Europe
Informed consent and assent guide for paediatric clinical trials in Europe
Original Research
Pirkko Lepola, Maxine Kindred, Viviana Giannuzzi, Heidi Glosli, Martine Dehlinger-Kremer, Harris Dalrymple, David Neubauer, Geraldine B Boylan, Jean Conway, Jo Dewhurst, Diane Hoffman
Archives of Disease in Childhood, 1 December 2021
Abstract
Objective
Clinical trial sponsors spend considerable resources preparing informed consent (IC) and assent documentation for multinational paediatric clinical trial applications in Europe due to the limited and dispersed patient populations, the variation of national legal and ethical requirements, and the lack of detailed guidance. The aim of this study was to design new easy-to-use guide publicly available on European Medicines Agency’s, Enpr-EMA website for all stakeholders.
Methods
Current EU legal, ethical and regulatory guidance for paediatric clinical trials were collated, analysed and divided into 30 subject elements in two tables. The European Network of Young Person’s Advisory Group reviewed the data and provided specific comments. A three-level recommendation using ‘traffic light’ symbols was designed for four age groups of children, according to relevance and the requirements.
Results
A single guide document includes two tables: (1) general information and (2) trial-specific information. In the age group of 6–9 years old, 92% of the trial-specific subject elements can be or should be included in the IC discussion. Even in the youngest possible age group (2–5 years old children), the number of elements considered was, on average, 52%.
Conclusion
The EU Clinical Trial Regulation (2014) does not contain specific requirements exclusively for paediatric clinical trials. This work is the first to extensively collate all the current legal, regulatory and ethical documentation on the IC process, together with input from adolescents. This guide may increase the ethical standards in paediatric clinical trials.
Consent models in Canadian critical care randomized controlled trials: a scoping review
Consent models in Canadian critical care randomized controlled trials: a scoping review
Review Article
Katie O’Hearn, Jess Gibson, Karla Krewulak, Rebecca Porteous, Victoria Saigle, Margaret Sampson, Anne Tsampalieros, Nick Barrowman, Saoirse Cameron, the Canadian Critical Care Trials Group
Canadian Journal of Anesthesia, 8 November 2021
Open Access
Abstract
Purpose
Our primary objective was to describe consent models used in Canadian-led adult and pediatric intensive care unit (ICU/PICU) randomized controlled trials (RCTs). Our secondary objectives were to determine the consent rate of ICU/PICU RCTs that did and did not use an alternate consent model to describe consent procedures.
Source
Using scoping review methodology, we searched MEDLINE, Embase, and CENTRAL databases (from 1998 to June 2019) for trials published in English or French. We included Canadian-led RCTs that reported on the effects of an intervention on ICU/PICU patients or their families. Two independent reviewers assessed eligibility, abstracted data, and achieved consensus.
Principal findings
We identified 48 RCTs of 17,558 patients. Included RCTs had ethics approval to use prior informed consent (43/48; 90%), deferred consent (13/48; 27%), waived consent (5/48; 10%), and verbal consent (1/48; 2%) models. Fifteen RCTs (15/48; 31%) had ethics approval to use more than one consent model. Twice as many trials used alternate consent between 2010 and 2019 (13/19) than between 2000 and 2009 (6/19). The consent rate for RCTs using only prior informed consent ranged from 54 to 91% (ICU) and 43 to 94% (PICU) and from 78 to 100% (ICU) and 74 to 87% (PICU) in trials using an alternate/hybrid consent model.
Conclusion
Alternate consent models were used in the minority of Canadian-led ICU/PICU RCTs but have been used more frequently over the last decade. This suggests that Canadian ethics boards and research communities are becoming more accepting of alternate consent models in ICU/PICU trials.
Race, Place, and The Federal Exception from Informed Consent (EFIC): A Semiotic Approach [DISSERTATION]
Race, Place, and The Federal Exception from Informed Consent (EFIC): A Semiotic Approach [DISSERTATION]
Samantha Whitney Stein
UCLA, 2021
Abstract
The Exception from Informed Consent (EFIC) regulatory mechanism can be used to waive federal informed consent requirements for emergency medical research, pending satisfaction of pre-trial requirements. EFIC’s most notoriously challenging pre-trial requirement is ‘community consultation,’ a process through which EFIC researchers solicit public feedback on their trials. Using a Peircean semiotic framework, this thesis unpacks the presuppositions undergirding the idea that community consultation can reduce friction between emergency clinical trials carried out without informed consent and the values of patients enrolled in them. I introduce a semiotics of prediction, showing how assumptions about race figure prominently in the commensuration-based tasks of selecting community consultation respondents and subsequently generalizing findings from these respondents to broader populations. I suggest that in practice the content and / or generalizability of feedback collected through community consultation has very limited utility for reducing friction. Rather, community consultation’s primary function—as it is currently operationalized—is one of public relations, whereby the discursive processes through which community feedback is solicited have more bearing on EFIC trials’ public acceptability than the content of community feedback and the ability of biomedical research actors to transpose this content across contexts. By examining who participates in / is affected by the discursive processes through which community feedback is solicited, I help explain otherwise untheorized yet nonetheless troubling disparities between the acceptability of EFIC as determined by community consultation respondents and the acceptability of EFIC as determined by EFIC trial participants and their surrogates.
Informed Consent as a Component of Online Research Ethics — The Perspective of the Participants
Informed Consent as a Component of Online Research Ethics — The Perspective of the Participants
Online Research
Nataša B. Matović, Kristinka Č. Ovesni
Globethics.net, 1 November 2021
Abstract
The paper discusses informed consent as a component of online research ethics. It begins from the analysis of understanding, from the preconditions on which the realization depends, and from the difficulties that accompany the application of the informed consent in practice. The aim of the empirical part of the research is to determine the characteristics of the process of obtaining the informed consent in online research and to examine the factors on which they depend. The sample included 153 teachers. Data were collected with the survey-type questionnaires and with the descriptive assessment scales. For data processing, besides the frequencies and percentages, the χ2 test and Kramer ‘s V correlation coefficient were performed. The results indicate that most of the respondents have had experience of giving informed consent in online surveys in which they have participated so far; that the text often contained information about the purpose and the goal of the research, apart from the tasks of the respondents in the research; that the majority of the teachers evaluate the content of the text as understandable and useful; and also that most of the characteristics depend on the environment of the school in which the teachers are employed. The results are discussed in the context of the possibility of improvement of the process of obtaining informed consent from the respondents in the online survey.
Editor’s note: Globethics.net is a global network of teachers and institutions with the vision to embed ethics in higher education. It hosts a publishing house open to all the authors interested in applied ethics.
Defining the Critical Components of Informed Consent for Genetic Testing
Defining the Critical Components of Informed Consent for Genetic Testing
Kelly E. Ormond, Maia J. Borensztein, Miranda L. G. Hallquist, Adam H. Buchanan, William Andrew Faucett, Holly L. Peay, Maureen E. Smith, Eric P. Tricou, Wendy R. Uhlmann, Karen E. Wain, Curtis R. Coughlin, Clinical Genome CADRe Workgroup
Journal of Personalised Medicine, 5 December 2021
Open Access
Abstract
Purpose
Informed consent for genetic testing has historically been acquired during pretest genetic counseling, without specific guidance defining which core concepts are required.
Methods
The Clinical Genome Resource (ClinGen) Consent and Disclosure Recommendations Workgroup (CADRe) used an expert consensus process to identify the core concepts essential to consent for clinical genetic testing. A literature review identified 77 concepts that are included in informed consent for genetic tests. Twenty-five experts (9 medical geneticists, 8 genetic counselors, and 9 bioethicists) completed two rounds of surveys ranking concepts’ importance to informed consent.
Results
The most highly ranked concepts included: (1) genetic testing is voluntary; (2) why is the test recommended and what does it test for?; (3) what results will be returned and to whom?; (4) are there other types of potential results, and what choices exist?; (5) how will the prognosis and management be impacted by results?; (6) what is the potential family impact?; (7) what are the test limitations and next steps?; and (8) potential risk of genetic discrimination and legal protections.
Conclusion
Defining the core concepts necessary for informed consent for genetic testing provides a foundation for quality patient care across a variety of healthcare providers and clinical indications.
Center for Informed Consent Integrity 