OKO Digital

The ad optimisation people

  • Home
  • Publisher Solutions
    • Website Monetization
    • Header Bidding
    • AdX – Google Ad Exchange
    • App Ad Monetization
    • WordPress Monetization
  • About us
    • OKO & the OKO team
    • Careers
  • Blog
    • Latest blog posts
    • Ad Blocking
    • Ad Exchange (AdX)
    • Ad Optimisation
    • Ad Performance & Page Speed
    • Ad Publishing Landscape
    • AdSense
    • DoubleClick For Publishers (DFP)
    • Exchange Bidding
    • Google Ad Manager
    • Google Certified Publishing Partners
    • Header Bidding
    • Privacy & GDPR
    • Program Policy
    • Open Bidding
    • Traffic
  • Contact

Privacy and GDPR . 7th June 2018

How the world’s busiest websites tackle GDPR consent

Confusion around GDPR has led many website owners to make the decision to wait and see how other websites tackle it before committing to their own solution. User consent is an area of particular concern for many websites, with a myriad of approaches and solutions being used around the web.  Hoping to find some form of consensus on how to approach consent, we looked at how some of the world’s busiest websites are approaching it. Visiting the top 5 websites in fifteen difference categories, we looked at how each presented cookie/privacy information to a user inside the European Economic Area.

How many sites notify about cookies / privacy?

The first test was simply whether any form of privacy or cookie information was presented to the user. It was noted whether each site requested active consent (such as clicking of an “agree” button, or setting preferences), provided some sort of notice beyond a discrete privacy link (such as a pop-up message or interstitial), or did neither of these things. Over 37% of the tested sites did neither.

What sites requested consent

Of the 75 sites tested:

  • 28 presented no notice regarding cookies, privacy or personalised ads
  • 26 showed a notice (such as a pop-up alert)
  • 21 requested some form of user interaction to provide consent

What active consent mechanism was used?

Test two was to look at what method was used to collect consent when some form of active consent was sought. Over half of the sites tested opted for granular controls that allowed the user to either select what Cookies were used, or what purposes cookies could be used for.

GDPR consent methods

Of the 21 sites that presented some form of opt-in:

  • 7 were Opt-in only :  A notice was presented with a means to provide consent (such as an “I agree” button). No on-site means offered to refuse consent or otherwise adjust cookie usage.
  • 1 was Opt-in / Opt-out : A notice was presented with a means to provide consent (such as an “Agree” button) and a means to decline it (such as a “Disagree” button).
  • 11 offered granular controls over cookie usage : A means was provided to consent to decline the use of either particular cookies or particular uses of cookies.
  • 2 took a different approach (see below)

Foxnews.com showed no privacy or cookie notice, but prevented personalised ads serving to EEA users by simply blocking all ads to users in that region. Content still served normally, but without ads showing.

Indiatimes.com Simply blocked all users in the EEA from accessing the site, instead showing a notice explaining that they are currently not allowing users in Europe to access the site.

What the sites served whilst awaiting consent

Sites load before consent is given, and there are differences in what content is served whilst waiting for consent. 37.5% of the sites that serve ads didn’t do so until consent was sought. Almost half of sites blocked all content/interaction until preferences had been set.

ShowblockadsShowblockcontent

Of the 21 sites that required active consent:

  • 10 blocked content until the user had expressed their preferences
  • 5 were sites that didn’t show ads
  • 6 blocked ads until preferences were set
  • 10 served some sort of ad before preferences were expressed

Conclusions

Even amongst some of the busiest sites on the web there is still little consensus on either when consent should be sought or what form that consent should take. Solutions range from the costly  and conservative to making no outwardly obvious efforts towards compliance. Even amongst top sites, over a third have no apparent means to gain consent. Whether that is due to taking the position that none is required or not yet having a solution in place is not yet clear.

Methodology

We looked at the top 5 websites in each of Alexa’s top level categories, skipping any domain that appeared in an earlier category. Each was viewed on desktop and mobile in an incognito browser window from two different UK IP addresses. We only looked at consent gathering, not the less clear topic of whether consent was necessary. No testing was done as to whether withdrawing consent had any actual impact on Cookie use.  No testing was done on site in the adult category.  Analysis was performed on June 6th 2018. Please note that our experience at time of testing may not reflect the experience of others. No opinion is offered regarding the compliance status of any of the websites tested.

Consent methods were classified as follows:

  • None : No notice regarding cookie or advertising consent was seen.
  • Notice only : Some form of notice was presented regarding Cookies/Privacy. This was information only with not means presented to affect cookie use.
  • Opt-in only : A notice was presented with a means to provide consent (such as an “I agree” button). No on-site means offered to refuse consent or otherwise adjust cookie usage.
  • Opt-in / Opt out : A notice was presented with a means to provide consent (such as an “Agree” button) and a means to decline it (such as a “Disagree” button).
  • Granular controls : A means was provided to consent to decline the use of either particular cookies or particular uses of cookies.

Raw data

Category / Domain Notice type Content serving Ad serving
ENTERTAINMENT
youtube.com Notice only Serve immediately Serve immediately
imdb.com None Serve immediately Serve immediately
bbc.co.uk Granular controls Serve immediately Doesn’t run ads
cnn.com Opt in only Serve immediately Serve immediately
espn.com Opt in only Serve immediately Serve immediately
BUSINESS
office.com Notice only Serve immediately Doesn’t run ads
paypal.com Granular controls Serve immediately Doesn’t run ads
chase.com None Serve immediately Doesn’t run ads
indeed.com Notice only Serve immediately Serve immediately
alibaba.com None Serve immediately Serve immediately
COMPUTERS
google.com Notice only Serve immediately Serve immediately
facebook.com Granular controls Block until preference known Block until preference known
yahoo.com Granular controls Block until preference known Block until preference known
wikipedia.org None Block until preference known Doesn’t run ads
twitter.com Notice only Serve immediately Block until preference known
GAMES
twitch.tv Notice only Serve immediately Serve immediately
roblox.com None Serve immediately Doesn’t run ads
steampowered.com None Serve immediately Doesn’t run ads
gamespot.com Granular controls Serve immediately Serve immediately
ign.com Granular controls Block until preference known Serve immediately
HEALTH
nih.gov None Serve immediately Doesn’t run ads
webmd.com Opt in only Block until preference known Doesn’t run ads
myfitnesspal.com None Serve immediately Serve immediately
mayoclinic.org None Serve immediately Serve immediately
psychologytoday.com None Serve immediately Serve immediately
HOME
yelp.com Notice only Serve immediately Serve immediately
theverge.com Opt in only Serve immediately Block until preference known
gizmodo.com Granular controls Block until preference known Serve immediately
gsmarena.com Notice only Serve immediately Serve immediately
cnbc.com Notice only Block until preference known Block until preference known
KIDS AND TEENS
epicgames.com Notice only Serve immediately Doesn’t run ads
reverso.net Notice only Serve immediately Serve immediately
thesaurus.com Notice only Serve immediately Serve immediately
weebly.com Notice only Serve immediately Doesn’t run ads
battle.net Notice only Serve immediately Doesn’t run ads
NEWS
reddit.com Opt in only Serve immediately Serve immediately
nytimes.com Opt in only Serve immediately Serve immediately
theguardian.com Opt in / out Serve immediately Serve immediately
indiatimes.com Other Block until preference known Block until preference known
foxnews.com Other Serve immediately Not to EEA users
RECREATION
booking.com Notice only Serve immediately Doesn’t run ads
tripadvisor.com None Serve immediately Serve immediately
9gag.com Granular controls Block until preference known Doesn’t run ads
expedia.com None Serve immediately Serve immediately
hotels.com Notice only Serve immediately Doesn’t run ads
REFERENCE
stackoverflow.com Notice only Serve immediately Serve immediately
archive.org None Serve immediately Doesn’t run ads
worldreference.com None Block until preference known Block until preference known
goodreads.com None Block until preference known Block until preference known
blackboard.com None Serve immediately Doesn’t run ads
REGIONAL
Amazon.com None Serve immediately Serve immediately
Google.co.in Notice only Serve immediately Serve immediately
Googe.co.uk Notice only Serve immediately Serve immediately
microsoft.com Notice only Serve immediately Doesn’t run ads
amazon.co.jp None Serve immediately Serve immediately
SCIENCE
researchgate.net Notice only Serve immediately Doesn’t run ads
coinmarketcap.com Notice only Serve immediately Serve immediately
sciencedirect.com None Serve immediately Doesn’t run ads
urbandictionary.com None Serve immediately Serve immediately
ieee.org Notice only Serve immediately Doesn’t run ads
SHOPPING
netflix.com None Serve immediately Doesn’t run ads
ebay.com None Serve immediately Serve immediately
amazon.co.uk None Serve immediately Serve immediately
walmart.com None Serve immediately Doesn’t run ads
etsy.com Granular controls Block until preference known Doesn’t run ads
SOCIETY
siteadvisor.com None Serve immediately Doesn’t run ads
patreon.com None Serve immediately Doesn’t run ads
state.gov None Serve immediately Doesn’t run ads
jw.org Notice only Serve immediately Doesn’t run ads
europa.eu None Serve immediately Doesn’t run ads
SPORTS
cricbuzz.com Notice only Serve immediately Serve immediately
nba.com Granular controls Block until preference known Serve immediately
espncricinfo.com Opt in only Serve immediately Serve immediately
bleacherreport.com Notice only Serve immediately Serve immediately
goal.com Granular controls Block until preference known Block until preference known

If you need some help understanding GDPR consent, we have a free download explaining EU user consent for publishers websites.

Privacy and GDPR . Analysis

About Abbey Colville

SEARCH

TOPICS

  • Ad Blocking
  • Ad Exchange (AdX)
  • Ad Optimisation
  • Ad Performance & Page Speed
  • Ad Publishing Landscape
  • AdSense
  • DoubleClick For Publishers (DFP)
  • Exchange Bidding
  • Google Ad Manager
  • Google Certified Publishing Partners
  • Header Bidding
  • Open Bidding
  • Privacy & GDPR
  • Program Policy
  • Traffic

Could the ads on your site be earning more?

Find out how OKO help publishers earn more from their ads.

LEARN MORE
Insticator

OKO Digital, The Cake Shed, Manor Farm, Manor Road, Hayling Island, Hampshire, PO11 0QW

Google Certified Publisher Partner Logo

OKO is a registered trademark and trading style of OKO Digital Limited. Registered in England company number 03867231. © OKO Digital Limited 1996-2018. All Rights Reserved.

  • Privacy Policy
  • Cookie Policy
Manage Cookie Consent
We use cookies to optimise our website and our service.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Manage options Manage services Manage vendors Read more about these purposes
View preferences
{title} {title} {title}