You’ve seen those notifications online: a box that pops up alerting you that a website uses cookies.
So what are they?
“We don’t see them, we don’t actually touch them, and we’re always being prompted, ‘Do you want to accept cookies?’” said Kris Wall, Chief Technology Officer of Critical Fault, an offensive cybersecurity firm in San Antonio.
Websites use cookies to know who you are by storing information like your username, what you did the last time you logged in and more.
Think of it like a digital nametag.
The cookies a website gives you are stored on the device you’re using to access the internet.
“Now any time that you come to this website, you’re going to hand me that cookie every single time,” Wall said. “Your browser does it automatically.”
“It’s simply a small piece of data,” said UTSA assistant professor of computer science Rocky Slavin. “So, the next time you come back to that website, you’ll send that cookie information with you. And they’ll be able to say, ‘OK, I remember this person. They logged in yesterday.’ This is maybe some of the stuff that they did or some of their settings.”
That’s convenient, but it does come with privacy concerns.
Let’s say you’re browsing around online for a new pair of shoes. Then, you head to another site like Facebook, for example, and that’s where you find an ad for the kind of shoes you were just looking for.
“That’s why it seems like they’re following you around because they are,” Wall said. “And it’s cookies that they’re using to do that.”
What you search online isn’t necessarily stored in the cookie itself.
That’s in the website’s server.
“But because the cookie has information about you and can help keep track of you, well, now we can keep track of your habits or the things you’ve been doing,” Slavin said. “Then that information, that data, can be used by the advertising services to better target you towards different ads.”
It’s the sharing and selling of cookies that has raised privacy concerns, which the European Union has done something about.
“The United States lags pretty far behind on privacy protections,” Wall said.
The EU created the General Data Protection Regulation, or GDPR, which took effect in 2018.
GDPR lays out a long list of regulations on how personal data can be stored and requires users to give consent that they are aware of and agree to the collection of their data.
The rules apply outside of Europe, so long as websites can be reached by users in Europe, which is why you see those pop-up notifications about cookies in the United States.
The notifications typically give users the options to accept all cookies, deny all cookies or manage them.
“You are accepting that they can track you and generally whatever their privacy policy is,” Wall said.
Managing cookies gives users more control and should allow you to view a company’s privacy policy.
“Which ones you want to allow, where they’re allowed to track you, who they’re allowed to sell your information to,” Wall said. “Unfortunately, most sites do a bad job of putting this out there.”
Sometimes, users can exit out of the prompt without making a selection.
According to GDPR, that does not equal consent but what it does mean can differ from software system to system.
If you want more control, it’s best to make your own cookie choices.
Look at the web browser you’re using and see if there’s an extension or add-on you can use to manage your cookies.
“And you can say, ‘I want to find an add-on that lets me manage my cookies where I can look through, sort them. I can delete them. I can clear them. I can just prevent them from ever even remaining,” Wall said.
“If you’re worried about your privacy, which you should be, one thing you can even do is disable cookies altogether,” Slavin said. “That might break some websites, unfortunately. But then you don’t have to worry about any of these problems we’ve talked about.”
