GDPR cuts tracking cookies in Europe

Three months after the introduction of the General Data Protection Regulation (GDPR), European news sites have reduced their use of tracking cookies by 22 percent, according to research from the University of Oxford. Companies that run websites should be aware of the problem and ready to act.
Written by Jack Schofield, Contributor

Video: Lawyers: Follow EU's GDPR to avoid issues in the future

European news sites have reduced the number of third-party tracking cookies by 22 percent in the three months since the introduction of the GDPR (General Data Protection Regulation), according to a survey of 200 sites by the Reuters Institute for the Study of Journalism at the University of Oxford.

Also: What is GDPR? Everything you need to know | GDPR: The EU's General Data Protection Regulation, explained CNET | GDPR: A cheat sheet TechRepublic

This does not prove that GDPR caused the decline, but it may have prompted websites to look at the cookies they were using, and for which they now had to obtain consent. The report says: "The introduction of GDPR may have provided news organisations with a chance to evaluate the utility of various features, including third-party services, and to remove code which is no longer of significant use or which compromises user privacy".

Graph of tracking coookies per country

The RISJ report shows a decline in the use of third-party tracking cookies in six European countries, and an increase in Poland.

As the RISJ's bar chart shows, there was considerable variation in the results from the seven countries surveyed: Finland, France, Germany, Italy, Poland, Spain, and the UK. The number of cookies on UK sites fell by 45 percent, while the number on German sites fell by only 6 percent. Spain, France, and Italy all saw falls of more than 30 percent. Poland saw a 20-percent increase.

Also: GDPR compliant? Here's a handy five-step preparation checklist

However, American technology companies generally evaded the cull. Most sites retained cookies from Google (96 percent), Facebook (70 percent), and Amazon (57 percent). Facebook cookies dropped by five percentage points from 75 percent, but Facebook suffered major problems far beyond the GDPR.

table of Google cookies

A table from the RISJ report shows that, apart from AdSense, Google tracking cookies held up well.

Most news sites have more than one Google cookie, with the top five being DoubleClick (found on 87 percent of sites), Google Analytics (86 percent), Google Tag Manager (80 percent), AdSense (72 percent), and Google APIs (69 percent).

The report adds that design optimisation cookies fell by 27 percent, advertising and marketing cookies by 14 percent, and social media cookies by 9 percent.

The report's authors used webXray, an open source tool, to count cookies between April and July 2018. They acknowledge that some sites may block the tool, so "the true number of [third party cookies] on a given page may be higher."

However, the tool cannot provide answers to the main topic of interest: How many users are now blocking tracking cookies? The GDPR makes it harder to get blanket consent to cookie use -- or, at least, to get legitimate blanket consent. If large numbers of users refuse their consent, this will reduce the value of tracking cookies. This should lead to websites eliminating cookies that no longer deliver any value.

Also: GDPR: These are the organisations which are least prepared

Whether the recent decline is a trend or a blip remains to be seen. The next RISJ survey could show a further decline, or a recovery, if the tracking industry finds ways to tackle the problem.

Either way, every company that runs a website should be aware of the problem, and be prepared to act.

Facebook alternatives: Social apps you need to try

Editorial standards