After GDPR, Still Tracking or Not? Understanding Opt-Out States for Online Behavioral Advertising

A recent trend in Internet advertising has been online behavioral advertising (OBA). For users concerned about their privacy, ad agencies provide an OBA opt-out opportunity. However, previous work has shown that many users misunderstand what it means to have opted out on an opt-out website. In fact, ad agencies still track the browsers of users who have opted out of OBA. In this study, we clarified what it means to be in the OBA opt-out state by crawling numerous websites and collecting browser cookies. Moreover, we analyzed the difference between the attitudes of agencies regarding OBA between before and after the EU General Data Protection Regulation (GDPR) was implemented. We found that around half of agencies stop web tracking after opt-out. However, some agencies start tracking again when users begin browsing, so the number of agencies stopping web tracking eventually declines. Furthermore, we found no evidence of a difference in agency attitudes between before and after GDPR implementation.