“By browsing this site, you accept cookies”: Research on the cookie usage permissions of news sites in Türkiye
Murat UlukWhile Internet cookies provide services for enhancing users’ experiences on websites, they have also become one of the leading tools for online surveillance. Particularly in recent years, increasing awareness levels about personal data, digital privacy studies, and legal regulations have raised concerns about the use of cookies. According to the legal framework, users must give explicit consent for the use of cookies that are not necessary for the functioning of a websites. From this point of view, this research examines Türkiye’s 50 most-visited news websites between May 11, 2022, and May 19, 2022, to analyze their use of cookies. The data obtained show all news sites to have set non-necessary cookies on users’ devices without obtaining their explicit consent. One-third of the sites didn’t even provide any clarification statements regarding the use of cookies. Half of the sites that provide cookie usage statements were identified to claim visiting the site as a valid reason for setting cookies. The study is expected to raise awareness for the development of cookie usage systems that comply with both laws and ethical values of being honest, non-manipulative, and respectful to users and their choices.
“Sitemizi ziyaret ederek çerezleri kabul etmiş sayılırsınız”: Türkiye’deki haber sitelerinin çerez kullanım izinleri üzerine bir araştırma
Murat Ulukİnternet çerezleri, web sitelerinin kullanıcı deneyimini artırmaya yönelik hizmetler sağlarken, aynı zamanda, çevrimiçi gözetleme faaliyetlerinin de öncü araçlarından birisi hâline gelmiştir. Özellikle son yıllarda kişisel veriler üzerine hassasiyetin artması, dijital mahremiyet tartışmaları ve yürürlüğe giren yasal düzenlemeler çerez kullanımına ilişkin birtakım endişeleri de beraberinde getirmiştir. Yasal çerçevede, web sitelerinin çalışması için zorunlu olmayan çerezlerin kullanımı için kullanıcıların açık rıza vermiş olması gerekmektedir. Araştırma buradan yola çıkarak, çerez kullanımını analiz etmek için 11 Mayıs 2022 ile 19 Mayıs 2022 tarihleri arasında Türkiye’nin en çok ziyaret edilen 50 haber sitesini incelemiştir. Elde edilen veriler, haber sitelerinin hepsinin kullanıcılar herhangi bir aktif irade beyan etmeden onların cihazlarına zorunlu olmayan çerezleri yerleştirdiğini göstermektedir. Sitelerin üçte biri çerez kullanıma yönelik herhangi bir aydınlatıcı bildirim dâhi sunmamaktadır. Çerez kullanım bildirimi sunanların ise yarısı siteyi ziyaret etmenin çerez yerleştirmek için geçerli bir neden olduğunu iddia etmektedir. Çalışmanın, hem yasalara hem de etik değerlere uyan; dürüst, manipülasyondan uzak, kullanıcılara ve onların tercihlerine saygılı çerez kullanım sistemlerin geliştirilmesi için farkındalık oluşturması beklenmektedir.
Cookies are small text files that facilitate the information exchange between a remote server and the device accessing the information. In 1994, Lou Montulli and John Giannadrea invented HTTP cookies while working at Netscape to enhance website user experience. Montulli and Giannadrea placed a file on the user’s device to remember which products were added to the shopping cart and kept the product information in that file. Each time the user visits the shopping site, the remote server communicates with the user device and reads the text in the cookie, which contains information about the products in the basket. Engineers did not find it necessary to obtain permission from users when placing cookies. Over time, the dramatic increase in Internet access and the growth of the digital industry have allowed cookies to be used for different purposes.
Currently, cookies are classified into various categories based on their source, purpose, and duration of use. Source-based cookies are divided into two types: 1) firstparty cookies, which are placed by the website itself, and 2) third-party cookies, which are placed by another actor through the website. The purpose of use is categorized under four types: 1) necessary cookies that help the website work correctly (such as adding a product to a shopping cart), 2) preference cookies that personalize user preferences, 3) analytic cookies that collect information about website usage, and 4) advertising cookies that aim to display data-based ads. Duration of-use cookies have two types: 1) session cookies that self-destruct when the website visit ends, and, 2) persistent cookies that are stored on the device for longer periods. Many types of cookies exist today, and while some are considered necessary and do not require explicit user consent, many others do.
The use of cookies, especially for advertising and analytical purposes, and the way many third-party cookies collect data about users, cause much controversy these days. Legal regulations have been established to protect personal data and impose conditions requiring explicit consent regarding the use of cookies. The General Data Protection Regulation (GDPR) was enacted in Europe in 2018, and the Personal Data Protection Law (KVKK) was enacted in Türkiye in 2016; these are the most up-to-date legal regulations for protecting personal data. Companies such as Google, Meta, and Twitter in Europe were fined for not using cookies in accordance with the law, while Amazon faced a similar penalty in Türkiye. Guidelines prepared by data protection authorities on how to implement cookies serve as a guide for websites. Accordingly, websites must obtain explicit consent from users for cookies other than the necessary ones and must provide proper information about the use of cookies.
This study analyzes whether websites receive explicit consent from users about the use of cookies and how they present the cookie consent notification. The sample for the research consists of Türkiye’s 50 most-visited news sites, which were considered a suitable sample due to many users regularly visiting news sites. The study first captured the cookies on the websites using the CookieBot, Brave Browser, and Get cookies.txt browser plugin, and then performed a manual content analysis. The research was conducted between May 11, 2022 and May 19, 2022, with a total of 6,271 cookies being detected on the 50 news sites. Of these, 672 were necessary cookies, while 5,599 were unnecessary cookies. Yenicaggazetesi.com.tr was found to be the news site that placed the most cookies on user’s device, with a total of 489 cookies.
Of the websites, 28% displayed no consent notification banners to the user indicating that they were placing cookies. In other words, 14 news sites placed cookies on users’ devices, without giving any notification, let alone asking for approval. The vast majority of the remaining sites offered no option for obtaining explicit consent when presenting the cookie notice, or simply provided an option to accept them. Half of the sites that display cookie consent notifications included the phrase “By visiting this site, you accept the use of cookies.” However, by law, visiting a website is not a valid reason for cookie usage to be accepted. This study is expected to raise awareness for the development of cookie usage notifications that respect user preferences and privacy.
