Creating data graph from quantcast.com

consent collection dialogue

The consent collection dialogue on quantcast.com, as seen in Fig 1., starts with a "I Agree" and "Show Purposes". You can use the Web Archive version of this page here.

Clicking on "I Accept" assumes that the user has consented to all purposes and choices. This is evident by clicking on the "Change Consent" item at the bottom in the footer, and going into "Show Purposes" where all options have been pre-selected, as seen in Fig 2.

NOTE: We avoided the interpretation of whether the "I Accept" button fails some consent requirements such as not having options pre-ticked or pre-chosen by default. We focused on the modeling of options provided, with the ManualTest constraints responsible for this qualitative assessment.

Extracting Purposes, Processing, and Personal Data

Clicking on "Show Purposes" in the first screen (Fig 1.) takes the user to a second screen where various options are presented along with descriptions, as seen in Fig 3.

The second screen lists items such as "Information storage and access" along with a description next to a radio button that is off by default. We interpret the title as a purpose, and collect processing and personal data from the descriptions. Purposes are defined as both gdprov:Process and gc:Purpose, with processing defined as gdprov:Step and gc:Processing, and personal-data are defined using gdprov:PersonalData and gc:PersonalData. A list of purposes, processing, and personal data extracted from the consent dialogue are provided in Table 1.

For personal data mentioned in the consent dialogue, we indicated the source of this data as the user by defining a gdprov:DataCollectionStep that generates or collects this data.

Extracting Third-Parties

About halfway through the dialogue, a separate list of purposes associated with third-parties is provided, called "Third Party Vendors". Below the radio button, there is a "View Companies" link, which when clicked, expands the list of companies (third parties) associated with that purpose, as seen in Fig 4.

Clicking on the radio button is indicated to provide consent to all third parties as evidenced by the fact that individual third parties cannot be (de-)selected. Therefore, all third parties associated with a single purpose were represented using a single data sharing operation that shared data with ALL third parties listed. A list of purposes and third parties extracted from the consent dialogue are provided in Table 2. The third parties were defined using gdprov:ThirdParty and gc:ThirdParty. To associate them as data recipients for the specified third party, they were linked to a gdprov:DataSharingStep and gc:DataStep using the property gc:SharesDataWithThirdParty.