Is Personalization Worth It? Notifying Blogs about a Privacy Issue Resulting from Poorly Implemented Consent Banners

Several websites integrate trackers without users’ consent. Previous
research studied whether notifying responsible website operators
about such issues is an effective measure, often with limited suc-
cess. Insights from marketing research suggest that personalizing
notification emails may be an effective means to improve reme-
diation rates, with previous research pointing in both directions.
We studied this approach using a sample of 119 German fitness
and sports blogs employing Google Analytics (GA) without user
consent: In a first step, we compare the fix rate of blog operators
that received a personalized notification tailored to their blog with
the fix rate of operators that received a generic notification. We find
that personalized notifications do neither increase remediation rate
nor operators’ response behavior. In a second step, we analyzed the
reasons not to fix mentioned in (A) the email responses and (B) a
survey sent to the blog operators. We find that they mostly center
around (I) denial that a data leak exists, (II) a lack of resources
to remedy the issue and (III) claims of specifically requiring GA.
... mehr
We hypothesize that an additional reason not to fix could be the
so-called moral credentials phenomenon and sketch how to study
that in future work.