On Wednesday, 18 March 2026 Seyedali Rasaii defended his thesis with the title: “Understanding Impact of Banner Interaction on User Tracking via Web Cookies”. From April 2021 until June 2025 he was PhD student in Computer Science at the Saarland Informatics Campus, Saarbrücken and the Max Planck Institute for Informatics under the supervision of Prof. Anja Feldmann, head of Department “Internet Architecture”. The doctoral degree is awarded by Saarland University.
Abstract of the thesis:
The Internet has become a cornerstone of modern society, revolutionizing how people communicate, conduct business, and access information. Its connectivity capabilities have enabled the emergence of new types of services in the form of online platforms, such as messaging and shopping. In parallel, advertising has become a dominant revenue model for these platforms. Consequently, advertising companies utilize tracking technologies, such as cookies, to collect large amounts of data, including Personally Identifiable Information (PII), enabling them to deliver personalized content and targeted advertisements. Although these practices enhance user experience and platform monetization, the extensive collection, storage, and analysis of personal data at scale raises concerns regarding user autonomy and privacy.
Recognizing these concerns, governments and regulatory bodies have introduced frameworks, including the General Data Protection Regulation (GDPR), to safeguard user privacy. Under the GDPR, any website or service that collects or processes personal data—defined in Article 4(1) as any information relating to an identified or identifiable natural person (“data subject”)—of individuals located in the EU must obtain users’ consent prior to data collection. In response to publishers’ efforts to comply with these requirements, consent mechanisms such as cookie banners have emerged to inform users about data collection practices and obtain explicit consent for processing their personal data.
In this study, we evaluate cookie banners from different perspectives in accordance with GDPR provisions and mandates. First, we introduce BannerClick, a tool capable of interacting with cookie banners with nearly 99% accuracy. Using BannerClick, we examine the web cookie landscape through various lenses, including geographic location, device type, and banner interaction modes, providing a comprehensive understanding of how these factors influence the deployment of tracking cookies.
Furthermore, we investigate the emerging trend of cookie paywalls, which allow users to choose between accepting tracking or paying for an ad-free experience, assessing their implications for privacy and accessibility. Lastly, we explore the structural misalignments between existing consent mechanisms and regulatory objectives, demonstrating how seemingly opposing interactions with banners can influence the behavior of subsequently visited websites, thereby extending unwanted tracking via cookies. Ultimately, our findings highlight significant gaps between current consent practices—primarily in the form of cookie banners—and the objectives of privacy laws, emphasizing the need for more practical and user-centric solutions.