The default settings tend to enable non-essential cookies which could raise concerns regarding whether the consent is truly informed

However some users may find the setting interface complex, and cookie preferences may not always carry over across all BBC domains

• Explains what data is collected and user rights under GDPR; uses Standard Contractual Clauses for data transfers.

• Transparent but combines all Disney services, making Disney+-specific info less clear.

Netflix

• Clearly lists data types, usage, and GDPR rights including access and deletion.

• Transparent and easy to navigate with a detailed privacy statement.

Prime Video

• Covers data collection and user rights across Amazon services.

• Comprehensive but generic; not tailored to Prime Video specifically.

• Clear banner with “Accept All,” “Reject All,” and “Manage Preferences.”

• Fully compliant with GDPR by allowing user control before consent.

Netflix

• Cookie Preferences tool allows users to reject or customise non-essential cookies.

• Banner clearly explains purposes like personalisation and advertising.

Prime Video (Amazon)

• Banner offers accept/reject/manage options with category-level control.

• Slight bias toward “accept all,” though still GDPR compliant.

Whilst practices are disclosed transparently and aligned with GDPR, the depth and sensitivity of data gathered necessitate strong safeguards and clear user consent mechanisms.

• Collects personal, payment, and usage data for personalisation and analytics.

• Data sharing disclosed; follows GDPR transparency principles.

Netflix

• Gathers account, usage, and device data for service improvement.

• Shares limited info with analytics partners; clear about purposes.

Prime Video (Amazon)

• Collects watch history, device data, and account info for recommendations and ads.

• Shares across Amazon group; users can control marketing preferences.

• Create a Disney+-only privacy policy page for clarity.

• Add simpler summaries or visuals to explain privacy terms.

Netflix

• Clarify how long user data is kept.

• Combine all privacy and cookie settings into one dashboard.

Prime Video (Amazon)

• Make Prime Video privacy info separate from wider Amazon policies.

• Equalise “Accept” and “Reject” options on the cookie banner.

• Data Controller: House of CB explicitly names itself as the "controller of the personal data you submit to us."

• International Data Transfers: The company states that data is stored within the EEA but may be transferred outside. It mentions using Standard Contractual Clauses (SCCs) and Shields to ensure compliance for transfers to countries without an adequacy decision. This demonstrates an awareness of and a stated commitment to a key GDPR requirement for international data transfers.

• Purpose and Lawful Basis: The policy states it will inform users of the legal basis for processing for each specific data collection process, whether it's for a contract or other reasons. This addresses the GDPR principle of transparency and lawfulness.

• Data Subject Rights: The privacy policy details several rights of the data subject, including the right to access, rectification, portability, and erasure. It also includes the right to object to processing based on "legitimate interest" and to direct marketing. This is a crucial element of GDPR compliance, as it empowers individuals to control their personal data. However, the policy does list specific exceptions to the "right to erasure" (e.g., ongoing customer service issues, unshipped orders, unsettled debts), which is a common and legally justifiable practice.

• Tone: Clear, plain English, updated regularly.

• Data: Customer details, purchases, loyalty cards, CCTV.

• Purpose: Orders, fraud prevention, marketing (consent).

• Rights: Full GDPR rights explained, easy DPO contact.

• Strength: Strong governance and training.

• Weakness: 2025 cyberattack exposed vulnerabilities.

🛒 Amazon (Europe)

• Tone: Comprehensive but dense and complex.

• Data: Customer info, payments, browsing, Alexa, Prime/Kindle, ad profiles.

• Purpose: Service delivery, personalisation, targeted ads.

• Rights: GDPR rights available, harder to exercise at scale.

• Strength: Advanced infrastructure, global resources.

• Weakness: Reliance on profiling → €746m GDPR fine (2021).

⚽ Premier League

• Tone: Layered, tailored for fans, players, staff, children.

• Data: Fan registrations, Fantasy League, CCTV, player/staff data.

• Purpose: Competitions, fan engagement, safeguarding, marketing.

• Rights: GDPR rights, with extra focus on children/vulnerable groups.

• Strength: Strong safeguarding, tailored notices.

• Weakness: Complex ecosystem → risk of inconsistent compliance.

• Consent for Non-Essential Cookies: The policy states that House of CB will ask for user consent to place cookies, "except where they are essential." This is a key requirement of GDPR—you cannot place non-essential cookies on a user's device without their explicit consent.

• Information and Transparency: The policy provides a table detailing the cookies used, their purpose, and whether they are essential. It also mentions third-party cookies for marketing purposes, like those used with Partnerize. This level of detail is a good practice for transparency.

• Withdrawal of Consent: The policy explicitly states that users can withdraw consent or manage cookie preferences through a "privacy dashboard" or by emailing the company. The ability for a user to easily withdraw consent is another core GDPR requirement.

• Essential vs. Non-Essential: The policy clearly distinguishes between essential cookies (e.g., for currency selection or session ID) and other cookies that may require consent (e.g., for marketing). This shows an understanding of the legal distinction.

• Uses a cookie preference centre for consent, but CNIL fined them for setting advertising cookies before consentand poor transparency.

• Strength: Clear user controls and consent categories.

• Weakness: Past enforcement shows implementation gaps in genuine opt-in and clarity of purposes.

• Data Minimization: The policy implies that data is only collected and used for specific purposes, such as fulfilling orders and providing services. It states that data is only shared with third parties to "provide you with our services" and that they "never pass on, sell or swap your data for marketing purposes to third parties outside the House of CB group."

• Third-Party Data Sharing: The policy mentions that categories of third parties are listed under each specific process. While the publicly available snippets do not show this list, the statement indicates a commitment to transparency regarding who processes the data. It's a good practice to explicitly name third-party data processors to be fully transparent.

• Lawful Basis for Processing: The policy states it will inform customers of the legal basis for processing for each data collection. This is a key GDPR requirement, and it can be either consent or a legitimate interest, as described in their policy.

• Enhance Transparency on Third-Party Processors: Explicitly listing the names and categories of all third-party data processors (e.g., shipping partners, payment gateways, analytics providers) directly in the privacy policy would provide greater transparency and accountability. The current statement that these are listed "under every specific process" is a good start, but a clear, easy-to-find list would be better.

• Implement a Granular Consent Mechanism: While a privacy dashboard is mentioned, a prominent, user-friendly cookie consent banner on the first visit that allows users to accept, reject, or customize their cookie preferences (e.g., by category such as "Marketing" or "Analytics") would be best practice. This provides a more explicit and informed consent process from the start.

• Detail Security Measures: The privacy policy states that House of CB has a "policy setting out how your personal data will be processed and protected," but it does not provide public details about the specific technical and organizational security measures in place. Providing a general overview of security practices (e.g., data encryption, access controls, regular security audits) would increase consumer confidence.

• Provide an Easy-to-Find DPO Contact: Appointing a Data Protection Officer (DPO) and making their contact information easily accessible is often a requirement under GDPR, especially for companies that process large amounts of data. While the company provides a general email for contact, a dedicated DPO or privacy team contact would be a clear sign of accountability.

• Clarify Data Retention Policies: While the policy mentions that data is kept for "book-keeping purposes" for purchases, a more detailed data retention schedule for all types of personal data would be a positive step. This aligns with the GDPR principle of storage limitation and shows a clear process for data deletion.

Amazon collects data from user activity, devices, and third parties to personalise services, improve security, and deliver targeted advertising, with strong user controls and transparency.

Marks & Spencer

M&S gathers customer and employee data for service delivery, marketing, and internal operations, backed by structured governance, supplier oversight, and role-specific privacy notices.

Premier League

The Premier League collects personal data through its digital platforms, events, and football operations, using layered privacy notices and tailored safeguards—especially for children and players.

Your data may be shared with airports, border control, third-party travel providers, and IT service suppliers. We take measures to protect your data and comply with GDPR, including rights to access, correct, or delete your data. Data may be transferred outside the UK/EEA under appropriate safeguards.

• They allow users to access, correct, delete data; withdraw consent. asset.sephora.ie
• They have Data Subject Access Request (DSAR) procedures (UK: respond within one month).

This clearly explains the processes and practices, however there are some inconsistent enforcement of data subject rights.

• Incident: In 2022, the Romanian DPA fined Sephora €2,000 for continuing to send marketing messages to a customer who had exercised the right to object (Art. 21 GDPR).

Sephora’s cookie consent mechanism is partially compliant with GDPR.
While it satisfies the transparency and information requirements, it falls short of GDPR’s strict standards for freely given, informed, and prior consent.

Until Sephora ensures that:

• no cookies load before consent,

• “Reject all” is as easy and visible as “Accept all,” and

• consent records are auditable,

its cookie consent practices remain only partly in line with GDPR.

• Account creation – name, email, date of birth, address, and password.

• Online purchases – payment details, billing/shipping addresses, and order history.

• Cookies and tracking technologies – collect browsing behaviour, device IDs, IP addresses, click patterns, and location data.

• Newsletter sign-ups and surveys – voluntary submission of preferences or opinions.

• Social media and advertising pixels – data collected via Facebook/Meta Pixel, Google Ads, and similar tools for targeted advertising.

Nandos are very clear about the range of data that they collect such as name, contact information and location, and how it is used within their company.

Data is collected automatically to improve the experience of the service.

Nandos are very clear about how they use data provided and put an emphasize on only processing necessary data.

Additionally, their cookie banners and settings comply with GDPR and the eprivacy directive (EU cookie law)

Essential cookies (keeping you signed in, videos), Analytics cookies (Measure engagement and performance) and advertising cookies ( deliver personalised or non - personalised ads) are used.

The privacy statement outlines the legal bases for processing personal data, which include consent (for marketing and personalised services), contractual necessity (for fulfilling purchases or service requests), legitimate interest (for analytics and service improvement), and compliance with legal obligations. It also includes a breakdown of user rights under GDPR, such as the right to access, rectify, delete, or restrict data, as well as the right to object to profiling and direct marketing. Instructions for exercising these rights and contacting the Data Protection Officer are typically provided.

L’Oréal explains its data sharing practices, noting that personal data may be shared within the L’Oréal Group or with authorised third-party service providers. While cross-border data transfers are acknowledged, specific safeguards (e.g., standard contractual clauses) are mentioned only briefly in some regional policies. Data retention policies are also included but tend to lack precise timeframes, often stating that data will be kept “as long as necessary,” which could be made more transparent.

Overall, L’Oréal’s privacy statement demonstrates a strong commitment to data protection and user transparency. However, areas such as profiling explanations, opt-out processes, and specific retention details could be improved for better compliance clarity and user control. The policy reflects a solid GDPR framework but would benefit from further consistency across different brand and regional implementations.

Nandos has a cookies preference control which can be accessed at any time.

There's information about what cookies are used, how they're used and why the use of them can improve customer experience.

They state that non essential cookies are used and can be shared with third parties.

Negatives are that the third parties are not named. The length that information is stored for is not explicitly given in a time period.

- Low per-feature granularity - central privacy notice is broad - not prime video feature level - reducing the transparency under GDPR.

- Layered Linking Risk

Weaknesses: Consent Evidence and UX - public pages show controls but fo not publish organsisations approach to how consent choices are stored and how long consent records are kept

Third party scope: Some third party sharing can be opaque

Twitch’s privacy statement outlines data collection, rights, and security under GDPR. It’s transparent and region-specific but lacks detail on retention, encryption, and tracking controls, raising concerns about children’s protection and data security.

Here’s a high-level summary of what ITV’s policy states (in broad strokes):

What they collect / what data categories

• Registration data (name, email, phone, date of birth, postcode, password) ITVX

• Payment data and purchase history (for paid services, prizes, etc.) ITVX

• Usage / behavioral data: viewing history, search queries, interactions, device info, inferences / profiling ITVX

• Technical / device data: IP address, device type, OS, network type, performance metrics, cookies & identifiers, etc. ITVX

• Location data: non-precise (via IP) and precise (only with explicit permission) ITVX

• Data from third parties: e.g. from partners, advertising / tracking providers, platforms (smart TV providers, social media) ITVX

• Data you provide voluntarily (feedback, surveys, entering competitions, contact form) ITVX

Purposes / legal bases

• To deliver the service (account functions, content access, login, performance, etc.) — “performance of a contract” and/or “legitimate interest” ITVX

• To improve, analyse and enhance services, measure usage, testing, recommendations, etc. — using “legitimate interest” ITVX

• For marketing and personalised advertising (targeted ads) — relying mainly on “legitimate interest” or explicit consent depending on context ITVX

• To manage competitions, polls, events, prize fulfilment, etc. ITVX

• To comply with legal obligations (e.g. law enforcement, regulatory) ITVX

Sharing / disclosures

• With service providers (IT / analytics / support) on a “need to know” basis ITVX

• With distribution partners (smart TVs, set-top boxes) to enable cross-device / platform functionality ITVX

• With advertising / marketing partners for ad delivery, profiling, exposure reporting, matching hashed identifiers, etc. ITVX

• With group companies within ITV for cross-service improvements / promotions ITVX

• With government / law enforcement as required by law or for legitimate interest (safety, fraud, legal claims) ITVX

• Cross-border transfers: acknowledging that they rely on adequacy decisions, standard contractual clauses, or other UK-law compliant mechanisms ITVX

They are vague with what third parties they’re using and how each one are using the data

They have insufficient detail when users asked for their own data.

Unclear data retention duration

Lack of transparency about international transfers

• identification of data controller and contact information

• When the policy became effective

• Legal bases mentioned

• The different categories of personal data collected and purposes

• User rights

• Data sharing with third parties

• Security and breach provisions

• Retention and data erasure

However gaps include and risks includes:

• lack of specificity around cookie and tracking consent

• Automatic deployment of non essential cookies/tracking without opt out

• Lack of mention on DPIA

• No mention of the DPO or supervisory authority

They share data internally (across corporate affiliates) and with third parties under certain conditions (e.g service providers, advertising, legal compliance). They claim to secure data and take precautions to protect it from unauthorised access through with usual disclaimers.

• how long data is stored

• Where it is sent

• How tracking and profiling are used

• Stronger user control over marketing and behavioural data

Shares data with third-party service providers (e.g., delivery, analytics) under strict contractual terms.

Offers transparency about third-party involvement and allows users to withdraw consent.

• Contact & Identity Details

• Stay & Reservation Details

• Government / Identification Data

• Device & Technical Data

Goal: Make it clearer to users what data is collected, why, and how consent works.

Granular Cookie Controls
→ Offer a layered consent banner that allows users to opt-in separately to analytics, advertising, and personalization cookies (not just “Accept All” or “Reject All”).

They have visible options, "accept all", "reject all" or "personalize my choices" and they offer follow-up information detailing how they manage browsing cookies - thus this gives the user the right to withdraw consent

Could allow users to consent to different categories separately

Media : YouTube - YouTube's privacy policy outlines its commitment to user data protection and compliance with the General Data Protection Regulation (GDPR). The policy details how YouTube collects, uses, and shares personal data, emphasizing transparency and user control. It provides information on data retention, security measures, and the rights of users under GDPR, such as access, correction, and deletion of personal data. Additionally, the policy explains YouTube's practices regarding data sharing with third parties and international data transfers. Overall, YouTube aims to ensure that users' personal data is handled responsibly and in accordance with applicable data protection laws.

Fashion : Prada - Prada’s privacy policy explains how it collects and uses personal data for order processing, customer management, and marketing, following GDPR rules. It highlights individuals’ rights like access, correction, and erasure, and clarifies legal bases for data processing such as consent and contract necessity. Prada ensures data security, controls data sharing with third parties, and manages international transfers responsibly. Contact details are provided for exercising privacy rights or inquiries.

A fully compliant design under GDPR/ePrivacy should offer a Reject All button of equal prominence.

Because of GDPR / UK GDPR, you generally have the following rights and visibility:

• Access: You can request what data Amazon holds about you (account info, viewing history, etc.).

• Rectification: You can ask Amazon to correct inaccurate or incomplete data.

• Erasure (“right to be forgotten”): Under certain conditions you can have your data deleted.

• Restriction of Processing: You may request that Amazon limit how certain data is processed.

• Data Portability: You can ask for your data in a portable format in some cases.

• Object to Processing: For certain uses (e.g. marketing, profiling), you can object.

• Consent / Withdrawal: Where data processing depends on your consent, you can withdraw that consent.

• Transparency: Amazon has to publish its privacy notice, disclose the categories of data collected, purposes of processing, with whom they share the data, how long it’s kept, etc.

  What Amazon Shares / Visibility to Others

  • Amazon may share anonymous or aggregated data with content providers (studios etc.) to report on viewership without revealing your identity.

  • They may share data with service providers (e.g. for streaming infrastructure, analytics, billing) under contractual data protection obligations.

  • For advertising: data or identifiers may be used to deliver personalized ads; and some data may be shared with advertising partners, subject to your settings / consent.

  • Legal / regulatory / safety-related sharing (law enforcement, fraud prevention, etc.) as required.

1. Lacks Specific Legal Basis for Processing

   • Why it matters: Under GDPR Article 6, companies must specify the legal grounds for processing data (e.g. consent, legitimate interests, contractual necessity).

   • Improvement: The policy should state why the data is collected, e.g. “We process your data based on legitimate interest when you contact us directly, or contractual necessity when you purchase a product.”

2. No Reference to User Rights

   • Why it matters: GDPR requires informing users about their rights: access, rectification, erasure, restriction, objection, and data portability.

   • Improvement: Include a section like: “You have the right to access, correct, or delete your data. Learn more about your rights here [link].”

3. No Mention of Data Retention Periods

   • Why it matters: Users must know how long their data is retained.

   • Improvement: State how long personal data will be stored and the criteria used to determine retention.

4. Unclear Reference to International Transfers

   • Why it matters: BMW AG is based in Germany, and some data may be transferred internationally (especially outside the UK). Users must be told if their data leaves the UK/EU.

   • Improvement: Add a line like: “Some data may be transferred to BMW AG or other entities outside the UK. We ensure appropriate safeguards are in place.”

5. Lacks Contact Details or Link to Full Policy

   • Why it matters: Users should easily be able to find out more or ask questions.

   • Improvement: Add a link or contact like: “For more details or to contact our Data Protection Officer, please visit [URL] or email [DPO contact].”

• In France, CNIL fined Amazon for placing certain cookies automatically for visitors arriving via third-party ads before obtaining consent. This is a violation: non-essential cookies were being set without proper prior consent.

• There’s been criticism (and regulatory guidance) around cookie banners that are not clear enough, or that make rejecting non-essential cookies very difficult. Things like “pre-ticked opt-in boxes,” or only having an “accept all” option, or hiding the “reject” option, are often flagged as non-compliant.

• Lack of Transparency:

  Netflix did not adequately explain the purposes for processing customer data, including for its recommendation engine or audience analysis. 

• They failed to explicitly list the third parties who received customer data. 

• Failure to Provide Full Data:

  When users requested access to their data under GDPR, Netflix provided incomplete and ambiguous responses. 

• The Dutch Data Protection Authority (AP) fined Netflix €4.7 million for these infringements, serving as a warning to other companies.

• The data they collect (like account info, device identifiers, purchase history, etc.)

• Why they collect it (to deliver orders, personalize recommendations, prevent fraud, etc.)

• Who they share it with (subsidiaries, delivery partners, advertisers — always with a lawful basis)

• User rights under GDPR (access, deletion, portability, objection, restriction)

This privacy notice is used to collect and process personal data through Amazon websites. They state that they know the user cares about how their information is used and shared and that it will be used carefully and sensibly.

• Key Findings:
  The privacy statement provides extensive detail on data collection and usage but lacks core GDPR requirements, such as specifying the legal basis for processing, retention periods, data subject rights, and clear identification of the data controller.

• Cookie Consent Findings:
  The policy mentions cookies and tracking technologies but does not explain how consent is obtained or how users can opt out, falling short of GDPR and ePrivacy standards for clear, informed, and freely given consent.

• Data Collection Findings:
  The policy clearly outlines the categories and sources of personal data collected, including online, offline, and third-party data, showing strong transparency in scope but limited explanation of lawful processing purposes and data minimization.

• Suggestions for Improvement:
  Clearly identify the data controller and lawful bases for each processing activity, include retention periods, outline users’ GDPR rights and contact methods, and implement a compliant cookie consent mechanism that allows users to easily opt in, opt out, and withdraw consent.

• Explicit consent before setting non-essential cookies such as tracking or advertising cookies.

• Allows the user to 'Accept all', 'Reject all' or 'Manage Preferences'

• Provides the user with a Cookies Preferences Page where users can later adjust their choices.

1.

YouTube Privacy Statement Summary

YouTube, as part of Google, collects and processes personal data to provide, maintain, and improve its services. Key points include:

• Data Collected:
  

  • Account information (name, email, phone number)

  • Usage data (videos watched, search queries, watch time)

  • Device and log information (IP address, device type, browser)

  • Location data (if location services are enabled)

  • Cookies and similar tracking technologies

  • Interactions with ads, videos, and content

• 
  

• Purpose of Data Use:
  

  • Personalizing content and recommendations

  • Improving service functionality

  • Targeted advertising

  • Analytics and research

  • Fraud detection and legal compliance

• 
  

• Sharing of Data:
  

  • With Google and its affiliates

  • With content creators (for analytics)

  • With advertisers (aggregated or anonymized)

  • Legal or safety requirements

• 
  

• User Rights:
  

  • Access, update, or delete your data

  • Control ad personalization

  • Manage activity controls and location settings

• 
  

1.

Cookie Consent Banner

Upon visiting Nike’s website, users are presented with a cookie consent banner. This banner informs users about the use of cookies and provides options to manage their preferences. Users can typically choose to:

• Accept All Cookies: Grants permission for all cookie categories.

• Customize Settings: Allows users to select specific cookie preferences.

• Reject Non-Essential Cookies: Opts out of non-essential cookies, which may affect certain website functionalities.

The banner ensures that users are aware of the cookies in use and can make informed choices about their data privacy.

2.

Cookie Categories

Nike’s cookie policy outlines various categories of cookies used on their website:

• Essential Cookies: Necessary for the basic functionality of the website, such as user authentication and security.

• Performance Cookies: Collect information about how users interact with the website, helping Nike improve site performance.

• Functional Cookies: Remember user preferences and settings to enhance the user experience.

• Advertising Cookies: Used to deliver personalized advertisements based on user behavior and interests.

Users can manage their preferences for each category through the cookie settings interface.

1. Breakdown of Key Components

· The Actors:

· "We": Rock Paper Shotgun (RPS).

· "902 partners": A strikingly high and specific number that includes ad networks, data brokers, analytics companies, and social media platforms. This number is intentionally disclosed to be transparent but also to signal the complexity of the modern ad-tech ecosystem.

· The Action:

· "Store and/or access information on a device": This is the technical definition of using cookies, localStorage, and other tracking technologies.

· "Process data": This encompasses collecting, analyzing, combining, and selling the data they gather.

· The Data:

· "Browsing data": Your history on RPS and potentially other sites.

· "Unique identifiers": Such as cookie IDs, device IDs, or other tokens that can be used to create a profile of you over time and across different websites.

· The Purpose (The "Value Proposition"):

The notice lists the core reasons for processing data:

· Personalised advertising and content: Tailoring ads and even editorial content to your perceived interests.

· Advertising and content measurement: Analyzing how well ads and content perform (e.g., click-through rates).

· Audience research: Understanding the broader demographics and interests of their readership.

· Services development: Using data to improve their website and services.

· The User's Control & The "Nudge":

· The Default Action: The path of least resistance is to click "I Accept," which enables all tracking.

· The Consequence of Saying No: It explicitly states a downside: "some content and ads you see may not be as relevant to you." This is a common "nudge" technique to encourage acceptance by framing rejection as a loss of personalization.

· Granular Control: It informs you that you can "Manage Preferences" later, which is a legal requirement under laws like the GDPR. This allows users to give consent for some purposes but not others.

2. Strategic Analysis & Implications

· Compliance with GDPR/CPRA: The passage is clearly designed to comply with strict privacy regulations like the EU's General Data Protection Regulation (GDPR) and the California Privacy Rights Act (CPRA). It provides notice, seeks consent for specific purposes, and outlines the user's right to withdraw consent.

· The "Privacy Paradox" in Action: It perfectly illustrates the tension between user privacy and a publisher's business model. RPS likely relies on revenue from personalized advertising to fund its free content. This consent mechanism is the gatekeeper for that revenue stream.

· Framing and Choice Architecture:

· "I Accept" is a powerful, affirmative button that makes consent feel like the correct, default action.

· The warning about "less relevant" ads uses loss aversion—people are more motivated to avoid a loss than to acquire an equivalent gain. They are framing the loss of personalization as a negative outcome to steer you toward accepting.

· The "Manage Preferences" link is present but less prominent, requiring an extra step from the user. This is a classic example of making the desired business outcome (consent) easier than the alternative (granular control or rejection).

· Transparency vs. Overload: Mentioning "902 partners" is transparent, but it's also a number so large that it can feel abstract and overwhelming to the average user. This can sometimes lead to "consent fatigue," where users just click "accept" to make the pop-up go away because managing preferences with 902 entities seems impossible.

3. What This Means for You (The User)

· Consent is Binary (at first glance): The initial choice is presented as "Accept" or manage preferences. Clicking "I Accept" gives permission for RPS and all 902 partners to track you for the listed purposes.

· Your Data is a Commodity: Your browsing data and identifiers are being used to create a profile that is valuable to advertisers. RPS and its partners are acting as intermediaries in this data marketplace.

· Control is Possible, but Requires Effort: You have the right to refuse or customize your consent. However, you must take the proactive step of clicking "Manage Preferences," which will likely lead to a more complex menu where you can toggle different categories of data processing on or off.

· The Experience May Change: If you disable tracking, you will likely see more generic, repetitive, and potentially irrelevant advertisements. The site's functionality should remain intact, but some personalized content recommendations might not work.

Summary

This passage from Rock Paper Shotgun's privacy statement is a sophisticated, legally-compliant tool that serves a dual purpose:

1. To Inform: It clearly tells you that you will be tracked by RPS and a vast network of partners for advertising and content personalization.

2. To Nudge: It is designed to guide you toward giving broad consent by making it the easiest option and by highlighting a perceived downside to refusing.

It is a microcosm of the modern internet's fundamental bargain: free content in exchange for the user's data and attention, now mediated by legally-mandated consent interfaces.

1. Personal Information:

Bentley collects personal data such as name, contact details, vehicle information (e.g., VIN), and financial data during interactions with its websites, mobile applications, and services  .

2. Vehicle Data:

For vehicles equipped with Bentley Connected Car Services, data including vehicle diagnostics, location, and usage patterns may be collected to provide services like navigation assistance and remote diagnostics  .

3. Online Interactions:

When using Bentley’s online services, data such as IP addresses, browser types, and usage patterns are collected to enhance user experience and ensure security  .

Suggestions for Improving Data Collection Practices

1.

Transparency & Clarity

• Clearly explain what data is collected, why, and how it will be used.

• Use plain language instead of long legal jargon so users can easily understand.

2.

Granular Consent

• Allow users to choose which types of cookies or data collection they consent to, instead of an all-or-nothing approach.

• Make it easy to update or withdraw consent at any time.

3.

Minimization of Data Collection

• Only collect data that is strictly necessary for service delivery.

• Avoid excessive tracking for marketing or analytics purposes without clear user benefit.

4.

Stronger Data Protection

• Implement robust encryption, access controls, and regular audits to prevent unauthorized access.

• Regularly review and delete outdated or unnecessary data to reduce risk exposure.

5.

User Control & Rights

• Provide simple ways for users to access, correct, or delete their personal data.

• Offer opt-out options for marketing and third-party sharing without impacting essential services.

6.

Third-Party Management

• Ensure third-party vendors comply with strict privacy and security standards.

• Clearly disclose data sharing practices with third parties.

7.

Regular Privacy Updates

• Keep the privacy policy and cookie notices up-to-date with regulatory changes.

• Communicate changes to users proactively and in plain language.

8.

Education & Awareness

• Provide users with short guides or FAQs about how their data is collected, stored, and used.

• Encourage users to actively manage privacy settings and cookies.

Here is a structured evaluation:

1. The Theory: A Step Towards Empowerment (The Pros)

In a pre-GDPR world, tracking was often silent and invisible. The current practice of cookie consents is theoretically founded on several positive principles:

· Transparency: It forces websites to be upfront about their data collection practices. Users are no longer completely in the dark about who is tracking them and for what purpose.

· Choice and Control: The core idea is to give users a choice. Laws like the GDPR established the principle that consent must be "freely given, specific, informed, and unambiguous." The "Manage Preferences" option is the embodiment of this, allowing granular control.

· Accountability: It places legal responsibility on publishers to obtain and manage consent, creating a paper trail for regulators.

2. The Reality: Pervasive Flaws and Manipulation (The Cons)

In practice, the implementation of cookie consent has become deeply problematic and often undermines its own principles.

· Dark Patterns and Choice Architecture:

· Nudging to Accept: As seen in the RPS text, the interface is designed to make acceptance easiest. The affirmative "I Accept" button is prominent, while the path to rejection is often hidden behind a "Manage Preferences" or "More Options" link.

· Framing Rejection as a Loss: Warning users that they will see "less relevant" ads (as RPS does) is a psychological nudge that leverages loss aversion to steer behavior toward acceptance.

· False Equivalency: The choice is often presented as "Accept" or "Customize," rather than a simple, equally prominent "Reject All" button. This makes rejection a multi-step, cumbersome process.

· Consent Fatigue and Banner Blindness:

· The constant barrage of complex pop-ups on every website leads to user exhaustion. Faced with legalese and an overwhelming number of "partners" (902 in RPS's case), most users simply click "Accept" to make the banner disappear and access the content. This makes the consent uninformed and reflexive, voiding its legal spirit.

· The Illusion of Control:

· The "Manage Preferences" menu is often complex, confusing, and filled with marketing jargon. For a non-technical user, toggling settings for hundreds of entities is an impractical task. This creates an illusion of control rather than genuine, understandable choice.

· The "Cookie Wall" Problem:

· Some sites implement a "take-it-or-leave-it" approach, blocking access to content entirely if the user does not consent to tracking. This contradicts the GDPR's requirement that consent be "freely given," as it is a condition for service.

3. The Business and Legal Context

· Economic Model: For many publishers like RPS, personalized advertising is the primary revenue source that allows them to offer free content. The consent banner is the gatekeeper to this essential revenue stream. Their design incentives are misaligned with pure user privacy; they need users to say "yes."

· Legal Compliance (on the surface): Most of these banners are built by Consent Management Platforms (CMPs) that are designed to meet the bare minimum legal requirements. They provide the necessary information and record consent, but the manner in which consent is obtained often pushes the boundaries of what is ethical and, in some cases, legal.

Overall Evaluation and Conclusion

The current state of cookie consent practices is a well-intentioned but fundamentally broken system.

It has successfully made tracking visible, which is a crucial first step. However, it has largely failed in its goal of giving users meaningful and autonomous control over their data.

· For the User: The experience is one of annoyance, manipulation, and a sense of powerlessness. The choice is rarely a fair one.

· For the Business: It's a necessary compliance hurdle that often damages user trust and creates friction, all while being a constant legal risk.

· For Privacy: It has become a "checkbox" exercise that legitimizes widespread surveillance capitalism rather than challenging it. The sheer scale of data sharing (902 partners) revealed in these banners demonstrates how normalized mass tracking has become.

The Future:

The failure of this model is leading to calls for more robust solutions,such as:

· Global Privacy Control (GPC): A browser-level signal that automatically communicates a user's desire to opt-out of data sales, making granular consents less necessary.

· Shift in Business Models: More publishers may be forced to explore alternatives like subscriptions, micropayments, or contextual advertising (which targets the content of the page, not the user) to reduce their reliance on invasive tracking.

· Stricter Enforcement: Regulators may begin to crack down on deceptive designs and "dark patterns" in consent banners, forcing a more user-friendly standard.

In summary, while the RPS banner and its countless cousins are a product of privacy laws, they have been co-opted by business interests. They represent a flawed compromise that highlights the tension between user privacy and the ad-supported web, but ultimately places the burden of a complex systemic problem on the individual user.

You have control over your cookie preferences and can choose which categories to accept or decline using the checkboxes provided. Please note that blocking certain cookies may affect the performance or functionality of the website.

All collected data is processed in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. We ensure that your data is anonymized where possible and never used to identify you personally without your explicit consent.

For more details, please refer to our full Privacy Policy.

Possible gaps:

• No mention of a mechanism for users to withdraw or change consent after the initial choice.

• No explicit mention of cookie duration or data retention.

• No details about third-party cookies or whether data is shared with external partners.

* Personal Information: Name, address, contact info, payment data, preferences.

* Automatic Data: IP addresses, browsing activity, device info, location data via cookies and technologies.

* Third-Party Information: Data from partners, travel agencies, and other third parties.

2. How They Use Your Data:

* Booking & Reservations: To manage bookings, reservations, and customer support.

* Personalization: Customizes experience (room preferences, offers, targeted ads).

* Marketing & Communication: Sends promotional emails/messages based on preferences/behavior.

* Business Operations: Research, analytics, and internal business purposes.

3. Data Sharing:

* Service Providers: Shares data with vendors for services like payment, marketing, and support.

* Affiliated Brands: Shares data for cross-promotion or service improvements.

* Legal Requirements: Discloses data if required by law or for safety/protection.

4. Data Security and Retention:

* Security Measures: Uses encryption and access controls to protect data.

* Retention: Keeps data as long as necessary for business, legal, or regulatory purposes.

5. Your Rights:

* Opt-out: Option to opt-out of marketing and manage cookie preferences.

* Data Rights: Right to access, correct, delete, or restrict use of personal data depending on jurisdiction.

6. Cookies and Tracking:

* Cookies: Uses cookies for functionality, behavior tracking, and personalized ads.

* Preferences: You can manage cookie settings through browser settings.

7. Children's Privacy:

* Under 13: Does not knowingly collect data from children under 13 (except as permitted by law).

8. International Transfers:

* Data Transfers: Data may be transferred outside your home country, subject to different privacy laws.

9. Changes to the Privacy Statement:

* Updates: Hilton may update its privacy policy and will post changes on their website.

• GDPR Rights: Hilton includes rights such as access, correction, deletion, data portability, objection, and consent withdrawal.

• Transparency: The privacy statement explains how Hilton collects, uses, and shares data, but some details (e.g. specific purposes or retention times) are general.

• Concerns:
  

  • Limited detail on which data is used for which purpose.

  • Unclear retention periods.

  • Vague on international transfer safeguards and legitimate interest balance.

  
  

• Consent Mechanism: Hilton provides a cookie banner and “Manage Cookies” options on its website.

• Opt-out Option: Users can manage or reject cookies, but the clarity and visibility of the “Reject All” option vary by region.

• Compliance: Likely GDPR-compliant, but the banner’s clarity and purpose explanations could be improved.

Practice Assessment Risk/Implication

Scale (902 Partners) Excessive & Unmanageable Loss of data control, increased security risk, and user fatigue.

Data Type (Identifiers) Designed for Tracking Enables persistent surveillance and profiling across the web, not just on RPS.

Primary Purpose (Ad Targeting) Commercial Exploitation The user's behavioral data is the product being sold. The service is the bait.

Method (Real-Time Bidding) High-Risk Industry Standard Involves broadcasting user data to a unpredictable number of entities in a poorly controlled environment.

Conclusion:

The data collection practice disclosed by Rock Paper Shotgun is a textbook example of the pervasive, surveillance-based business model that dominates the modern internet. It is:

1. Extensive: It goes far beyond what is necessary for the website's function.

2. Opaque in Practice: While transparent in stating the number of partners, it is impossible for a user to know who they are or what they do.

3. Profiling-Focused: The goal is to build a detailed behavioral model of the user for financial gain.

4. Inherently Risky: Sharing data with such a vast network creates significant privacy and security vulnerabilities.

While this practice is legally compliant on the surface due to the presence of a consent banner, its scale and nature raise serious questions about whether the consent obtained is truly informed, free, and specific as required by laws like the GDPR. It represents a fundamental power imbalance where the user's choice is between accepting industrial-scale tracking or facing a degraded experience.

• Data Collected: Personal data (name, contact, payment, ID), technical data (IP, device info), and behavioral data (usage, preferences).

• Use of Data: For reservations, marketing, analytics, personalization, and security.

• Sharing: With Hilton subsidiaries, service providers, advertisers, and third-party partners.

• Transparency Issues:
  

  • Some sharing and anonymisation practices are not fully explained.

  • Retention timelines and optional vs required data are unclear.

  
  

- Rights listed

- Data subject request/contact channel

- Lawful bases/legal grounds

- Automated decision-making/profiling

- Data categories & third parties

Assessment:

- Clear - High level purposes and categories of data are describe in readable language.

- Unclear - granular lawful-basis mapping, detailed retention schedules, technical details on profiling/automated decisions

Areas of Concern:

- Consent vs. legitimate interest for tracking/personalisation ads

- Off-site tracking and third-party cookies/tags

- Lack of detailed, itemised retention periods

- Practical friction in exercising rights

1. Clarify Data Use: Explain exactly what data is used for each purpose.

2. Enhance Cookie Banner: Add clear “Accept/Reject” buttons and detailed cookie categories.

3. Show Transfer Safeguards: Publish how Hilton protects data moved outside the UK/EU.

4. List Retention Periods: Specify how long each data type is stored.

5. Increase Transparency: Identify key third parties and anonymisation steps.

6. User Control: Create a privacy dashboard for managing personal data and consent.

7. Staff Training: Ensure all employees understand GDPR duties.

A. For Rock Paper Shotgun (The Publisher)

These suggestions focus on building trust through transparency, ethical design, and exploring alternative business models.

1. Drastically Improve the Consent Interface (UI/UX):

· Default to Rejection: The most user-trusting change would be to have the initial choice be between "Reject All" and "Manage Preferences," with "Accept All" as a secondary option. This puts privacy first by default.

· Plain Language: Replace jargon like "personalised advertising" and "unique identifiers" with clearer explanations. For example: "We and our partners use data to show you ads for games you've recently looked at on other sites" or "We use a tracker to recognize your browser across different websites."

· Structured, Intuitive Categories: In the "Manage Preferences" menu, group purposes clearly (e.g., "Essential," "Performance Analytics," "Personalized Ads") and provide a one-sentence explanation for each. Use a simple on/off toggle.

2. Increase Meaningful Transparency:

· Partner Vetting and Capping: Commit to reducing the number of partners and publicly state a policy for vetting them based on their data security and privacy practices. Instead of "902 partners," aim for a curated, accountable list.

· Just-in-Time Explanations: Instead of one massive banner, consider contextual explanations. For example, if an article uses an interactive embed, a small notice could say, "This content needs XYZ to function. [Learn More]." This breaks down the consent process.

· A Clear "Why": Before the technical list, explain the business model simply: "We are ad-supported. Allowing personalized ads helps fund the free journalism you enjoy. You can choose to support us in these ways:" and then present the options.

3. Explore and Incentivize Privacy-Friendly Alternatives:

· Promote Contextual Advertising: Offer advertisers the option for contextual ads (e.g., showing PC hardware ads on a PC gaming news site). Actively market this as a privacy-friendly alternative that doesn't require tracking.

· Develop Value-Exchange for Consent: Instead of framing rejection as a loss, frame acceptance as a conscious choice to support the site. Consider a model where users who log in or subscribe get an ad-light/no-tracking experience, while anonymous users see contextual ads.

· Invest in Direct Revenue Streams: Continue to build on subscriptions, memberships, and donations to gradually reduce reliance on the most invasive forms of advertising.

---

B. For Regulators and Industry Bodies

The current problems are systemic and require top-down solutions to create a fair playing field.

1. Enforce Stricter UI Standards and Ban Dark Patterns:

· Mandatory "Reject All" Button: Legally require that "Reject All" is as equally prominent and easy as "Accept All." The European Data Protection Board (EDPB) has already issued guidelines in this direction; this needs robust enforcement.

· Define "Nudging": Provide clear examples of prohibited language, such as framing the rejection of tracking in a negative light (e.g., "see less relevant ads"). Consent must be presented in a neutral manner.

2. Promote Technological Shifts:

· Mandate Support for Global Privacy Control (GPC): Legally recognize GPC—a browser-level signal that communicates a user's desire to opt-out of data sales—as a valid expression of non-consent, just like a "Reject All" button.

· Encourage the Phase-Out of Third-Party Cookies: Support the industry's shift towards privacy-preserving technologies (like Google's Privacy Sandbox proposals, with careful scrutiny) that aim to provide utility for advertisers without exposing individual user data to hundreds of companies.

3. Clarify the Legality of Current Practices:

· Rule on Real-Time Bidding (RTB): Issue definitive rulings on whether the mass broadcasting of user data in RTB systems, even with consent, is compliant with data minimization and purpose limitation principles. This would force the industry to adapt.

---

C. For Users / The Public

While the burden should not be on the user, there are ways to navigate this landscape more effectively.

1. Use the "Manage Preferences" Link. Always.

· It's the single most powerful action. Instead of reflexively clicking "Accept," take the extra few seconds to click "Manage Preferences" or "Options" and disable everything that isn't "Essential." You will often find you can disable 90% of the tracking with a few clicks.

2. Leverage Browser and Tool-Level Solutions:

· Install a Privacy-Focused Browser: Browsers like Brave or Firefox Focus are designed to block trackers by default.

· Use Browser Extensions: Extensions like uBlock Origin (ad/tracker blocker), Privacy Badger (blocks spying ads and invisible trackers), and ClearURLs can automatically handle a large portion of this problem.

· Enable Global Privacy Control (GPC): Check your browser's settings or use an extension to enable GPC to broadcast your privacy preference automatically.

3. Support Publishers Directly:

· Subscribe or Donate: If you value a site like Rock Paper Shotgun, the most effective way to free it from the ad-tech dependency is to become a paying subscriber or member, if that option is available.

Summary: A Shift in Philosophy

The ultimate improvement requires a fundamental shift from a model of "harvesting consent through manipulation" to one of "earning trust through transparency and choice."

The ideal future state would be:

· For Publishers: A default private experience, with clear value propositions for why data collection might benefit the user (e.g., better recommendations) or support the site, presented with neutral, ethical design.

· For the Ecosystem: A move away from mass surveillance and profiling towards contextual advertising and user-supported models.

By implementing these suggestions, a publisher like Rock Paper Shotgun could distinguish itself as a leader in ethical digital publishing, building a more loyal and trusting audience in the long run.