Privacy Policy
Cookie Consent Alignment Study - Research Extension

Research Study Extension
This browser extension is used solely for an IRB-approved research study run through Prolific. It is not a general-purpose consumer extension and is intended only for invited study participants.

Ethics details:
Study title: Do Users' Real-World Consent Choices Align with Their Privacy Preferences?
IRB Protocol #: NCR250873
Overview
This Privacy Policy applies to the extension used for the research study "Do Users' Real-World Consent Choices Align with Their Privacy Preferences?" The extension helps measure cookie-consent behavior in real browsing contexts and supports study workflow tasks.

The extension is designed only to facilitate study participation, including:

Checking extension installation and study eligibility requirements
Reading supported consent settings from the user's history to determine the types of cookies allowed for a website
Providing study-specific pages and interactions needed to complete survey tasks
Supporting end-of-study uninstall flow
Participation in the study is voluntary, and the user must agree to the terms of the consent form to participate.

Data Collection & Use
Important: The study is designed to minimize data collection. Research records are based on hashed domain identifiers and consent settings rather than raw website names.
Data the extension may access (on your device)
Consent-related cookies needed to decode consent state and websites/domain names (e.g., for a given website "www.example.com" we aim to collect the type of consent stored in the browser, such as "necessary: accepted, functional: accepted, performance: accepted, advertising: rejected")
Browsing-history metadata needed for study eligibility and visit-count calculations
Tab/page context needed to run study components and communicate with the survey workflow
Data transmitted for the study
The extension sends consent and browsing-history records needed by the study workflow, including hashed domain values, consent-category settings, action status, website's Tranco rank range, and visit-count metadata. Raw domain names and URLs are removed from submitted records.

Data we log or retain
Consent records: decoded consent settings by hashed domain
Browsing-history records: hashed-domain visit summaries used for study analysis
Local study state: temporary extension storage needed to complete multi-step study tasks
What we do NOT collect
No passwords, account credentials, or authentication tokens
No submission of raw authentication/session cookie values to study records
No sale, rent, or lease of participant data
Cookie and history minimization
Consent cookie values are processed to decode consent choices; submitted records retain derived settings, not raw cookie strings
Domain names are hashed before persistence in study records
Visit dates are normalized from day-level to month-level before survey persistence
Study Processing
The extension processes consent and browsing signals to support required research tasks and the participant survey flow. Processing is limited to the study's single research purpose.

Cookies permission: decode consent-signal data from supported consent cookies
History permission: compute visit-based eligibility and summary metrics
Storage permission: keep local temporary state for study continuity
Tabs/activeTab/host access: detect relevant pages and run study components in participant browsing context
Management: support participant-requested post-study removal of the extension
Sharing Information with Third Parties
We do not sell, rent, or lease participant data.
Study outputs may be published in aggregated or de-identified form.
Data may be reviewed by authorized research personnel and institutional/regulatory oversight as described in the consent form.
Security of Your Information
We take steps intended to protect study data:

Encryption in transit: extension-to-study communication uses TLS/HTTPS.
Access controls: research systems are access-controlled and limited to authorized researchers.
Data minimization: raw domains/URLs are removed from persisted records; hashed domains are used for study data.
Despite safeguards, no internet transmission or system is 100% secure.

Your Rights
Voluntary participation and withdrawal
Participation is voluntary. You may stop participating at any time. If you withdraw, we will follow the consent form's procedures regarding what data can be deleted and what may have already been anonymized.

Deletion requests
You may request deletion of identifiable research data associated with your participation, if applicable and feasible. If data has already been anonymized/aggregated such that it cannot be linked back to you, deletion may no longer be possible.

CCPA/CPRA (California residents)
If you are a California resident, you may have rights to:

Know what personal information we collect and how it is used
Request deletion of personal information (subject to exceptions)
Request correction of inaccurate personal information
Opt out of sale/sharing (note: we do not sell personal information)
Non-discrimination for exercising your rights
To exercise rights or ask questions, contact the study team (see Contact Information).

Children Under Thirteen
This extension and study are not intended for children under 13, and we do not knowingly collect personal information from children.

Changes to this Policy
We may update this policy if procedures change (e.g., hosting, retention, or study design). Updates will be posted on this page, and the "Last Updated" date will change.

Contact Information
If you have questions about this policy or the study, contact:

Principal Investigator
Dr. Jan Tolsdorf
Email: jan.tolsdorf@mpi-sp.org

Principal Investigator
Dr. Adam Aviv
Email: aaviv@gwu.edu

Research Group:
SPRING @ MPI-SP
https://spring.epfl.ch/
GWUSEC @ GWU
https://gwusec.seas.gwu.edu

If you have questions about your rights as a research participant, contact:
GW Office of Human Research at ohrirb@gwu.edu or (202) 994-2715

Effective as of: April 3, 2026

Last Updated: April 3, 2026