Note: The following is a post by Emer Kirrane, who is a Yahoo! Web Analytics Account Manager out of the Budapest office. Go connect with her @eXXX – as I said before, she’s smart!

I recently surveyed 100 “internet-savvy” people to understand their attitude towards cookies and whether or not they considered cookies to be a privacy or security concern. As a follow-up, I surveyed another group. This time, my focus was the general internet user, who would not be expected to understand the use of cookies. Getting to my target of 100 took slightly more time in this case as the respondents were not as engaged with the subject!

The survey was posted on a group unrelated to web analytics on LinkedIn.com, on Facebook.com, as comments on some blog posts on the subject of internet privacy, and in 15 random categories on answers.yahoo.com. It was also circulated by email (thanks Andy, Mom, and friends!). To my knowledge, the respondents came from at least 8 countries.

In my previous survey, I asked 5 questions which assumed at least a basic understanding of cookies. In this survey, because I could not make the same assumptions, I asked 6 slightly differently-phrased questions, most of which had a yes/no answer and an optional comment field.

The Results

1) I know that cookies are put on my computer by websites that I visit.

• YES 84%
• NO 16%

The vast majority of those surveyed knew that cookies were placed on their machines, although several of those who responded “Yes” were under the impression that cookies were only placed by certain types of sites, like forums or social networks.

2) I know what cookies are and understand what they are used for.

• YES 57%
• NO 43%

Although more than half of the respondents claimed to understand cookies and their usage, quite a few of those who answered “Yes” felt that cookies were solely used for website preferences or helped to load a page faster. The overall understanding seemed rather vague (some considered them to be rather benign viruses) though many grasped the basic concept. It is interesting that although 84% know that cookies are placed on their computers when they visit a website, not all of those have tried to find out what cookies actually are.

3) I know the difference between 1st-party and 3rd-party cookies

• YES 35%
• NO 65%.

Given the fact that 57% of respondents claimed to understand cookie usage, it is interesting to note that only 35% knew the difference between 1st-party and 3rd-party cookies. However, this segment did appear to genuinely understand the difference between the two types of cookie.

4) I have customised my browser settings with regard to the treatment of cookies.

• YES 35%
• NO 65%

The responses to this question were interesting. Of the 35% who responded that they had customised their browser settings with regard to the treatment of cookies, several admitted that they had customised their settings, but that they had no idea what the settings now were. On the other hand, there were several whose set-up meant that they were prompted for permission every time there was an attempt to set a cookie. Some blocked all cookies while some accepted them all, so there was no one setting that stood out as the most adopted.

The majority, those who responded that they had not customised their browser settings, commented that they had not changed their browser settings for a variety of reasons – because they did not know how to, because they would not know what they should change them to given their understanding of cookies, because they knew the default settings of their browser or because they regularly used an application to clear out cookies. We can infer from this then that most of the respondents use the default browser settings, which are often to allow 1st-party cookies and reject 3rd-party cookies (though not always: Chrome, by default, accepts all – you can then choose to reject all or “restrict how 3rd-party cookies are used” – I haven’t been able to find out exactly what this means (though I can imagine) but would be curious to know).

I asked this same question in my first survey, the response to which was YES: 42% and NO: 58%.

5) When I visit a website, I look for and read the privacy policy.

• Always 5%
• Sometimes 41%
• Never 54%

Though this question is not directly related to cookies, my interest included attitudes towards privacy on the internet and overall security concerns. The overwhelming feeling that I got was that “life is too short” for reading privacy policies. In addition, all privacy policies were considered to be the same and over-complicated with legal jargon which could hide any dubious statements. In general, it seems that privacy policies are considered a nice-to-have element of a website, but not a crucial part of a visitor’s navigation behaviour.

6) I have privacy concerns specifically regarding cookies being set on my computer by websites I visit.

• YES 38%
• NO 62%

A similar question in my previous survey (I have concerns about cookies being misused to compromise my privacy) generated exactly the same results. In this case, however, the reasons were slightly different – the distrust of cookies centred more around data being sold on, unwanted viral material etc than profiling and targeting. There was also distrust stemming from a lack of understanding of what cookies are and what they can be used for.

In a fascinating twist, quite a few of those who did not have these concerns said that it was because they did not understand what cookies are and what they can be used for!

Generally, knowing what cookies are does not seem to be a barrier to acceptance. In addition, ignorance of what they are does not seem to be a barrier to acceptance. Most of those surveyed did not know of any problems caused on their computers by cookies and for that reason did not fear them. This did not mean that they knew what cookies were or even had much interest in finding out. Again, as in the first survey, to a large degree, convenience is an important consideration – knowledge that, for example “Bebo forgets me if I delete cookies” outweighs any other possible concerns.

So, all in all, good news for the 1st-party cookie (depending on the default browser settings of your website visitor). For the 3rd-party cookie, however, apathy may mean that it is often blocked and largely misunderstood – like me, as a child :-).

Cheers,

E