SOME people say that clicking accept on a website's cookie pop-up can damage your phone or computer and open the door to hackers.
The pop-up appears on most websites, and many people tap it away without a second thought.
But can clicking accept on a cookie pop-up get your device hacked?
Verdict:
FALSE
Clicking accept on a cookie pop-up does not automatically damage your device or get it hacked, although it can have consequences for your privacy.
That is the finding of a MyCheck.my report drew on cybersecurity firm Kaspersky and the Malaysian Cyber Consumer Association (MCCA), and the wider research shows where the real risks lie.
A cookie, as the FBI describes it, is a small piece of data that a website sends to your device so the site can remember things about your session, such as login details, preferences or items in your shopping cart.
Technical standards from the Internet Engineering Task Force, which develops standards for the internet, describe cookies as a way for servers to store state in your browser so that a session can carry on over a protocol that has little memory of its own.
Kaspersky says that clicking accept gives a website permission to store information on your device and to collect data about how you use the site, such as your login status, language choice and browsing activity.
Cookie pop-ups exist because privacy laws require websites to explain how they use data and to give users a choice, according to Kaspersky.
Functional cookies keep a site working by remembering things like your login or language, while advertising cookies track what you look at and collect data about your behaviour.
The privacy risk lies mainly in tracking.
A 2016 study by Princeton University researchers, which crawled the top one million websites, found more than 81,000 third parties present on at least two sites, with only Google, Facebook and Twitter appearing on more than 10% of them.
When Firefox's third-party cookie blocking was switched on, only 0.4% of the 55,000 sites tested set any third-party cookies, the researchers found.
MCCA president Siraj Jalil said clicking accept does not cause a device to be hacked automatically, but cookies do gather data on how users behave online.
"Cybercriminals then use behavioural data from cookies to study the target's patterns of thinking, psychology and tendencies.
"This information helps them find the user's weak points to launch attacks such as scams or clickbait and rage bait headlines," said Siraj.
Clickbait is content designed to make you click a link, while rage bait is content deliberately designed to provoke anger or outrage.
Siraj said cookies alone may not be critically dangerous, but the risk grows sharply when they are combined with other personal data, such as leaked identity details, identity card numbers or phone numbers, because criminals can then build a complete profile of a target.
Where hacking does come into it is cookie theft.
On Oct 30, 2024, the FBI Atlanta Division warned that cybercriminals were getting into email accounts by stealing cookies from victims' computers.
Remember-Me cookies, which are created when you tick a box such as Remember this device while logging in, often last about 30 days and can let a criminal sign in as you without a username, password or the extra step of multifactor authentication, the FBI said.
Victims hand over their cookies without realising it when they visit suspicious websites or click phishing links that install malicious software, according to the FBI.
The National Institute of Standards and Technology (NIST), the US government's standards agency, says in its digital identity guidelines that browser cookies are the predominant way a login session is created and tracked, and that the secrets which keep a session going are at risk of theft by malware.
Columbia University researchers showed in a 2016 study presented at the Institute of Electrical and Electronics Engineers (IEEE) Symposium on Security and Privacy that cookies sent over unencrypted connections can be hijacked by anyone monitoring the network, exposing details such as names, email addresses and search histories and, on some sites, account functions.
In 30 days of monitoring part of the university's public Wi-Fi, they detected more than 282,000 accounts exposing the cookies needed for such attacks.
Researchers at Ruhr University Bochum in Germany and their colleagues ran experiments with more than 80,000 users, presented at the ACM Conference on Computer and Communications Security in 2019, and found that people were more likely to accept tracking when offered a simple accept-or-decline choice than when they had to choose by category or company.
They also found that nudging in how notices are designed has a large effect on the choices people make.
Kaspersky advises rejecting unnecessary cookies on public Wi-Fi or shared devices, on untrusted or suspicious sites, when third-party tracking is involved, when logging in, paying or entering personal information and on sites that do not use HTTPS.
Rejecting cookies has trade-offs, since you may have to log in again each time, your shopping cart may be empty whenever you return to an e-commerce site and pages may load more slowly.
Many sites offer a middle path, letting you accept only essential cookies or reject third-party ones, which are usually the ones used for advertising.
Beyond that, the FBI advises clearing cookies regularly, thinking twice before ticking Remember Me, visiting only sites with a secure HTTPS connection and checking the recent login history in your account settings.
So the accept button will not break your phone or hand it to a hacker, but it is not a harmless formality either, and a few seconds spent reading the options is cheaper than a stolen account.
Sources:
3. https://pages.nist.gov/800-63-
4. https://www.rfc-editor.org/
5. https://webtransparency.cs.
6. https://www.cs.columbia.edu/~
7. https://arxiv.org/abs/1909.
