HADE DU ÄTIT KAKAN OM DU INTE VISSTE VAD SOM VAR I DEN? En kvalitativ studie om studenters kunskap, tillit och hantering av cookie-samtycken på nätet

Sammanfattning

Today, almost every visit to a website starts with a choice. Before users can read news, shop,search for information or use a service, they are often asked to accept, reject or change cookiesettings. These choices may seem small and quick, but they are connected to larger questionsabout personal privacy, trust and control over personal data.This study examines how Swedish students relate to personal privacy online, with a specialfocus on cookie consent. The aim is to understand how students handle cookie banners ondifferent types of websites, how they reason about privacy and trust, and what knowledgethey have about data collection. The study is based on three research questions: how studentshandle cookie consent on different websites, how they reason about privacy and trust online,and what knowledge they have about the meaning and consequences of sharing personal data.The study is based on two theories: Privacy Paradox and Bounded Rationality. PrivacyParadox is used to understand the difference between what students say about privacy andhow they actually act when faced with a cookie banner. Bounded Rationality is used tounderstand why students may make quick decisions even if they care about privacy. In thesesituations, students may have limited time, limited knowledge and limited energy to read andunderstand all the information.The study uses a qualitative method. We combined observations with semi-structuredinterviews. The observations were done first, so that we could see how the participants actedbefore they knew that cookies were the main focus of the study. After the observation, theparticipants were informed about the specific focus and were interviewed about their choices,thoughts and knowledge. The material consists of observations and interviews with 13students in Gothenburg. During the observation, the participants visited five websites: 1177,Swedbank, Apoteket, Göteborgs-Posten and Temu. These websites were chosen because theyrepresent different types of actors, such as public, financial, Swedish commercial andinternational commercial websites.The result shows that students often handle cookie consent quickly and routinely. In theobservation, “accept all” was the most common choice. Many participants described cookiebanners as something they wanted to get past in order to reach the website. This means thatcookie consent was often not treated as an active privacy decision, but more as an obstacle.Several participants also said that they care about personal privacy, but their actions did notalways match this. This shows a gap between what they value and how they actually act inthe moment.Trust was also important in the participants reasoning. Swedish and public websites, such as1177, were often seen as more trustworthy. Commercial and international websites, especiallyTemu, created more uncertainty. The participants often connected trust to the purpose of the website, where public and socially useful websites felt safer than websites that were mainlyfocused on selling products. At the same time, trust did not always decide how theparticipants acted. Some participants talked about different levels of trust in differentwebsites, but still made similar cookie choices in the observation.The study also shows that the participants had some general knowledge about cookies. Mostparticipants understood that cookies are connected to tracking, data collection andpersonalised content. However, many were unsure about what different cookie choicesactually meant, for example the difference between accepting all cookies, rejecting cookies oraccepting only necessary cookies. This means that they often knew that data was beingcollected, but not exactly what they were agreeing to.Another important result is that cookie banners often created tiredness or frustration. Someparticipants said that there is too much information to read and that it takes too much energyto make an informed choice every time. Others described a feeling that their personal data isalready available online, which made individual cookie choices feel less important. This canhelp explain why students sometimes accept cookies even when they say that privacy mattersto them.The conclusion of the study is that students cookie choices are shaped by several factors atthe same time. Knowledge, trust, design, habit and the desire to quickly access the website allaffect how students act. The study shows that cookie consent is often not a fully informed andwell thought out decision. Instead, it becomes part of everyday internet use, where studentsoften click quickly even if they care about personal privacy. This means that the problem isnot only that students lack knowledge, but also that the situation makes it difficult to use theknowledge they have.Because the study is based on 13 students in Gothenburg, the result cannot be generalised toall Swedish students. However, the study gives a deeper understanding of how cookie consentcan work in practice among students. Future research could study whether clearer and shortercookie information would make users more aware of their choices. It could also examinewhether more knowledge about cookies actually changes behaviour or if habit, trust andspeed still matter more in the moment of decision.