Data processing systems for identifying whether cookies contain personally identifying information

• US 10,013,577 B1
• Filed: 12/29/2017
• Issued: 07/03/2018
• Est. Priority Date: 06/16/2017
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Beaumont, Richard, Mannix, John, Barday, Kabir A., Brannon, Jonathan Blake
• Primary Examiner(s): Cribbs, Malcolm
• Application Number:
  US15/858,802
• Time in Patent Office: 186 Days
• Field of Search: None
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system for identifying and determining whether a particular cookie may include personal data, in various embodiments, is configured to analyze collected cookies to determine whether the collected cookies may be used to directly or indirectly identify a particular individual. The system may, for example: (1) generate one or more virtual profiles; (2) use the one or more virtual profiles to access a plurality of websites; (3) collect cookie data for the plurality of websites for the one or more virtual profiles; and (4) analyze the cookie data to determine whether a particular website of the plurality of websites utilizes one or more cookies which may potentially include personal data. The system may then generate a report of the analysis, and display the report to an administrator or other individual associated with the particular website.

Claims

1. A computer-implemented data processing method for identifying personal data via a particular web beacon, the method comprising:

scanning, by one or more processors, using a plurality of unique user profiles, a single website for one or more web beacons and one or more cookies;

scanning, by one or more processors, a plurality of websites using a first particular one of the plurality of unique user profiles that persists across the plurality of websites for the one or more web beacons and the one or more cookies;

identifying, by one or more processors, the particular web beacon from the one or more web beacons and a particular cookie of the one or more cookies;

determining, by one or more processors, a host of the particular web beacon;

determining, by one or more processors, a purpose of the particular web beacon;

determining, by one or more processors, a host of the particular cookie;

determining, by one or more processors, a purpose of the particular cookie;

determining, by one or more processors, based at least in part on the host of the particular web beacon, the purpose of the particular web beacon the host of the particular cookie, and the purpose of the particular cookie, whether a particular individual is likely to be identified by the particular web beacon and the particular cookie;

in response to determining that a particular individual is likely to be identified by the particular web beacon and the particular cookie, generating, by one or more processors, a report regarding a likelihood that the particular individual might be identified by the particular web beacon and the particular cookie; and

displaying, by one or more processors, the report to an individual associated with the single website, the report enabling the individual to make one or more changes to modify data collected and stored within the particular cookie.

2. The computer-implemented data processing method of claim 1, wherein:

the method further comprises;

generating a plurality of virtual user profiles; and

storing the plurality of virtual profiles in memory; and

the plurality of unique user profiles comprise the plurality of virtual user profiles.

3. The computer-implemented data processing method of claim 2, wherein:

scanning the plurality of websites using the first particular one of the plurality of unique user profiles comprises scanning the plurality of websites using the first particular one of the plurality of unique user profiles at a first time;

the method further comprises;

scanning, by one or more processors, the plurality of websites using the first particular one of the plurality of unique user profiles at a second time; and

determining, by one or more processors, a persistence of the particular web beacon between the first time and the second time; and

determining whether a particular individual is likely to be identified by the particular web beacon is further based at least in part on the persistence of the particular web beacon.

4. The computer-implemented data processing method of claim 1, wherein:

the method further comprises determining, whether a particular individual is likely to be identified by the particular web beacon based at least in part on a number of the plurality of webpages that comprise the particular web beacon.

5. The computer-implemented data processing method of claim 1, wherein:

the method further comprises determining, by one or more processors, whether the particular web beacon is unique to each of the plurality of unique user profiles; and

determining whether a particular individual is likely to be identified by the particular web beacon is further based at least in part on whether the particular web beacon is unique to each of the plurality of unique user profiles.

6. The computer-implemented data processing method of claim 5, wherein:

the single website comprises a web-based e-mail service; and

the web beacon is disposed on the single website within a particular e-mail message.

7. The computer-implemented data processing method of claim 1, wherein the single website and the plurality of websites are associated with one another.

8. The computer-implemented data processing method of claim 1, wherein:

the host is a third-party host; and

determining whether the particular individual is likely to be identified by the particular web beacon is further based on information associated with the third-party host.

9. A computer-implemented data-processing method of determining whether a particular website of a plurality of websites may track personally identifiable data, the method comprising:

creating, by one or more processors, a plurality of unique user profiles;

storing, by one or more processors, the plurality of unique user profiles in computer memory;

using, by one or more processors, each of the plurality of unique user profiles to scan the plurality of websites for one or more canvas read attempts;

gathering, by one or more processors, for each of the plurality of websites, canvas element data for each of the plurality of unique user profiles, the canvas element data comprising one or more canvas elements making the one or more canvas read attempts;

gathering, by one or more processors, for each of the plurality of websites, cookie data for each of the plurality of unique user profiles, the cookie data comprising one or more cookies;

determining, by one or more processors, for each of the one or more canvas elements, a respective canvas element host;

determining, by one or more processors, for each of the one or more cookies, a respective cookie host;

determining, by one or more processors, based on the respective canvas element host and the respective cookie host, whether the particular website of the plurality of websites may track personally identifiable data; and

in response to determining that the particular website may track the personally identifiable data, transmitting a notification to an individual associated with the particular website comprising the canvas element data and the cookie data, the notification enabling the individual to make one or more changes to modify data collected and stored within the one or more cookies.

10. The computer-implemented data-processing method of claim 9, wherein each of the plurality of unique user profiles define a respective operating system, a respective web browser, and a respective graphics processor.

11. The computer-implemented data-processing method of claim 10, wherein:

using each of the plurality of unique user profiles to scan a plurality of websites for one or more canvas read attempts comprises using a virtual machine defined by each of the plurality of unique user profiles to access the plurality of websites.

12. The computer-implemented data-processing method of claim 9, wherein determining whether the particular canvas element of the one or more canvas elements may include personally identifiable data comprises determining whether the particular canvas element is unique for each of the plurality of unique user profiles.

13. The computer-implemented data-processing method of claim 9, wherein determining whether the particular canvas element of the one or more canvas elements may include personally identifiable data comprises analyzing a respective profile for each of the plurality of unique user profiles derived from the particular canvas element.

14. The computer-implemented data-processing method of claim 9, further comprising:

using, by one or more processors, each of the plurality of unique user profiles to scan a plurality of websites for one or more cookies;

gathering, by one or more processors, for each of the plurality of websites, cookie data for each of the plurality of unique user profiles;

determining, by one or more processors, for each of the one or more cookies, a respective cookie host; and

determining, by one or more processors, based on the respective canvas element host and the respective cookie host, whether the particular canvas element of the one or more canvas elements may include personally identifiable data.

15. The computer-implemented data-processing method of claim 14, wherein the plurality of websites are a plurality of websites associated with a particular organization.

16. The computer-implemented data-processing method of claim 9, further comprising:

scanning the plurality of websites to identify a webform used to collect one or more pieces of personal data;

robotically completing the identified webform using at least one of the plurality of unique user profiles;

analyzing the completed webform; and

determining, by one or more processors, based on the respective canvas element host and the completed webform analysis, whether the particular canvas element of the one or more canvas elements may include personally identifiable data.

17. A computer-implemented data-processing method of identifying one or more cookies of a plurality of cookies that may contain personal data, the method comprising:

creating, by one or more processors, a first unique user profile;

storing, by one or more processors, the first unique user profile in memory;

using, by one or more processors, the first unique user profile to access one or more first webpages of a first website;

collecting, by one or more processors, for each of the one or more first webpages, first cookie data for the first unique user profile, the first cookie data being associated with a first plurality of cookies;

using, by one or more processors, the first unique user profile to access one or more second webpages of a second website;

collecting, by one or more processors, for each of the one or more second webpages, second cookie data for the first unique user profile, the second cookie data being associated with a second plurality of cookies;

scanning the one or more first webpages for one or more canvas read attempts;

in response to scanning the one or more first webpages for the one or more canvas read attempts, identifying a first canvas read attempt by at least one of the one or more first webpages;

determining, by one or more processors, based on the first cookie data, the second cookie data, and the first canvas read attempt, whether the first plurality of cookies contain one or more cookies that may contain personal data;

in response to determining that the first plurality of cookies contain one or more cookies that may contain personal data, generating, by one or more processors, a report identifying the first plurality of cookies; and

displaying, by one or more processors, the report to a site owner of the first website, the report enabling the site owner to make one or more changes to modify data collected and stored within the first plurality of cookies.

18. The computer-implemented data-processing method of claim 17, wherein determining whether the first plurality of cookies contain one or more cookies that may contain personal data comprises comparing the first cookie data to the second cookie data.

19. The computer-implemented data-processing method of claim 18, wherein:

the method further comprises;

creating, by one or more processors, a second unique user profile;

storing, by one or more processors, the second unique user profile in memory;

using, by one or more processors, the second unique user profile to access the one or more first webpages of the first website;

collecting, by one or more processors, for each of the one or more first webpages, third cookie data for the second unique user profile, the third cookie data being associated with a third plurality of cookies;

using, by one or more processors, the second unique user profile to access the one or more second webpages of the second web site;

collecting, by one or more processors, for each of the one or more second webpages, fourth cookie data for the second unique user profile, the fourth cookie data being associated with a fourth plurality of cookies; and

determining, by one or more processors, based on the first cookie data, the second cookie data, the third cookie data, and the fourth cookie data, whether the first plurality of cookies contain one or more cookies that may contain personal data; and

determining whether the first plurality of cookies contain one or more cookies that may contain personal data comprises comparing the first cookie data, the second cookie data, the third cookie data, and the fourth cookie data with one another.

20. The computer-implemented data-processing method of claim 19, wherein determining whether the first plurality of cookies contain one or more cookies that may contain personal data comprises:

identifying a first cookie of the first plurality of cookies;

identifying a second cookie of the third plurality of cookies that corresponds to the first cookies;

determining whether the first cookie is unique to the first unique user profile; and

determining whether the second cookie is unique to the second unique user profile.