Data processing systems for identifying whether cookies contain personally identifying information

• US 9,858,439 B1
• Filed: 06/16/2017
• Issued: 01/02/2018
• Est. Priority Date: 06/16/2017
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Beaumont, Richard, Mannix, John
• Primary Examiner(s): Cribbs, Malcolm
• Application Number:
  US15/626,052
• Time in Patent Office: 200 Days
• Field of Search: None
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system for identifying and determining whether a particular cookie may include personal data, in various embodiments, is configured to analyze collected cookies to determine whether the collected cookies may be used to directly or indirectly identify a particular individual. The system may, for example: (1) generate one or more virtual profiles; (2) use the one or more virtual profiles to access a plurality of websites; (3) collect cookie data for the plurality of websites for the one or more virtual profiles; and (4) analyze the cookie data to determine whether a particular website of the plurality of websites utilizes one or more cookies which may potentially include personal data. The system may then generate a report of the analysis, and display the report to an administrator or other individual associated with the particular website.

Claims

1. A computer-implemented data processing method for identifying personal data in a particular cookie, the method comprising:

scanning, by one or more processors, using a plurality of unique user profiles, a single website for one or more cookies;

scanning, by one or more processors, a plurality of websites using a first particular one of the plurality of unique user profiles that persists across the plurality of websites for the one or more cookies;

identifying, by one or more processors, the particular cookie from the one or more cookies;

determining, by one or more processors, a host of the particular cookie;

determining, by one or more processors, a purpose of the particular cookie;

determining, by one or more processors, based at least in part on the host of the particular cookie and the purpose of the particular cookie, whether a particular individual is likely to be identified by the particular cookie;

in response to determining that the particular individual is likely to be identified by the particular cookie, generating, by one or more processors, a report regarding a likelihood that the particular individual might be identified by the particular cookie; and

displaying, by one or more processors, the report to an individual associated with the single website.

2. The computer-implemented data processing method of claim 1, wherein:

the method further comprises;

generating a plurality of virtual user profiles; and

storing the plurality of virtual profiles in memory; and

the plurality of unique user profiles comprise the plurality of virtual user profiles.

3. The computer-implemented data processing method of claim 2, wherein:

scanning the plurality of websites using the first particular one of the plurality of unique user profiles comprises scanning the plurality of web sites using the first particular one of the plurality of unique user profiles at a first time;

the method further comprises;

scanning, by one or more processors, the plurality of websites using the first particular one of the plurality of unique user profiles at a second time; and

determining, by one or more processors, a persistence of the particular cookie between the first time and the second time; and

determining whether a particular individual is likely to be identified by the particular cookie is further based at least in part on the persistence of the particular cookie.

4. The computer-implemented data processing method of claim 1, wherein:

the method further comprises;

determining, by one or more processors, an expiration time of the particular cookie; and

determining, by one or more processors, based at least in part on the expiration time, a persistence of the particular cookie; and

determining whether a particular individual is likely to be identified by the particular cookie is further based at least in part on the persistence of the particular cookie.

5. The computer-implemented data processing method of claim 1, wherein:

the method further comprises determining, by one or more processors, whether the particular cookie is unique to each of the plurality of unique user profiles; and

determining whether a particular individual is likely to be identified by the particular cookie is further based at least in part on whether the particular cookie is unique to each of the plurality of unique user profiles.

6. The computer-implemented data processing method of claim 1, wherein:

the method further comprises;

monitoring, by one or more processors, the single web site for one or more changes;

in response to detecting one or more changes to the single website, scanning, by one or more processors, using the plurality of unique user profiles, the single website for one or more second cookies;

identifying, by one or more processors, a second particular cookie from the one or more second cookies,

collecting, by one or more processors, cookie data for the second particular cookie using the plurality of unique user profiles; and

determining whether the particular individual is likely to be identified by the second particular cookie based at least in part on the cookie data; and

the one or more cookies do not comprise the second particular cookie.

7. The computer-implemented data processing method of claim 1, the method further comprising:

scanning, by one or more processors, the plurality of websites using each of the plurality of unique user profiles, wherein each of the plurality of unique user profiles persists across the plurality of websites for the one or more cookies.

8. The computer-implemented data processing method of claim 1, wherein:

the host is a third-party host; and

determining whether the particular individual is likely to be identified by the particular cookie is further based on information associated with the third-party host.

9. A computer-implemented data-processing method of determining whether a particular cookie of one or more cookies may include personally identifiable data, the method comprising:

creating, by one or more processors, a plurality of unique user profiles;

storing, by one or more processors, the plurality of unique user profiles in computer memory;

using, by one or more processors, each of the plurality of unique user profiles to access a plurality of websites over a first period of time;

gathering, by one or more processors, for each of the plurality of websites, cookie data for each of the plurality of unique user profiles, the cookie data comprising the one or more cookies;

determining, by one or more processors, for each of the one or more cookies, a respective cookie host;

determining, by one or more processors, for each of the one or more cookies, a respective cookie purpose;

determining, by one or more processors, based on the respective cookie purpose and the respective cookie host, whether a particular cookie of the one or more cookies may include personally identifiable data; and

in response to determining that the particular cookie of the one or more cookies may include the personally identifiable data, transmitting a notification to an individual associated with at least one of the plurality of websites comprising the cookie data associated with the particular cookie.

10. The computer-implemented data-processing method of claim 9, further comprising:

retrieving, by one or more processors, the plurality of unique user profiles from the computer memory;

using, by one or more processors, each of the plurality of unique user profiles to access the plurality of websites over a second period of time;

determining, by one or more processors, a respective persistence of each of the one or more cookies between the first period of time and the second period of time; and

determining, by one or more processors, based on the respective persistence, the respective cookie purpose, and the respective cookie host, whether the particular cookie of the one or more cookies may include the personally identifiable data.

11. The computer-implemented data-processing method of claim 9, wherein:

using each of the plurality of unique user profiles to access the plurality of websites over the first period of time comprises using each of the plurality of unique user profiles to access a first portion of webpages that make up the plurality of websites; and

the method further comprises using each of the plurality of unique user profiles to access a second portion of webpages that make up the plurality of websites over a second period of time.

12. The computer-implemented data-processing method of claim 9, wherein determining whether the particular cookie of the one or more cookies may include personally identifiable data comprises determining whether the particular cookie is unique for each of the plurality of unique user profiles.

13. The computer-implemented data-processing method of claim 9, wherein determining whether the particular cookie of the one or more cookies may include personally identifiable data comprises determining whether the respective cookie host is a first-party host or a third-party host.

14. The computer-implemented data-processing method of claim 9, wherein determining whether the particular cookie of the one or more cookies may include personally identifiable data comprises determining an expiration time of the particular cookie.

15. The computer-implemented data-processing method of claim 14, wherein the plurality of websites are a plurality of websites associated with a particular organization.

16. The computer-implemented data-processing method of claim 15, wherein:

the method further comprises;

using, by one or more processors, each of the plurality of unique user profiles to access a second plurality of websites over the first period of time;

gathering, by one or more processors, for each of the second plurality of websites, second cookie data for each of the plurality of unique user profiles, the second cookie data comprising one or more second cookies; and

determining, by one or more processors, based on the cookie data and the second cookie data, whether the particular cookie of the one or more cookies may include personally identifiable data; and

the one or more second cookies comprise the particular cookie.

17. A computer-implemented data-processing method of identifying one or more cookies of a plurality of cookies that may contain personal data, the method comprising:

creating, by one or more processors, a first unique user profile;

storing, by one or more processors, the first unique user profile in memory;

using, by one or more processors, the first unique user profile to access one or more first webpages of a first web site;

collecting, by one or more processors, for each of the one or more first webpages, first cookie data for the first unique user profile, the first cookie data being associated with a first plurality of cookies;

using, by one or more processors, the first unique user profile to access one or more second webpages of a second web site;

collecting, by one or more processors, for each of the one or more second webpages, second cookie data for the first unique user profile, the second cookie data being associated with a second plurality of cookies;

determining, by one or more processors, based on the first cookie data and the second cookie data, whether the first plurality of cookies contain one or more cookies that may contain personal data;

in response to determining that the first plurality of cookies contain one or more cookies that may contain personal data, generating, by one or more processors, a report identifying the first plurality of cookies; and

displaying, by one or more processors, the report to a site owner of the first website.

18. The computer-implemented data-processing method of claim 17, wherein determining whether the first plurality of cookies contain one or more cookies that may contain personal data comprises comparing the first cookie data to the second cookie data.

19. The computer-implemented data-processing method of claim 18, wherein:

the method further comprises;

creating, by one or more processors, a second unique user profile;

storing, by one or more processors, the second unique user profile in memory;

using, by one or more processors, the second unique user profile to access the one or more first webpages of the first website;

collecting, by one or more processors, for each of the one or more first webpages, third cookie data for the second unique user profile, the third cookie data being associated with a third plurality of cookies;

using, by one or more processors, the second unique user profile to access the one or more second webpages of the second website;

collecting, by one or more processors, for each of the one or more second webpages, fourth cookie data for the second unique user profile, the fourth cookie data being associated with a fourth plurality of cookies; and

determining, by one or more processors, based on the first cookie data, the second cookie data, the third cookie data, and the fourth cookie data, whether the first plurality of cookies contain one or more cookies that may contain personal data; and

determining whether the first plurality of cookies contain one or more cookies that may contain personal data comprises comparing the first cookie data, the second cookie data, the third cookie data, and the fourth cookie data with one another.

20. The computer-implemented data-processing method of claim 19, wherein determining whether the first plurality of cookies contain one or more cookies that may contain personal data comprises:

identifying a first cookie of the first plurality of cookies;

identifying a second cookie of the third plurality of cookies that corresponds to the first cookie;

determining whether the first cookie is unique to the first unique user profile; and

determining whether the second cookie is unique to the second unique user profile.