HADE DU ÄTIT KAKAN OM DU INTE VISSTE VAD SOM VAR I DEN? En kvalitativ studie om studenters kunskap, tillit och hantering av cookie-samtycken på nätet

Abstract

Today, almost every visit to a website starts with a choice. Before users can read news, shop, search for information or use a service, they are often asked to accept, reject or change cookie settings. These choices may seem small and quick, but they are connected to larger questions about personal privacy, trust and control over personal data. This study examines how Swedish students relate to personal privacy online, with a special focus on cookie consent. The aim is to understand how students handle cookie banners on different types of websites, how they reason about privacy and trust, and what knowledge they have about data collection. The study is based on three research questions: how students handle cookie consent on different websites, how they reason about privacy and trust online, and what knowledge they have about the meaning and consequences of sharing personal data. The study is based on two theories: Privacy Paradox and Bounded Rationality. Privacy Paradox is used to understand the difference between what students say about privacy and how they actually act when faced with a cookie banner. Bounded Rationality is used to understand why students may make quick decisions even if they care about privacy. In these situations, students may have limited time, limited knowledge and limited energy to read and understand all the information. The study uses a qualitative method. We combined observations with semi-structured interviews. The observations were done first, so that we could see how the participants acted before they knew that cookies were the main focus of the study. After the observation, the participants were informed about the specific focus and were interviewed about their choices, thoughts and knowledge. The material consists of observations and interviews with 13 students in Gothenburg. During the observation, the participants visited five websites: 1177, Swedbank, Apoteket, Göteborgs-Posten and Temu. These websites were chosen because they represent different types of actors, such as public, financial, Swedish commercial and international commercial websites. The result shows that students often handle cookie consent quickly and routinely. In the observation, “accept all” was the most common choice. Many participants described cookie banners as something they wanted to get past in order to reach the website. This means that cookie consent was often not treated as an active privacy decision, but more as an obstacle. Several participants also said that they care about personal privacy, but their actions did not always match this. This shows a gap between what they value and how they actually act in the moment. Trust was also important in the participants reasoning. Swedish and public websites, such as 1177, were often seen as more trustworthy. Commercial and international websites, especially Temu, created more uncertainty. The participants often connected trust to the purpose of the website, where public and socially useful websites felt safer than websites that were mainly focused on selling products. At the same time, trust did not always decide how the participants acted. Some participants talked about different levels of trust in different websites, but still made similar cookie choices in the observation. The study also shows that the participants had some general knowledge about cookies. Most participants understood that cookies are connected to tracking, data collection and personalised content. However, many were unsure about what different cookie choices actually meant, for example the difference between accepting all cookies, rejecting cookies or accepting only necessary cookies. This means that they often knew that data was being collected, but not exactly what they were agreeing to. Another important result is that cookie banners often created tiredness or frustration. Some participants said that there is too much information to read and that it takes too much energy to make an informed choice every time. Others described a feeling that their personal data is already available online, which made individual cookie choices feel less important. This can help explain why students sometimes accept cookies even when they say that privacy matters to them. The conclusion of the study is that students cookie choices are shaped by several factors at the same time. Knowledge, trust, design, habit and the desire to quickly access the website all affect how students act. The study shows that cookie consent is often not a fully informed and well thought out decision. Instead, it becomes part of everyday internet use, where students often click quickly even if they care about personal privacy. This means that the problem is not only that students lack knowledge, but also that the situation makes it difficult to use the knowledge they have. Because the study is based on 13 students in Gothenburg, the result cannot be generalised to all Swedish students. However, the study gives a deeper understanding of how cookie consent can work in practice among students. Future research could study whether clearer and shorter cookie information would make users more aware of their choices. It could also examine whether more knowledge about cookies actually changes behaviour or if habit, trust and speed still matter more in the moment of decision.