What is in Your Cookie Box? Explaining Ingredients of Web Cookies with Knowledge Graphs

# Overall
This paper presents a set of contributions surrounding making cookies more transparent to the end-user: an ontology for cookies (called ontocookie), a kg for cookies, and a tool for visualizing cookie information (and an evaluation thereof).

This work is timely: of data privacy is an important, current problem and educating consumers / users to fight against surveillance capitalism is important.

To my knowledge, the work is also novel -- I know of no ontology for cookies and the related work is convincing in pointing out similar -- but distinct -- semantic web resources for this purpose.

In general, the quality of writing is good. I would carefully proofread for consistent use of the Oxford comma, comma splices, and ensure that a comma follows the use of every "e.g." and "i.e.".

The manuscript is organized around the contributions: the ontology, the KG, and the visualization. My concerns are as follows.

* The Ontology
The manuscript has not made a convincing case that an ontology is needed (beyond machine-interpretability). The ontology does not use any particularly rich semantics (only domain and range), acting more as a schema than something to aid in inference/reasoning. Are there functional relations, or existential?

I also am not sure exactly how well implemented this could be. For example, dates and times are implemented as classes, and there is no data property. What does the actual KG look like? I can't find a way to look at the exact triples being generated.

* The KG
Inline with above, there is no way to actually inspect the KG -- or it is not apparent in the github repository.

* The Tool and Evaluation
The link for openid generator does not work within the tool. (9/1/22 - ~17:00 EDT)

The results of the evaluation should be visualized in a table. The prose format was difficult to follow, or compare answers pre/post tool use.

The metrics evaluated in the tool do not seem to actually reasonably proxy the conclusion. Where did the 47.5% increase in caution come from?

Section 6 (conclusions) should be separated into a discussion of the results (i.e., discourse related to how the tool helped, etc., reasonable discussion of the effectiveness of the proxies), and actual a summary of the paper (conclusion)

Finally, it was not exactly clear to me why using an ontology and KG is useful or effective. In the most uncharitable case - this work could be replicated using ad-hoc json files and some python scripting. I would like to know why the (admittedly quite heavy) overhead of an ontology and triplestore (e.g., graphdb) is necessary for this.

It is this reviewer's opinion the paper would benefit from significantly extended discussion of the value that semantic web / knowledge graph technologies bring to the table, or how they enable significant added value in future work (i.e., that this is the foundation upon which future laurels may rest).

This paper introduces an approach for the very important problem of cookies and their management through semantic web techniques, and is quite relevant to the Special Issue on Interactive Semantic Web. The paper describes all the steps of the approach with details, performs a user-based evaluation, and provides links to the source code and to the web application. On the contrary, there are some parts that should be revised, such as to mention more clearly the novelty of the presented work, i.e., also in comparison with the related work, whereas more statistics and efficiency measurements can be added. For this reason, my suggestion is for major revision, since I believe that the changes and advances required can be resolved. More details are presented below.

Strong points
S1. An interactive web application for the very important issue of cookies and their management is presented by using semantic web technologies.
S2. A web application and the code is available online, whereas a new ontology the can be also important for other researchers has been released
S3. A user based evaluation has been performed and analyzed.

Weak Points
W1. Some sections, but especially the related work section, should be reorganized
W2. In some parts, more details should be provided, as it is mentioned below, e.g., novelty should be described in more details, and comparison with related work is missing
W3. Experiments including statistics and the efficiency of the presented workflow are missing.

Abstract & Introduction

The abstract is well described. Concerning the introduction, the motivation is well presented, i.e., the key problems that are related to cookies and privacy are discussed. On the contrary, in my opinion, the paragraph “The use of semantics, namely KGs … discussed in [22, 23]” should be moved to the related work section. Please try in the introduction to focus on motivation, contribution and novelty. In this way, provide more details about your contribution, and the novelty of your approach. For instance, you just mention “A cookie KG”, however more details should be included.

Related Work

The related work section is hard to follow, please provide different subsections, e.g., Cookies and Privacy, Cookies and Semantic Web solutions, visualizations etc. Moreover, you should place the presented work according to the related approaches, i.e., to describe more clearly your novelty, differences with these works, etc.

Section 3

This section presents the main methodology, my only comment is the following:
More details should be given for the following “Existing solutions for cookies (with and without the use of semantics) were also reviewed”, e.g., to mention in brief these solutions.

Section 4.

The ontology is well described, it reuses existing standards, and statistics are mentioned. Concerning 4.2, it could be interesting to provide the SPARQL queries that you use for the insert and the select case. Also, as I mention below, statistics about the number of triples and their creation/retrieval time are missing, and it would be good to provide both the mentioned statistics and the queries that are used.

Section 5.

Concerning the evaluation section, in my opinion several things are missing. I agree with the user based evaluation, however, it should be also good to provide statistics/metrics about the effectiveness and efficiency of the presented workflow of Fig. 3. For example, some ideas are listed below:
Number of triples per website/cookie type/etc
Execution time for insert/retrieve the data to/from your KG and for the whole workflow of Fig 3.
Regarding the user based evaluation, it is quite interesting and well presented.

Conclusion.

Please reorganize it, first describe in brief what you presented, then the evaluation results, and finally, the future work.

Additional issues

By trying to use the web app, I had two different errors.
a) i received a CORS policy error
b) By turning off CORS, i got the following error:
Failed to load resource: the server responded with a status of 503 (Service Unavailable) main.dart.js:33263 Uncaught TypeError: Cannot read properties of null (reading 'i')

Minor issues
emphasise → emphasize
higher level of → higher levels of
comprises of a → comprises a
indivdiuals’ → individuals’
a button that give →a button that gives
if agreed → if they agreed
of the the users willingness →of the users’ willingness

The paper presents and discusses a KG-based tool aiming to improve the awareness of web users with respect to the cookies installed on their devices.
The tool relies on the OntoCookie ontology and, by starting from it, it creates a KG and a custom viewer to ease the presentation of information to end-users.

The overall idea behind a tool like this is nice.
However, from both the scientific and technological perspectives the contribution of this manuscript seems poor.

First, concerning the semantic layer, which is the actual difference between the KG and the OntoCookie ontology?
They are presented as separate contributions, but from the paper, it is not clear how these two elements contribute to the work in two different ways.

Second, concerning the tool, it seems that the implementation "simply" instantiate the OntoCookie ontology with cookie's data but, besides a straightforward visualization, no further operations are performed of such data (e.g., reasoning).
Hence, it is unclear if such a tool is only a good exercise for adopting semantic technologies into a real-world use case, but without particular innovative aspects.
Indeed, the testing by considering only 4 websites is quite limited.
Moreover, using such well-know domains may lead to the guess that their cookies are also well-formed.
But, what would it happen if the tool would manage cookies from lesser-known websites?
Here, it would be interesting to observe if null nodes would be created in the knowledge graph and how user awareness may change.

Finally, the evaluation is appropriate and quite well-defined.