Content uploaded by Edward Melcer
Author content
All content in this area was uploaded by Edward Melcer on Nov 16, 2020
Content may be subject to copyright.
Cookie Mania: A Serious Game for Teaching
Internet Cookies to High School and College
Students
John Dominic S. Diez(B)and Edward F. Melcer(B)
University of California Santa Cruz, Santa Cruz, CA 95064, USA
{jdiez,eddie.melcer}@ucsc.edu
Abstract. Internet cookies are data storage tools that collect information from
a platform’s users to inform various aspects of the platform such as marketing
and recommendations systems. Notably, there is a lack of understanding around
what internet cookies are and how they work, which spans from adolescents to
adults. This can lead to major misunderstandings of how consenting information
works in online mediums, and results in negative outcomes and effects for users
by default. To help increase understanding of internet cookies and address these
issues, we have developed a serious game called Cookie Mania. Our game aims to
develop knowledge of internet cookies and related ethical issues through an inter-
active narrative, as well as foster additional engagement through cookie-focused
minigames. In this demonstration paper, we discuss the design and development
of Cookie Mania—highlighting how the various design choices target learning
objectives for internet cookies and their underlying ethical issues.
Keywords: Internet cookies ·Media literacy ·Ethics ·Interactive narrative ·
Game-based learning ·Serious game
1 Introduction
In this modern age, knowing how to use technologies such as computers and phones is
an essential skill. Individuals are now exposed to the internet at even younger ages [4,
30], and many begin interacting with smart phones and tablets from almost the moment
they are born [30]. For instance, approximately 85% of children under 6 use some sort
of technology device within the U.S [22]. With a growing dependence at younger ages
on such technologies comes a growing need to teach technology and media literacy,
especially with respect to internet cookies. Specifically, internet cookies are widely
misunderstood, and most individuals (from children to adult) do not fully understand
how they work or what they even do [21]. This is especially problematic for adolescents
and young adults since they are particularly susceptible to the erosion of privacy due to
social media and internet search engines [8,30].
Electronic supplementary material The online version of this chapter (https://doi.org/10.1007/
978-3-030-61814-8_5) contains supplementary material, which is available to authorized users.
© Springer Nature Switzerland AG 2020
M. Ma et al. (Eds.): JCSG 2020, LNCS 12434, pp. 69–77, 2020.
https://doi.org/10.1007/978-3-030-61814-8_5
70 J. D. S. Diez and E. F. Melcer
One tool which has been demonstrated to effectively enhance learning outcomes
of knowledge and ethical issues are serious games, especially ones that incorporate an
interactive narrative [2,20]. While there are serious games that teach important related
topics such as responsible conduct of research [20,21], social anxiety [26], and ethics
[9], to name a few, to our knowledge there has not been a game created to teach concepts
focusing on internet cookies. In this demonstration paper, we discuss the design of
Cookie Mania—a serious game created to develop knowledge of internet cookies and
underlying ethical issues through an interactive narrative.
2 Background
The origins of internet cookies date back to Lou Montello when he gave the internet
the ability to have a memory and coined the term “magic cookie” [5]. Magic Cookies
were small files that would track what a person’s computer did in a specific website
and allowed that information to be transferred from one computer to another, effectively
allowing memory and actions to be stored in a computer. However, these magic cookies
also resulted in newfound issues of privacy, secured information, and laws [18,25].
While the function of cookies today remains the same and can be utilized to provide the
convenience benefit of storing important information like passwords, preferred website
settings, and so forth, cookies still present huge problems of privacy and consent—
namely due to their ability to store sensitive information for a long period of time
without secure servers or proper protections [16,27].
While internet cookies may only have a simple function, their real dangers lie in
how companies utilize different forms of cookies and if/how users perceive this usage.
For instance, once individuals started deleting regular cookies from their browsers, flash
cookies were developed to maintain preferences such as volume and language while
being harder to delete [27]. However, these new cookies also enabled transfer of data
between websites with no expiration date. This in turn allowed more direct tracking of
users and the websites they visited, giving marketing companies access to even more
unprotected data for prediction and recommendation [4,8]. Unfortunately, many more
types of cookies and related tools (such as web beacons) have similarly been created
with good intentions, but are ultimately abused. E.g., in the case of web beacons, they
allow tracking of user interactions to improve website design [18], but this is done with
a severe lack of awareness from the user that their data is being collected [4,23,30].
Ultimately, criticisms of internet cookies have been brought up since their creation,
leading to studies highlighting their confusing nature to users [3,7,12] and loss of
privacy/internet protections [9,23,24]. These issues recently pushed the EU to pass
The General Data Protection Regulation (GDPR)—providing user protections through
consent or other specific exceptions [7,12]. Although this change was only done in
the EU, it has had a global impact due to most countries hosting websites that attract
EU users. However, even with these important steps towards properly informing and
protecting users, there is still a large majority of individuals who misunderstand cookies
as well as websites that make it difficult to protect personal data [17]. This led to the
development of our game in order to teach players how their data is collected/used.
Cookie Mania 71
3 Game Design
We developed Cookie Mania to focus not only on teaching players what internet cookies
are, but also how internet cookies are affecting their very lives. We do this through a linear
5-month storyline in which players become a website manager for a major technology
company. Throughout gameplay, players are introduced to several major NPC characters
which they can interact with through dialogue choices. Their interactions with these
NPCs contain both teaching moments and moral decisions that mirror ethical issues
which have arisen in the real world. This implementation of moral decision-making
is important in that it can increase engagement and retention [10,14,20], as well as
help players develop better moral reasoning and critical thinking skills [14,20,27,28,
31]. In between the segments of interactive narrative, learners will also play cookie-
based minigames designed to further increase player engagement and motivation. These
minigames act as set milestones throughout the narrative and are necessary to advance
the story.
3.1 Learning Outcomes
Based on the many ethical issues surrounding internet cookies as well as their current
applications and relevance, we determined 5 key learning outcomes that were critical
for players to learn through gameplay. Since the game covers a timeline of five months,
we have ordered these learning outcomes by the in-game month they are taught to the
player. These month-by-month progressions also allow us to make the storyline more
fluid, making the jumps between learning each outcome coherent within the storyline.
For example, by the time the player reaches to the final month where they learn how
to protect themselves and others with data consent, they would have experienced a data
breach, viruses, different types of cookies used by companies, and general knowledge
of how cookies are used in their everyday lives. The learning outcomes are as follows:
– (MONTH 1) Understand the definition of internet cookies and the different types of
cookies that are implemented within websites [1,28].
– (MONTH 2) Reinforce cookie knowledge by using real world context and scenarios
including laws and large events related to the topic [7,12].
– (MONTH 3) Help players understand how companies use different types of cookies
and how they work internally through basic lessons on ML, AI, and marketing [26].
– (MONTH 4) Teach players how cookies are related to virus and malware spread, as
well as how to prevent it [8,24,26].
– (MONTH 5) Provide players with real world actions and guidance for how to act
regarding sharing information to cookies and consenting to it [14,23].
3.2 Game Characteristics
From the beginning, we wanted to teach the learning outcomes through an interactive
narrative game. Prior work has suggested that effective ways to enable educational
games to address learning outcomes is the incorporation of a convincing and interactive
narrative [21], scaffolding and proximal growth for development [19], and also to appeal
72 J. D. S. Diez and E. F. Melcer
to players from different ethnic, social, and individual backgrounds [25]. The gameplay
loop for Cookie Mania draws from this, providing a linear story that spans 5 different
“months” (learning outcomes) with branching paths that change various dialogue as well
as the ending. After each month is completed in the narrative, the learner then plays a
minigame to unlock the next month. Each learning outcome will be taught through the
narrative, as well as through special events within the minigames.
Moral Choices. To tackle the interactive narrative portion, we have implemented ethi-
cal decision-making where parts of the game require players to make moral choices. This
is done to help players understand how cookies are utilized by companies/people and the
corresponding the results of these actions, e.g., [28,29,32]. These choices lead to dif-
ferent endings, but more importantly they demonstrate how such choices affect both the
consumer and the provider. This helps put more weight on player actions and can foster
further investment and care from the player towards the interactive narrative [23,27,31].
Table 1. A subset of the different types of cookies that appear in Cookie Mania.
Type of Cookie Function and implications
HTTP/Magic Cookie First iteration of internet cookies. Its main
function was to store units of information,
effectively providing the internet with
memory.
Flash Cookies Stored user preferences such as volume and
language but was harder to delete and more
permanent. Used by viruses and malware to
collect and steal data and hack into accounts.
Beacons
Tracks user interactions on websites. Very
subtle and the user is even more naïve in what
specifically is being collected.
Teaching Through Gameplay Representation. Enemies are specifically designed to
represent their corresponding internet cookie types visually. Table 1illustrates different
types of cookies taught in the game and their memorable visual representations. To
improve engagement and applicability to the real world [25], we made sure that the
events and moral choices within the game mirrored events that occurred in real life,
specifically focusing on different scandals from big tech companies’ problems with
cookie and recommendation algorithms. For example, Cambridge Analytica was a major
scandal in the United States where Facebook user’s data were taken without consent by
Cambridge Analytica, causing major discussions on privacy and user rights [30]. Using
this event, we implemented a storyline within the game that mimicked the events of
Cookie Mania 73
Cambridge Analytica, with moral decision making and repercussions for whether to
include consent at the player’s company.
Personalization. Serious and educational games need to be accessible to a range of
individuals [25], which is why we designed our game to make it adaptable to differ-
ent individuals and their skills/preferences in order to increase engagement and playa-
bility. Specifically, we used gender neutral language throughout the game, and also
included character and gameplay customization options to help players identify with
their character and the company (see Fig. 1)—as this can help maintain player motivation
[12].
Fig. 1. Screenshot of cookie customization screen. Players can customize their cookie character,
company name, and main art styles for development.
3.3 Gameplay
Office Scenes and Desktop Scenes. Players will go between two main game screens
during the game. One section will be in the offices (see Fig. 2), while the other will be in
the desktop scene where they would take on their role as a manager. While some learning
of different cookie types is implemented in the minigames, most moral decisions and
lessons will occur in these scenes through office dialogue and pop-up emails.
Fig. 2. The boss’s office (left) and the main office (right) represent the main story setting in which
the player interacts with other NPCs through dialogue to learn cookie related material.
74 J. D. S. Diez and E. F. Melcer
Minigames. The minigames provide extrinsic motivation to play the game and can be
selected through the Desktop scene (see Fig. 3). Most progression in Cookie Mania lies
with playing minigames multiple times, collecting points for upgrades and unlocking the
next month. Currently, there are two minigames that can be unlocked—i.e., the marketing
minigame and the security minigame. In the marketing minigame, players are instructed
to jump to different platforms to avoid malicious cookies and collect good ones for the
company. The collection of these cookies allows players to gain upgrades and improve
their website’s data collection. In the security minigame, players are instructed to protect
their customer’s data by destroying viruses and zombie cookies from reaching the data.
Destroying these enemies also yields points for upgrades.
Fig. 3. The figure represents the desktop “tab” in which players can collect resources by choosing
to play one of the two main video games. The Jumper game represents our marketing minigame
where players collect cookies to improve their website, while cyber defense represents security
for the website.
Analytics Page. The analytics page provides players with a growing knowledge set of
how cookies work and what they provide in the “website manager” context. The screen
visually shows how many websites use these cookies and what information they collect.
Upgrade System. Once players’ finish the minigames, they will have points that they
have accumulated to spend on upgrades. These upgrades improve gameplay throughout
the course of the game and add additional information to the analytics page. Both the
analytics page and upgrade system are designed to scaffold learning through the gradual
introduction of upgrades that match what is newly learned as the player progresses [19].
Email Tab. The email tab provides narrative related information and moral decision
making. Players can also use this tab to replay tutorials, reread specific events and
dialogue, or explore additional information on what they are learning in that month.
4 Conclusion and Future Work
Cookie Mania is a serious game created to develop knowledge of internet cookies and
underlying ethical issues through an interactive narrative. In this paper, we described
Cookie Mania 75
the design of Cookie Mania and its core target learning outcomes. While Cookie Mania
is still a work in progress game, we are close to completing it and conducting an initial
evaluation of its efficacy. Due to the nature of a 1-h game, players may not have a large
retention rate, so we hope to conduct a longitudinal study as well.
Acknowledgements. This research was supported in part by a CITRIS Tech for Social Good
award from CITRIS and the Banatao Institute. We also want to formally thank the team who is
continually working on Cookie Mania. This could not have been done without them:
Game Developers: Mia King, Matthew Stevens, Jacob Wynd
Researcher Assistants/Script Writers: Jacob Brinneman, Sanyukta Kamath Ahn-tu Pham
Artists: Cole Cota, Delong Du, Miriam Perez, Amber Vo
References
1. Cahn, A., Alfeld, S., Barford, P., Muthukrishnan, S.: An empirical study of web cookies. In:
Proceedings of the 25th International Conference on World Wide Web, WWW 2016, pp. 891–
901. International World Wide Web Conferences Steering Committee, Republic and Canton
of Geneva, Switzerland (2016). https://doi.org/10.1145/2872427.2882991
2. Camingue, J., Melcer, E.F., Carstensdottir, E.: A (Visual) novel route to learning: a taxonomy
of educational visual novels. In: Proceedings of the 15th International Conference on the
Foundations of Digital Games, FDG 2020, Malta. ACM (2020)
3. Abt, C.C.: Serious Games. The Viking Press, New York (1970)
4. Crocco, M.S., Segall, A., Halvorsen, A.-L., Stamm, A., Jacobsen, R.: “It’s not like they’re
selling your data to dangerous people”: internet privacy, teens, and (non-)controversial public
issues. J. Soc. Stud. Res. 44, 21–33 (2020). https://doi.org/10.1016/j.jssr.2019.09.004
5. Djaouti, D., Alvarez, J., Jessel, J.-P., Rampnoux, O.: Origins of serious games. In: Ma, M.,
Oikonomou, A., Jain, Lakhmi C. (eds.) Serious Games and Edutainment Applications, pp. 25–
43. Springer, London (2011). https://doi.org/10.1007/978-1-4471-2161-9_3
6. Englehardt, S., et al.: Cookies that give you away. In: Proceedings of the 24th International
Conference on World Wide Web - WWW 2015 (2015). https://doi.org/10.1145/2736277.274
1679
7. European Commission: Adequacy of the protection of personal data in non-EU countries
(2018). https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/ade
quacy-protection-personal-data-non-eu-countries_en
8. Ha, V., Inkpen, K., Shaar, F.A., Hdeib, L.: An examination of user perception and misconcep-
tion of internet cookies. In: CHI 2006 Extended Abstracts on Human Factors in Computing
Systems - CHI EA 2006. https://doi.org/10.1145/1125451.1125615
9. Hodhod, R., Kudenko, D., Cairns, P.: AEINS: adaptive educational interactive narrative sys-
tem to teach ethics. In: AIED 2009: 14 th International Conference on Artificial Intelligence
in Education Workshops Proceedings, p. 79 (2009)
10. Holl, E., Bernard, S., Melzer, A.: Moral decision-making in video games: a focus group study
on player perceptions. Hum. Behav. Emer. Technol. 2, 278–287 (2020). https://doi.org/10.
1002/hbe2.189
11. Homer, B.D., et al.: Moved to learn: the effects of interactivity in a Kinect-based literacy
game for beginning readers. Comput. Educ. 74, 37–49 (2014). https://doi.org/10.1016/j.com
pedu.2014.01.007
12. International dimension of data protection. In: European Commission - European Commis-
sion. https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-
protection_en. Accessed 7 July 2020
76 J. D. S. Diez and E. F. Melcer
13. Isbister, K., Schwekendiek, U., Frye, J.: Wriggle: an exploration of emotional and social
effects of movement. In: CHI 2011 Extended Abstracts on Human Factors in Computing
Systems, pp. 1885–1890. ACM, May 2011
14. Khoo, A.: Video games as moral educators? Asia Pacific J. Educ. 32, 416–429 (2012). https://
doi.org/10.1080/02188791.2012.738638
15. Kim, N.Y.: The effect of ad customization and ad variation on internet users’ perceptions
of forced multiple advertising exposures and attitudes. J. Interact. Advert. 18, 15–27 (2018).
https://doi.org/10.1080/15252019.2018.1460225
16. Kulyk, O., Hilt, A., Gerber, N., Volkamer, M.: “This Website Uses Cookies”: users’ per-
ceptions and reactions to the cookie disclaimer. In: Proceedings 3rd European Workshop on
Usable Secur. (2018). https://doi.org/10.14722/eurousec.2018.23012
17. Lomas, N.: Europe’s top court says active consent is needed for tracking cookies. In:
TechCrunch (2019). https://techcrunch.com/2019/10/01/europes-top-court-says-active-con
sent-is-needed-for-tracking-cookies/. Accessed 7 July 2020
18. Martin, D., Wu, H., Alsaid, A.: Hidden surveillance by Web sites. Commun. ACM 46, 258
(2003). https://doi.org/10.1145/953460.953509
19. Mayer, R.E.: Computer Games for Learning: An Evidence-Based Approach. MIT Press,
Cambridge (2014)
20. Melcer, E.F., et al.: Getting academical: a choice-based interactive storytelling game for
teaching responsible conduct of research. In: Proceedings of the 15th International Conference
on the Foundations of Digital Games. FDG 2020, Malta. ACM (2020)
21. Melcer, E.F., et al.: Teaching responsible conduct of research through an interactive sto-
rytelling game. In: Extended Abstracts of the 2020 CHI Conference on Human Factors in
Computing Systems (2020). https://doi.org/10.1145/3334480.3382973
22. New Research from the TEC Center at Erikson Institute • TEC Center. In: TEC Center. https://
teccenter.erikson.edu/publications/tec-parent-survey/. Accessed 6 July 2020
23. Peacock, S.E.: How web tracking changes user agency in the age of Big Data: the used user.
Big Data Soc. (2014). https://doi.org/10.1177/2053951714564228
24. Pierson, J., Heyman, R.: Social media and cookies: challenges for online privacy. Info 13,
30–42 (2011). https://doi.org/10.1108/14636691111174243
25. Plass, J., Homer, B., Kinzer, C.: Playful Learning: An Integrated Design Framework (2014).
https://doi.org/10.13140/2.1.4175.6969
26. Sanchez, A.Y.R., Kunze, K.: Flair: towards a therapeutic serious game for social anxiety disor-
der. In: Proceedings of the 2018 ACM International Joint Conference and 2018 International
Symposium on Pervasive and Ubiquitous Computing and Wearable Computers - UbiComp
2018 (2018). https://doi.org/10.1145/3267305.3267558
27. Schmaling, K.B., Blume, A.W.: Ethics instruction increases graduate students’ responsible
conduct of research knowledge but not moral reasoning. Accountabil. Res. 16, 268–283
(2009). https://doi.org/10.1080/08989620903190323
28. Schrier, K.: Designing games for moral learning and knowledge building. Games Cult. 14,
306–343 (2017). https://doi.org/10.1177/1555412017711514
29. Sipior, J.C., Ward, B.T., Mendoza, R.A.: Online privacy concerns associated with cookies,
flash cookies, and web beacons. J. Internet Commerce 10, 1–16 (2011). https://doi.org/10.
1080/15332861.2011.558454
30. Schwartz, J.: Giving web a memory cost its users privacy. In: The New York
Times (2001). https://www.nytimes.com/2001/09/04/business/giving-web-a-memory-cost-
its-users-privacy.html. Accessed 7 Jul 2020
31. Staines, D.: Videogames and moral pedagogy. Advances in Game-Based Learning Ethics and
Game Design 35–51 (2010). https://doi.org/10.4018/978-1-61520-845-6.ch003
Cookie Mania 77
32. Stephen, C., Edwards, S.: Digital technology use and uptake by young children. Young chil-
dren playing and learning in a digital age, pp. 95–108 (2017). https://doi.org/10.4324/978131
5623092-9
33. Wong, J.C., Lewis, P., Davies, H.: How academic at centre of Facebook scandal tried – and
failed – to spin personal data into gold. In: The Guardian. https://www.theguardian.com/
news/2018/apr/24/aleksandr-kogan-cambridge-analytica-facebook-data-business-ventures.
Accessed 12 July 2020
