> In fact the law pretty explicitly disallows dark patterns like that.

Yes. For "cookie banners" the law in fact forbids hiding "Reject all non-essential and continue" to be given less visual weight than "Accept all and continue", let alone hiding it behind "More details" or other additional steps.

It also requires consent to be informed (i.e. you need to know what you're agreeing to) and specific (i.e. you can't give blanket consent, the actual categories of data and purposes of collection need to be spelled out) and easily revokable (which is almost never the case - most sites provide no direct access to review your options later once you've "opted in").

One good example I can think of for a "cookie banner" that gets this right is the WordPress plugin from DevOwl: https://devowl.io/wordpress-real-cookie-banner/ (this is not an ad, but this is the one I've been recommending to people after having tried several of them) because it actually adds links to the footer that let you review and change your consent afterwards.

EDIT: Sorry, I first misread "disallows" as "allows". I've amended my reply accordingly.

Yeah, and only when (I think) Google got a hefty fine did the banner implementations start to add an instant "opt-out" button. The tech companies really try to skirt the rules as closely as possible.

I'm glad I'm not in EU legal, it's gotta be like dealing with internet trolls ("I didn't ACTUALLY break any rules because your rules don't say I can't use the word "fhtagn"")

The #1 problem with the cookie law is that it's not enforced.

Start fining sites with dark pattern banners and they'll start going away.

Yes, this sounds good. This sounds like something desirable. I mean, this is the expectation literally everywhere else so... why not the web?

Also, data collection is fully a choice. You can always choose not to. I've built websites with logins and everything and guess what - no cookie banners necessary. Just don't collect data you don't need.

> GDPR requires informed consent before collecting data.

And this is a good thing, no? I certainly think so.

> It's a wonder we don't have to force everyone through an interstitial consent page.

If the information being tracked is truly essential to the site/app (session management and authorisation data for instance) then no consent is needed, for anything else ask before you store it, and most certainly ask before you share it with your “partners” or anyone else.

> Many websites are free because they survive from ads. Ads make more money if you collect data.

My business is to get money out of other people's wallets and bank accounts. I could get make much money if you just logged into your bank account and approved transactions whenever I told you to, or screamed less whenever I took the wallet out of your pocket on my own.

That there's a way to earn more money does not justify it as legitimate thing to do, and if you can't figure out how to run a service in legitimate ways does not mean that illegitimate ways that attempt to violate its users in secret suddenly become okay.

> First, this regulation hurts all the small websites that need to exist in order for we have to have a healthy "web."

there is nothing healthy about force-feeding ads optimized via collected data.

In some cases is how I would state it. It's actually very rare that you have to consent to 'accept all cookies' to read content, I've never actually seen it myself. 'Pay if you want to read more' is common, for certain types of sites.

> Yep, it baffles me that a lot of people would rather not have the option to reject cookies.

Back in the day browsers offered this natively. When the advertising companies started building browsers there was a lot of incentive to see that go by the wayside of course...

But the earlier comment isn't saying that you shouldn't have options, rather that the law needs to be more specific, such as requiring browsers to work in coordination with website operators to provide a unified solution that is agreeable to users instead of leaving it completely wide open to malicious compliance.

These kind of laws need to be careful to not stifle true innovation, so it is understandable why it wanted to remain wide open at the onset. But, now that we're in the thick of it, maybe there is a point where we can agree that popup dialogs that are purposefully designed to be annoying are in volition of the spirit and that the law should be amended to force a better solution?

Seems like it's working then? Because the website chose to (optionally) track you, you need to go through a minor annoyance to accept it. You're effectively making a choice that you're fine with this annoyance (since you keep using the website) and since you're accepting it, you're fine with being tracked.

Other people already get two choices to make here which they didn't get before, which is a win in my book. Seeing the banner, you can decide to avoid the website and if you still wanna use the website, you can chose if you allow them to track you by PII or not.

Try UBlock Origin. It blocks stupid banners just fine. And it doesn't mean that you give your consent.

You should understand that the law doesn't mandate the cookie popup to be annoying. It's a deliberate choice of websites, they want you to hate the banner and the law.

Always remember it is the web site owner who chose to waste your time.

The more obnoxious the cookie banner, the quicker you can conclude "I didn't really need to visit your site anyway".

Most probably magnitudes less than those wasted on advertisement and the resulting unnecessary purchases.

Under German law, the BGB (Bürgerliches Gesetzbuch, German civil law book defining most private laws) provides very specific and concrete provisions for liabilities and duties in most business transactions and commercial exchanges of goods and services and even employment. It's not necessary to agree to formal contractual obligations in writing for most service agreements unless you want to add additional obligations or explicitly waive ones prescribed by the BGB (and some in fact can't be waived or not entirely) - if you can prove an agreement was made that falls under the BGB's laws, those laws apply to it regardless of the existence of a written and signed contract. And yet it's extremely uncommon not to have a written contract for serious business relations and most contracts explicitly insist on signatures (in fact in German contract law, the legal phrase "in Schriftform", literally "in writing", is defined in such a way it specifically requires a document signed by both parties whereas for "in Textform", literally "in text", even an e-mail or text message would be sufficient).

It's not cookie banners that are wasting productivity, it's mutual distrust and the need to protect against it. "Cookie banners" (or more correctly: consent forms) are legal contracts. The reason they are often so annoying to navigate is that the companies that built them want to try to trick you into agreeing to things you have no interest in agreeing to or might even have an interest in not agreeing to. Technically the law forbids this but it's still more profitable to risk the fine than to abide by the law.

Or to put it another way: there's no honest reason to require a consent form to let you read an article. The consent form isn't for reading the article, it's for what the site wants to do to you (or your data - which includes all data collected about you because the GDPR defines that as being yours, too) while you're reading the article.

The GDPR doesn't make you waste time on cookie banners. The GDPR grants you ownership of all personally identifiable information of you and about you - it creates legal rights and protections you previously didn't have. Cookie banners exist because companies want to infringe upon those rights. Most cookie banners are difficult to navigate because most companies don't want you to understand what you're agreeing to (and on second order because they want you to blame the law granting you rights rather than them for infringing upon those rights).

I know it'll be considered a hot take, but I'd argue that people don't even know what "tracking" in the Internet context even means enough for their supposed "preferences" about it to be valid.

90% of non-tech-nerds have this simple of an opinion about it:

1. Retargeting ads are "creepy" because ... "they just are"

2. Retargeting ads either annoy me because I think they're dumb in that particular instance ("I already BOUGHT a phone case last week, it's so dumb that it keeps showing me phone cases all day!") or because they're too good ("I gave in and bought the juicer after I kept seeing those ads all around the web") and I don't like spending money.

The rest of "tracking" they don't even know anything about and can't verifiably point to any harms.

Data brokers acquire data from thousands of different sources - many of which aren't stemming from Internet usage - and most of the browser data relevant here isn't tied to their actual name and permanent identity (and doesn't need to be to serve its purpose which is usually "to show relevant ads" and the more specific case of "to get people to come back and buy things they saw").

Honestly, just like people are annoyed by pushy car salesmen, and being asked for a "tip" at a self-order kiosk counter-service restaurant, they are going to be annoyed about aspects of the commercial Internet, and it doesn't automatically mean that they're being victimized or that they need regulations to try to help.

> By any objective measure

Number of sites using google analytics on my browsing session with my consent has gone down

Very little? The norm used be to slap google analytics on everything. Suddenly everybody thinks about compliance — especially those who didn't even have idea there was something wrong.

Many sites ditched tracking altogether so they don't have to have banners. Everybody is aware of GDPR so you can be pretty confident that when european site has no banner it doesn't track you.

Could the law be better? Sure I would love to ban tracking altogether. But this was lobbied to hell by AD companies. Everybody was kicking and screaming because they want all the data. And we still got something that helps. That is a win.

And you can see how industry hates it in way they implement the banners. It is annoying and confusing on purpose. You could comply in nice way but when you need to share the data with your 141 ad partners and each one gets their own checkbox… good luck.

Same reason nobody was respecting the dont track me flag. The industry is absolutely and exclusively to blame here.

Have you seen the 300 individual checkboxes you need to disable? Or the hoops that the advertising industry went through to claim that “Do-Not-Track” didn’t count for:

> In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02...

Article 4, Section 21.5

The malicious compliance is more that they all refused to add the one-click opt-out until a high-profile enforcement against Google brought them to heel.

The "malicious" compliance came from the trick that accepting / opting-in was fast and almost instant, but rejecting / opting-out was a slow and arduous process, and it required lawsuits and fines [0] for companies to comply.

I found a website that lists all fines handed out for violating the GDPR: [1]

[0] Google fined €325 million by French CNIL for placing cookies without consent https://www.cnil.fr/en/cookies-and-advertisements-inserted-b...

[1] https://www.dsgvo-portal.de/gdpr-fines/gdpr-fine-against-goo...

It’s because those were made to be bad solution by very advertising companies wanting people to be denied their rights and making it look like law is bad instead of implementation being bad

> They're honor system, which is dumb when you could have browsers not send that data back without opt-in.

Given that there is no objective way to differentiate between functional and tracking cookies, your "technical" solution would also boil down to honoring marking certain cookies as such by the website owner, effectively being the same as what we have today.

(Though I do agree that the UX would be nicer this way)

The EU law is good for consumers & bad for advertising companies. In response to this, advertising companies have made the web a significantly worse user experience.

You can reasonably argue that if the EU had not taken action to reduce advertising companies' ability to abuse customer rights, then advertising companies would not have retaliated, & therefore the web would be a less annoying experience. You cannot reasonably argue though that this is some isolated one-sided situation where ad companies are devoid of culpability.

Your entire comment essentially amounts to ignoring an elephant in the room to sell a narrative that one "side" bears 100% of responsibility for the outcome.

They don't even have to reply, just make a note on your footer or something or have a page you can link to that explains it. I've done this before

For that specific question, none; I'm extrapolating from past experience, mostly not mine but other people's (who told me stories).

For regulators in general doing dumb things? Lots and lots of examples all over the place. Talk to any small-business owners you know, get them drunk, and encourage them to rant. You'll hear some stories.

Doesn’t usually go over well with regulators. If they have to prove their site is fully compliant in court it would become mighty expensive to do so.

So, cookie banner it is.

There's a general principal in regulated businesses that it's best to be above suspicion and below the radar at all times. You don't want to give regulators or opponents (such as competitors or advocacy groups) any ammunition.

This is how you minimize headaches and your legal bill. And on the day that people come after you for some unforeseeable tragedy or perhaps genuine wrongdoing (covered up by unscrupulous employees or less-than-honest vendors), you'll be better positioned to deflect legal repercussions and bad press.

The unnecessary cookie banner is a no-brainer: it costs you nothing and poses but a minimal irritant to users.

They are not forced to use banners, they are forced to get explicit opt-in permission before tracking users, which can be done in non-obtrusive ways.

Cookies are the easiest way to keep track of a user, but if browsers regularly stop sending cookies then website operators will just find another method to fingerprint users and then we're back to square one with the law still requiring publishers to receive opt-in approval, but with no requirements on how.