GDPR itself is quite a good law. It's implementation and enforcement are not.

E.g. the nag problem would have been solved simply and effectively with something like do-not-track header (probably as OS setting, as apps are often even worse than websites with tracking). Also enforcement of obvious violations taking years and years, especially against large corporations, means it's just violated all the time.

EU also failed to give good interpretation guidelines early on, causing massive piles of overjealous lawyer CYA red tape and just silly stuff like removing names from apartment buzzers.

▲

latexr a day ago | parent | next [-]

> the nag problem would have been solved simply and effectively with something like do-not-track header

You’ll be glad to know that the EU is working on a proposal to do just that. Look for EU Digital Omnibus article 88b.

You’ll also be unsurprised to know that companies like Google are already lobbying hard to prevent it.

▲

foldr 2 days ago | parent | prev [-]

The do-not-track header is a nice idea but could never have worked. The GDPR is based on the idea that you can only store certain data about users if you have their consent to do so. Bearing in mind that most users have no idea what a header is and no idea how to configure their browsers, a user simply not sending a particular header does not imply consent to store information beyond that which is absolutely necessary for use of the site.

▲

jampekka a day ago | parent [-]

Lack of do-not-track header is not a consent to track of course. It's just signaling non-consent.

▲

foldr a day ago | parent [-]

I take your point. It would be nice to have a header that effectively just automatically canceled all the consent pop ups for you. But there are still some issues.

1) You'd have to find a way of writing the regulations without baking in particular technical assumptions about the web. The current GDPR talks about general principles of consent and data processing, not the specifics of cookies, headers, etc.

2) People can change their minds or override their general preferences in specific instances. Just because someone has a default setting in their browser indicating that they don't want to accept tracking cookies doesn't necessarily mean that they won't want to allow your site to store more data about them. So it is still legitimate for sites to ask them the question – and then you're back to the pop ups.

▲

jampekka a day ago | parent [-]

1) is not a problem. This is actually already defined technology neutrally in GDPR: "the data subject may exercise his or her right to object by automated means using technical specifications". For specific implementations the law can defer to e.g. standards, as is also very common in legislation.

In general defining laws technology neutrally is bread and butter of legislation, there are just a lot of misconceptions that laws are about specific techniques.

2) you can easily make a non-intrusive UI for that.

	▲	foldr a day ago \| parent [-]
		Yes, you can make a non-intrusive UI for that. Indeed, website creators can do that right now, with existing technology and compliant with the GDPR as-is. The question is how do you prevent the annoying UX without making overly technology-specific rules. Just adding a do-not-track header does not stop websites from ignoring the header and showing a pop up to ask you if you want to override your default settings.