I think GDPR is more good than bad, but the author's example of surveillance capitalism is easily repeated on most EU news sites. Visit bild.de and watch the network inspector light up like a christmas tree. Do you really feel your privacy is being respected?

The 996 partners banner is just the piss take that supposedly makes this legal.

> It is also definitely true that the regulations are largely written by people who do not understand the tech

I kind of switched side on this after the silicon valley made it clear that they are in the king making business, and the kings they want are of the fascistic and not benevolent kind. Also, a big aspect of the "tech culture" (beyond the silicon valley itself) has been about focussing on what could be done rather than whether it should, and this "restraint" must come from "outside the tech bubble".

> Banner gets a lot of attention because of the never-ending annoyance it's causing. It's like being surprised that someone would care about something so small as a little rock in their shoe.

No one is surprised that anyone is annoyed by the banners. But it doesn’t make sense to be annoyed at the law¹ instead of the perpetrators. If someone is deliberately putting pebbles in your shoes you should get annoyed at the person doing it, not the pebble.

The GDPR doesn’t require websites to have those banners², nor do they require them to be annoying³. That’s a choice the websites make. Every time you are annoyed at the GDPR because of those banners, you have been manipulated by the website to be mad at the wrong thing.

Imagine restaurants are pissing in their soup. This has become so rampant that a law comes out saying that if you pee in soup, you must warn your customers and give them the option for a pee-free soup. Restaurant then start serving you soup but before letting you eat force you to unwrap hundreds of layers of cellophane. You get so mad at it, “I just want to eat my soup, I don’t care about the pee, what a stupid law”. You should instead be mad that they were pissing in your soup in the first place, and when you see a restaurant doing the cellophane shenanigan you should leave in search of another which doesn’t pee in your soup.

¹ Unless you are annoyed that it is too lenient and think there should’ve been no option at all and that data collection should’ve been outright forbidden, not given a “consent” option that is abused.

² You can choose to not disregard people’s privacy.

³ Quite the contrary, the law requires that rejection be as easy as acceptance.

The purpose of GDPR was never data protection or privacy. It was designed to legitimise data trade and give corporations legal basis for selling and processing the data where before that it was a grey area. If you look at it through that lens, it will make sense.

Regulators are just a potemkin village thing to make it look like the law is serving ordinary person.

You know GDPR is bad based on what it is

I disagree with several points, but you already made clear that you are right and I'm wrong, and so there's no point in debating anything. Must be nice to know everything

People are hating it untill goes abroad to the countries where no such regulations exists.

Like in Switzerland it's okay to charge double for the car insurance simply because you carry "unlucky" citizenship.

Or EU law about mandatory 14-day return policy for internet order. Ordered recently something in Switzerland and turns out it was a special sale where standard rules does not apply and items could not be returned.

Or mandatory USB-C charge socket. God bless EU regulations!

Especially Gruber is getting really tiresome. Almost devolving into a “look at them there fruity Yuropeeans with their healthcare and holidays”-level of tech commentary about any minor roadbump big-US-tech encounters in the EU.

I dunno, recently traveling through Europe I mentally “joined” the campaign by seeing the ridiculousness for myself.

I very much support their ideals and their people-centered mindset.

But in execution it’s that meme: US rocket lands in slow motion on reusable pad, Chinese rocket lands in slow motion on reusable pad, European hand in slow motion closes a water bottle cap that is permanently attached to the bottle and always hits you in the nose.

I made a physical product and upon learning European regulations, I quickly decided I was going to spend 0 time designing it for Europe.

If I made millions, sure, pay someone to figure it out.

But I was not going to waste design time early on.

I can't imagine how much this affects small business in Europe.

Are you sure about it?

In fact,eu commission and parliament are Meta's biggest political spenders in most EU countries.

https://www.facebook.com/ads/library/report/?source=onboardi...

Personally i find this type of knee-jerk reaction to any discussion about the EU suspicious

Maybe it’s all a misinformation campaign… or maybe even people who live in, recognise and benefit from the good sides of the European experience, can also legitimately criticise bad aspects? It’s not binary - there are shades of grey.

There are many powerful actors in whose interests it is to spread FUD about the EU, and none of those entities have the average citizen’s best interests in mind.

I'm a European citizen. I hate the EU.

I mean this isn't some hidden agenda. The Heritage Foundation has an active plan to dismantle the EU from within.

Yeah but don't tobacco control advocates want to kill the tobacco industry? We don't want to kill the tech industry - surely the tech industry's pain is widely felt sometimes.

Well, it's the cost of collecting data. A lot of businesses don't really need to collect data. It's only the cost of doing business if you are in the personal data business.

For example, a newspaper or a blog have absolutely no reason to produce a cookie banner.

TFA talks exclusively about being hated by the right people. If you are only hated by the right people (yes, I made an adjustment there), it's probalby not because you are a jerk. Come on.

google naggs you exactly once.

The cookie banners come from the earlier ePrivacy Directive, and while it was possible to comply by not storing cookies at all, if you want to store data on the user's browser you do need to get their consent, hence the cookie banner.

Even the EU's own government websites are polluted with the same cookie banners. Are they "maliciously compliant" with their own regulations? Are they trying to "undermine the regulation itself"?

https://european-union.europa.eu/

Everyone understands this, it doesn't matter.

I’ve posted this before. I was working on a website where we used a single cookie for an auth token, and we logged absolutely _everything_ on the server side (we didn’t sell it FWIW). When it came to publishing the site, we went to legal for our parent company and filled in their form. One question was “do you use cookies”, to which we answered truthfully. That site has a cookie banner, and absolutely 0 mention of the piles of telemetry we gathered.

The ePrivacy directive is a waste of time, money, attention and resources and I wish we spent that effort on complying with GDPR instead which is much much better.

It’s more specific than that: “You know x is good based on if the worst people hate it” which I agree with the author is an extremely useful argument.

While you might hate them, you don’t want your data to be removed from their systems. If you’re having a hard time accessing credit with them, imagine what happens when you try to access credit as a ghost.

It might have sounded clever but if you aren't concluding GDPR is good/bad based on what it is you are not reasonable.

>The problem is the major players aren't going to be European because it is no longer legal for EU companies to get started by doing what the US companies did to get started

essentially finding ways around the law and its spirit to screw people over and degrade the quality of life for the citizens to one's own benefit. Your edit pointing to Uber never working is pretty much making the case here.

> She had to go to Berlin data authority periodically and report status.

That seems more of a German bureaucracy thing rather than GDPR specifically.

The UK, which does still implement GDPR from its time as a member state, does not require this level of officiousness.

except the package law as it stands is going to force many small businesses to close because they can't afford the cost.

> the nag problem would have been solved simply and effectively with something like do-not-track header

You’ll be glad to know that the EU is working on a proposal to do just that. Look for EU Digital Omnibus article 88b.

You’ll also be unsurprised to know that companies like Google are already lobbying hard to prevent it.

The do-not-track header is a nice idea but could never have worked. The GDPR is based on the idea that you can only store certain data about users if you have their consent to do so. Bearing in mind that most users have no idea what a header is and no idea how to configure their browsers, a user simply not sending a particular header does not imply consent to store information beyond that which is absolutely necessary for use of the site.

I have relevant personal experience here:

At a previous job, I didn't have a company phone when I got set up, so when I signed up for a tool we all used, I used my real phone number. Unfortunately it was an American company, and from that day FOR YEARS I got spam calls, which I never got before.

I can't prove it was them, but it feels like I got too naive because there was never trouble giving my real number to services...

My employer's site has no banners, since we decided not to use any tracking.

We measure our success based on enquiries, orders and so on, not the number of hits to the website.

Shaka, when the walls fell.

I hate the banners and the ugliness too but they are designed precisely to do that, and adtech maneuvers to ensure the hate is directed at the wrong source - the lawmakers instead of the people doing all the spying.

GDPR 1.1 should address all that - no legitimate interest exclusion of any kind, ONE SINGLE CLICK to reject all, no witholding service at ANY degree unless consent is granted, a 3rd option (I offer to pay to not be tracked), and a mandatory disclaimer on the cookie banner saying in clear terms: "Tracking is spying. If we were not tracking you and invading your privacy, this banner would not be necessary at all". Maybe even revive the "do not track" header by mandating that websites react to it accordingly, obey it 100%, not even show a banner if the header already tells them what to do, and ask users if they want this set or not, without a default value which would give an excuse for complaint from the people spying on you.

The cookie banner isn't actually specified in gdpr, it was just how everyone else tried to build the solution to the problem at the last minute.

I remember thinking "ok once this hits an actual web spec, we should see this built into browsers, and sent as headers or something"

Nope

As someone who worked on GDPR compliance just last year, in a company that is deeply affected by it, no, it’s not that complicated.

I'm responsible for GDPR in a small European company that processes fairly sensitive data. It's not that complicated as people like you make it out to be - if you're willing to actually try to do the right thing.

>US companies like Meta or Google __LOVE__ GDPR

If that were the case they'd have spend money on supporting GDPR rather than sending armies of lobbyists to Brussels in an attempt to prevent it, or attempting to turn the US president in an attack dog on their behalf.

This generic libertarian talking point "companies love regulations!" is routinely disproved by how companies behave. As the article points out, you know what is good by who hates it.

Sure buddy. And it's all orchestrated by the Rothschilds, right?

> Who is wasting time defending it?

I do! It’s one of my favorite regulation ever. I find it very well researched and designed, in a world where it often feels we cannot change the status quo it’s really impressive that a community of countries as messy as the EU has been able to design, pass, and actually implemented such a complex and citizen-centered set of rules

The point of the article is not that banners are good; it’s that they would not be needed at all if websites didn’t share all the possible data about their users with hundreds of vendors.

Fun fact: the OP blog doesn’t display a GPDR banner.