> “cookie consent” pop-ups are stupid and pointless. Pop-ups do not improve privacy, and they make the web worse.
GDPR is not about cookies or consent popups. Even the previous directive from 2011, known as the "cookie law", wasn't about cookies or consent popups.
Both laws are about tracking (GDPR also covers personal data in a broader sense).
Developers are completely free to use cookies, or any other technology, in order to implement their sites. GDPR and the "cookie law" don't care about that.
What they do care about is the purpose of what's been implemented. If it's something that the user wanted, by virtue of visiting the site, e.g. the ecommerce features of an online shop, then that's fine. Use cookies for your shopping carts, use local storage for your word processor's undo, use Flash supercookies for your game's high scores, whatever.
If the functionality is not something that the user wanted, i.e. they could achieve what they want (buying stuff, editing documents, playing a game) without that functionality, then that functionality is forbidden to use personal data (like tracking the user's activity) unless explicit opt-in consent is given. Again, it doesn't matter how that functionality is implemented: 1x1 images, iframes, local storage, browser fingerprinting, or cookies.
If you find cookie consent popups annoying, don't blame GDPR, the EU, etc. Blame the site, since either:
- It doesn't need to ask, since its functionality is wanted by the user.
- The developers wanted to do shady stuff so much, that they were willing to ruin their site's UX.