It's obviously against the spirit of the law to have 200 different boxes that must be individually unticked, or the sort of nonsense that Oracle were pulling a while back (maybe still do) with the intentional delay spinner if you don't 'opt-in'.
To quote:
"Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history) or cookies used by a website to count the number of visitors."
Source: https://ec.europa.eu/digital-single-market/en/proposal-epriv...
So... maybe you should go back in time and tell the EU back at the turn of the millennium that...
People say that DNT failed because it was selected by default - but no, it failed because compliance was voluntary. The EU principles require explicit opt-in confirmation, so a browser setting that's set to "not track" by default is a reasonable way to do it, it only needs enforcement to ensure that websites (in EU jurisdiction) treat the DNT header as binding instruction to not track that user.
One of them would be to make browsers responsible for providing sensible defaults. And while the public perception might think the webpages are at fault it was the browsers that were responsible for storing and broadcasting private data. Arguably without clear and informed consent.
Of course there are problems with requiring software to have sensible default settings, but I reckon most problems with any legislation are due to the fact that none of them address the fact that cookies are a perfectly private system (with the user in full control of their own data) provided browsers don't send this data with every request without permission.
There was definitely a prior movement to push these cookie consent settings down to the browser (where I think they have the most chance of being respectful of the user and their consent choices) - but the situation changed later during subsequent ePrivacy regulation drafts.
Please voice your concerns with your MEP if you can - displays of support can and will change policy directions.
> It shall be as easy to withdraw as to give consent.
Is consent given by agreeing to a huge banner that pops up anew every time you load the page?
Fine, you can do that, but then you have to pop up a huge "withdraw consent" banner every time a user that gave consent visits your site. Which you probably don't want, so you can't do the obnoxious opt-in banner either.
In practice, that would make any obnoxious way to ask for consent untenable, because you couldn't use it to annoy users into consenting (and staying in consenting state).
(I'm wondering if they're teaching me to hit the de-emphasised button by default.)
If you can't run a website without literally violating the users basic human rights, then just don't.
Certainly the bar owner cannot distribute the videos without explicit consent. And yes, that can be problematic in many cases (for examples, capturing faces of people in a concert).
If a shopping center would want to distribute surveillance camera data to 'trusted partners' for marketing research without informed consent of the customers, that would definitely be a GDPR violation, and there would not be a "if you don't like it then don't go to that supermarket" situation but "if your supermarket can't survive without that income, then tough luck".
Correct, and thankfully website operators don't get the choice to violate users privacy without consent.
When you give up a small piece of seemingly insignificant data about yourself a million times per year, the aggregate is wildly more significant than the sum of those pieces. When you and everyone you know give up the aggregate of each persons aggregate information, again, its value is compounded. Finally, since no one has any insight into nor control over where their data ends up or how it's used down the road, the danger of sharing is even less evident.
Good can and does come from transparency, but this is one-way transparency. It's top-down and is begging for abuse. If we had a truly voter-representative government, it would have already created laws to mitigate the easy-to-anticipate problems that arise from massive accumulations of personal information, and we would no doubt have a better, if less profitable, WWW as a result.
Start from the top of the list every month, and slap any continued violator with 10x the previous fine. Go as far as time allows within the month.
I bet by the start of month 3, 90% of the sites would be compliant instead of 99% of them blatantly violating the rules.