Who cares? Those damn consent banners are ruining the web.
"Oh, you want us to tell people we're tracking them as a means to stop us tracking them? nah, lets just make the banner as obnoxious as possible so that they hate the banners- if we all do it, people will overturn the regulation"
The problem? Websites were not only ignoring it but using it as yet another tracking vector.
A browser implementing a cookie consent UI would not fully solve the problem because websites might still want to track you through other means (browser fingerprinting, server-side analytics, etc) and if they want to respect the regulation then they still need to ask for consent.
Why don't we have any browsers that aggressively deny and block tracking?
Oh right, the ad companies.
This would be like Go-Ahead-And-Try-Track-Me-I-Dare-You.
And according to the ico (https://ico.org.uk/for-organisations/guide-to-data-protectio...), the common click-this-button-to-get-through or do annoying things is not valid consent: "You may not rely on silence, inactivity, default settings, pre-ticked boxes or your general terms and conditions, or seek to take advantage of inertia, inattention or default bias in any other way.".
The reason why you don't want a specific technical provision in this law (and almost all laws) is that they get outdated in less than five years. For example, imagine a framework based on http-headers fixed in law. That would've made it (almost) impossible for google to introduce spdy in europe, since it isn't http. Or, more general, the EU initiative to use micro-usb connectors would have made the switch to usb-c impossible, if they were written into law. And that's a comparatively slow moving field, with a very specific applications (charging mobile phones).
We only we could be free to skip asking, right?
I think with tracking protection in modern browsers it should be absolutely fine to allow websites to store data in any possible way (cookies, local storage, websql etc)
I'm hoping the EU cracks down on dark pattern implementations, malicious compliance (as another comment mentioned) very likely goes against the spirit of the law. The ad-tech industry is quite powerful so I think this will drag on for a while.
While it drags out, I've been stubborn. Always refusing all cookies when I can't zap the cookie banner/blocker with uBlock. The most pain I can take is setting about 20 toggles. There are some implementations creating hundreds of lines of opt-outs, some where you have to opt-out vendor by vendor on their own website. Those are the ones where I close the page and forget about the content. It's not worth the hassle and my data.
I wasn't such an advocate for data privacy half a decade ago, I was aware about it and how it could be used, just had never seen it, not necessarily in action at the time, but being debated on corridors.
The unethical proposals I heard in meetings or by the coffee machines on how to extract/transform/identify through amassing data were quite alarming. Not because they were blatant bad but that the collective way of talking about it completely disregarded the end user.
GDPR really changed that talk internally, it's been a massive effort and a pain in the ass sometimes but I do value the spirit of it. Could it be the wrong approach? Or too heavy-handed? Misapplied? And so many other still unknown problems? Yes, I do think there are too much uncertainty in how this pans out on the long term. I do deeply appreciate the effort though from the EP and the EU in putting this into the public eye, we should have been having this discussion quite some years ago...
There are still tons of open questions and discussions to be had on data privacy laws, I feel the pain of having an increased workload because of it but it should become cost of business. Protection of your customers' data, its usage and their privacy should be a cost of business for companies depending on that. Level the game, create some mechanisms to help smaller companies be bootstrapped with this mindset and with guidelines and best practices for a quick ramp up.
It can be a cost of business for large enterprises, smaller companies might need help to not be overburden if these laws get too complex.
I don't think I'm too revolutionary.
If I'm not mistaken, if there isn't a big 'Refuse All' (non critical) button on the 1rst dashboard 'page', then that implementation is considered to be illegal by the GDPR ?