Hacker News Reader

> I see and hear of GDPR violations everywhere

The legal follow-up could be better. The exacted fines should actually follow the law instead of being softened. With at least 4% of gross revenue in every instance, it would have bite and act to curb the excesses, thereby tackling the root problem. After all, it was never meant to outlaw data collection, just excessive surveillance.

> The annoying cookie banners

The GDPR isn't unclear about what companies can collect, what consent should be asked and how. Those banners are malicious compliance or non-compliance. They're purposefully built that way to get you as a potential consumer riled up about the regulation. And it's working: instead of talking about the companies trying to abuse your data and implementing horrible popups that don't do what the law says they should, you're now upset at the regulators. Classic case of "Don't like what they're saying? Change the narrative".

> And it's working: instead of talking about the companies trying to abuse your data and implementing horrible popups that don't do what the law says they should, you're now upset at the regulators.

Actually I'm upset at both the companies using dark patterns and the horribly designed cookie regulations.

What is horrible about the design of the cookie regulation?

> I see and hear of GDPR violations everywhere (here in the UK, pre and post Brexit). Despite the threat of legal action, companies still ignore (too small to care) or are ignorant of the rules.

It was wild west before GDPR, it takes time for companies and attitudes to adjust. And that adjustment is ongoing. Every fine helps; it results in increasing compliance. Give it a few years, wild west won't be so wild anymore. I'm sure you'll still find lots of smaller companies that didn't get the memo but the likelihood that your daily activities involve entities that violate your privacy left and right is getting lower and lower.

> The annoying cookie banners where everyone just clicks "accept all" because no one wants to go through a list of checkboxes. This is classic EU strategy to problems

Annoying banners are not EU strategy, they are strategy by companies who want to violate your rights and annoy you until you consent. The regulators are aware of this problem and I believe it's being worked on.

The DSA proposal discussed in the article includes additional regulation against dark patterns and there's this little bit: > In order to avoid fatiguing recipients who refuse to consent, terminal equipment settings that signal an objection to processing of personal data should be respected.

I have no idea if it's going to work out but this would make something like Do Not Track legally binding. I very much support this bit, because I hate annoying consent nags as much as you do..

> I see and hear of GDPR violations everywhere (here in the UK, pre and post Brexit). Despite the threat of legal action, companies still ignore (too small to care) or are ignorant of the rules. At the end of the day, Big Tech still owns all the personal data in some way or another getting around EU restrictions.

Companies may ignore law, but fines are being issued, so they do it at their own risk: https://www.enforcementtracker.com/

> The annoying cookie banners where everyone just clicks "accept all" because no one wants to go through a list of checkboxes. This is classic EU strategy to problems: just throw more bureaucracy and administration at a problem.

These cookie banners are (slowly) being deemed illegal: "Accept all" and "Reject all" must have the same prominence and accessibility. GDPR is forcing companies to care about security and about how they use information about their users and, probably for the first time, it's forcing companies to be transparent with how they are processing their users' data. And it's not requiring company to do anything you wouldn't expect an honest person to do when you give them some personal information, it's not just throwing bureaucracy at a problem.