I wish people would stop confusing cookie-consent laws and GDPR. They are quite distinct laws and are giving GDPR a bad rap for wholly the wrong reasons.
I wish (computer-savvy) people would stop talking about "cookie laws" altogether, since there's no such thing.
When people say "the cookie law", they're usually referring to two EU regulations:
- PECD: https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...
- GDPR: https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
However, neither of these is a "cookie law". In particular:
- The laws cover much more than "cookies"; e.g. they're just as applicable to browser fingerprinting, Flash "supercookies", etc.
- Cookies which perform a requested job have implied consent: users visit an online store because they want to use the shopping cart functionality; if they don't agree to having a shopping cart cookie, they can leave the online store. (In contrast, users don't visit online stores in order to be tracked by advertisers; so separate, explicit consent is required)
Or even better, make the form automatically recognizable by your browser and a setting in the browser so that it says yes or no for you.
Have you ever notices that the "yes I agree" button is most of the time MUCH easier to click on than to tell "no I don't" ?
That's illegal under GDPR. Yet here we are.
The follow-up privacy legislation also bans the current dark pattern of making the "accept all" button more prominent and obvious than "decline all" at least requiring both to be equally prominent. The flow of having to go through "manage" or "see options" or other shenanigans as links in order to decline all has always been in violation of the GDPR and could theoretically open you up to the fines as it demonstrates intent.
"But we want to show you ads to finance our website and our advertising partners want to abuse your privacy" is not a legitimate interest.
Informed consent about cookies was a law that predated the GDPR.
The consent boxes only got worse because, with GDPR, you suddenly have regulators who care about these things and are empowered to impose hefty fines. So people stopped ignoring the whole space of privacy, as they had been before.
One of the declared goals of GDPR is to reign in "profiling". So the industry started trying to desparately weave a narrative on the grounds of consent: they wanted to create an electronic paper trail that would somehow support their claim that people were consenting under the rules of the GDPR to being profiled.
But consent under the definition of the old cookie directive does not meet the standard required under the GDPR for consenting to profiling [1]. People like Max Schrems are actively engaged in trying to get the industry to turn away from their noncompliant ways [2]. Especially the use of certain UI dark patterns has already lead to hefty fines [3].
My hope is that, when this has all played out through the legal system, it will become clear to the industry that the stuff they are trying to get you to consent for them to do, is just outlawed altogether, thus scoring a victory for privacy on the web and rendering that consent-stuff moot.
If not, regulators may need to get involved to make it more clear, that this is the intended outcome, which I have no doubt they eventually will.
I also have high hopes that, eventually, GPC will become enshrined in law [4]
[1] https://academic.oup.com/idpl/article/5/3/163/730611?login=f...
[2] https://www.dataprotectionreport.com/2021/06/max-schrems-pri...
[3] https://www.cnil.fr/en/cookies-cnil-fines-google-total-150-m...