The standard "Accept Cookies" banner is, give or take, malicious compliance to the EU's cookie laws. For actually required things, it doesn't *need* to be a banner. Companies tend to use a standardized, third-party-powered "follow the EU law" tool that they get the ugly cookie banner. And even that banner's malicious compliance is under attack now because it takes too many steps to opt out.

For things like sign-in, you barely have to mention the use of cookies on your website, because it's necessary. For things like items in an anonymous shopping cart, a simple "adding this item to the cart when you're not logged in will cause the item to be saved in a cookie so we can remember it later" would suffice.

I'm not a lawyer, but that's my understanding.

The cookie banner pop-ups are not compliance with the EU legislation, in fact, many of them are in direct violation of EU laws. If you were to give sites the benefit of doubt, they are doing it because they are copy pasting, but the reality is, that the law is that they can not track you without your concent and that they are not allowed to bother you. The fact that they do is likely malicious compliance to get you to blame the EU rather than their shitty tracking practices.

Any site that doesn't have a single button click to ignore all cookies, breaks EU law. But to truly follow the law, you would have to go into a site setting on your own, and enable tracking. Which nobody would do.

The alternative would have been banning tracking and I don't think that would have happend. At least now you're being informed and have at least the perception of an option to opt-out.

Had you truly preferred not being informed, not being allowed to opt-out?

This is a persistent stupid take but many HN readers are also on the wrong side of the consumer protection. Those startups don't make money out of thin air eh?

Once again. The full consumer protection would be banning behavior-based advertisement completely, which I would welcome. GDPR is striking a balance. It forces the companies to ask if they are going to collect data and use it in any other purpose from delivering the information / service.

Almost all of the web is feeding data into Google's ad and statistics services which are used to profile people and completely out of scope. That's the minimum. Worser services feed your data into every single PII broker. If you don't collect such data, no banners are necessary. If you need an address and an email to just ship a product, you need 0 cookie banners. The websites can also do geo-fencing so you don't see any banners. They don't want to spend any money to engineers though.

But no, it is EU's fault to create a balanced law. Companies should be violating you and your pricacy left and right. That's their right, isn't it.