Yep. If anything, things are worse now. You HAVE to give consent to do anything useful on the website (so blocking the notice won't work), and in the consent form it's usually very hard to turn tracking off, full of dark patterns.

Not legal from the perspective of GDPR, sure, but it seems that everyone is doing it.

/edit: downvoted for stating basic facts, amazing.

And I hope they will all get heavy fines for doing so. Let's see how well the EU will enforce the GDPR.

They won't. The ICO in the UK has already said they aren't interested in imposing fines [0]. They would much rather nudge companies into compliance.

> "The fine is really a last resort," she told Computing. "Even to get to the fine we have to go through a lengthy investigation that might take several months, then we have to take it though the courts. So fines are not our go-to tool."

However. I think with egregious cases like selling data. I am happy that the ICO fined a company for doing that. [1].

[0]: https://www.computing.co.uk/ctg/news/3027593/ico-theres-so-m...

[1]: https://www.theregister.co.uk/2018/08/09/ico_fines_data_brok...

It’s totally OK that fines are used as a last resort. As long as they will be used as a last resort.

Don't we have a glimpse of (lack of) enforcement based on previous incarnations of laws like this? What about this time is special? And why are laws crafted without ample enforcement mechanisms? At the least that makes them toothless, at the most it gives a piece of legislation that can be pulled out and used only when someone wants a reason to punish a company.

The difference is that GDPR does have effective enforcement mechanisms, precisely unlike previous laws. Now let’s see if they’ll be applied.

Mechanisms in the laws or the institutions? The difference is very important and many people, who agree with the intent of the law, have been pointing out this difference for a while now. Scribbles don't make something so. If the approach of just writing it down didn't work before, why just change words instead of approaches?

Both, if I understood what you mean: The GDPR regulation ((EU) 2016/679) contains provisions for legal enforcement, and describes which process and agencies are responsible for that.

Whether this actually works, only time can tell. But the fact that similar previous legislations went unenforced was a specific concern that the designers of the GDPR intended to address.

I honestly don't get why so many sites are even paying attention to GDPR. If they don't have a presence in the EU, it is irrelevant.

> If they don't have a presence in the EU

Only sites with a presence in the EU are paying attention. The LA Times is a counter-example of a site that hasn't bothered with GDPR because they didn't feel EU users were worthwhile keeping.

However, collecting data on the 0.5 billion people in the EU evidently seemed worthwhile for most sites.

It seems strange to me that the LA Times would cut off European users, when they presumably have to comply with the new California Consumer Privacy Act, which is similar, anyway.

Because GDPR includes provisions for handling US GDPR violators, a lot of security vendors were touting up the idea that if a European fills out a form on your site or gets cookied for any reason, you could be sued.

So they'd file suit in the EU and... what would happen? Some sort of judgment that would prevent a company from starting business in the EU at a later date?

I don't know. Why are EU companies paying attention to American laws, again?

Largest economy and military in the world are big reasons to play nice with America

The US is not the largest economy. Whatever gave you that idea?

Except for military force and incarcerations per capita, the US is lagging behind in almost every statistic compared to China or the EU.

Military doesn't come in to this at all.

And similar arguments could be made for why American companies would play nice to the EU.

If I were a company I would target America first and Asia second. Due to increasing regulations, political uncertainty and lack of growth I'd shift the EU to third (it used to be an obvious second to me).

Fair enough, but you'd be missing out on a huge market. And unlike Asia, it has a single regulation to follow for things like data protection.

If your company was unable to comply with GDPR, many wouldn't want business with your company anyway, especially other companies who are trying to comply with it.

Detained during their connection in Frankfurt?

Honestly that is a classic "Come at me bro" type of moment. Sue me in the EU, it really doesnt matter if I don't do business there.

It is not. If their customers are in the EU they have to to comply.

I was specific. If I don't do business in the EU, it doesn't matter. I don't really care where my customers are but if they pay in the US, GDPR is not relevant to me.

I get that everyone is super excited about GDPR, but sorry to say most websites can safely ignore it.

What authority would make them comply?

...which is not compliant. "Opt out everywhere" has to be the default when you click accept.

But for version 2 of GDPR I'd like to see something like: No landing pages. Content must be served on the first request. And no Captchas for Tor users.

I just don't use sites that won't work until you give consent.

That's idealistic. In my country all the news sites, as well as the local commerce sites do it. Where should I get local news from?

It is idealistic. Idealism is how the status quo changes for the better.

The short-term effect of GDPR is ugly interstitial pages and mandatory consent, but that's not the point of GDPR. The point is to make legally collecting user data difficult, annoying, and onerous in the hope that going forward more companies will eventually decide it's more trouble than it's worth. That'll only work if complying actually is a chore.

Call your local news site and complain if they aren't honoring GDPR to the letter. Call your country's ICO and complain to them too. Talk your friends and family into doing the same. Be a pest; the more annoying the better.

The reason GDPR exists is to protect people who do not understand the complicated world of online tracking. If GDPR is effective only when said people are on the front line of defense, than the GDPR has failed.

As a matter of fact, I do complain a lot, and I do file complaints about GDPR violations, but convincing my friends and family to even care about this stuff is science fiction (I've tried for over a decade now without success).

I dunno. Convincing my friends and family to care about Facebook's potential for abuse was science fiction, right up until it wasn't. Certain recent events in American politics took an issue that was abstract and invisible to the median consumer and made it very concrete and very visible.

Business and engineering culture around website construction is horribly broken with regards to user privacy. Changing that culture is going to take years of consistent pressure which existing interests are going to fight every step of the way.

In my opinion the ugly consent forms are the best thing about GDPR. A problem that techies have known about for years is now visible (and annoying) to the general public. Of course that doesn't restructure the entire internet overnight, but dragging the problem out of the shadows seems like a pretty good opening salvo.

Buy a newspaper?

This is actually non-compliant. Sites may not withhold service based on consent. They can paywall things no-problem, but users must not be forced to give consent at any point in order to use the service.

Well, this way you know what websites you should just avoid, because they're selling your data? The web is a large and open place, you don't need to give consent to anyone.

"downvoted for stating basic facts, amazing."

Most people who complain about this just don't want to admit that they're not actually stating basic facts.