That didn't work out so well for the EU's cookie law. We need a different solution I think.

Nah, we just need enforcement so people actually have a way to opt out rather than being fobbed off with dialogs like "apparently we have to display this annoying popup to tell you we are using cookies because this is how the internet works now. [whatever, just take me to the page]", or "more options" buttons that take you to a never-ending maze with no actual way to opt out.

Actually stamp down on the sites taking the piss. Without teeth, GDPR is useless, but so would any other toothless solution be.

Many sites actually do follow it properly, i.e. they have the popup tell you that tracking ads are all OFF and if you want you can ENABLE them to get more relevant ads, but you are free to just dismiss it.

Once one of the big players that don't do this and instead have it e.g. opt-out are actually fined, I suspect more sites will begin to behave correctly.

I think it worked wonders with GDPR which exposed all this pus. Unfortunately, there EU has been too slow acting on it. Only British Airways has been slapped with a significant fine so far.

Marriott were fined £99m in the same week as BA in the UK, and Google were fined €50m in France last year, both under GDPR.

Ah, I forgot about Marriott.

The problem with fines against Google (and Facebook, too) is that it's peanuts for them. They just factor this in the same category as "legal costs", and it never affects them even remotely.

GDPR opt out rate is well well under 1%.

Cause at this stage opting out included navigating many stages of dark pattern and deceptive pages, including semi hidden links and fake slow progress bars. Even on the biggest sites.

If, and I say If, these gangsters ever get hit with major fines, and we get the simple yes/no option that a few pages have, then it will be better.

Right now, the ad industry (or should i say Mafia) is trying to actively circumvent this legislation

What does that even mean? GDPR requires companies to request that people opt in to information gathering.

And in reality, as long as no fear-mongering fines are handed out, companies will try to bypass it.

There would be ways to get control over this, but law is slow.

I rarely see opt in GDPR popups, it's typically "accept tracking" or "more options...", the latter seemingly sending you down an infinite rabbit hole. Well, now that I think about it, this might count as opt in, but this is definitely a dark pattern.

This is supposedly not allowed under the GDPR, but we're going to have to wait a while before this is actually tried in court.

It's not, the consumer advocate in Norway has already released one report on the subject [1, PDF]

Pushing all this through the legal system will take some time but the watchdogs in different countries are not sitting idle.

[1] https://fil.forbrukerradet.no/wp-content/uploads/2018/06/201...

The other thing I often see is an "accept tracking" button, and a tiny "more options" link that just goes to a page explaining how to switch off cookies on your browser. I'm pretty sure that's not OK with GDPR as well.

IANAL, but this is not entirely true. Under GDPR data can be used by claiming "legitimate interest" [0]. In the case of legitimate interest, the user needs to opt-out rather than opt-in.

0: https://www.gdpreu.org/the-regulation/key-concepts/legitimat...

1% of 1 million is 10k people.

If legal action would be taken, shouldn't browser have the controls regarding tracking preference? Setting up each page (provided that 'No' would still load page in either full or stripped-down variant) on each devices owned and/or reapplying choices whenever browser cache is cleared would be frustrating.

Maybe DNT should return as respected feature within browser and user choice shouldn't affect the access to the content but only its form.

DNT is counterproductive from a technical perspective. The more bits of entropy you give trackers, the easier you are to track.

If DNT was legally binding, they wouldn't be allowed to use that additional bit of entropy.

But I would prefer a PTM (please track me) header with legally binding semantics.

Those who abuse it the most will just move to a jurisdiction where it is allowed. Or they'll do it anyway, since many of the worst threats on the internet are already criminal. On the internet, technical solutions > legal solutions.

There are clearly some things that are economically viable as a criminal enterprise, but I don't think tracking people for ad targeting purposes is one of those things.

Tracking only pays if you can track a huge number of people and sell ads to a huge number of advertisers. The profit per tracked user is too small to pay for running a criminal enterprise.

Moving to a different jurisdiction is impossible as your customers (the advertisers) and the sites/apps where ads are placed would still be breaking the law.

> There are clearly some things that are economically viable as a criminal enterprise, but I don't think tracking people for ad targeting purposes is one of those things.

True, most illicit ads tend to be non-targeted. But some criminals do things like blackmail, fraud, espionage, etc. using tracking data.

> Moving to a different jurisdiction is impossible as your customers (the advertisers) and the sites/apps where ads are placed would still be breaking the law.

That all depends on the specific business model, business partners, and their presence. Regardless, what I describe is not conjecture, many companies are shuffling around data to avoid GDPR rather than comply.

https://www.theguardian.com/technology/2018/apr/19/facebook-...

A different company without a physical presence or business partner in the jurisdiction in question, might have little to no incentive to follow the law.

In the end, even if companies are breaking the law, or even if they are fined, your data won't be protected unless they actually change their behavior as a result. Calculated non-compliance is a commonplace strategy for corporate legal compliance.

I don't dispute any of that. But what it means is merely that compliance will never be perfect. Companies will always test the limits of the law and look for loopholes.

Like with tax compliance, this will always be an arms race. But if the law raises the bar, they will jump a little bit higher on average.

It doesn't have to be perfect. Privacy is not black or white, and trackers themselves are anything but perfect.

I recently looked at the list of what Google thinks I'm interested in. It's funny. Supposedly, I have a particularly strong interest in vehicles and buying cars. In fact I don't even have a driving licence, never owned a car, never will.

The list goes on and on like that. They must have rolled the dice to come up with things like "Flowers" and "American Football". I feel my privacy is completely safe with these geniuses :)

For sure, mass marketers prefer quantity to quality. Google/Facebook are not doing anything particularly novel in the realm of what is possible, nothing more than is needed to get accurate enough across a large number of users.

It's the more targeted uses of fingerprinting and data collection that are scary. If you're a person with lots of money or influence, there's already someone out there who is specifically trying to collect data about you in particular. Those people and organizations are looking at the data in much more detail than mass marketers.

Exactly. That's how we ended up with the terrible cookie warnings. The funny thing is that GDPR has language about respecting the DNT but no one cares.

Is there a good example of a large company that blatantly ignores DNT? I'd guess its hard to know as a lot of the tracking could be server side only.

Actually from what I can see, checking US websites from Paris gives much less requests.

Compare the request map for CNN from

- Dulles, VA: 511 requests https://requestmap.herokuapp.com/render/200123_JH_ed7b9b27df...

- Paris, France: 77 requests https://requestmap.herokuapp.com/render/200123_87_39fdca38ac...

I don't know if it's for sure because of the cookies/gdpr law, but there is a clear difference, and that's a big win in my opinion.

One acronym: GDPR

It's also one of the reasons why people have become so acutely aware of the problem. When the umpteenth site asks you to consent to over 200 ad providers/trackers, there's clearly something wrong.