Thank god, I never understood the EU directives that didn’t consider that by making sure things were implemented at a browser level it would cause an order of magnitude less work for web developers/site owners and ensure a consistent experience for end users.

It boggles my mind why they didn't think of doing this in the first place. I've been annoyed by the stupid cookie law since it became a law, it's ridiculous to have every single website implement it differently when the darn browsers can just implement it.

The cookie law is 18 years old, browsers have changed quite a bit since then, as has legislative understanding of the tech field.

Having read through GDPR, I got the distinct impression that nobody involved in writing it really understood the technologies involved. There's a lot of handwaving about "reasonable measures" whenever they run into ignorance that's absent in the many chapters about inter-government protocols.

GDPR was explicitly designed to be "general". Specifying website behaviour is a bit specific for a regulation that wants to regulate privacy at a whole (in virtual and reallife interactions). Of course that also means that the regulation is quite lacking when it comes to specifics but that wasn't its goal. The goal was to be a fallback-law which regulates everything that is not explicitly regulated otherwise.

What you want is the ePrivacy Directive which "introduced" the cookie banners many years ago and its updated version which is (still) not ready.

Yep, let's hope that becomes true - the last time I looked into[1] the situation, it seemed that the latest drafts have moved the settings back out of the browser.

I contacted my MEP at the time about this, and please do the same if you can voice your support for simpler, genuinely user-friendly and consent-respecting settings.

[1] - https://news.ycombinator.com/item?id=21914283

It's still there, page 27. They just refer to the browser as software providers, which is probably better, as it now covers internet software that is not technically a browser.

It seems ambiguous to me - my concern/question is whether the definition of 'software settings' could include the content of a web page itself.

That could lead us back to the current situation where consent dialogs are designed by advertising networks, and result in user consent fatigue.

What makes that different than the failed do not track header?

The DNT header must be honored by the remote service, similar to robots.txt.

Since the browser itself stores the cookies, it has the absolute authority to stop them.

So is this just going to be a different/easier way to configure per site cookies?

Actual legal backing.

Has anyone been successfully sued/fined/punished under GDPR in a meaningful way? Clearly TC still gets away with this nonsense.

Yes.

https://en.wikipedia.org/wiki/GDPR_fines_and_notices

Google, $50M; Marriott International, £99M; British Airways, £183M; 1&1 €9.5M; etc.