The right to not be tracked if you don't want to is (now) a fundamental legal right that overrides any rules you can implement.

It's not that they don't consent to your monetization scheme, is that a monetization scheme that involves tracking people who don't really want to be tracked is illegal as such, you can't have one. You can deny access to whoever you want, but the key point is that if you "threatened" them to deny service if they don't accept, then that does not really indicate that they wanted you to use their data, does it?

You can't say "oh but I gave them some goodies to influence them to click 'Accept'" - nope, if they don't really want to be tracked, then you aren't allowed to do so, the consent is not something that people can trade away in a contract for some content, server time, money, lentil soup or whatever.

Ok, then EU shall not have a free option on any of my services. Pay or GTFO. Harms the poor, IMO, but at least the poor's privacy will be protected from ad companies.

I think the whole conclusion of this thread is that "Pay or GTFO" is perfectly acceptable and legal, but "Consent to tracking or GTFO" is not.

Everyone's privacy will be protected - the same consent restrictions will also apply to your paid customers. Free webservices are not the majority of the world's businesses, a big part of why GDPR was needed is because all the paid online and offline services also traded all their subscriber private data; and with GDPR you can't just have a line in your paid service terms&conditions that allows you to screw their privacy.

Yes, I understand that. However, do you acknowledge that current monetization methods for "free tiers" of services generally involve cookies/tracking? If so, you also acknowledge said free tiers must go away if the service is to operate in EU, correct? If so, wouldn't you agree the EU poor will have access to fewer online services than their USA peers?

> do you acknowledge that current monetization methods for "free tiers" of services generally involve cookies/tracking?

I guess it depends wether you consider free plans to be a loss leader for the paid plans.

If you don't want to operate a free service that is without tracking, then don't. No-one is forcing you to, but you should be aware that you still need to follow the law for paying users too.

> It's my server. Don't agree to my rules? GTFO. Why should you have the right to ignore my rules and still use my server? That's like having your cake and eating it too.

It's european society. Don't agree to its rules? Don't try to monetize european citizens. Why should you have the right to ignore their rules and sell their personal information? That's like having your cake and eating it too.

Privacy is a consider a basic right in the EU, so no, you cannot operate monetisation schemes that violate it. It would be like having a 'by entering our restaurant you are agreeing to our reduced-hygiene policy' sign at the door. If a business cannot survive with clean hands, then it should not.

> Privacy is a consider a basic right in the EU

Your point definitely makes a lot of sense, but there are many of us who believe that we should be able to make our own decision to give up certain types of privacy in exchange for something of value.

Everything involves some level of risk/reward. Should I not be allowed to skydive because of the increased risk of death? Generally, I think my rights end where others’ rights begin, so I fail to see how sharing or withholding my personal information affects anyone else.

> we should be able to make our own decision to give up certain types of privacy in exchange for something of value

This is what these laws are all about.

People volunteer personal information because they believe the website will use it with their best interests in mind. There is a well-defined goal and achieving it is the only reason the website even has access to such data. For example, people give their home address to an online store so they can ship orders. Selling this data to marketers so they can spam the consumer's mailbox with advertisements is outside the scope of that goal.

Websites should collect only what's strictly necessary for them to do whatever it is that they do. They should use this data only for this purpose and ideally delete it afterwards.

I do agree with you that you should be able to freely exchange your privacy as you see fit. But the difficulty, as I see it, lies in determining whether the exchange is truly free or coerced by some means. The GDPR takes a strong stance on this (that consent is only freely given if withholding it would have no drawbacks) and it does have false negatives, i.e. situations where the exchange was fair but prevented.

However, there are two reasons why I think this is still reasonable (with 1. being more important):

1. The reality of the current situation is that invasions of privacy come bundled with other services, which you are pressured to use due to external factors. So I believe that the vast majority of cases are modelled well.

2. I see a privacy as similar to herd immunity, in that society benefits if lots of people have it, even if the individual does not profit from it directly. (In particular, it may prevent certain kinds of power from accumulating or centralising.) In these kinds of situations it can be necessary to restrict individual rights to achieve optimality.

> Generally, I think my rights end where others’ rights begin

So invading someone else's privacy, without their consent, for your own monetary gain, should be your decision, because it's fairer?

> someone else's privacy, without their consent

I didn’t say anything about not getting consent to share personal information. I think almost everyone would agree consent is always necessary.

"Ok, then EU shall not have a free option on any of my services. Pay or GTFO. Harms the poor, IMO, but at least the poor's privacy will be protected from ad companies."

Sure. Just like I didn't click on the techcrunch link above, I'm sure I'll live without your server as well :)

There won't be many sites you will be able to click on, nor services. No more free email, no more free news, no more free chat forums. Your web will be a lonely place with a very small number of sites you're able to visit without paying.

Great, this is exactly how capitalism should work. You don't like the rules, don't use my service. If I want you to use my service, I'll change the rules.

Yeah, I agree with you. If people don’t like that a site uses cookies, then don’t visit it and maybe it will naturally go out of business. They shouldn’t be forced to still provide content.

Or not. Personally I have no problem with cookies. Maybe they will just lose traffic from a small fraction of HN users instead of going out of business.

It’s kind of like paywalls. I get annoyed whenever I visit a news website and a paywall pops up, but I just leave the site unless I’m interested in subscribing. If enough people leave instead of paying (i.e. providing something of value in exchange for accessing interesting content), then the publication goes out of business.

The GDPR limits your rights insofar. You may find that "overbearing", I find it okay. Your rights end where my rights begin. Where the line is, is debatable, of course.

Remember that the law came only because web site owners took things way too far. Pendulums swing both ways.

Well in that case I disagree where EU has drawn the line, so I'll just not serve EU customers (or if I do, it will not have a free option, only a pay option) and we'll both have all of our rights.

Exactly. Many US newspapers go that route already. I'm fine with that.