No, they didn't. They implemented something that they thought allows them to continue with the practices that the law was specifically designed to combat.
The user has very little motivation to accept tracking. The web site has a lot of motivation to track the user (because personalized ads = more money).
Thus, web sites make saying no as difficult as possible, while making saying yes as easy as possible.
A 100% compliant, user-friendly implementation would be showing non-personalized ads, then occasionally replacing one of those ads with a banner "want to receive ads that are actually relevant? click here to enable personalized ads" (which would lead to an informed consent dialog and set a cookie that would then apply to all web sites that use that ad provider).
But pop-ups coercing the user to consent are more profitable.
This could be fixed by enforcing the actual law (punishing the companies that tried to weasel out of it and processed data without valid consent) so that trying to weasel out of it is no longer a valid strategy.
The same companies have their customers convinced that they need data collection to turn a profit.
As a result we see all kinds of stupid attempt to circumvent the law because an entire industry of shady data collectors and brokers have convinced businesses that the only way of making money online is by tracking people.
The basis of your argument is: All data collection is bad.
Therefore, in your model of the world, an evil conspiracy of bad actors are looking to strategically undermine the law with various dastardly convoluted schemes. I understand why you're arguing that, given the premise you're starting with.
However, the majority of business on the internet are not doing evil things with your data. They simply want to better target their offerings to their customers, allow for you to keep items in a shopping cart, etc. If they are providing better services to their customers, they make more money and the customers are happier. It's a win win for everybody involved.
Could it simply be that, most businesses put cookie popups on their sites because they don't want to get fined? Not because they are embroiled in an elaborate scheme to undermine the law?
Could it be that the EU should have created a smarter law that would actually help people be more aware of data tracking? Instead of stupid popups?
I wouldn't be so sure. There aren't that many advertising and analytics companies, but they make products that are widely used (and clearly misused) everywhere. The websites using such tools were never told that they could avoid having the banner if they just didn't have tracking cookies.
As a user I don't want anyone to "better target me" - no single exception. Gosh I miss the time where we just burned the McDonald's...
There's no need to straw man secret cabals of conspirators, when it's just business. (Or if you want to get political, capitalism). When big tobacco companies pour money into lobbyists, fund skewed studies, and buy ads to flout anti-smoking legislation, no one calls it conspiracy. Businesses are incentivized to respond in certain ways.
They can do it without the cookie notice. For example, Amazon can track what I'm looking at on their site and what I'm buying and store it to their database. They can use this information to offer me what they think I'll like. Also, another user-friendly approach would be for a site to ask me to select categories/topics that I like. Whatever it is, GDPR gives me a right to export the data, review it, and ask for it to be deleted if I don't want the site to have it anymore. No need for cookies in this scenario. What they need cookies for is when one site wants to track what I do on other sites.
> allow for you to keep items in a shopping cart
This is a functional cookie and there's no need to ask for consent to store a shopping cart. This is just a perfidious argument that data tracking companies use to ridicule the law.
> Could it simply be that, most businesses put cookie popups on their sites because they don't want to get fined? Not because they are embroiled in an elaborate scheme to undermine the law? Not because they are embroiled in an elaborate scheme to undermine the law?
The law is very clear about when you need to ask for consent and when you don't need to ask for consent. Most sites implement it in a wrong way, many of them use deliberate dark patterns, for example, when you deny cookies you get a loading spinner that spins for a couple of minutes. These are all attempts to condition the user into avoiding pressing the "slow" button.
Using user’s data within the confines of a web app is usually OK so we can put just small much smaller guardrails up to keep companies respecting the public good.
I generally just don’t like my data shared with third parties. A single web site can literally pass your data on to hundreds of companies (as discussed in the book on Surveillance Capitalism).
I don't think that's stupid, nor unintended.
That's not what actually happened. Companies got scared that the law would impact their business model, for which the law was directly design to impact, and asked lawyers to find the minimum change which could be argued as being in compliance.
When you ask lawyers to find a solution to a problem you do not get the intention of the law. If you ask a lawyer to find a solution to tax law you don't get the intention of the tax law, you get tax avoidance, the direct opposite. And if you ask a lawyer about consent, as I have done during conferences, you get straight answers like "People can consent to a 20 page EULA they have not read or have the legal education to translate".
It not that the word is stupid or that the person who designed the law is stupid. It just happens that if you pay a lot of people who have studied and spent a large part of their life to find clever interpretations of words what you get is a clever interpretation that may or may not be what a judge will see.
To make a quick parallel, a bunch of lawyers for companies are arguing that while the company is having millions in profits and giving out a lot of dividends to shareholder, the company is at the same time in "economical crisis" and thus deserve government grant money in order to handle corona. The department in charge of giving out the money asked its lawyers and they agreed, but the politicians are now a bit upset since they disagree. And so now everyone is arguing/blaming each other and discussing if they should change the law to specify what an economic crisis is and isn't and if the change to the law should be retroactive or not.
It sounds like you're saying the lawyers are smart, but the government is still stupid.
Why didn't the government have any lawyers involved in writing the law?
Isn't that pretty...stupid?
> If your answer is "the entire world is stupid,"Only by using a very loose definition of "implemented" sans common implementation measures like clarification and enforcement.
> implementation measures like clarification
No directive needs clarification to be implemented as law. That's the most absurd thing I've heard all year.
We don't need to imagine a world like that, because it has nothing to do with what we are talking about.
Let's stick to the real world. The EU implemented a law. Everybody is scared of the power of the government, so they implemented what they thought was the intention of the law, to avoid prosecution. The mom-and-pop flower shop down the street could care less about making troll political statements about technical internet topics.
Turns out, the law had stupid unintended consequences. Was the person who designed it stupid? Or is the entire world stupid?
If your answer is "the entire world is stupid," then I'd argue you don't understand how the field of design is supposed to work.