If a company is going to lie or skirt the law about their cookie use, why show the banner at all? It's almost worse to show a decline option that does nothing.

It's basically a form of malicious compliance.

Malicious compliance is still compliance. Somebody being told "Please watch the pressure gauge." and then staring at it as it goes outside of safe regions is doing exactly what they were asked to do. This is blatant noncompliance with the thinnest veneer of respectability.

Then you can lobby to change the law because the users-electors are annoyed and it's not your company fault every website is doing it.

Yeah, people should start reporting these sleazy sites to their authorities if in the EU. I'm hoping that GPDR enforcement will eventually get up to speed.

Except that those authorities are often stripped of resources toothless organizations often made to serve as digital potemkin villages to the public, everyone knows this and can't be bothered one second of their life to be wasted on that bs.

I typed "cnil fines" (the CNIL being the French data watchdog) on google which led me to their sanction page [0] which features 100M€ fines to Google and 35M€ to Amazon _last week_. It is surely not much in the grand scheme of thing but surely this is more than a mere Potemkin village.

[0] https://www.cnil.fr/fr/tag/sanctions

That's true, but I wish they spread their reach wider. These fines to Google/Amazon/Facebook make the news, but are just a slap on the wrist to these giants. What would work much better is a wider campaign of smaller fines, so that everybody in the sleazy business would know or heard of someone who was fined.

good that at least in one country they do something, but everywhere else it's wild wild web and the bandits are not threatened.

I typed "UK data watchdog" (for I did not know its name) and while it is true that I needed more clicks than for France, I found their enforcement page with their list of fines [0]: £18m here, £2m there...

[0] https://ico.org.uk/action-weve-taken/enforcement/?facet_type...

It's not actually doing it's job, it only goes after certain types of easy targets:

https://www.openrightsgroup.org/blog/parliament-must-hold-th...

They also had a massive budget shortfall which meant they sent out what amounted to a protection racket letters demanding £40 per year from every UK business, even though almost none of those businesses should be paying it.

All this while simultaneously investigating the ad industry, finding it is egregiously breaking the law, but then doing nothing about it.

The UK's ICO is taking an extremely broad definition of who should be paying it, but an extremely narrow definition of who it should enforce against.

I might add that the £40 it is demanding is almost 3 times the normal £15 yearly fee for running a business in the UK.

In the UK, BA was fined £20M recently, although that was for egregiously failing to protect customer data.

I have now started reporting stuff. It was easier than I thought :-)

Legitimate interest exists, and we use it at work. But because I work in the field of security, and for the sake of our infrastucture, we log specific informations and might drop a mandatory cookie at a time.

Everything outside that field cannot, I guess, be considered as legitimate interest.

The absolutely funniest interpretation of ”legitimate interest” is in a recurring spam message I get from (of all things) an email lead marketing company.

They have small print after each of their emails that says that GDPR allows them to email me because they believe I might be legitimately interested in purchasing their services.

I always look for that - and the 'deny all' button. They do not have a 'legitimate interest' to track the hell out of me.