I think the cookie banner requirements are just fine: they're only required if sites are tracking you. It's a good sign that if I'm on a site that's not bothering me with a cookie banner, it's respecting my privacy: https://github.blog/2020-12-17-no-cookie-for-you/

Making the widespread surveillance that was previously invisible visible (and annoying) seems like a good move to me.

They’re ok but they should be more precise:

1. Require websites to be concise and offer a yes/no ONLY.

2. Reverse-lobby browser vendors to turn this into an API.

3. Require everyone to use the API.

Now users can block or accept all requests at once like they can block or accept Notification requests.

But virtually every site I visit is tracking me.

It doesn't change the fact that they're tracking me, it just makes me click an "X" or "OK" every damned time I visit some new site to read an article or something.

I could understand your argument if sites were actually removing tracking in order not to annoy users with the popup.

But sites aren't doing that, not in any meaningful number at all. So it's not having any effect on privacy, while annoying basically every internet user ever constantly (before you hunt for an extension to block as many of them as you can).

So I don't see how it's a good move at all, not in practice. It's just annoying, and that's it.

Before cookie banners were required, do you think the average user would have any idea how many sites were tracking them? I don't think they did. It's beneficial if only to increase public awareness, because tracking is otherwise invisible.

Heck, I'm a reasonably technical user, and I wouldn't have noticed in most cases. Again, invisible. Now I have a negative first impression of a site if it annoys me with cookie banners, and a more positive one if not.

Except now it feels like a California Prop 65 warning that you see on literally every business. “Something in here may cause cancer. Is it a bottle of toilet cleaner locked in the supply closet? Is it benzene in the hummus? Who knows!”

And what difference does it make if we now know we are being tracked?

I wonder that too. Would this be something the W3C would look into introducing some configurable cookie-consent (i.e. "Accept all", "necessary only", "block all" options) that browser vendors could then pick-up on and adopt so that it wouldn't require manual checks at each website visit?

As the DNT header history shows, the only solution is privacy laws

Something like the Do-Not-Track header? The history of that pretty much shows how much adoption to expect for a feature like this, sadly.

Cookie banners aren't required per-se, and when the website wishes to do tracking that would require consent under the GDPR, the regulation mandates that the consent prompt should be clear, opt-in (aka pre-ticked checkboxes aren't allowed) and that accepting should be as easy as declining (so if opting in takes one click, so should opt-out).

The problem is that the GDPR is not being enforced seriously so these breaches of the regulation aren't being cleaned up. I'm not sure if it's malice or outright stupidity and the companies legitimately believe they are compliant (there is tons of bad and incorrect advice out there).

If you want things to change and you're in Europe, you should start by questioning the incompetence of your local data protection agency as they are the ones that have the power to investigate breaches & impose fines. In the UK, the Open Rights Group is raising money to sue our data protection agency for its incompetence/unwillingness to enforce the regulation, so maybe it's worth checking out: https://action.openrightsgroup.org/help-us-protect-your-data... (no affiliation)

Do Not Track should have been made legally binding. Hell, with any sane interpretation of GDPR it would be.