I'm baffled by the number of companies that should not have any need for third-party cookies and still go full-on dark pattern. In particular online shops: I'm already on their site, why would they loudly advertise "we're shady and want to trick you into selecting all cookies"? I've cancelled more than one purchase because I didn't want to bother with this.

One expects it of many companies. But the BBC seemingly have a dark pattern here - if you follow the cookie link it shows all cookies are turned off already, so there's nothing to do, no confirmation, nada. If you don't follow the link they of course have set tracking cookies ... so the cake^w link is a lie.

IMO it would be fine to say "we were tracking you but when you followed the link we deleted those cookies and won't now set them". "Reject all", or default off ("no cookies are set, cock here to enable the committee types you wish") is better.

What's far worse is the admission that they still use ad networks even when those networks are clearly breaking the law (ie they offer no settings to disable tracking). Indeed BBC should be going further and not allowing advertisers on their network to drop cookies if a user has disabled first-party cookies. Instead they say "go to these networks and disable it yourself", good luck with that!

This from an org funded in [minor] part by taxation and whose rausin d'etre is supposed to be serving the public interest.

They use ad networks only outside the UK, so the taxpayers are not tracked by these networks. They're very explicit about it in their cookies explanation: 'Set your cookie preferences for performance cookies. And if you’re outside the UK you can set your preferences for personalised advertising.'

It's certainly down to bad legal advice. Lawyers are trained to take everything they can get. If it turns out that was too much, then they frame it as a bargaining chip, as leverage to at least recover some fraction of what they previously took.

It's sneaky, immoral, unethical and illegal. It also works.

Taking everything one can get is not exclusive to lawyers. Many engineers would rather have more information/data than not enough. Better yet get all the data up front and then decide what you need later.

I’ve also wondered why there aren’t “enough” fines. Are the countries just being cautious because they want to establish precedent before going after the “big fish” like Facebook or Google? Or is it something else?

It sounds like a fear of backlash - essentially if you find like 3% of the population with parking tickets it is fine. If you fine 40% to 60% then you get a large contingent pissed off at you - regardless of validity of the laws and enforcement unpopularity is perilous to laws and officials.

If 40% to 60% of population gets fined then that means the law is stupid* and should be abolished. Backlash on law enforcement is totaly understandable.

*"stupid" is relative term. Laws are made for particular society, if almost a half of that society disagrees with the rule then it shouldn't be a rule.

With this logic, there's essentially no regulatory way out of local minima, lemon markets and such. And, the freemium for personal data mining model is very much such a situation.

And I don't think it's a fair statement that any large percentage of _people_ oppose this particular law; in my experience, most people don't seem to have a strong opinion about it, and those that do have a strong negative opinion very often don't really understand it (and are mostly reacting to the irritation that the various stakeholders are deliberately putting them through). Sampling the opinion of companies that live off ads is a bit like asking printer companies how they feel about toner prices.

Not half of society, half of profit at any cost companies that doesn't care about ethics ever.

So great laws actually even if gets 100% of those.

The way of things in EU is a bit different than some other areas. The goal is to change the industry slowly. You don't change industry by killing them quickly so these things are first made into law, then there is usually a number of warnings, then the fines starts showing up small and then the gets ramped up if the industry doesn't change.

These dark patterns we keep seeing shows that the sites didn't do their homework and is trying the usual weazel way of getting past on "you clicked accept so now you are stuck.". Consent can only be given knowingly, if you hide it in the fineprint (or behind a "show more" button) it's not valid according to GDPR. To invent things like selling customer data to third party and call it fair usage of private data is not ok either.

The agreement has to be easy to understand and very short. And it has to be presented close to the actual entering of data or the accept button. No hiding, no shenanigans, no trying to fool with colors or design. It's that simple.

> The goal is to change the industry slowly. You don't change industry by killing them quickly...

I completely agree. People calling for an immediate 4% fine are ignoring that killing companies is bad for the economy. If a “pitiful” fine of $200,000 fixes the behavior, why fine the living daylights out of them?

I’m just wondering why the fines have been so “slow” to happen. Enforcement Tracker[0] lists only 533 of which the majority appear to be against individuals (such as “Doctor”, “Private person”, etc.) I just figured there would be more by this point.

[0]: https://www.enforcementtracker.com/

> People calling for an immediate 4% fine are ignoring that killing companies is bad for the economy.

As a person who calls for these, my reasoning isn't that they should dismantle the entire web because of it[0] - but that destroying a few small businesses and seriously hurting some big ones would set an example for all the rest to fall in line. Right now, companies seem to correctly reason that they're statistically unlikely to be noticed and fined.

--

[0] - Even though my belief is that advertising industry in particular is a social cancer and absolutely needs to be torched down to the ground.

Data protection officials are generally understaffed and underfunded. GDPR has increased public awareness, scope and thereby caseload. The rest of the normal justice system isn't responsible to handle data protection cases and will just refer you to the data protection officials. So while fines are happening, things move very slowly if at all.

GDPR is pretty recent (2018) and legal opinions on how to apply it (e.g. marketing tracking) are still in the making. I think fines are still applied "slowly" so that the industry has time to change.

Constantly applying fines is not sustainable. You eventually want to get to the point where privacy "just happens".