I disagree. Pop-up fatigue causes people to just click the button that will get them to their content the fastest. While some people might dive into trying to opt out, when you get these pop-ups on every other site, many people are going to click the easiest button to make it go away. This is a poor law because it has to be done on every website.

I think it may be better to have this as a decision the user chooses once within their browser, and the browser can then pass along the intention to the website. There can maybe also be a third option where the user could then choose on each site, and the browser would show the choices, rather than the website itself. This would standardize the UX around the issue.

The law is that it needs to be as easy to reject cookies as it is to accept them. Ergo, "people are going to click the easiest button to make it go away" indicates a failure to enforce.

I agree it'd be better handled by the browser than each website, though.

My interpretation of that is that at least two buttons are required: a close (or “reject all”) button, and an “accept all” button. Websites would then be free to add a third “customize” button if they wish.

Unfortunately, many websites that I’ve seen have only “customize” and “accept all”. And the customize pane then contains dozens of preselected checkboxes (which, AFAIK, isn’t allowed, but I digress). Each checkbox is for a separate tracker I need to disable before clicking “save”.

The problem is absolutely the lack of enforcement.[a] If it was being enforced better, these sites would be fined until they fix themselves.

[a]: Yes, I’m aware that it is being enforced. I’m complaining that it’s not enough.

> Pop-up fatigue causes people to just click the button that will get them to their content the fastest.

And why is that button allowed to be the "Accept Everything" button? There should be two buttons, equally easy to find and press.

GDPR is not only about the browsers , it is applied outside of tech too, would be weird for the law to define browser standards . desktop apps standards and mobile apps standards. Developers should do their job, does w3c guys could decide how to handle this and not force politicians to decide for them.

Sure some people will click accept but some of them will know who is the actual bad guy that sends their data to 100+ third parties and what websites are respecting them or at least respect the laws.

I agree that browsers could do a better job, maybe implement a shit list, put all shitty websites there and ask you only once if you want to accept to allow this bastards to track and sell your data or if you want to open the website in a special container. Then if you decide to use the container the browsers should try to do their best to limit the tracking, maybe by blocking requests to the trackers, clearing caches often, disabling some features that could fingerprint you and if it works just disable JS.

But who knows, maybe we will have to pass laws to force the popups to use certain fonts, colors and input types because the majority of websites are evil.

> This is a poor law because it has to be done on every website.

The law doesn’t require this, it only requires informed consent.

> I think it may be better to have this as a decision the user chooses once within their browser, and the browser can then pass along the intention to the website. There can maybe also be a third option

This is would be an allowable approach under GDPR. Someone just needs to build it and make it happen. Unfortunately the “do-not-track” debacle shows that ad companies aren’t interested in playing ball. Hence our current mess.

The fact that you need to download a _opt-out_ plugin to disable Google Analytics for tracking you is a prime example of failing enforcement.

> The legislation itself explicitly prohibits annoying/misleading consent prompts.

What does a non-annoying prompt look like?

A non-existing one, you go to your settings to enable it so they can track you.

There are more or less annoying prompts however. With the later kind I could coexist.

Instagram has the most annoying one ever, if I stumble upon it by accident I am so annoyed that I need to count to 10. And I am not even using it, its just random click

The far less annoying popups are barely noticeable and do not block/fade content or have missing options like "NO, I don't want cookies, let me in".

Legislation is problematic too. I can't be bothered to make a decision to make a decision about storing cookies every time I visit a website, so I click yes every time without reading.

If the legislation were to be enforced, you would click "no" every time without reading.

Or just ignore/hide the banners, which by GDPR, may not be interpreted as consent.

Perhaps, but legislation should be designed carefully so that it can be enforced in a meaningful way

Having to go through a menu of a few dozen items to see & choose what you'll allow to track you is annoying, but so long as sites are willing to track you in dozens of different ways there's really no way around it.

Sites win because exercising your privacy rights even under the GDPR is an inherently annoying thing to do.

> Sites win because exercising your privacy rights even under the GDPR is an inherently annoying thing to do.

Under GDPR:

- only cookies and data strictly required for the site's functionality don't require consent

- collection of any other data requires consent

- pre-ticked boxes, lack of "reject all" button, leading the user to click "allow all" and similar dark patterns are not consent, and are, strictly speaking, violating the law.

See? exercising your privacy rights under the GDPR should be extremely easy. Too bad the law isn't enforced vigorously enough.

There's a way around it: uBlock Origin, a few extra filter lists, and a block on third party cookies.