EVERY WEBSITE I visit from my location in the USA seems to have these stupid cookie popups. We added one to OUR WEBSITE even though nothing is hosted in the EU - simple cargo-culting "everyone is doing it so we must do it also".

I doubt it actually does a @#$@$ darn thing.

> We added one to OUR WEBSITE even though nothing is hosted in the EU

Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it.

> simple cargo-culting "everyone is doing it so we must do it also".

If your site is cargo culting everything it probably also has a ton of third party trackers for the same reason.

> Serve pages to the EU? You get to follow it.

What can the EU do about it if the company has no physical or legal presence in the EU? Have there been any serious attempts at such enforcement?

It's weird how people keep claiming this.

No one says that all sites should honor China's laws for visitors from China. No one claims that all sites should honor Saudi Arabia's laws for visitors from Saudi Arabia.

But magically the GDPR must be followed by the entire world if a visitor shows up from France.

China has the great firewall, the EU tried something similar under the "think of the children" excuse, which promptly failed.

Also a lot of people speaking out against China had to find out the hard way what some western companies will do when you speak out against a cash cow that will happily kick them out if its rules are enforced.

A firewall is not the only way to enforce this I'd guess. If I open a shop in China and do business here I might have to comply with local laws.

USA set the precedent when the FBI arrested Dmitry Sklyarov (a Russian Citizen) for working for a Russian company that apparently, while in Russia, broke US law.

It would be like Wendys slagging off the Thai king on a billboard in Dakota, then an employee of Wendys went on holiday to Bangkok and was arrested.

That's actually a counter example to what you're trying to say.

In this case you are arguing that Russian law should follow a citizen, where as the US said it shouldn't. So the "precedent" that was set (if in fact there was one set) in a case from 20 years ago in which the case against the accused was dropped, was actually that your laws don't follow you around.

The precedent set was that the EU could arrest a citizen of the US for working for a company based in the US if that citizen happened to go to the EU on holiday.

The Meng Wanzhou case had the EU being able to extradite a US citizen from the UK for breaking EU law.

If it has no presence, no money, no sales, no partners, basically absolutely nothing in the EU then it may be in the clear. But that is a large difference to just not having hosts in the EU.

I have decreed that anyone who serves pages into my machines owes me $billion.

> Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it.

This is completely false. Your laws do not follow you around on the internet.

> Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it.

No, merely serving pages to the world (that happens to include the EU) does not mean you have to follow the GDPR. That is only the case if you cater to EU residents specifically (e.g. by taking payments in Euros).

We've had them up long enough for somebody to have generated some hard numbers by now. I wonder what the numbers look like on percentage of users that modify the settings from the default?

I don’t have a cookie banner on my website. You know why? Because I don’t track my users with (or without) cookies. Maybe you should stop doing it on your website, and then the cookie banner can be removed.

US companies started implementing it as a result of CCPA. So it's everywhere now