Please see the EU website itself - All normal websites are using cookies. The EU itself is doing a banner - they have (thankfully) made it a lot less obtrusive where you can still use the site now without giving explicit consent.

But this is I think the "big lie" of the GDPR folks - no banners needed, when even the EU itself and its agencies etc all use it.

So you expect random joe blow website to overthink this even further, go against what they see the EU itself doing? It's total garbage.

No banners are needed. They are required when you start tracking your users because that when you need their consent to do so. And that's quite proper.

I'm browsing europa.eu a fair while now (in a private browser session to avoid any old cookie from maybe interfering) and the only banner they show is "An official website of the European Union - How do you know?"

There are two links to the cookie page (https://europa.eu/european-union/abouteuropa/cookies_en or equivalent for the currently used language), one in the top nav bar, one in the bottom. Interestingly, that page talks about the cookie banner and how they need consent for analytics and stuff, but I never saw that.

So, given how they explicitly state that they need it for analytics, I went to my browser settings and disabled sending the DNT header - and there was the cookie consent popup.

So: State outright and by default that you don't want to be analyzed and they won't bother you.

My only question is why they see a need to do analytics. Without that they wouldn't require that stuff _at all_.

I think the point is that no one knows which activities call for consent, or what all of their transitive dependencies do, and so they show it out of an abundance of caution. As should have been predictable by intelligent legislators, which the EU generally are.

> As should have been predictable by intelligent legislators, which the EU generally are.

this is certainaly debatable

in every subject I'm a... subject matter expert in: it's been pretty bad

This is a fair point. I suppose I just meant relative to most legislators. It's a very, very low bar - which is partly understandable, given their explicit job is to be the ultimate judge of a vast range of things in none of which they are experts.

Websites could do a better job and if browser makers would get involved to standardize the popup for Accept All/RejectAll/Manage Cookies then you could have a perfect experience.

Today I hit for the first time a site that made it as easy to Accept or Reject startrek.com also many sites now offer option to delete my account and even JS APIs for tracking now have options for GDPR to not store private data. So YES things improved but are not perfect, to blame is not the law but the jerks.

As mentioned in a sister thread, europa.eu uses the browser's DNT header (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...) to see if they should bother asking for tracking.

Browser vendors tried to establish such a standard but it pretty much died when Microsoft enabled it by default for IE9 and some ad brokers began to claim that they can now ignore DNT because it doesn't actually reflect user intent anymore. (see https://www.theregister.com/2015/04/03/microsoft_reverses_ie...)

With that it became deprecated. Thank you, Microsoft and Yahoo.

You still find people here on HN that want to be tracked, they are convinced that tracking is necessary. So a browser could implement something to shut this people up, Instead of a simple flag On or off, you can start with 3 states, On, Off, Unset and you can have it set per webpage.

The DNT spec offers these three states. It also doesn't say anything about it being global, so a browser UI could have a default + overrides.

The general sentiment seems to be that "if you want it, you want it, and who would want it explictly off?"