One of the biggest legal changes in the past few years was a new direction altogether to determine anticompetitive behavior.

If I recall correctly, FB’a recent acquisition of giphy (?) was also stopped on anti competitive grounds.

Point being that this stuff isn’t necessarily easy, the other side has very good lawyers who tell them what not to do on top of this being novel.

It’s not unique at all. The old trusts that were broken up at the dawn of antitrust (that’s where the name comes from) were of a similar structure and even more dominant.

The “consumer harm” test (really “short term consumer cost” test) was a deliberate crippling of antitrust doctrine during the Reagan era. The process is only now starting to return to its roots.

Consumers can be harmed by a low price when it is predatory, either to drive out competitors (so price can go up later) or to transfer business to a monopolist who can charge higher prices elsewhere and/or stave off competitive technological or entrepreneurial threats. This doctrine blessed such predatory tactics while pretending to be a high-minded consumer-friendly approach.

I'd like to cynically say that the rhetoric and arguments have finally started to return to their roots within this particular administration, but there's no evidence of a process actually being carried to completion yet.

Of course the rentiers can still squash things, and will. But I think the tide is against them.

Matt Stoller has done great work both documenting this and contributing.

Failing that, you could read his blog. He's the most succinct and thoughtful writer on the topic today.

This is not some "hidden history" -- they were quite proud of it. I watched it unfold in real time.

I find it fascinating that the Reagan administration (and the bevy of organizations around it) moved taxonomy and models such that the democrats (in particular Clinton) discussed economics and antitrust using the republicans' framework, just as the republicans still think of the economy from a Victorian/Marxist framework (Labor Theory of Value, capital expressed only in smokestack industries and finance, etc etc).

It’s heartening that things are shifting, but it’s bound to be slow progress.

The fundamental hope that democracy is based upon is that they will eventually (in finite time) grind all problems, even if not right away.

It's important to remember that 100 years ago (if you squint, 150 years no contest, there basically was no democracy in the modern sense (universal suffrage, no special rights), kings and queens and aristocrats still held most power and wealth in most places around the world. It's very easy to forget that the descendants of these aristocrats in places where lasting measures against the lingering power of the old rich weren't taken (i.e., they weren't executed and their wealth was left intact) are usually still in the richest 100 families of the country and wield considerable political influence.

I will stop here now because dang has repeatedly asked me not to make statements likely to inflame "boring" political discussions but I do think that as more and more people realize that they are not in fact temporarily embarrassed millionaires the old power bases of corruption and uncapped dynastic wealth will follow the way of dynastic hegemony over nations.

I no longer believe this to be the case. I am pro-democracy but I am not a suffrage maximalist. During the last election cycle I looked at the myriad of obscure positions I had the right to vote for on the ballot and I realized most of what I was voting for I was unqualified to weigh in on.

For instance, why do I vote for the Railroad Commissioner? Why do I vote for my local county's community college board of trustees seat 5 and 6? You could say that I should be informing myself before I go to cast the ballot. While you wouldn't be wrong for saying that is my responsibility as a voter, I can assure you virtually no one actually does this. I also find the down ballot candidate's pitches so generic and milquetoast that there isn't enough substance to actually distinguish between them.

What's worse is that the obscure positions have either unopposed candidates or just two. And most of the time, people just look for the (R) or the (D) by the name and that's what they go on.

"more democracy" simply means we do not just give one dude (and it's still most often a dude) the keys to power and call it a day and instead think about how to distribute this power so that it stays functional enough to produce public goods, but smeared around finely enough that it's hard to abuse.

:-(

Fortunately antitrust appears to be moving back to its century-plus-old roots.

I always thought this. I was recently introduced to the concept of “practice prevails” whereby if you’ve been routinely flouting a rule, and that rule has never been enforced that you can claim the rule is obsolete. I think it’s mainly confined to contract law but it does help to explain the standpoint of those who oppose such retrospective regulatory measures.

I hear what you're trying to say, but there are problems with this basis.

There is no clear established legal-nexus between the your purported statement of "protecting consumers", and banning the use of any data center owned by multi-national corporate entities who host protected data exclusively internal to the EU in accordance with all known EU data-protection regulations. Now to be clear, I'm not saying this is your statement or position.... but it's what you wrote.

So it boils down to a false-dichotomy; This is protectionism, but not to be confused with consumer protection. The protectionism is the kind protecting EU owned & operated data centers.

I think analogies are awful, but to give an analogy it's like banning a product sold by any multi-national corporation simply on the basis they are not originally EU multi-national corporations. For instance, banning the sale of McDonald's chicken-nuggets, because McDonald's is a foreign corporation, and then alleging the corporation violate the consumer data protection laws because the nuggets are not EU nuggets

It makes no sense because there is no causal-link or rational basis, it's all irrational. Just because irrational laws have been the norm for a while, as you say particularly in Germany, doesn't make them rational now. That's a variation of the ad-populism fallacy.

I think you are mistaken here. Strong privacy laws in Germany are decades older than Facebook et al., and to some degree have constitutional level. Similar for other EU countries before the europization of the variants of national law (which actually weakened German privacy and consumer protection law in some minor details).

Big Ad companies have a core business model that is simply incompatible with the values implemented here. That is the whole secret of why there are so few Big Ad companies founded in the EU. Calling that anticompetitive is mistaking cause and effect.

I also think you are overestimating our ability to rationally observe, understand and predict things in society. Part of the reason why we have these laws is that it is so incredibly hard to predict the outcomes of any intervention.

Of course there is the threat of over-reach, but it's always there. On the other hand, we have plenty examples where lack of regulation lead to massive harm (environmental pollution, medical experiments, monopolies etc). So there is no easy solution, and "irrational" regulation is definitely on the spectrum of sane ones.

Evidence-based policy-making is rare because there is lots of policy-based evidence-making.

It’s the same with the US.

The moment you want to monitor your users' behavior for whatever reason, though you need to ask them. They are not your guinea pigs.

I strongly believe you can have a great business, even do advertising, without selling out your customers/visitors.

And blaming the law because industry is using dark patterns to circumvent it seems odd to me.

Do I like these consent banners? Most of them not. Neither as consumer, nor as the one implementing them. But the hiddeous ones to me are a symptom of a rotten company not valuing their customers. Not a symptom of a bad law.

Then why would you implement them (assuming your company is not rotten), if not for compliance with regulation that failed to find the sweet spot?

But you might find it easier (or whatever) to integrate Google Analytics than set up your own Matomo instance, so you'll have to ask the users if they want their data shared with Google.

It's not as complicated as most companies want to portray it.

edit: I had our company website at this point. Locally hosted fonts, no external tracking, own Matomo instance, everything was great and I could finally remove the cookie banner. Then marketing came around the corner, wanted to run paid ads on LinkedIn and Xing, also it was "sooooo comfortable" to link Google Analytics with Google Ads and see how your campaigns perform. Now there are more external scripts than ever, we have Cookiebot (let's see for how much longer :-D) and a cookie banner with the usual settings and lawyer copy on it. I hate it.

I don't think that it is always trivially obvious how to correctly comply, like some other comments claim. Especially when you really want to eliminate all legal risk and avoid Abmahnfallen.

IANAL, but if the people/company running it is the same entity I think you should be fine. Browers on the other hand will only look at the domains and think it's somebody else... So... Yes, better safe than sorry.

Because they are the path of least resistance. Companies don't want to spend any time figuring out how to actually be compliant, so they slap these cookie banners on, most of which aren't compliant.

Also they're not "cookie banners". You don't need to show a banner to set cookie that your site needs to function (such as login, etc.).

They're "we're doing stuff you didn't ask us to and sharing your data with over 300 other companies" - banners.

I use klaro.js as a consent tool. No need for a CDN.

I configured it such that on the first screen you can opt in, opt out or choose to choose.

I hate the ones (them being not in line with the regulations btw) that force you to go to the second screen for saying "no".

It needs to be as easy as one click for yes or no.

Absolutely. At the very least it should be legally required that "Reject all" is at least as easy and prominent as "Accept All" if we already started to legally require clicks for consent.

Yes, this is what it feels like.

Now.

Because the industry is in a Wil-E-Coyote moment. Their business model has always been more than shady, a shadiness that has now officially been defined as illegal.

Industry response to "you are not allowed to do this" has been "but I really wanna", and they think that they can get out of complying with the law via these dark patterns about tricking the user into giving them "consent".

All of this crap is illegal.

Tricking users into "giving" you "consent" is illegal, as is coercing them. The law is very clear about this.

It will take a while for the wheels of justice to grind, but grind they will.

In the meantime, we apologise for the inconvenience, but the world will be a better place.

Honestly it is, we are dealing with huge amounts of medical-tier PII data(not actually medical, but as vulnerable as as protected).

It's just that companies are reluctant to give up the profiling powers they get from their current system.

For obvious reasons, companies choose not to comply in that way, and ambitious companies will instead often test the limits of what the regulation actually prohibits.

This situation was wholly predictable the minute it was decided to pass laws to codify what were previously best practices. We now get to enjoy the same benefits the law has granted in the past on environmental protection, civil rights, labor practices, patents, and copyright... With similar grey areas, fuzzy and contradictory outcomes, and but-what-if attempts to augur the legal process. Not to imply any of those laws should never have been passed! Merely observing that when we use this tool to solve our problem, this is how this tool operates. The pattern is well-established and basically at least as old as rule-of-law.

If a company has to show 300 banners and asks for consent multiple times, it’s because they are doing extremely weird stuff. Legislation just made it visible.

There was a story yesterday about someone getting terribly upset about researchers probing the GDPR compliance of the website of a blogger. Some froth developed around people's mouths as the site in question was called a "victim" and any shrugs seen as "victim-blaming". (And I was thoroughly downvoted for pointing out that calling website owners "victims" was a bit more drama than was called for)

GDPR and similar legislation has, as you correctly pointed out, had disappointing results. There is no doubt that stronger regulation is needed to stop companies essentially spying on users for financial gain - just as there is no doubt that regulating this in a way that both helps, and doesn't just become an expensive waste of time, is hard.

And that's why I find the line of argumentation that says 'the consent law is fine, just give it more time' a bit frustrating. It is such a waste of time and energy, while it does not really tackle the core issue of data abuse, but it negatively impacts everyone's user experience.

I think that the law is not well adjusted plays a major role in the situation that we have today. We are in the fourth year of the law and I see no impulses that would lead to a world without full page overlays on most websites on first visit, where the only primary action is "Accept all". While I as a techie take the time to reject most cookies, the more tech-illiterate part of my family has already sold my firstborn child for a couple of news articles.

Every time I see one of the GDPR popups it incentivizes me to think "do I really need to access this content?" - and more and more often I just think "no" and delete the bookmark or make a mental note that "this website isn't worth the click".

That's actually a good question... how would you do that. I guess the website would need explicit consent to save a cookie with the information that you consent to nothing else.

They remind me of those little fan-like gadgets people sell online that goes in your car air intake and supposedly gives you more horsepower. I've always been amazed that there is enough of a market for things, that rather obviously do not work, for companies to actually bother making and selling these things.

That being said I don't really agree with the premise of your comment. A law that isn't applied shouldn't be considered a law, and saying "you should just have applied the law from the start" isn't always fair. For instance, in France, woman were not allowed to wear trousers until maybe 5 or 10 years ago. French privacy laws 1980s already had a real scope on privacy, but it was barely applied. Applying a 40 years old law out of nowhere would simply be targeted attacks to the current disgraced company.

Now, GDPR is really recent, so I won't put it in the "hasn't been used for so long it's dead" basket. Though I kinda think that the portability part of GDPR will (I'm crossing fingers it will still happen, because I think it's the best part)

That law was a dead letter from 1800. It’s the equivalent of the old English law memes, like that you can shoot an arrow at a Welshman within the precinct of Hereford.

It's not 200 years old, but it definitely is OLD.

(Disclaimer: Legal theory is slightly simplified, but true to principle)

But I'd argue that the roots of Germany's focus on privacy are not only rooted in protection against the state. Yes, constitutional fundamental rights are protections against the state (Abwehrrechte), but the legal interpretation established by the supreme court also draws on an ideal-typical perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society.

Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's also the root of informed consent, of course. So in this sense, privacy protections are a safeguard against dumbing down citizens, and I think the general intent is indeed valid.

That's excellent, it's these type of arguments that get too little attention when digital "privacy" gets discussed today.

This is a foundational assumption of post-Hobbesian democracy, which asserts that power originates from the people and is delegated to the government (contrast to other political philosophies such as divine right of rule etc).

so the consequence of 'dumbing down citizens' is a destruction of the legitimacy of the government. Just as if the king rules by divine right, he would be silly to promote atheism.

I live here. Privacy awareness is very high, compared to everywhere else I've personally been. Nobody likes having their picture taken, nobody likes being filmed, nobody likes answering questions for strangers. And they'll tell it to your face too.

Go onto Google street maps for Germany and see how far you get.

And yet, people are amazingly complacent în other aspects ("War halt immer so"). For example, your apartment's doorbell has to have your last name on it: someone with an unusual name could conceivably be tracked down just by postal code. For another example, when I was blogging, I had to display my full name and address in an Impressum on the website - dox myself, so to speak.

And, of course, the Berlin government forces people to register their address, and allows everyone to query it, because why wouldn't they:

https://service.berlin.de/dienstleistung/120732/

Meldepflicht is in all of Germany, it's not a Berlin thing.

> and allows everyone to query it, because why wouldn't they:

This is highly controversial, for exactly the reasons you might think.

However, this is an "Einzelauskunft", so you get one address per query, and you are not allowed to trade in those addresses or use them for advertising. Also, if you want more detailed info, you have to provide a valid reason for wanting them.

Same principle as with password hashes were you might prefer a slow hashing function with a work factor.

I don't necessarily agree with the streetview restriction, but also don't really mind not letting Google make pictures.

You actually don't need to put your name on your doorbell, but that at least has very practical advantages for yourself.

Berlin is a failure of government since time immemorial but I am not familiar with this law.

ephemerality. If you think your neighbor is violating your privacy you can take it up with them, you think you can take on Google? There is no incoherence here. If you live in a neighborhood, there are of course certain natural limits to your privacy given that you're part of a community.

But digital privacy laws first and foremost protect citizens from entities well beyond their control, they protect them from automated processing, storage of their data beyond their own borders, and privacy erosion in ways they cannot control and at a scale that creates entirely new problems. Of course nobody has absolute privacy, everyone can overhear a conversation, but this does not end with a surveillance state or control society. Corporate entities or governments processing billions of messages in real time does.

Uh...whose last name would you put on that doorbell? Someone else's who doesn't live there?

I've never heard of a delivery person say they wouldn't delivery an item because there was no name on the bell or that the bell name wasn't consistent with the recipient, and those guys are experts at excuses for why they can't/won't make a delivery!

That's exactly what our post will do to you. (And not just because they don't know what doorbell to use if there's no name on it.)

People constantly complain about the greedy tech companies collecting data where ever they can and proceed to complain about the strict privacy regulations in the EU in their next sentence. Forcing private individuals to put their full name and address into the imprint of their personal website, which often enough isn’t even run for profit, seems absolutely absurd and very publishing hostile.

To me it’s more and more starting to seem like people don’t actually care about their privacy, they just want to be against something.

Wait...so people can decide which facts about their life they want to remain private and which they're fine with you knowing? I thought that was the whole idea of self-determination. Where's the catch?

Your building's facade is whatever you decide it to be. It doesn't matter what other people think, it's not up to them. So, likewise, you're not the one to say that someone's building's facade is not private. A major part of respect for other people's privacy is letting them decide what they're private about. I mean, sure, lots of impolite things you may be doing are still legal. Laws don't define courtesy.

In my case it is actually the other way around. I had no problem with street view but would never list my number in the public phone book.

I selectively decide what to attribute to my name as long as I am able to. So that I for example decided that I am OK with the need to have an imprint on my website and my full name and address being tied to what I write there.

I understand that this isn't for everybody, but I decided that I was okay with attaching my name to my writing.

But I am not okay with random businesses being allowed to spam me via online generated profiles without me knowing or consenting.

I know there are a lot of things that still should be massively better in Germany. But knowing how easy it is to comply with the GDPR and relevant other regulations I actually like them.

That courts are ruling against this, in whatever way, is still a good sign.

When you get to the point where judges and lawmakers have, more likely than not, personal experience of threatening emails containing private information, there's a lot of incentive to reduce the amount of data collection - and correspondingly, a lot of popular support for the idea.

Even if that is the case, it would still not be an argument against such regulations.

If someone else is okay with the data transfer, he can opt-in if he wants to. I should not carry the burden of having to opt-out of it.

You are wrong. I have been living in Germany for almost a decade and it absolutely does. In fact, it is one of the things that I appreciate the most about German culture.

Maybe privacy preferences are a bit incoherent sometimes, but nothing is perfect, and I much prefer that we err on the side of protecting privacy too much than too little. Especially in this brave new world we live in, were culture is being slowly but surly manipulated by powerful interests to erode the right to privacy more and more.

https://joinup.ec.europa.eu/sites/default/files/document/201...

See page 55 for per country chart.

It's sadly the opposite; It's so normalized that a whole generation was born into it and don't even see anything wrong about it.

All a lot of them see is how Google is giving them "free services" and how Facebook allows them to make "free friends", and then they declare; That's the web, and that's how the web has always been and how it should be.

And who can blame them; They never knew any other web than the glorified digital mall [0] it has mostly become.

[0] https://staltz.com/the-web-began-dying-in-2014-heres-how.htm...

I find it problematic that the university requires any cookie consent whatsoever in the first place. They are a public institution (Körperschaft des öffentlichen Rechts), not even a "company" but state-owned, and they run basically a static website and shouldn't have a need for cookies. Any "member" area (students and faculty) would require an account anyway, where you can and have to ask for all kinds of consent during signup anyway.

I get the Danish company doesn't want to run a CDN (with DDoS mitigations and all that) on their own, and it's a real problem that the EU economy snoozed when it came to creating competitors to Akamai, Cloudflare, AWS/GCP/Azure. There is a sliver of hope that court decisions like this will create a "demand" for such platforms within the EU, and that finally some companies with some "investment" money to spare (we still have plenty "rich" companies) will fund that. Or maybe at least the US providers will find way to create EU "subsidiaries" which are actually legally shielded from US (and other non-EU) law.

Totally right, and also

> If someone else is okay with the data transfer, he can opt-in if he wants to. I should not carry the burden of having to opt-out of it.

so much this. If something is spiraling out of hands it is the cookie usage, which is 99% AD tracking.

The current law is badly implemented, or lead to bad implementation. Now almost every site asking your for their necessary or "helping" cookies, most often using dark patterns to trick you into just accepting all - and because you get this stupid cookie prompt on every page now, everybody just wants to click it away as fast as possible, which misses the target totally, too :(

Still, its not data protection spiraling out of hand, but that basically every site, even ones where I don't login to or want to drop off any other data, but just fetch a small information, wants to set cookies is ridiculous. We all should have never accepted that, but too late?

[0] a huge amount of misinformation going on, making people think there would be live cameras showing them on street view. At least to me, it felt like manufactured outrage by people who didn't understand what was going on (neither the instigators, nor the outraged).

edit: It was mainstream enough that there were articles about it: "Webforscher Humer glaubt, die deutsche Skepsis basiere auf falschen Vorstellungen zu Street View. Viele Menschen würden davon ausgehen, dass Google Live-Bilder übertragen wolle" - https://www.onlinekosten.de/news/webexperte-deutsche-versteh...

I remember more from the local press back then. But it's hard to find sources about it now.

so it kind of depends on what you mean by "I'll be going to the next day and prepare accordingly."

I know several people who have blocked their houses on Google and absolutely none of them had this assumption. Anecdotal, I know, but in the article there is zero data backing that assertion.

And then they wrote pieces about what kinds of idiots didn't want to have their houses filmed. And about people who had their shop front blurred, because people in the 5th floor didn't want the house to be in the clear on street view.

It was outrage porn at it's best.

And one of the things that made me decide that I maybe should do something else with my life.

that was in no way a mainstream "idea" about it.

The reason to allow data transfer to the US for (arguably) trivial data is that a private entity might choose Akamai as their subjectively best option. Restricting data flow for (arguably) no good reason puts restrictions on other who can invoke their own fundamental rights. Leaving aside that it’s also not great to force the technologically inferior solution for (arguably) moot policy reasons.

As to the argument of informed consent, I think that’s another severe misconception. In my opinion, consent is only one option to legalise data processing. The fact that GDPR (and older German legislation) lists legitimate interest is important. We should — in my opinion — not fall for the fallacy that data is a whole different universe that can be split off from everything else. For most of our lives, data just flows with contracts, relationships, torts and whatnot.

I do acknowledge that in the case, the university is Public and does not have (relevant) fundamental rights. Also that web analytics is likely one of the consent only scenarios. But we’re drifting into theory anyway.

Now you could certainly argue that this right is irrelevant/not needed, but you didn't bring forth arguments to this extend. Without this your argument is largely about businesses being inconvenienced (many European countries don't give businesses fundamental rights like they do for people)

And what if it's China/Russia, and its 'best' because it pays for private data? Does the argument still hold?

At the end of the day, this is simple: is it my data, or not? If it's my property, why should someone elae have freedom over it?

and your search results may be use to implicate you of homosexuality, or by extension your relatives in that country, and the country's police are monitoring search histories.

So much this.

This is evident, for example, from the very first sentence [1] of the GDPR:

The protection of natural persons in relation to the processing of personal data is a fundamental right.

[1] https://gdpr.eu/recital-1-data-protection-as-a-fundamental-r...

US law grants the US government broad (some would argue over-broad) reach into the digital activities of US-based companies independent of where those companies physically house their data. The great truth of the Internet is that it's a location-disrupting technology: modulo latency, the computer next to me on my desk and a computer in Sydney, Australia are logically exactly as close (by which I mean: fully equivalent whether I'm fetching data from one or the other as a client). But of course location still matters for the oldest location-focused institutions on the planet.

I predict that unless higher courts just decide to disregard the reasoning in this case, the resolution here will be either an international treaty between the US and the EU to clarify data access rules here or a simple jurisdictional mess: whether an EU citizen's data can be sniffed by a US company from computers in the US will be entirely up to who's government cares most.

What I am thinking right now: How will this affect me as European wanting to access US sites? There are already a bunch of sites that completely exclude European traffic on IP level.

It's great to have data privacy. I am totally for it. But it comes at a cost. People are not willing to talk about this cost, let alone take it into account when making a decision.

You get to live in a place that has (democratically) decided to put a particular cost on privacy. That cost being that you don't get to benefit from the cheap-ness of low-privacy offered in other places.

And we don't talk about this nearly enough. Everybody loves being able to buy super cheap clothes from sweatshops in Bangladesh. Everybody is still going to enjoy the football world championship in Qatar, played in stadiums built by what's effectively a form of slave labour.

We should definitely enforce our humanitarian values also through our trade and other agreements, otherwise they're meaningless.

Despite some politicians best efforts and desires, there's no practical way to stop someone 'importing' privacy damaging web traffic, so the risk of non-compliance is being loaded onto foreign website operators. Therefore should a US website desire to follow EU laws, there would be no restriction on them being accessible to EU people.

No matter how much privacy laws and regulations occurs within EU, it is unlikely that companies like google, apple, Microsoft or amazon will ever be willing to completely give up on the European market. There is simply too much money to give it up and have competitors take it. The websites that might be willing to exit the market is those that already have very little stakes to remain, like American news sites that focus on specific regions and demographics in the United States. For HN readers we tend to see those for time to time, but I doubt many other Europeans notice much of sites that already exclude European traffic.

changes VPN location to US

"Ah, an American, welcome!"

Everyone should be using a VPN. Of course, "Which VPNs can you trust?" ends up being a valid question and I'm sure that landscape will continue to evolve for the foreseeable future.

Everyone who accepts the rule of US companies.

If you have very specific needs, there might be something better than it. But no one ever got burned by choosing Mullvad.

What you are complaining against is that some sites are built around selling user data and EU makes it hard to do so. The cost you are talking about is your inability to form certain contracts. Every regulation comes at certain cost. However, in this particular case the data protection and safeguards against selling of such data are the basis of regulation, not the consequence. GDPR is born to enforce this cost and this cost has been integral part of surrounding debate.

It is not people who are not willing to talk about this cost, but rather data broker lobbyists, who try to sweep this cost (data protection) under the rug who do not want to talk about this cost. Every time someone makes a counterpoint against broad statements protecting data broker interests (e.g. personalized-ad supported websites cannot exist profitably), that is the debate you are looking for.

This is actually not true.

If I understand your example correctly, you refer purely to the point of view of a citizen, not a company. In that case, I think you are right. It has drawbacks for those citizens that also benefit from it. This was considered when the regulation was created, and some balance resulted.

I think the basic problem is that GDPR is one of those "global" laws - everyone has to follow it, everywhere. This is similar to what the US has (effectively) been doing for a while, perhaps the reason why it became similar. Either way, I consider it as wrong. No law should go beyond a country's border, unless a separate agreement between countries was made. From my point of view, it would suffice to force European companies to not use any services by those who do not comply.

The Abmahnwesen never dies.

https://time.com/5290043/nazi-history-eu-data-privacy-gdpr/?...

Not only did none of us live during the Nazi-Era, but most of us that lived at least during the Stasi-Era (in the West) are routinely falling short of living up to their own moral standards.

They champion getting rid off tax-privacy, they champion getting rid off non-digital currency, they champion blocking social-networks because of "foreign desinformation" (i.e. domestic opposition), they take no offense that a think-tank owned for-profit media-conglomerate does the domestic deletion and blocking of social media accounts (Bertelsmann > Arvato -> FB/Twitter/…).

And most hilariously, progressive luminaries like Daniel Cohn-Bendit or Volker Beck – which during the 1980s gained political traction by "fighting" against having A NATIONAL CENSUS AT ALL – are nowadays championing throwing out medical-data privacy alltogether and having to hand out your unlocked phone to the police at their whim.

(Needless to say how cultural chest-pounding thouse luminaries were in the 1980s)

Can you provide some sources for that, I haven't closely followed German politics in recent years (as I've been living overseas), but I'm quite surprised that DCB would champion police search powers like that.

It leads to some funny statements, to be sure. The woman who said she felt like Sophie Scholl because she had been in coronavirus lockdown was one example - but honestly, if you mess with somebody's parking place, they're about two sentences away from saying you're literally the NS-diktatur.

Still, if it leads to a sense of urgency over privacy, I'm all for it.

Do we actually have any proof of this, over the past years?

Most of these legislation are a big hurdle for startups (e.g. you have to have a "chief privacy officer" for GDPR) but at best a hiccup for big tech (no, million, even billion dollar fines are nothing but a hiccup to their uninterrupted business models).

I am a consultant. My colleagues and I work for a number of smaller and larger companies in the Nordic countries and elsewhere.

My feeling is this isn't as big a problem as HN makes it out to be.

As a small company it seems you'll get questions and free advice first, and then only you'll get fined unless the violation is intentional or so severe that you should have realized.

I guess that it is much bigger problem for the megacorportations. I guess in addition to the fines doled out so far they've also spent countless hours both at work and at night to try to get passed GDPR, and also I guess it has slowed down internal processes quite a bit just like the Sarbanes-Oxley Act (SOX) did a couple of decades ago.

It is really easy to comply. Even if you want to use specific services for which there is no alternative.

But more often than not there are alternatives (for cookie consent, for analytics, for hosting, for CMS, for newsletters, and so on).

Marketing conversion tracking becomes more effort, though. That's true. Because that would mean handing your user's data to the big monopolies like Google or FB.

Is this even true for any european country? Don't get me wrong, this is vastly applies right now and the only problems appear at a high level, but If i'm not mistaken no european country has a fundamental text that protects what you're talking about.