The moment you want to monitor your users' behavior for whatever reason, though you need to ask them. They are not your guinea pigs.

I strongly believe you can have a great business, even do advertising, without selling out your customers/visitors.

And blaming the law because industry is using dark patterns to circumvent it seems odd to me.

Do I like these consent banners? Most of them not. Neither as consumer, nor as the one implementing them. But the hiddeous ones to me are a symptom of a rotten company not valuing their customers. Not a symptom of a bad law.

Then why would you implement them (assuming your company is not rotten), if not for compliance with regulation that failed to find the sweet spot?

But you might find it easier (or whatever) to integrate Google Analytics than set up your own Matomo instance, so you'll have to ask the users if they want their data shared with Google.

It's not as complicated as most companies want to portray it.

edit: I had our company website at this point. Locally hosted fonts, no external tracking, own Matomo instance, everything was great and I could finally remove the cookie banner. Then marketing came around the corner, wanted to run paid ads on LinkedIn and Xing, also it was "sooooo comfortable" to link Google Analytics with Google Ads and see how your campaigns perform. Now there are more external scripts than ever, we have Cookiebot (let's see for how much longer :-D) and a cookie banner with the usual settings and lawyer copy on it. I hate it.

I don't think that it is always trivially obvious how to correctly comply, like some other comments claim. Especially when you really want to eliminate all legal risk and avoid Abmahnfallen.

IANAL, but if the people/company running it is the same entity I think you should be fine. Browers on the other hand will only look at the domains and think it's somebody else... So... Yes, better safe than sorry.

Because they are the path of least resistance. Companies don't want to spend any time figuring out how to actually be compliant, so they slap these cookie banners on, most of which aren't compliant.

Also they're not "cookie banners". You don't need to show a banner to set cookie that your site needs to function (such as login, etc.).

They're "we're doing stuff you didn't ask us to and sharing your data with over 300 other companies" - banners.

I use klaro.js as a consent tool. No need for a CDN.

I configured it such that on the first screen you can opt in, opt out or choose to choose.

I hate the ones (them being not in line with the regulations btw) that force you to go to the second screen for saying "no".

It needs to be as easy as one click for yes or no.

Absolutely. At the very least it should be legally required that "Reject all" is at least as easy and prominent as "Accept All" if we already started to legally require clicks for consent.

Yes, this is what it feels like.

Now.

Because the industry is in a Wil-E-Coyote moment. Their business model has always been more than shady, a shadiness that has now officially been defined as illegal.

Industry response to "you are not allowed to do this" has been "but I really wanna", and they think that they can get out of complying with the law via these dark patterns about tricking the user into giving them "consent".

All of this crap is illegal.

Tricking users into "giving" you "consent" is illegal, as is coercing them. The law is very clear about this.

It will take a while for the wheels of justice to grind, but grind they will.

In the meantime, we apologise for the inconvenience, but the world will be a better place.

Honestly it is, we are dealing with huge amounts of medical-tier PII data(not actually medical, but as vulnerable as as protected).

It's just that companies are reluctant to give up the profiling powers they get from their current system.

For obvious reasons, companies choose not to comply in that way, and ambitious companies will instead often test the limits of what the regulation actually prohibits.

This situation was wholly predictable the minute it was decided to pass laws to codify what were previously best practices. We now get to enjoy the same benefits the law has granted in the past on environmental protection, civil rights, labor practices, patents, and copyright... With similar grey areas, fuzzy and contradictory outcomes, and but-what-if attempts to augur the legal process. Not to imply any of those laws should never have been passed! Merely observing that when we use this tool to solve our problem, this is how this tool operates. The pattern is well-established and basically at least as old as rule-of-law.

If a company has to show 300 banners and asks for consent multiple times, it’s because they are doing extremely weird stuff. Legislation just made it visible.

There was a story yesterday about someone getting terribly upset about researchers probing the GDPR compliance of the website of a blogger. Some froth developed around people's mouths as the site in question was called a "victim" and any shrugs seen as "victim-blaming". (And I was thoroughly downvoted for pointing out that calling website owners "victims" was a bit more drama than was called for)

GDPR and similar legislation has, as you correctly pointed out, had disappointing results. There is no doubt that stronger regulation is needed to stop companies essentially spying on users for financial gain - just as there is no doubt that regulating this in a way that both helps, and doesn't just become an expensive waste of time, is hard.

And that's why I find the line of argumentation that says 'the consent law is fine, just give it more time' a bit frustrating. It is such a waste of time and energy, while it does not really tackle the core issue of data abuse, but it negatively impacts everyone's user experience.

I think that the law is not well adjusted plays a major role in the situation that we have today. We are in the fourth year of the law and I see no impulses that would lead to a world without full page overlays on most websites on first visit, where the only primary action is "Accept all". While I as a techie take the time to reject most cookies, the more tech-illiterate part of my family has already sold my firstborn child for a couple of news articles.

Every time I see one of the GDPR popups it incentivizes me to think "do I really need to access this content?" - and more and more often I just think "no" and delete the bookmark or make a mental note that "this website isn't worth the click".

That's actually a good question... how would you do that. I guess the website would need explicit consent to save a cookie with the information that you consent to nothing else.

They remind me of those little fan-like gadgets people sell online that goes in your car air intake and supposedly gives you more horsepower. I've always been amazed that there is enough of a market for things, that rather obviously do not work, for companies to actually bother making and selling these things.