Yes.
Absolutely.
dont blame the lawmaker for participants bad behaviour?
well, ok. allright.
but i DO blame the responsible authorities for licking the misbehaving participants' boots
Ok, but they are enforced. So this entire line of reasoning makes absolutely zero sense. If your demand is that every infraction is enforced immediately, then you will be disappointed. Such things take time.
> i DO blame the responsible authorities for licking the misbehaving participants' boots
There's a single European country that does this (Ireland) and it is definitely a stain on an otherwise healthy situation in terms of enforcement. It is not fair to attribute their willful ignorance in the face of plain bribing to the rest of the enforcement agencies.
Fortunately organizations like NOYB (with Max Schrems) are doing exactly this: https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner... Once there are a few high-profile cases with high fines to set a precedent, this hopefully changes the way companies handle cookie banners.
How many sites have you reported?
[0]: https://edri.org/our-work/the-eu-parliament-takes-strong-sta...
[Recital 32]: https://gdpr-info.eu/recitals/no-32/
A solution to a poliical problem is political, not technical.
And a fundamentally bad one: providers' incentive is to make it easy to get consent and hard to refuse.
I don't know what policy is better than this, but right now, we only get more annoyance without any benefits in privacy. Pretty much every page I've visited issues 3rd party requests before I consent to data sharing.
Most of these banners violate the GDPR even before they're showing up, because the GDPR actually restricts your ability to embed non-first-party content without consent. That's why Google Fonts violates the GDPR, for example. Arguably every vanilla Wordpress install violates the GDPR because Wordpress embeds something from s.w.org on every page (presumably for install count / analytics reasons).
This kinda sounds like a bad thing but it's not. It's actually a huge boon, because it's an excellent legal excuse to get rid of embedding stuff from 213789 origins and CDNs, which only has negative performance effects since caches have been origin-segregated for years, meaning that even if another page uses the same jQuery version from cdnjs, it will be downloaded again anyway.
Hard disagree. I've been racking my brain as of late trying to decide if default apache access logs violate the GDPR, and stackexchange searches on the topic seem to confirm the confusion.
If the legality of data collection hinges on what is considered necessary for service maintenance in the eye of a judge, the law is not clear.
https://en.m.wikipedia.org/wiki/The_Ensigns_of_Command
The other aspect of EU law that always gets US companies is that penalties are large enough to actually be penalizing. In the US companies can basically ignore the law until they get caught, pay a token $100,000 or $1,000,000 fine (which sounds impressive in all the papers), then invent a new interpretation of the law and go do it again. In the EU the regulators start looking at percentages of income during the entire time the illegal activity occurred, so again the US companies are caught completely off guard when they get asked to forfeit billions of dollars.
This can change, but enforcement and courts by nature are slow. With EU courts striking down asymptotic consent banners as illegal, sites are spooked, and you now see sites adding a "reject all" button next to the "accept all". I still have hope we get there.
Surprisingly the UK are trying to rid or weaken GDPR significantly after brexit.
The only way to fix this problem now is through strong legislation.
My anger is directed towards the criminal websites that seek to circumvent the spirit of the law (most if the web today)
If you've found some, please share.
... It's not even clear that it's safe to log IP addresses in the style of a default Apache configuration on a static website without user consent.
It's completely predictable that there are people who don't want to comply. Collecting personal information is a lucrative business.
Re. Website logs: in fact it's perfectly clear that a website log retained for the purposes of site management is fine. It's on the face of the regulation.
Right, collection for the purpose of running the site and all that. But does that mean "I run my site without having ever configured apache's HTTP access logs off the default, but I never read the logs" is fine? Because that sounds like collecting more PII (in the form of stored IP addresses) than is strictly needed to run the site. https://law.stackexchange.com/questions/42438/do-default-apa...
... and that's the problem and the reason that it's probably wise for even site administrators who aren't doing advertising-related data collection to pop the banner. Because the answer to that question is on the other side of a judge's ruling after a very expensive lawsuit. Better safe than sorry.
The law, as written, has entirely too many "The resolution of that ambiguity is on the other side of a judge's ruling after a very expensive lawsuit" for people to have not predicted a million banners. The defaults of the most ancient tools we use to host websites are, under the GDPR, ambiguously compliant.
Frankly, I don't think someone with that attitude should administer a server that's connected to the internet.
At least, every small blog and personal site that hasn't just given their content to one of the FAANGs already to do those jobs for them (which will, of course, "solve" these problems by throwing a cookie-consent banner and hooking the content up to their view-tracker of choice).
I disagree.
As far as I can see, GDPR enforcement is not heavy-handed. You get a warning before any attempt at enforcement; then you get a modest "warning" fine.
Also, I'm not aware that the silly cookie banners provide any protection against GDPR enforcement; it's how you handle the data that matters, not a two-liner banner offering [OK] [Later] buttons.
If you want to "be on the safe side", handling data correctly will help; cookie banners won't.
https://news.ycombinator.com/item?id=30402052
... and again, the problem is "correctly" is in the eye of a judge after an alleged violation has occurred.
Regarding Apache logs, a default install of logrotate will probably bring you into compliance (not sure, haven't looked into it lately). Scrubbing IP addresses from Apache logs defeats the purpose of the logs; you need to know what IP addresses are attacking your server.
To reach the stage of a modest fine, you will have to ignore that warning and advice, effectively saying "So fine me, regulator!" And if your violation isn't egregious, you'll be a long way down the list of forthcoming legal actions.
Basically, making a reasonable effort to understand GDPR and come into compliance is probably both a protection against action, and a defence against conviction.
It's not hard to comply with the GDPR, unless you are running a business that depends on violating GDPR.
IANAL.
I'm not convinced yet it is a net positive. For sure it increased senseless bureaucracy by a huge margin (not just the clicks on web sites, it creates more work in other places, too).
The real players collect just as much data as before, but private people can't do most basic things anymore.
No.
Google Tag Manager could be declared illegal on the outset, with a 5 to 10% fine for Google if they continue to offer it in the EU. Do a top-down assessment of the usage of Google Tag Manager in the largest e-commerce users in Europe. Fine them as well. At the end of the day privacy enforcement could easily pay for itself.
(Edit: After typing this I think you were writing from a US perspective. I think GDPR is a big win as well, but enforcement is feeble ;)
are you certain? would be certainly nice, but i dont believe there is a majority in the US that would support such a change. I mean there are probably more individual people interested in doing that than not, but I bet in comparison there are more individual $$$ being invested in keeping data privacy laws as lax as possible
Isn't that the whole point of brexit - to get rid of various EU customer protection laws and regulations?
In reality, GDPR is pure nonsense. It's a serious burden for anyone putting up a site. Any site. They all have cookies. All of them. It is so bad, there are now services taking care of this, because it's so much of a bullshit that people need to rely on others to get it right.
You'll probably spin this as a net win, right? Because more businesses, right? Right??
The odds of 99% of the people not simply clicking "accept all" are slim to none and anyone insisting otherwise would make himself look like a moron. It's like you're assuming the masses out there are actually thinking about things.
They don't! It's not how people work! They just click it away and are done with it, because it's super fucking annoying to constantly click that bullshit away and it does literally nothing for us people, no matter how much anyone would want to insist that it does, theoretically, do benefit us.
The GDPR is pure nonsense. It is not made for the people. It in fact completely ignores how people operate.
Just as a very brief note: it's not really about cookies, it's more about how companies should store data about people and what kind of rights people have concerning that data.
ALL IT IS
IS AN ANNOYING WINDOW
WHICH HAS TO BE CLICKED AWAY!
That's what I mean by "detached from reality." For you it's something glorified, but the vast majority of humanity do not give a flying fuck and just think it's annoying.
You think this is good!
It's not!
You're just so deep in that bubble, you don't fucking recognize that your bubble isn't actual reality!
The GDPR is about protecting personal information of EU citizens, giving them rights to demand access to data that is held about them, and giving them rights to request deletion of any personal data that is held about them.
To be super clear, I'm not saying that cookie consent pop-ups are good - I also think they're not really serving any real purpose. But this fact has very little to do with the GDPR!
> As a EU citizen, i hope that our ineffectual administration at least tries to fight this somehow. Of course, there is little hope.
GDPR is thanks to the EU and I wouldn’t say it has no effect.
It seems like you’re contradicting yourself with these two paragraphs.