Did it really make the world a better place? Most sites collect as much data as ever, but now we need many more clicks, and can't have nice things like photos from kindergarden parties anymore.

I'm less likely to use a site that offers obnoxious cookie consent forms, and I think I'm better off without them. so yeah, it made the world better for me.

My anger is directed towards the criminal websites that seek to circumvent the spirit of the law (most if the web today)

To my observation, there are no sites with more than a dram of content on them that haven't been compelled by GDPR compliance to put an obnoxious cookie banner up.

If you've found some, please share.

If you need to set a cookie for the correct operation of your site, then you don't need a cookie banner. The banners are a middle-finger to the GDPR.

... but "correct operation of your site" is in the eye of a judge and can't be evaluated before someone brings suit, so "better safe than sorry" behavior (at the cost of user time) is completely predictable.

... It's not even clear that it's safe to log IP addresses in the style of a default Apache configuration on a static website without user consent.

> completely predictable

It's completely predictable that there are people who don't want to comply. Collecting personal information is a lucrative business.

Re. Website logs: in fact it's perfectly clear that a website log retained for the purposes of site management is fine. It's on the face of the regulation.

> It's on the face of the regulation.

Right, collection for the purpose of running the site and all that. But does that mean "I run my site without having ever configured apache's HTTP access logs off the default, but I never read the logs" is fine? Because that sounds like collecting more PII (in the form of stored IP addresses) than is strictly needed to run the site. https://law.stackexchange.com/questions/42438/do-default-apa...

... and that's the problem and the reason that it's probably wise for even site administrators who aren't doing advertising-related data collection to pop the banner. Because the answer to that question is on the other side of a judge's ruling after a very expensive lawsuit. Better safe than sorry.

The law, as written, has entirely too many "The resolution of that ambiguity is on the other side of a judge's ruling after a very expensive lawsuit" for people to have not predicted a million banners. The defaults of the most ancient tools we use to host websites are, under the GDPR, ambiguously compliant.

> But does that mean "I run my site without having ever configured apache's HTTP access logs off the default, but I never read the logs" is fine?

Frankly, I don't think someone with that attitude should administer a server that's connected to the internet.

Fair, but I'd wager that's the average case for small blogs and personal sites... That most administrators of such sites don't read their access logs until there's a problem.

At least, every small blog and personal site that hasn't just given their content to one of the FAANGs already to do those jobs for them (which will, of course, "solve" these problems by throwing a cookie-consent banner and hooking the content up to their view-tracker of choice).

> probably wise for even site administrators who aren't doing advertising-related data collection to pop the banner.

I disagree.

As far as I can see, GDPR enforcement is not heavy-handed. You get a warning before any attempt at enforcement; then you get a modest "warning" fine.

Also, I'm not aware that the silly cookie banners provide any protection against GDPR enforcement; it's how you handle the data that matters, not a two-liner banner offering [OK] [Later] buttons.

If you want to "be on the safe side", handling data correctly will help; cookie banners won't.

Handling data correctly may not be feasible, especially for smaller users on shared-hosting solutions.

https://news.ycombinator.com/item?id=30402052

... and again, the problem is "correctly" is in the eye of a judge after an alleged violation has occurred.

The point is: the regulator simply can't prosecute every website, even if he wanted to. The regulator's goal is to achieve compliance. Accordingly, the regulator will first warn you that your site appears to be non-compliant. He will advise you on steps to be taken to come into compliance.

Regarding Apache logs, a default install of logrotate will probably bring you into compliance (not sure, haven't looked into it lately). Scrubbing IP addresses from Apache logs defeats the purpose of the logs; you need to know what IP addresses are attacking your server.

To reach the stage of a modest fine, you will have to ignore that warning and advice, effectively saying "So fine me, regulator!" And if your violation isn't egregious, you'll be a long way down the list of forthcoming legal actions.

Basically, making a reasonable effort to understand GDPR and come into compliance is probably both a protection against action, and a defence against conviction.

It's not hard to comply with the GDPR, unless you are running a business that depends on violating GDPR.

IANAL.

The GDPR applies to everything outside of purely personal/household activities - it's not limited to websites.

Yes, hence the issue with photographs of events of our children.

I'm not convinced yet it is a net positive. For sure it increased senseless bureaucracy by a huge margin (not just the clicks on web sites, it creates more work in other places, too).

The real players collect just as much data as before, but private people can't do most basic things anymore.

I'm not convinced yet that it isn't a net positive, given that a lot of what you described is illegal according to it, and said illegal behavior is being punished

"a lot of what I describe" - you mean big players collecting even more data? Not really illegal, you just have to get the users to consent somehow. Which most do anyway.

> you mean big players collecting even more data?

No.

So taking photographs of your children's life's events? Or what are you referring to?

Do we really need more or new legislation if there is still ample room for improvement on the enforcement side of GDPR. Just a not so far stretch: all or most of the GDPR supervisors now think Google Analytics is a no-go. Publish this and an intention to fine say 2% of revenue, set an expiration date six months ahead and do a EU-tender for a scraping facility finding all users of Google Analytics. Then in six months, re-scrape and send out the fines. Rinse and repeat.

Google Tag Manager could be declared illegal on the outset, with a 5 to 10% fine for Google if they continue to offer it in the EU. Do a top-down assessment of the usage of Google Tag Manager in the largest e-commerce users in Europe. Fine them as well. At the end of the day privacy enforcement could easily pay for itself.

(Edit: After typing this I think you were writing from a US perspective. I think GDPR is a big win as well, but enforcement is feeble ;)

US law makers are trying to mimic GDPR?

are you certain? would be certainly nice, but i dont believe there is a majority in the US that would support such a change. I mean there are probably more individual people interested in doing that than not, but I bet in comparison there are more individual $$$ being invested in keeping data privacy laws as lax as possible

> Surprisingly the UK are trying to rid or weaken GDPR significantly after brexit.

Isn't that the whole point of brexit - to get rid of various EU customer protection laws and regulations?