Don't blame the lawmaker for the bad behaviour of people who are trying to bypass it... If you're on such website, you know that the website itself shouldn't be trusted.

Yes, absolutely blame the lawmaker for making laws which are completely detached from how people operate. Yes, absolutely, blame lawmakers for making laws that don't actually fit reality.

Yes.

Absolutely.

the laws are teethless if they are not enforced, and playing hot potatoe with responsibilities like is the case with Max Schrems makes it all laughable.

dont blame the lawmaker for participants bad behaviour?

well, ok. allright.

but i DO blame the responsible authorities for licking the misbehaving participants' boots

> if they are not enforced

Ok, but they are enforced. So this entire line of reasoning makes absolutely zero sense. If your demand is that every infraction is enforced immediately, then you will be disappointed. Such things take time.

> i DO blame the responsible authorities for licking the misbehaving participants' boots

There's a single European country that does this (Ireland) and it is definitely a stain on an otherwise healthy situation in terms of enforcement. It is not fair to attribute their willful ignorance in the face of plain bribing to the rest of the enforcement agencies.

Enforcing requires court cases and time. That's how law works, unfortunately.

Fortunately organizations like NOYB (with Max Schrems) are doing exactly this: https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner... Once there are a few high-profile cases with high fines to set a precedent, this hopefully changes the way companies handle cookie banners.

> the laws are teethless if they are not enforced

https://www.enforcementtracker.com/

> the laws are teethless if they are not enforced

How many sites have you reported?

There are solutions to most of that, e.g. https://chrome.google.com/webstore/detail/consent-o-matic/md...

Those are (nice) solutions to a problem that shouldn't be allowed to (legally) exist. The industry shouldn't be allowed to play clever with the ways to coerce their users into giving up their information just because they know that most of those users are not interested in navigating difficult dialogs.

They shouldn't be allowed, and they aren't allowed. Actually the new digital services act [0] is shaping up to clarify these, but IIRC there have also been first cases decided in courts.

[0]: https://edri.org/our-work/the-eu-parliament-takes-strong-sta...

This particular behavior is actually illegal. GDPR [Recital 32] clearly states that "Consent should be given by a clear affirmative act <...> Silence, pre-ticked boxes or inactivity should not therefore constitute consent."

[Recital 32]: https://gdpr-info.eu/recitals/no-32/

This is more of a workaround.

A solution to a poliical problem is political, not technical.

i would call it societal; society still needs to grasp in what way they are being exploited. it's still not clear to most people

How is it political?

The decision to force service providers collect consent from their own users is a political decision.

And a fundamentally bad one: providers' incentive is to make it easy to get consent and hard to refuse.

I don't know what policy is better than this, but right now, we only get more annoyance without any benefits in privacy. Pretty much every page I've visited issues 3rd party requests before I consent to data sharing.

I some cases the "people do illegal things regardless" argument can hold some water, but that's not the case for the GDPR, which is worded very clearly and hence it's really obvious that this kind of thing violates it.

Most of these banners violate the GDPR even before they're showing up, because the GDPR actually restricts your ability to embed non-first-party content without consent. That's why Google Fonts violates the GDPR, for example. Arguably every vanilla Wordpress install violates the GDPR because Wordpress embeds something from s.w.org on every page (presumably for install count / analytics reasons).

This kinda sounds like a bad thing but it's not. It's actually a huge boon, because it's an excellent legal excuse to get rid of embedding stuff from 213789 origins and CDNs, which only has negative performance effects since caches have been origin-segregated for years, meaning that even if another page uses the same jQuery version from cdnjs, it will be downloaded again anyway.

> which is worded very clearly

Hard disagree. I've been racking my brain as of late trying to decide if default apache access logs violate the GDPR, and stackexchange searches on the topic seem to confirm the confusion.

If the legality of data collection hinges on what is considered necessary for service maintenance in the eye of a judge, the law is not clear.

You can keep such logs under article 6.1.f if the retention period is 30 days or less (causing self-fulfillment of article 17) or indefinitely if you remove/anonymize PII from them. Of course article 17.3 gives you an exemption for various purposes, e.g. if you had a breach you don't need to delete the logs from that period while investigating it.

I fail to see how a 30-day or fewer retention policy impinges on article 17 one way or the other, nor do I see how article 6.1 gives any protection on the topic of the default Apache HTTP access logs (which include IP addresses).

Those patterns are more and more being punished by GDPR enforcement. Companies may try playing around the letter of the law, but Europe runs pretty solidly on the spirit of the law. See events like these: https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europe...

And American companies are absolutely dumbfounded when they try to play the “misplaced comma” card in the EU and they still get slapped down. It is a very American attitude — I always wondered what ST:TNG would have been like if Picard wasn’t always able to save the day by invoking some obscure sub paragraph of some obscure treaty. Note to Elon that if he launches lawyers into space it doesn’t kill them, he just ends up with a lot of lawyers in space.

https://en.m.wikipedia.org/wiki/The_Ensigns_of_Command

The other aspect of EU law that always gets US companies is that penalties are large enough to actually be penalizing. In the US companies can basically ignore the law until they get caught, pay a token $100,000 or $1,000,000 fine (which sounds impressive in all the papers), then invent a new interpretation of the law and go do it again. In the EU the regulators start looking at percentages of income during the entire time the illegal activity occurred, so again the US companies are caught completely off guard when they get asked to forfeit billions of dollars.

So what do you propose: "People are working around it so we should just give up"? I don't think it's time to admit defeat like that.

This can change, but enforcement and courts by nature are slow. With EU courts striking down asymptotic consent banners as illegal, sites are spooked, and you now see sites adding a "reject all" button next to the "accept all". I still have hope we get there.

Some reject all buttons don't set a cookie/localstorage for the rejection meaning the banner will be on every page, darkest of patterns!

In my experience, almost all of those consent popups work the same way. On the first popup, press the button that doesn't say they can just use all cookies. On the second popup, press the button that says it saves your preferences.

Couldn’t be further from reality.