That cost should be paid by the companies forcing pop-ups onto users.

Popups in no way GDPR's fault. The law does not mandates them.

Instead, it's a form of malicious compliance. Companies pester visitors with popup banners that are almost always unnecessary.

E.g. GDPR allows essential cookies e.g. a login cookie containing an encrypted token without any popup. If you want to notify users about it for extra safety you can show a little privacy notice on the login form. No need for popups.

I'm not sure it's malicious compliance. When you are threatened with massive fines for non-compliance but you aren't told explicitly about how to solve it other than, "A cookie notice would be a way of complying", everyone will use a cookie notice.

Bad news: those notices will do nothing to mitigate the fines, and might in fact even increase them if those notices pressure or trick users.

Good news (for the companies): GDPR enforcement has and continues being laughable, so you don't have to worry either way.

Modern cookie banners definitely are malicious compliance and most certainly are also violations of the GDPR.

All those companies could use less invasive methods of asking for consent, such as optional checkboxes in signup forms. Or a non-intrusive "click here to opt-in to tracking". The reason they don't do it like this is because they prefer forcing users to click "Accept All" using dark patterns.

Anyone complaining about shitty cookie banners is actually complaining about companies breaking GDPR.

Dismissing cookie notices is just a sign of companies outsourcing the cost of being privacy friendly.

They could just run their own analytics tool and you wouldn't need any notice at all for basic visitor counting. But everybody is craving for that shiny numbers from Google Analytics (for mysterious reasons _perfectly_ integrated into all other Google tools), easy ad money and whatever metric marketing wants to see this month.

Please don't make glib statements about what people do and don't want. If you don't want the metrics that you get from something like Google then that's fine but a lot of companies, ourselves included, find the insight massively valuable when we are trying to work out which parts of our product are or aren't working properly.

Sure, we could roll our own but that creates its own problems and doesn't exempt you from cookies notices at all.

> If you don't want the metrics that you get from something like Google then that's fine but a lot of companies, ourselves included, find the insight massively valuable when we are trying to work out which parts of our product are or aren't working properly.

As a user, I don't want to be spied on so that you can "improve" your product aka make it more addictive or refine your dark patterns. I definitely don't want Google spying on me to help you achieve that goal either.

The GDPR making it harder for you to do this means it's working as intended and I'm very glad to have it as a user.

> doesn't exempt you from cookies notices at all.

Sorry to tell you, but it actually does.

Cookie notices are only necessary when you are transferring data to third-parties and there's no technical reason for that.

Selling my personal data to some analytics company, and you have chosen to do exactly that, is not technically neccessary but a very deliberately made decision by someone.

I wonder what is the GDP cost of millions if not billions of people flushing the toilet every day, often multiple times a day.

We can all make silly arguments, just because something requires you to take action, and it might cost money, doesn't mean we therefore have to just let late stage capitalism run wild.

If we didn't flush toilets but all of a sudden because of some law (directly or indirectly), we started flushing toilets; we should be concerned about it. But that's clearly not the case here and your analogy doesn't hold up.

A better analogy was if you were forced to use the toilet every time you entered a store you haven't been to previously... Just why in the world would I need to take part in such a wasteful charade.

That's what browser extensions like Super Agent are good for.

And the fact that we need a browser extension to deal with such incredibly annoying and intrusive "functionality" that is required by law is just insane.

I'd have a lot more patience with this law if it had come with an implementable w3c do-not-track-like signal sites could transparently operate on so it didn't wreck the UX for people who didn't care (or for that matter, people who did!).

(... which, unfortunately, I guess wasn't "do no track" since that pretty much failed, right?)

My guess is that it is not a cost. It is a small annoyance, and I would be delighted for it to be gone. But... I really can't support any argument that inflates the cost of it.