very much this.

I'm getting so tired of people implying the law is wrong just because sites still want to perform the tracking and data gathering it intends to limit.

If the law is right, but not possible to enforce, some fixing may be needed

IMO, the problem with GDPR is the same problem we have with a lot of European laws. There's nobody who's incentivized to enforce compliance.

If you were able to sue for GDPR violations, either on your own or in a class lawsuit, you would have an incentive to prove that the violation has indeed occurred. As long as your lawyer was working on commission, they would share that incentive.

As it stands, all you can do is file a complaint with your GDPR office and hope it makes a difference. You don't get any money from that, so hiring a lawyer to get such a complaint right is an expense you will not get reimbursed for. More importantly, the person investigating your complaint is probably on a salary, not a commission, so they don't personally care about how successful they are.

Compare that to the ADA[1], for example, where you literally get legal firms looking for disabled Americans, finding places that don't comply with the law and suing them. Enforcement was partially privatized, and the free market, as it often does, found a better and more efficient way of enforcing the law than the government could dream of.

> Enforcement was partially privatized, and the free market, as it often does, found a better and more efficient way of enforcing the law than the government could dream of.

I'm not a fan of this. You're replacing one kind of dark-pattern wielding, stain-on-underpants-of-society, predator with another!

You will spawn industries of failed lawyers going after the easy money, i.e. clueless everyday people who inadvertently misconfigured wordpress and can't afford a lawyer when they get threatened with court cases if they don't pay the extortion fees.

Just like asshole copyright lawyers under Germany's shitty jurisdiction extending their disgusting and threatening attacks on everyday citizens around Europe who dare to have a personal webpage without being experts in copyright law. As with ad-tech, also not the kind of enterprises we need to have in our society. Also wouldn't shed a tear for that industry to just die.

If you do this kind of thing you need to directly target the companies enabling the illegal behavior, not the website owners.

You can actually sue under the GDPR and get compensation.

Article 79 explicitly gives data subjects "the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation"

Article 82 states that if someone has "suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered".

The ADA is the best example of why you need to actually give a law teeth for it to be enforced, and how well it can work when you do.

Everyone and their dog who has been getting away with bad behavior is going to take that stance as a stalling tactic. It might be true, but either way it's going to have a lot of bad-faith weight behind it, so we need to make our strategy robust to that inevitability.

I'll default to skepticism but keep my mind open to proposals that are concrete and specific.

Check my other comment: https://news.ycombinator.com/item?id=30755527

Like with drug dealers?

Yeah like instead of having them on the street, they could have a shop and you could tax them a lot and make sure people know what they are getting into.

Same with sharing personal data - maybe not a bad parallel :)

The law should not have had the consent provision. Without consent provisions, the law makes a fine general prohibition on unnecessary use of personal data,† albeit with a few kinks that I'm glossing over with "unnecessary". But it has the outlines of a sensible regulation, the corner cases could surely have been smoothed out in court.

The consent provision ruins everything. The fact of its existence reframes otherwise unlawful processing as "you need to get consent" instead of "you shouldn't be doing this", which is how it should be framed. It turns the whole regulation into a farce, restricting data processing to necessary uses except if you have the ability to document and semi-coerce consent (subtly enough to not invalidate the content you've obtained, but empirically that's clearly not closely examined).

And lo, a parasite industry dedicated to coercing and documenting "consent"!

†Just talking article 6 here, I don't really want to get into the weeds of chapter 3.

> developers misunderstand it.

Then maybe the law needs some adjusting to make compliance more manageable.

If you as a developer are tasked with understanding this, you take the time to read the actual rules and then you misunderstand it, you are incompetent. But this is not what generally happens. Folks don't read, just yolo some terrible explanation off of SO and then complain when someone tells them they are not compliant. That's laziness. Those are the only reasons for noncompliance, outside of actual malice.

It can be cheaper to misunderstand it. So long as risk of getting fined is low, and the fines aren't higher than they are, you aren't really tasked with being compliant. You are given a task to implement something in compliance but what that means is as compliant as possible while still making sure the business survives, possibly even on the same business model. That latter part isn't explicitly given to a developer in the instructions - but it's going to be made clear that if you don't want to put up the minimum-effort cookie wall, there is someone else that can do that job.

This is why we need a law that people actually fear to the point where they would rather switch off the lights and take down the sign, than try to put up an off the shelf cookie wall that can be configured to have an "Accept all" button.

Terrible take. If breaking the law to make money is how you operate, you're not a company. You're a criminal cartel.

That’s how all these sites operate now. It’s cheaper to keep operating in violation than shutting down. That’s what should change.

Why?

maybe developers beed some adjusting to make compliance numbers higher.

Because GDPR has been around for a few years and its still unmanageable. Laws need to be realistic to make compliance easy and widespread. Maybe there needs to be resources for training or something. There are lots of things you can tweak while still getting the benefits.

Compliance is easy and manageable, for the most part. It's just that companies want to still do the things the law is trying to disincentivize, and want to put as many dark patterns as they can in the way of users avoiding it. So the "unmanageable" part is trying to figure out how close you can come to breaking the law without being blatant.