If you don't consent to my connection to your server, all you have to do is return HTTP 403 Forbidden. Alternatively, you may simply not reply to my HTTP requests at all.

You can flip this the other way though — “this site uses cookies for ad targeting, business metrics, and UX improvement blah blah.” If you the user don’t consent all you have to do is terminate your connection.

They'd love that, wouldn't they? Their way or the highway, take it or leave it. They know that people depend on internet services and have no choice but to accept whatever bullshit terms they add to their little document which nobody reads. A document they need to "accept" before they're even allowed to read it.

Now we can deny consent, know that they're legally required to respect our choice and enjoy the fact they can't punish us for it by denying service. Whole world needs to adopt and expand upon these laws, and also ramp up enforcement and start fining all these non-compliant cookie banner-displaying web sites out of existence.

They don't get to flip that script. They're not entitled to data about us. It's our information, they don't have an assumed right to collect it for any purpose no matter how benign. That they even think they can do it is offensive. The audacity of these people. Any data we do give them is to be used for our benefit. It's not meant to fuel some surveillance capitalism nightmare.

In this context "they" is "web developers" and the Orwellian scenario you're describing is "The way the web has worked since cookie jars were implemented."

Yes, I don't doubt web developers would mostly prefer not to be bothered and just keep doing what they've been doing. Much cheaper than doing a system audit to figure out if you're GDPR-compliant, concluding with your lawyers that you have no idea if you're GDPR-compliant, and putting up a cookie banner nobody wants just in case. That's assuming you can afford lawyers.

At this point, it's safer to partner with a host that'll manage all that stuff for you than run an independent site. Which, ultimately, the Googles of the world love to hear, because they can afford the lawyers.

The GDPR is an amazing bit of jiu-jitsu to build a moat around competition. All the big names have to do is spend a pittance every so often to stay in compliance and they win the market, while small operators decide the risk ain't worth it because "Just don't collect user data" is actually quite hard to guarantee on a system built atop infinite cheap copying and arbitrary site access.

Not even the apache default logging config is GDPR-compliant. I don't know how anybody expects indie site admins to keep up.

Just don't collect any data and enjoy instant compliance. You're not supposed to hire expensive lawyers to tell you how you can spy on users safely, you're supposed to not do it in the first place. Most read-only websites have no actual need to collect data.

Everyone who thought that's how this would go was hopelessly naive.

Welcome to the new normal. Enjoy your cookie pop-ups.

I believe the GDPR specifically forbids that sort of configuration. By which I mean, I'm not allowed to deny you service if you aren't happy with consenting to my collection of your data.

It forbids denying me service as punishment for not consenting to your data collection. You can totally make your public server private though. Configure it so that it only responds to certain computers, then invite people or charge them for access. If you do it like this, the only way people can talk to your server is if you allow them to. They won't be strangers and will have your consent.

You still need their permission to collect data and you can't revoke their access as punishment for refusing.