Isn't that intended?

- A group that think GDPR = cookie law and there's nothing more written in it. Never any discussion about, say, forcing companies to report a data breach within 72h of detection. Or about being able to download your data, or forcing a company to remove your data, or...

- A group that think passing a new law = everyone is going to comply immediately and one random website that they know of that doesn't comply but wasn't sued yet into submission = GDPR was a mistake.

Oh, I'm not blind to it. My calculation is a simple one: looking at where we were and where are now, where would I prefer to be? For me it's not a difficult conclusion.

> This is going to be an enormous challenge to the EUs tech industry if UK and US firms can use LLMs but EU companies can't

Sure, but your argument completely disregards the privacy concerns which is the reason the EU has done what it's done. It's possible for Europe to decide that it's worth the cost in potential business to protect the privacy of its citizens. That's essentially what GDPR decided, after all.

(FWIW I've worked on GDPR implementations, I'm not so convinced it's a failure. It lead to a very meaningful drop in the amount of personal information the company was storing. The compliance costs were not particularly huge ongoing costs, just upfront implementation ones)

First there is the practical implementation. As we've seen the current stand-off between US government security laws and EU government privacy laws is still being decided in favour of transferring personal data for processing in the US. That might even be the preferable way to break the deadlock for the immediate future because the cost to the European economy and particularly the tech sector of suddenly cutting off all US-based services when the EU has no native competitors would be enormous and as things stand that appears to be the only safe way to guarantee legal compliance on both sides of the Atlantic.

There is also the hypocrisy angle. The GDPR allows for EU government access to personal data under their own security laws that is not so different to what the US laws allow the US government to have. There are definitely some double standards in the typical arguments about how the GDPR protects personal data from unwarranted government intrusion and overly broad security laws.

I'm also firmly in the pro-privacy camp on principle but the rules do still need to be workable or everyone is just going to ignore them anyway. It's not clear to me that the way the GDPR is currently being used against big US tech companies is a good way to go.

I think you have it wrong way round - EU business was late, and 5he market was sevured by US corps. I dont think EU will ban US business, but if they did, that would create opportunity for homegrown co petition to emerge. By now, cloud services are not rocket science.

That's one theory. The problem is the several years of lag time between the opportunity being created and anyone actually exploiting it at scale. In the meantime countless SMEs that depend on modern online services for their day to day operations would probably have failed.

By now, cloud services are not rocket science.

And yet the US keeps producing them at a far higher rate than we do over here. Much of that has been due to the VCs almost casually giving away millions in funding in the hope of backing the next unicorn among all the failures, which is an investment culture you don't see so much in Europe. But there are also reasons investors tend to favour some countries over others and the regulatory environment is usually second on that list (after taxes/subsidies) if it's not first.

And in their regulatory environments the EU and US are almost polar opposites. The US is very lightly regulated (apart from the problems of regulatory capture, where the US seems to do much worse when it does happen) but that means tech firms engage in practices we might not like. The EU is very heavily regulated but that means added overheads even for well-behaved businesses that can eventually add up to being less competitive in a global market. Maybe there is a sweet spot in between but certainly neither the US nor the EU have found it yet.

Now if the popups are obnoxious whose fault is it? (To answer that just notice how many other obnoxious popups/overlays/etc the same site has about other stuff)

They could just choose to honour "do not track", but I realise they want the money. Most large sites seem to have added the "reject all" button when it appeared that this was necessary for compliance. Those that did not don't care if they comply.

Obnoxious banners are a choice. If we didn't have them the choices of site -owner's wouldn't be less obnoxious, they would just be hidden.

It's like the warning your car makes 'put your seatbelt on'; sucks, but better than it not existing.

Imagine if this was one of the principal virtues in human civilizations. Where would humanity be? Would we know the Earth is round and not the centre of the universe? Would we have vaccines or antibiotics? Would we have most of our art and literature? Would simple technologies like irrigation even exist? We would probably not have any advancements past about middle ages.

I don't understand why so many cynics tell this to others these days. Do they genuinely have a mindset that nothing is worth trying if it failed the first time?

No. But the way you first picked to do the thing is very likely impossible to make work. Don't decide on a mechanism, like cookies, and fixate on it without regard for practicality or effectiveness.

Preventing invisible tracking is probably a good goal that's worth iterating on but making sites pop up a list of good and bad tracking and being allowed to track the people who accidentally don't click "No!" seems like an entirely failed way to go about this.

If tracking is bad then stop it for everyone, not just people who clicked the correct thing. If some tracking is generally bad but allowable for certain functionality then mandate that tracking is only applied once the user had opted in, etc. Don't make users mark "Don't steal my organs while I sleep" on the hotel paperwork.

GDPR is not about cookies. Cookies are mentioned only once in the entire legal text as an example of a technology that can be used to associate users with personally identifiable data. If there is no risk for this association, GDPR does not care about cookies.

GDPR is about ethically acquiring and handling personal data.

Yes, we need more effective GDPR, not less.

Some sibling comments challenge that it doesn't help reduce the amount of private data stored.

I would argue that GDPR is working as intended on the economic war front. The US weaponized their extraterritorial anti-corruption laws, China is also building similar legal weapons, GDPR is part of the european answer to that: a framework to catch up with other super powers who can pressure foreign companies whenever it pleases them.

It won't be GDPR but newer regs

> This is going to be an enormous challenge to the EUs tech industry if UK and US firms can use LLMs but EU companies can't

I'm sure they'll find a way

> a _lot_ of EU legislation is poorly thought out and given the slow pace of change extremely hard to revoke once it is in force

Kinda, but things don't change only by the original legislative process, but by subsequent regulations, agency reviews (like data protection organisms), judicial reviews, etc

> which were implemented in law in 2002 and _still_ haven't been changed, despite 10+ years of efforts to do so in the EU institutions

I'd love to know what kind of discussions went in regards to the cookie law and GDPR in legislative reviews. I'm sure it's all logged in a very verbose way in multiple websites and it would be some effort to get it all together

And the AI act worries me, but we know that actual enforcement and definitions and wiggle rooms exists (and as with GDPR, enforcement is kinda patchy)

Like every company will be different, but you really should know where your data is kept.