The EU didn’t tell those sites to show cookie banners, they just told them to stop collecting people’s data without their consent. It’s the sites that interpreted that as “annoy people until they consent so we can keep collecting their data”. That’s not really the EU’s fault, although they should have seen it coming.

They could have also started by making the ~4 web browser suppliers implement this consent dialog (remember Netscape cookie dialogs everybody hated 20 years ago?). Then the two W3C/IETF to create a protocol for transmitting consent to the server. Instead of making thousands of companies having to individually spend the money to implement it.

Great for job creation numbers. Crazy mismanaged in all other aspects.

I think the “Do Not Track” HTTP header was inspired by a similar idea…but then people used it for tracking (using a non-default setting is a good way to be unique.) https://en.m.wikipedia.org/wiki/Do_Not_Track

Thank you! Actually, they could also take this strategy to protect kids from adult/violent/sensitive content. I suspect their strategy is to replicate, with Internet, what they have done with the Financial industry. So it should not be considered as incompetence... on the contrary. (See my other comment for further details https://news.ycombinator.com/item?id=37457745#37461669 )

It's like we need to have a recurring demonstration of the old saying 'the path to hell is paved with good intentions' because we keep forgetting.

If a policy will predictably backfire, but the EU passes it anyway because the policy has good intentions, I would actually describe that as the EU's fault.

And I basically never give my consent. I'm happy that I have that choice (assuming a site honours it, of course).

This also allows me to decide which sites value my privacy (no cookie banners) and which do not (annoying banner every time I visit), so that's another plus in my opinion.

You always had that choice. All browsers Support deleting cookies.

Now that we live in age of javascript. Why not have user manually ask the server to set a cookie if they wish to be tracked?

GDPR isn't about "cookies", it's about how the website operator is allowed to abuse your personal data. Cookies are just a minor implementation detail that's only applicable to a subset of websites that don't require an account (otherwise it's stored in database).

The EU is showning these banners on their own websites. So not even the EU is capable of creating a website without banners (because - even the EU - wants analytics and other bullshit).

The EU parliament website says "We use analytics cookies to offer you a better browsing experience. You have the choice to refuse or accept them." I'd personally rather have the choice than not.

> I'd personally rather have the choice than not.

There are browser settings since the invention of cookies to control which sites are allowed to set cookies.

Yes, but not what the cookies can be used for, an important distinction.

The purpose of these laws is exactly to change people’s behavior through incentives. So if the incentives produced by the law resulted in behaviors with negative social outcomes, that really is the fault of the people who came up with the law.

Policy makers are responsible for the unintended consequences of the policies they implement.

This stuff is why I've moved over to the idea that governments doing nudges[1] is worse than just outright passing laws and polices to tell people what they have to do. In the case of cookies, pass laws forbidding collecting personal data. Done. Bonus getting to hear tech bro's whine they broke the law and can't go to Europe anymore.

[1] Thaler and Sunstein: any aspect of the choice architecture that alters people’s behavior in a predictable way without forbidding any options or significantly changing their economic incentives.

It is not necessary to ask for consent for cookies that are required to provide service.

Unfortunately the barrage of cookie dialogs seems to be working because you‘re blaming the EU now instead of those who decided to collect more data than necessary (or even to ask unnecessarily!)

Can you do us a favor and vote in someone to correct that particular one? It’s leaking into the rest of the world.

Same here, what triggers me the most is also the « tech laws »: GDPR, cybersecurity resilience act threatening open source, The coming AI act possibly limiting innovation and concentrating them in the hands of existing giants instead of a decentralized ecosystem, as it begins to be the case in the rest of the world. I understand the thinking behind all those laws and they probably are born from good intentions. I feel like, in this case, Europe lacks some big tech lobbying pointing out the technical flaws (and yes I agree that with lobbying you do have to sort out the « pointing out the technical flaws » from the « pushing single interests forward »).

And this has been going on for over a decade, but the EU hasn't decided to fix it.

That'd be admitting failure. We can't have that, can we?

But that directive is a big success? I know which sites are trying to track me, and which do not. What's more, even less technical people know that and may make an informed choice. Way better than allowing advertisers do whatever they want everywhere.

You know that pretty much all large sites are tracking you and most smaller sites probably are too but they couldn't be bothered with the consent popup because nobody will ever enforce anything against them.

Advertisers still do everything they want everywhere, we just got a bunch of pointless popups on top.

Do you really think most people are making an informed choice, as opposed to clicking the button that gets rid of the pop up fastest? Especially on mobile where the pop up obscures basically the entire site, and the byzantine process of opting out takes several clicks?

I think this was a spectacular failure of the EU to consider legislative effects, and problem solve. But that seems to be their recent MO.

> I don't know how much time I already wasted clicking away cookie banners. Maybe a minute a day? That's 6 hours a year.

Just install consent-omatic

The EU never mandated cookie banners, websites added cookie banners instead of not collecting your data

Imagine how many people JavaScript killed

Those are good people

Cookie banners are not compulsory at all, that’s only needed if the websites want to share your activity on this site with others in order to profile you.

How's it take you a minute to close cookie banners a day? Imagine the damage companies like FAANG are doing with their adverts, if you try the many minutes per day in your calculations!

Also, this is a UX issue with the site, not an issue with the EU. The EU wants companies to outright ask permission to collect your data and sell it. I can't think of another organisation at that level so pro-individual against big tech, can you? If cookie clicking is an issue, use companies that don't collect your data.

Edit: Look at the US is doing on another HN front-page article https://www.vice.com/en/article/m7bge3/dhs-uses-ai-tool-babe...

I still don't care about cookies works well, and that's not an EU absurd bureaucracy fault...

The main bureaucratic issue is that the institutional stack is not much democratic and it's dominated by economical powers that's have mostly only hurt EU citizens.

>> Those are good people.

I don't know, maybe they are libertarians