and to be clear, the european attitude to this regulation would be, "try again, better this time"

not ah yes, let's go back to having no regulation of corps tracking people.

People would be quite enthusiastic to more regulation which required no cookie banners where users had, eg., expressed a preference for no tracking at the browser level. And likewise, to require the provision of such "no-tracking signals".

I suspect something like this is on the horizon, and in part, something google was trying to head-off with its 3rd party cookies stuff.

"more, better!"

> "try again, better this time"

this is so true and kind of hilarious to see Americans not understand this. When a regulation happens and it's day to day effects are not working out great. The answer will always be to regulate more, add more rules and restrict things more.

The EU is inclined not to create regulations at first. They prefer to hold meetings, seminars and inform companies of their effects to encourage them to self regulate. If after years this does not help they will either:

A) create subsidies to help companies implement changes. but only if they have shown they are will to interact with the EU governing bodies.

or

B) Add rules and regulations to force companies to act a certain way.

The beautiful disconnect pointed out in the article where Apple thinks the meetings are negotiation and EU is basically showing that their smiles and friendly words are just formalities and change is happening no matter what Apple thinks or not.

This is particularly true in the case of Cookie Banners. regulation has been clarified and now most sites do have a explicit "reject all" button/link that is next to "accept all". This was not the case when the law was first introduced.

> 2. A government trying to protect you from said businesses.

While still protecting the “business freedom” of the said business.

They could have forbidden cookies and tracking altogether, but they are too probusiness for that.

If you use government websites within EU countries, most of them have cookie warnings. And a large part of them also use dark patterns to "forget" that you selected "only necessary" cookies each time you visit.

"Forgetting" doesn't seem to be common, making the dialog confusing and conducive to "accidentally" allowing everything, that's somewhat common. It would be difficult to prove innocence in the former case.

I'm pretty sure it's less "dark patterns" and more "remembering your preference isn't 'necessary'".

Which, technically, it isn't.

> I'm pretty sure it's less "dark patterns" and more "remembering your preference isn't 'necessary'".

> Which, technically, it isn't.

That's still a dark pattern, because by definition, dark patterns aren't illegal - just barely legal, and detrimental to the consumer.

So what is your conclusion? "It's a bad law"? Government websites breaking GDPR is an important thing to know, in order to fight against it.

I think it's a law with good intentions which was horribly implemented for which now the rest of the world will be feeling the effects for decades.

I think there are very, very few people who are earnestly proud of the work the EU did with this regulation every time they waste finite brain cycles on yet another cookie banner. I don't really know why Europeans use this as an example of their system of governance working as hoped.

It's possible that the EU thought: "This is likely enough to end cookie tracking. Surely no company would want to put their users through horrible consent UX just to retain their tracking!" ...and were wrong about just how far companies would be willing to abuse their user's experience, either because of the benefits of tracking, or purely out of malicious compliance.

The anticipated effect of requiring consent is that by forcing companies to shine a flashlight on their own bad behavior, they will instead choose to correct their behavior. That didn't end up happening in practice.

Much as I like the law, I'm sure I saw a headline when it first went live along the lines of "EU's own website about this law violates it", which suggests[0] that perhaps it could have been done better.

That said, I just looked at it, and this is my idea of a well-made popup: https://gdpr.eu/what-is-gdpr/

[0] But for the Betteridge law of headlines and Gell-Mann amnesia

This reminds me of the Cloudflare vs Archive.is shitfest. I do not care why CF DNS doesn't work with Archive, all I know is that it doesn't work, and others do.

I do not care why cookie banners are there. All I know is that they weren't there N years ago and now they are, and they are annoying.

Let us all cater to what annoys you.

> This reminds me of the Cloudflare vs Archive.is shitfest.

Is there some background reading on this? I would like to use Cloudflare as one of my DNS providers but this issue has always bothered me.

Archive.is wants to know where your request is coming from, so they can serve content to you from a server that's in a legally offshore place to you, so they can continue operating. Cloudflare doesn't want to give them this information, so Archive.is blocked them.

> 1. Businesses trying to violate your privacy

This is false. The GDPR does not mandate privacy - the GDPR mandates the protection of certain kinds of personal data, much of which (e.g. IP addresses) has legitimate reasons for being collected (e.g. abuse protection). Claiming that every business that shows a cookie warning is trying to violate your privacy is not only objectively false, but extremely intellectually dishonest - although that's about par for the course for GDPR enthusiast zealots.

You don't need cookie banners for IP addresses, so your whole example is completely wrong (who sets a cookie to store someones IP?). 99% of businesses that show a cookie banner do it to violate privacy. The remaining 1% didn't understand the law, thought they had to add a cookie banner, but didn't even have to. It's extremely intellectually dishonest to mix up logging and cookie banners, although that's about par for the course for anti-GDPR zealots.

I was referring to normal GDPR banners, not cookie banners. I didn't say anything about cookie banners in my comment. I'm not sure there's even much of a distinction, and my point holds anyway, because their are legitimate uses of cookies that non-privacy-violating businesses use.