TIL, thanks! The usual convention of calling them "cookie dialogues" sure obfuscates that.

Which is a very intentional (and successful) marketing ploy by companies to get users to not care about them. It sounds like a boring technical thing instead of "we need your permission to let massive advertising networks track you around the internet" (consent isn't needed for site functionality; you can use cookies and never mention it if you don't use them for tracking).

Unfortunately this is a challenge with regulation; companies find a way to break the spirit of it as much as possible while following the letter. It's better that companies need consent to track us than not, but consent managers are dark patterns designed to deeply annoy us at the prospect of saying no.

So does that mean that fingerprint.com, which records your fingerprint without asking for your consent, is operating illegally?

Without permission yes, if it stores it (but that would probably just be client-side).

If it stores it and uses it for matters different than what explicitely advertised when you consented to it, than yes it's even worse.

edit: just saw that's a service they resell. So yeah it is against GDPR

Good question :)

I think if it's all client-side, not logged or retained, and is not transmitted to third parties, it should be fine.

IANAL

Yes, almost certainly so. You did not consent, they have no legitimate interest to track you, and you were never informed about the what and why in plain language.

The GDPR isn’t the complex legislation monster people make it out to be, but for the most part common sense about handling sensitive data.