With ePrivacy looming, German publishers scramble to get users logged in

Businesses aren't going to trade their content out of the goodness of their heart, they want something in exchange. I would much rather trade ad views through Mozilla using a list of my interests that I control than to allow excessive tracking and profile building by some untrusted third party.

What we apparently have now is login collectives starting up, but who's to say how good or bad the practices are for each, or whether they have the ability to adequately secure their system.

So yeah, confusing all around.

I really can't wait the time you have to pay for most content. It will reduce informational clutter and improve quality of the content.

The new laws seem to avoid this mistake (of course, only time will tell for sure) - they are harsh enough to ensure the strategy "figure out what legalese we need to add to keep doing the same things" is not viable, and they have to actually stop gathering and using that data.

In my reading, GDPR seems like it will not enable workarounds that still allow targeting ads as optimally as they could in 2017. They'll still try to target them as optimally as they can, they'll probably figure out some workarounds for parts of it but that will by necessity be ads that are less targeted and use less private information (at least for EU residents) than last year. Also, the intent of lawmakers is clear - whatever workarounds the ad industry figures out to circumvent that intent are likely to be closed in 3-5 years with the next iteration of this directive.

The regulators are not "hoping that publishers and local companies band together, creating cookie pools and sharing user information amongst themselves" - they are explicitly creating conditions to ensure that it's almost impossible to get consent for that sharing of user information, and also that Facebook and Google will be able to get much less information than they could before - for example, the GDPR has a big impact on information gathered by all the FB like buttons and google analytics snippets in third party websites; and the "4% of global turnover" clause is included explicitly so that it has leverage to force Google and FB to change their behavior (at least for EU residents). There's no such thing as a "service-wide" opt-in for everything anymore; I will be able to deny Google consent to use my gmail data for targeting ads on google.com, and Google will have to obey; I will be able to ask Facebook for the data they've gathered about me on third party websites and get them to remove that data.

Since it's expected that most EU consumers will not give that consent (why would they?) it will pull Google and FB down to the level of those ordinary publishers; they will lose the data that historically gave them this advantage. They're not hoping that EU companies will magically grow new revenue streams, they are taking away those revenue streams (regarding EU customers) for all companies, EU and foreign.

This seems like what the regulators are actually expect to happen, and from what I've seeing in the internal activities of local businesses, it's going to happen - pretty much everyone here has major ongoing IT projects that will reduce the amount of private data that they are gathering and storing. That is the ePrivacy version of the crosswalk - stop gathering private data about users, anonymize/cleanse the data you already have, and do your advertising in a more coarse-grained manner.

I won't wade into whether the law is better for certain businesses, that's a complicated topic that I don't have the cycles for.

But what I will say is that the requirements[1] sound like really good benefits for consumers.

Being able to go to Facebook and say "delete everything you have on me" is a huge plus.

Being able to go to Whatsapp and download all of your contacts and messages in a 'commonly use and machine readable format' is awesome.

Now, of course, the devil is in the details. If 'machine readable format' is poorly defined, that provision is useless. If the consent provision requires 120 pt red font legalese on every page you enter data into, that's ridiculous. But since neither of us is going to go read the thing... at least the goals are good.

1: https://www.eugdpr.org/key-changes.html

Neither is really a "publisher", and (as people are arguing elsewhere in this thread) it's the US multinationals which will be in a worse position, since they rely so heavily on doing things with people's personal data without clear consent.

> band together, creating cookie pools and sharing user information

My impression was the directive makes this harder since everyone involved would have to get informed consent.

> promote the "right way". Example: People get hit by cars crossing the roads anywhere. They invent a crosswalk and make it illegal to cross the road anywhere other than the crosswalk.

Ah, the American solution. The UK never made it illegal to cross the road and instead invented a type of crossing where the pedestrian always has priority. https://en.wikipedia.org/wiki/Belisha_beacon

Just as an American must check the legality before crossing the road, it seems the intent of the GDPR is to make every developer think twice before storing any data about the user in order to consider whether it is personal data, or the even more restricted category of sensitive personal data. Hopefully this will prevent users getting hit by privacy breaches, intentional or accidental.

The law doesn't regulate specific technological details because that would be far too dirigiste, and break down as soon as there's a new technological innovation. People would either be complaining that they couldn't use a new solution because it wasn't mentioned in the law, or that their privacy was being violated in a new context.