EU is planning to order websites to delete extremist content within 1 hour | Hacker News Reader

EU is planning to order websites to delete extremist content within 1 hour

bbc.co.uk

71 pointsmartin-adams99 comments

"Mr King told the FT that the law would apply to small social media apps as well as the bigger players."

They are deliberately announcing a law that small upstarts will find impossible to deal with and they are deliberately announcing they intend to discriminate against them.

3 AM video while your entire team is asleep? Fined.

That is downright terrible.

You’d basically be forced to automatically take down anything that was reported to queue it for review.

Assuming it was reported within 1 hour

From what I read the 1 hour begins counting once something is reported and they also plan to make reviews/counter claims and such mandatory as they already exist on youtube (although youtube seems to have forgot the part where it needs to work)

This is my fear also. A simple side project in Europe which charges users would have to meet European VAT reporting, cookie consent, GDPR and now (if this happens) figure out how to remove extremist content within 1 hour.

setup pagerduty unfortunately.

Expect more things like this to come along. The EU has tested the waters and confirmed that yes, it is safe to mandate that every dev team in the world perform a 2 week sprint at its whim, anytime if feels like it.

We're partially responsible, for having implemented our silly cookie popups and GDPR checkbox screens without pushing back hard enough.

This. Someone needs to teach EU bureaucrats a lesson. A second "blackout day" (similar to what was done to protest SOPA in 2014), but limited to the EU, would be a nice idea. Things like the cookie nag screens are just absurd. They will unload much more BS if they aren't stopped early on.

Honestly, as a US based company with mainly US visitors, i would simply return HTTP 451 to any EU visitors. The risk of being sued for some silly EU law is just not worth it.

As a European victim, those cookie screens are simply exhausting. It's pushing us users towards silos like FB/Snapchat/Apple News where we don't get constantly nagged.

>It's pushing us users towards silos like FB/Snapchat/Apple News where we don't get constantly nagged.

Some would say that's the point. Not only are they pushing for laws that smaller players will have difficulty following - they're also making it less convenient to try and escape any large, centralized silos.

Who's gonna sue you? The EU has no power or jurisdiction over you, you're not required to block access to their citizens.

In the US, pretty much anyone can sue anyone else for any reason. While a judge may eventually throw out the lawsuit (for various reasons including frivolity, etc.), being sued generally requires the services of a lawyer to at least bring up the motion to toss the suit. Lawyers ain't cheap (at least the kind that are effective).

Furthermore, there's the whole watchlist thing - if the EU has decided against you, they can make traveling outside the US very inconvenient.

That's not true. The GDPR has an incredibly broad territorial scope:

    2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

        a. the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

        b. the monitoring of their behaviour as far as their behaviour takes place within the Union.

So offering free services to people in the EU is enough to ensnare you. What does it mean to offer? From the official notes:

    factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.*

As for being able to acquire personal jurisdiction over you or your company to actually punish you for not obeying, that is not much of an obstacle either. Do you envisage potentially serving EU customers at some point in the future? (for basically any online company, the answer is yes) Do you use any services, banks, etc. that are located in the EU? (another likely yes). They may not be able to directly fine you today, but they might be able to in the future, or cut you off from European companies.

There is a reason why the doctrine of international comity exists. When followed, it limits the extraterritorial application of laws such as to not infringe on the rights of other nations to decide what behavior is acceptable within their own territory. But the EU has decided to not follow it with the GDPR. In fairness, the internet has made it challenging to find the appropriate balance, but the EU is way out of left field here.

So, a US based firm offering a spanish version of their website has to apply with GDPR because people from Spain could also visit?

Whats next? US firms targeting the American-Korean community in the US need to apply with laws made in Northkorea? :)

Its not "EU bureaucrats" though. You can read any HN thread on GDPR and general consensus here is that it is good for consumer rights and if you are having hard time with it then you were doing something malicious and you should give up your unethical 'business model'.

Also, GDPR is not restricted to ' EU users'.

It is sad that in a place with so many developers this would happen. Especially sad to see that attitude prevail even with some developers' comments in there about "now we can't have fora anymore without a large team".

I'm sure that's just one of the costs associated with this, and yet it seems to me it's a clear loss. And what do we gain ?

> Also, GDPR is not restricted to ' EU users'.

I'm sure you can understand why having laws with (even pretend) global reach is a huge, huge problem given the people who make laws. Let's leave the discussion of which countries are or aren't problematic there, but let me just state that the problem is you're unlikely to agree with large dictatorships or religiously run countries' laws. That's why laws shouldn't have global reach.

The big problem police has with the internet in general is that it allows for things to be synchronized, and they can't easily block it. That it allows anything from going out with a lot of people, to protests, vandals ... and, yes, terrorists and I'm sure other criminals too to be as organized as the police is. They can't deal with that is the simple explanation.

But to totally sacrifice free speech for this is entirely out of proportion. This is not a good way to strike a balance and that's why this law needs to be stopped.

Also, the police ... out of the 30+ police services that interpol represents, I assure you, there will be a lot that are outright stupid, yet more that just don't care about the effect of what they do, and one or two that are outright malicious. These people can't be trusted with this power.

But that doesn't mean we shouldn't acknowledge their problem. It definitely exists. But there are better balances to be struck than this. But yes, I see how this is being used against them:

https://www.smh.com.au/world/europe/swedish-prime-minister-l...

https://en.wikipedia.org/wiki/2016_Brussels_bombings#Attacks

We're partially responsible

Those who implemented the user-hostile features that necessitated regulation in the first place are 100% responsible, direct your ire at them.

Someone on HN said that all regulation is written in blood. We're finally seeing regulation of the IT sector to avoid the issues that are plaguing users for decades now. Yes, it's inconvenient to click that "Ok, I accept cookies" (or the other button), but so are child-proof medicine containers, vaccines (needles hurt, right?) and many many other things in this life and people just have to get over it for the sake of common good.

P.S I don't agree with automated content censoring, I only agree with regulating the sector not to abuse my data and my user rights.

For GDPR you had over 2 years to implement a solution.

It just so happened consultants who can get a lot of money very quickly popularised it.

It seems they were making these laws without understanding how technology works.

Consider a website, which have a moderate community and solely runned by one or two developers.

How are they going to detect the content which is oppressive. By creating a NLP and image recognition software and run it within an hour.

If they want there country audience to have the content they like, either have a seperate internet for Europe or teach their own citizens to not visit such sites.

Censorship as a Service?

And who shall provide that service? Why, the government of course. It's just common sense.

> How are they going to detect the content which is oppressive.

That is not a requirement, but if they get a call from Europol they are required to take the offending content offline.

Well at simplest, if enforced, it will force a company to figure a way to comply. Either get rid of people who share such content or otherwise mute them. If not, you pay fines, preferrably way more than what you profit from letting such voices have a safe haven.

How else do you solve the problem of unwanted ideas spreading around? Serious question, as this is a constant challenge for every social group anywhere.

> How else do you solve the problem of unwanted ideas spreading around?

Though education, independent thinking. Presumably ideas itself are not unwanted, things resulting from those ideas are unwanted.

But that does not work in practice. Social groups need cohesion to function. If you fracture that cohesion, the group may split to more cohesive subgroups which may not be tolerant of each other. Their belief systems may be so incompatible in such way (by malicious design or otherwise) that peaceful co-existence becomes impossible and infighting ensues.

The history of our species is full of that scenario happening. In the grand scheme of things every war fought ever is a variation of that.

Not all of us are ideal, and most of us act in chaotic and irrational ways. Usually we don't see it or care much about it, unless we see it in others and we think its something to look down to.

Among us there are individuals who are suspectible to thoughts and ideas, which if presnted correctly, can alter and sway their values, identity, beliefs and behavior.

How do we defend a social group, which inherently has individuals as described above in them, from a info-social attack against our group cohesion? Because education can never be a perfect solution due to human factors. We are all different and respond differently to different ideas and content presented to us. Furthermore, some of us are naive and gullible by their nature, while others are careful and reserved, even paranoid.

How do you defend against an adversary which optimally targets crafted (often truthless) messages at receptive subgroups of different personalities, backgrounds etc.?

Think of social networks, content in apps, ads, blogs, HN/reddit/etc comments, ....

You're trying to solve an unsolvable problem, based on an inaccurate premise. Social cohesion in any nation-sized group is temporary at best. The notion of a permanently cohesive society is terrifying, as it implies the end of independent thought and the elimination of organized dissent.

Conflict is an inevitable part of the human condition. Anyone who tries to "solve" human nature inevitably ends up creating a nightmare society.

But what I am talking about is not just nation-sized group, but any social group.

You can think of religions as an example, and as an attempt to solve these problems, with all the problems that entails, of course.

What makes you convinced, if not the infinity of time, that conflict is inevitable? To me it is clear that as species due to our cultural development and understanding (which our societies represent) has increased dramatically over the last few thousand years. Similarly, our conception of our own social group (the "us") has grown dramatically, to the point that we today may identify ourselves as parts of multiple, independent social groups. Unlike not long ago, these groups need not be local, they can span countries or continents.

Because technological development leads to globalization of the species, our social groups start covering the whole planet.

If this development continues, is it not inevitable that we will at some point get de facto global entity which governs us i.e. world government? It would be the natural next step.

What would be the responsible social action to deal with global issues like global warming and to return to sustainable resource use?

We can not, as species, decentralize our decision making to independent self-interested groups i.e. nations much longer. Our consumption of resources is neither sustainable nor responsible. What wisdom is it to leave a barren earth for our children to inherit?

> Similarly, our conception of our own social group (the "us") has grown dramatically, to the point that we today may identify ourselves as parts of multiple, independent social groups. Unlike not long ago, these groups need not be local, they can span countries or continents.

> Because technological development leads to globalization of the species, our social groups start covering the whole planet.

I think you overestimate the effects of technology and globalization. I too used to believe this, but I have found it to be an illusion created by the intersection of modern media and the Internet. If you get out of your neighborhood, your city, your state, your country, and really engage with people, you'll find that most of them are more different from you than you can imagine. People have wildly different values, interests, and beliefs about even the most basic things. It is a wonder that we function as societies at all, and a testament to the resilience and inherent flexibility of the social structures we've constructed -- at least in the 50% of the planet where stable, large-scale societies exist.

> If this development continues, is it not inevitable that we will at some point get de facto global entity which governs us i.e. world government? It would be the natural next step.

No, mainly due to the inevitable competition for resources and status that would splinter any such centralized authority. Groups of humans will not agree to give an outsize share of their resources to perceived competition, even if it is a fair exchange. Look at the present urban/rural divide, racial and religious divides, and hatred between many nations. And this may be the best it has ever been! There has never been a time in history when strategic competitors could agree to put aside their differences for mutual advantage, except for brief moments when facing a greater threat. One could argue that climate change and resource depletion are indeed greater threats, but I would contend that such alliances suffer from fatigue and eventual defection if the "war" lasts too long. (Which it will! These issues are not going away.)

> We can not, as species, decentralize our decision making to independent self-interested groups i.e. nations much longer. Our consumption of resources is neither sustainable nor responsible. What wisdom is it to leave a barren earth for our children to inherit?

You're right, we can not -- but we will, unless technology allows a small group to put a boot on the face of humanity's abundant diversity of culture and thought. Either option is terrible; we dive back into the pit of global resource conflict, or we become enslaved. The only thing that can break us out of this awful set of choices is a benevolent "strong" AI, and I personally have doubts that this can be achieved in time to save us from the next, potentially final, global war.

If I were a global power, I would be secretly putting my resources into surviving this coming war. (There are no "winners" in the next global war, only survivors.) Unfortunately, if nations are doing this -- and they surely are -- it only adds to the probability of conflict.

> How else do you solve the problem of unwanted ideas spreading around?

Make the ideas illegal. Ban discussion or propagation of the ideas, including written materials. Set up a strong system of censorship to ensure that people don't try to use irony, innuendo, or sarcasm to evade the information blockade. Ensure that cross-border communication is intercepted and inspected for illegal ideas. If someone is reported for spreading the ideas, search their home and confiscate the illegal materials. Send repeat offenders to prison. Put the creators of the material in prison. Tightly control any and all devices that could be used to spread the information.

(For the record, any country that has come close to achieving this has become a totalitarian state.)

"Extremist" is a word that carries no weight without context.

Funny how laws are written before the context is formalized. Like a blank check for future oppression.

But THEY are the good guys, don't worry ;)

I am sure our mainstream is unbelievably extremist from the point of view of people living at the beginning of 20th century...

Or different parts of the world. Drones are extremist and suicide bombings are noble in parts of pakistan while opposite is true in usa.

That most reactions focus on the absurdity of a 1h deadline is proof that this technique still works wonders. https://en.m.wikipedia.org/wiki/Door-in-the-face_technique

Indeed. Or more people than you realise implicitly support the idea of censure with only vague restraint, and are just nerding out on the details.

In the end it will likely not matter how expertly the eurocrats contain the symptoms of deeper, social problems, it might very well blow up in their faces.

just two steps away from china

1. authorities can have their own definition of "extreme" 2. site must delete or get shutdown

yes, extreme is anything ISIS right now, and soon after whistle blowers, journalists not in the current political movement will be falling under the same net as well.

Sounds exactly the same excuse as ever: pretend to protect the children by applying new censorship rules.

There's a thing called the political opposition (or over here in Brit Her Majesty's Loyal Opposition) and that's how democracies stop authoritarian rules y'know.

That assumes that the opposition is willing to spend political capital arguing "in favor of extremism."

Is it foolproof? Some people believe it's possible for opposing parties to slowly drift towards each other on the political spectrum over time, to the degree that "opposition" becomes rather meaningless in a practical sense.

https://en.wikipedia.org/wiki/Overton_window

The Overton window, also known as the window of discourse, is the range of ideas tolerated in public discourse. The term is derived from its originator, Joseph P. Overton, a former vice president of the Mackinac Center for Public Policy, who, in his description of his window, claimed that an idea's political viability depends mainly on whether it falls within the window, rather than on politicians' individual preferences. According to Overton's description, his window includes a range of policies considered politically acceptable in the current climate of public opinion, which a politician can recommend without being considered too extreme to gain or keep public office.

As an example, consider the reaction of both the Republicans and Democrats (and the news media) to the very notion of Bernie Sander's socialized, single-payer medical care in the last election. In the not too distant past, the Democratic party rallied behind such causes, or at least had an open mind about them. Now, they will stick a knife in your campaign behind the scenes.

This touches on what Hillary Clinton used to believe, and what she believes now. Is she "just being pragmatic"?

https://www.cbsnews.com/news/hillary-clinton-single-payer-he...

I think removing extremist content is a good idea overall (although this then begs the question, how do you legally define extremist content?[1]), but I feel like 1 hour is a bit tough, primarily because 1 hour can mean different things: does it mean from being reported, or being uploaded? This question isn’t covered in the article and it’s an important distinction I feel.

1: the problem being that a lot of religious texts could be defined as “extremist” if an ill defined law is created. I guess you have to define directly what content would be considered extremist, e.g. any video from a known terrorist/terrorist group like ISIL, which will never be perfect but better than having a definition that’s too loose.

I think we can assume that it's within 1 hour of being reported, not uploaded, since there's no way to guarantee everything that's uploaded is fully checked, even with a staff large enough to look at it all and make decisions more than a few seconds long.

But that problem also basically exists for smaller sites under the "1 hour after reported" rule, too. IMO, it would basically force them to hide anything that was reported immediately, and then restore it after it was moderated.

That will make it horrifyingly easy for internet trolls to mess with things.

For a small website with a team working 9-5 and no advanced AI moderation, that would mean that they can't let users upload things outside of working hours...

I’m not sure though, because of this quote:

> In March, the EU's civil service published details of the current voluntary arrangement, which noted that "terrorist content is most harmful in the first hours of its appearance online".

This makes me think it may be timed from the upload, not the report.

Then that would basically mean that all content would have to be moderated in the EU, which would cripple forums and chat sites.

I can't even begin to imagine what repercussions that will have.

I don't think we can assume it's within 1 hour of being reported. The press release also says:

> In addition to referrals, internet companies should implement proactive measures, including automated detection, to effectively and swiftly remove or disable terrorist content and stop it from reappearing once it has been removed.

To me, that sounds a lot like they're willing to mandate AI detection in order to "solve" the "team is asleep" problem. They suggest this might be yet another rent-seeking opportunity for big internet platforms:

> To assist smaller platforms, companies should share and optimise appropriate technological tools and put in place working arrangements for better cooperation with the relevant authorities, including Europol.

No doubt, some "helpful" authorities will provide an "appropriate technological tool" to help. No need for the government to break Perfect Forward Secrecy if every site is giving it clear-text access to all uploaded content.

>I think removing extremist content is a good idea overall (although this then begs the question, how do you legally define extremist content?[1])

Whatever the people with power say it is. The whole point of free speech is to prevent this kind of thing. This isn’t some minor flaw you’ve identified, but the entire reason why freedom of speech is necessary.

In cases like this I’m ok with a restriction to true freedom of speech. For example, I am ok with making saying the holocaust didn’t happen illegal, or making Nazi imagery illegal even though it is a restriction on speech. I feel like this falls under a similar umbrella.

Essentially it boils down to having to trust the lawmakers, and I do by and large trust the lawmakers in the EU, moreso than in the states.

>I am ok with making saying the holocaust didn’t happen illegal, or making Nazi imagery illegal even though it is a restriction on speech.

People don’t deserve punishment for the contents of their conscience or their beliefs, no matter how wrong their beliefs are. To take a man’s freedom for speaking his mind is one of the most abhorrent things you can do in this world.

Why is it that the Nazi iconography and holocaust denial is always singled out, but no one ever bans Soviet apologia or imagery? Could it be that the powerful forces in Europe are more sympathetic to one side than the other? Both are clear cut cases of murderous regimes whose ideas belong in the history books, but already the censors you are eager to trust are abusing their power to further their political agenda.

> Soviet apologia or imagery

Is that actually a bigger problem in the EU than it has been in the past?

There have always been admirers of the USSR in every country, but if I recall, they've always been a tiny percentage compared to Nazi apologists, aside from Russia. I also don't recall any of them being outright racist and calling for wholesale destruction in the way that other extremists have done.

I could be wrong there - I'm not a huge consumer of Nazi or Soviet propaganda.

Europe is full of active self-identifying communist parties, many with seats in the various parliaments. Or how about the yearly ritual of masked French far-left activists wreaking havoc on the streets. Why is no one banning these violent extremists?

I really think there is absolutely no evidence that "extremist content" is a serious problem that would warrant infrastructure to moderate or censor content. What if we try to quantify the problem? How many people are really affected? And in which direction?

I think a closer inspection would quickly reveal that it is not a particular video or text that drives people to the edges and has more to do with the general reaction to terrorism for example.

"Extremist content" could very well be the rock'n'roll of the seventies.

And wrong people are already getting banned. And not for being "extremists".

Seriously, if wiser people just decided to completely drop the topic immediately, the problem which still lacks quantification, would be nearly invisible.

      extremist
      adj 1: (used of opinions and actions) far beyond the norm;

I think I should begin to consider the EU plans quite a bit extremist themselves.

The EU internal report is here: http://europa.eu/rapid/press-release_IP-18-1169_en.htm

It seems to be in early stages. The one hour rule is fine for larger sites that can afford it, though for smaller sites where "all employees are asleep" is a valid condition so I'm not sure how they'll handle that.

Additionally this seems to piggyback another set of rules determined to make Youtube DMCA/Copyright/Community Guideline strikes more transparent and fair, which is urgently needed IMO.

I'll definitely keep any eye on it, it might be harmful depending on how the final draft as law turns out.

End of our civilization. Wonderful. Now what was supposed to be the difference between EU and Soviet Union? That we voluntarily cheer for this and not get dragged to accept it? I am sure this opinion gets flagged as extremist soon...

I'm not sure it gets flagged, but might deserve a honorable mention in a weekly n-gate writeup.

1 hours is an extremely unrealistic timeline to remove or taken down content. This specially is externally hard because lot of social networks depend on people reporting something and then an action is taken. To add complexity there can be foreign language at play as well which people might get scared off even without knowing what it is.

If i said Israel is terrorist organisation and they stole a land doesn't belong to them, does this qualify an extremist content?

Depends. Is it election season or they're buying submarines from us season ?

Classically unreasonable political demand, 10/10

How do they classify videos about Catalonian Independance?

Extremist if Catalonia stays in Spain, I suppose. Winner takes all.

We are witnessing rise of totalitarian 1984esk dystopia.

That sounds possible for large players.

The EU usually makes little distinction between a 3 man startup and a multi national 5000 people company with their laws. They don't get that such laws only re-enforce and strengthen the position of the big dominant players (Facebook, Google, Twitter...) that have the legal capacity to deal with all this nonsense.

That is how proper laws are supposed to work, there is no rich and poor's court.

I agree. Thats why you should not pass this law.

In theory. In practice, there are a lot of ways to abuse that, for example by establishing a high entry barrier. The reality is always much more nuanced than ideologies.

They’ve made it clear that they are not making exceptions for small players, specifically somas to preclude pushing extremists out into the fringes of the Internet. No small platform will ever be able to launch in the EU again.

How? Can you even define "extremist content" in general terms without also making religious texts illegal? Or scientific articles that go against the politically correct narrative?

>Or scientific articles that go against the politically correct narrative?

Wut?

James Damore was fired for citing scientific articles, for example.

You can also watch the swedish documentary Hjernevask which shows what happens when science goes against the PC system, it's fascinating.

Damore was fired for what he said, not what he cited while saying it (I'm not saying it was justified). Misrepresenting events as a rhetorical tactic is essentially propaganda - it will never do anything but hurt both sides of the argument.

But what he said we're citations. Nobody is misrepresenting anything.

Norwegian documentary, actually.

https://en.wikipedia.org/wiki/Hjernevask

https://www.youtube.com/watch?v=cVaTc15plVs&list=PLaJtMuDnR5...

(The links in the Wikipedia article go to videos with a bit higher quality than the Youtube playlist.)

Assuming there are already laws defining what you can say/publish, I'd assume that these laws are only relating to how material that is already illegal should be handled?

What is legal is of course varying between EU member states, but e.g. hate speech or nazi propaganda usually falls under the same paragraph and is already illegal.

I agree that this is a very difficult distinction, but the distinction isn't new in any place where there aren't already hate speech laws for example

These laws are extremely vague, and already applied very selecively. For instance, if you look at Code of Conduct on Countering Illegal Hate Speech, the European Comission admits that they want the websites to perform the function of the judge, jury, executioner:

"Isn't it for courts to decide what is illegal?

Yes, interpreting the law is and remains the responsibility of national courts. At the same time, IT companies have to act in line with national laws, in particular those transposing the Framework Decision on combatting racism and xenophobia"

So if you're a website operator, and it has the text that says "slaves, obey your masters", should that be deleted? Why or why not?

What about "do not permit a woman to teach or to assume authority over a man, she must be quiet"?

really? On youtube there are more hours of videos uploaded every minute than actual human reviewers can ever hope to police, let alone under one hour...

Google has $100,000,000,000+ in the bank and slightly more than that in revenue last year, so realistically if they need 100,000 more employees to handle this they will still be ridiculously profitable, especially when they call them contractors to avoid health care, and evade taxes on a global scale, and woo oppressive new markets like China.

Charging users to upload videos would solve the problem.

I doubt ISIS and the like lacks funding. If this is really what you want to prevent money wont be a big barrier.

You're not thinking laterally. The problem isn't extremist videos. The problem is that there are too many videos uploaded to reasonably check all of them. Charging would solve that problem, which in turn solves the problem of extremist content.

What is "extremist content"?

How can the website owner be notified?

Cookie laws, legal nag screens everywhere, monitoring comment section is a 24/7 job... its just absurd. Honestly, just turn off the internet in the EU.

GDPR is a good idea (although I remains to be seen if any of it is enforced, as without enforcement it's pointless) but I agree the cookie law was the stupidest nonsense I've seen in a long time.

GDPR is just cookie law on steroids. Except now you have to click a million checkboxes instead of one button, and it works worldwide.

That's very untrue. In fact, any site which makes you do that is _violating_ the GDPR - you aren't allowed to have those checkboxes be opt-out.

Besides, that's only one small part of the GDPR, which is much closer to the Data Protection Act modernised for 2018's awful internet than anything else. We did this to ourselves by proving we can't be trusted to self-regulate.

I think his main point is that for now GDPR is just as inefficient as the cookie "law" it replaced, which I have to agree with - the only thing that will make these regulations useful is enforcement - until that happens companies will just ignore it (as we can already see with plenty of non-GDPR-compliant sites).

I agree, but until now I have seen very few websites doing GDPR properly (probably because it would go against one of their main ways to make money). The best implementation that I found to date, is on GitLab's website [1].

[1] https://about.gitlab.com/

Wikia is also good with it, though it's not too clear that "Reject advertising cookies" is a button.

http://metroid.wikia.com/wiki/Metroid_Wiki

Considering almost every big website makes me do that, and they presumably have a team of lawyers on payroll, I'd rather take their opinion on the matter (no offense). If million checkboxes thing violated GDPR, you'd think someone would be suing them already by now.

The problem with GDPR is that you can't sue over it directly, you can only report them to your jurisdiction's privacy watchdog (CNIL in France, ICO in the UK, etc), and if the privacy watchdog sucks or doesn't care then tough luck.

You don't need to click a million checkboxes. All the cookies should be disabled by default. If sites require you to disable everything by hand then they're not complying with GDPR.

You can still click only one button, if you're okay with all the tracking.

Let's just hope the EU clarifies some things quite quickly with the GDPR. Basically sites can't just show large cookie dialogs explaining to users what tech they want to use to track users and show better ads.

Users should be able to 1) view the site/use the service without being tracked in any way that isn't technologically necessary (not just financially necessary). 2) Sites can't just show a dialog asking for consent and then go on as usual.

The goal of the GDPR is to have sites default to non-tracking, and just keep showing me the content, without any dialogs. And hopefully some large company will be dragged to court and fined a symbolically enormous fee, after which everyone else follows suit.

Cookie law does not give users a way to opt-out. That's why you get annoying pop-ups that say "By viewing this site, you agree to all our tracking bullshit"

GDPR says users must be given an option to opt-out and you cannot start tracking them until they specifically click "I agree".

If you use private browsing by default, you literally have to click through checkboxes on every single page visit after you restart the browser. They killed Internet with it already...

Didn't the European Parliament vote this down just three months ago?

Reply on news.ycombinator.com