In apparent contravention of the GDPR, various parts of the page say that I must agree to their use of my data for third party advertising or I cannot access the site.
They can say that they have a legitimate interest exemption - and they do. Sites must be able to earn money from their content, or they cannot operate. Therefore, they have a "legitimate interest" exemption for this practice (allowed under GDPR) - they cannot provide you with the service you requested because you are unwilling to help pay for it by allowing third party ads.
Edit: By the way, none of this addresses the other elephant in the room. TechCrunch is US based, and to my knowledge they do not offer foreign language translations of their site, at least on the .com version of the site. This meets the test under Recital 23, which says that if it doesn’t “envisage” serving EU users, it isn’t even subject to the GDPR. Any privacy notices on TechCrunch.com are essentially a courtesy.
They don't. That's not a legitimate interest. Making money from the data is not covered and if it was then the entire law would be moot.
> they cannot provide you with the service you requested because you are unwilling to help pay for it by allowing ads.
You missed the word targeted there. And the massive background dissemination of data that accompanies them. That's the issue.
While I live in the US, I used an EU VPN for a few weeks just to see what would actually happen under GDPR as an EU user. I couldn't stand the popups after a while - GDPR has ruined the user experience of the web for 500 million people. But through that experience I saw that most sites based in the EU are either a) ignoring GDPR entirely, or b) taking the position that showing ads from third party ad networks without specific consent is a "legitimate interest" - whether you agree with that position or not. I also witnessed countless sites that required user consent in order to view content.
No, that would be tracking and targeted advertising. No data processing - no need for popups or consent. If you want to sell me out to the highest bidder then you need to ask, and ruin the look of your site. Your problem, not mine.
> I saw that most sites based in the EU are either a) ignoring GDPR entirely, or b) taking the position that showing ads from third party ad networks without specific consent is a "legitimate interest" - whether you agree with that position or not. I also witnessed countless sites that required user consent in order to view content.
The law hasn't been in place for that long, and it will take a while for things to catch up. Your last two types of site there are specifically disallowed, and the first just naive.
Showing third party ads without consent is perfectly fine. IFF you don't gather, share, or process any personal data in doing so. If they serve static non-personalised ads, that's perfectly GDPR compliant.
Even when data processing is necessary to the controller, such legitimate interests must be weighed against “the interests or fundamental rights and freedoms of the data subject”. Should data controllers justify processing without consent based on this subparagraph, they will need to be prepared to prove legitimate interests (a higher burden) relative to the implied general interests of data subjects.
So businesses will need to argue that their interest (income) outweighs the interests of their users (not to be sold out).
Specifically, when it comes to advertising itself as a legimate interest:
Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.
Which is funny. Because they clearly don't care about personal data if you're in the U.S.
Hopefully in a few years (and hopefully a few multi-million dollar lawsuits later) the industry will learn to actually value my personal data and choices.
Strange then that "techcrunch.co.uk" redirects to techcrunch.com/europe