Hacker News Reader

Comment by beshrkayali | Hacker News Reader

Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. I'd like to see how many websites offer a reasonable consent widget that doesn't opt you in by default, keep nothing checking but a huge button to tick and accept, or the usual million-and-one checkboxes to untick, and many other cheap tricks that even the most vigilant of consumers will fall to at some point.

I use everything I can to prevent tracking on my machine. But for a general solution for everyone, I don't know what would be the answer, but I don't think it's GDPR. If it's to work, acts forbidden by GDPR need to be handled very fast, and without interaction from user nor legal mumbo jumbo. Without a zero-tolerance policy, the cheap tricks will only grow stronger.

Edit: So apparently if you criticize gov/bureaucrats on HN you get downvoted.

View on HN

More a problem of enforcement than the legislation IMO. It wouldn't take many cases to be properly litigated before publishers would understand this is a law that is to be obeyed like any other.

I honestly don't trust governments/bureaucrats to be able to come up with a solution for this issue. This is one of those problems that evolves very quickly, and the solution probably needs to be done by a private company or by each person individually.

In 2016, I think, there were 0 airplane crashes and 0 air travel fatalities. Across 200 countries, hundreds of airlines and several airplane manufacturers, probably thousands of airports, millions of flights.

If you think that was an easy feat, then I don't know what to tell you.

Do you know how it was achieved? With finely tuned and ruthlessly efficient bureaucracy.

When people really care, bureaucracy works wonders.

Bureaucracy is basically formalizing social interactions for a specific topic. Formalizing something ossifies it, but it also prevents your pilot telling your copilot "Shut up!" just as the plane is about to crash into the mountain.

> 0 airplane crashes

I presume you meant commercial aviation, rather than aviation in general. Unfortunately not quite true even there. Your broader point stands though.

https://en.wikipedia.org/wiki/Category:Aviation_accidents_an...

> Your broader point stands though.

Well no, you've neatly disproved it.

The reason it works for commercial aviation and not anything else -- not even aviation in general -- is that the bureaucratic processes used for commercial aviation incur a massive overhead. When you have a product which costs a hundred million dollars a unit anyway and can kill 300 people in one shot if it fails, you pay the cost. For anything else it's too expensive, but spending less money causes the bureaucracy to be ineffective.

And even in commercial aviation, the overhead is still there, it's just capable of eating the loss. (Or maybe it isn't, given the miserable lack of competition in that industry now. And then where does that lead us on safety, Boeing?)

And the aviation industry is not exactly a massive innovator at this point. The most commonly used commercial aircraft today were developed before the world wide web was even a thing.

Why don't we just skip a few steps ahead - delete the internet and go back to cable TV? That's where we're headed for anyway.

> Do you know how it was achieved? With finely tuned and ruthlessly efficient bureaucracy.

Not to dispute the effectiveness of a finely tuned and ruthlessly efficient bureaucracy, but pilots and airlines have a strong incentive to not have fatal accidents; websites however have a strong incentive to track their users.

To use an analogy, enforcing this will be less like mandatory driving exams and more like net-zero carbon emissions.

Airlines and airline manufacturers also have vast financial incentives to risk crashes by taking minor shortcuts. That doesn’t exist for your drivers test.

That's not in the airline's interest because then the plane crashes and they lose a hundred million dollar plane and get sued and go bankrupt.

It could be in an individual manager's interest because then they get a bonus and are working for some other company by the time the plane crashes, but the airline itself has the aforementioned incentive to put processes into place all on their own to prevent that from happening.

Losing a brand new hundred million dollar aircraft is a huge hit. Losing a 50 year old aircraft is a different story, especially when the options are to retire it or keep flying. Further risking a crash when your airline is facing bankruptcy suddenly looks like a reasonable trade off.

It’s not like a major airline is going to intentionally crash an airplane, but if they can trade 1 billion dollars for an extra crash every 20 years that’s a net financial benefit.

> Losing a brand new hundred million dollar aircraft is a huge hit. Losing a 50 year old aircraft is a different story

A 50 year old aircraft still costs tens of millions, and the biggest cost of a crash is the lawsuits anyway.

> especially when the options are to retire it or keep flying.

50 year old planes fly all the time. The options aren't retire it or keep flying, they're maintain it properly or don't.

> Further risking a crash when your airline is facing bankruptcy suddenly looks like a reasonable trade off.

Which is where the insurance company comes in, and we're back to having an existing bureaucracy with an incentive to prevent that from happening.

> It’s not like a major airline is going to intentionally crash an airplane, but if they can trade 1 billion dollars for an extra crash every 20 years that’s a net financial benefit.

The value of a statistical life is generally regarded as being about ten million dollars. Times 300 passengers that's $3 billion. So that's how much they can expect to get sued for when the plane crashes, in addition to whatever the plane was worth. If they're "only" saving a billion dollars, they're losing money.

And if they could somehow save more than 3 billion dollars then that's what they're supposed to do -- at some point safety measures cost more than the value they provide and VSL calculations tell you where that is. (And if you don't think so then I assume you never travel by automobile or buy anything that has ever been in a truck.)

Insurance on older aircraft much like older cars drops because their worth less.

Your lawsuit numbers are also wildly off. Ex: “The US aviation giant has settled the first in a series of lawsuits filed by families of 737 Max crash victims. Boeing will reportedly pay $1.2 million to 11 families of victims killed in the 2018 Lion Air crash.“ https://www.dw.com/en/boeing-settles-first-lawsuit-with-737-...

No they're not. That's what they're supposed to get. If courts don't actually give families that then the problem is in the court system, not the company.

It doesn't matter where the problem lies. The value courts assign to life informs the airline when they estimate how much they would lose due to a crash.

It matters where the problem lies if you want to fix it.

Your argument is all "logical" but it does not agree with reality, the boeing 737 Max is a prime example.

Only then you're proving the other point just as much, because the 737 Max is also subject to the bureaucratic regulatory system being held up as an exemplar of something that works.

For 2 crashes out of 387 aircraft and several hundred thousand flights to be considered unacceptably dangerous suggests the system is largely working as intended. The aircraft had 0 fatalities in US or EU, globally an order of magnitude safer than driving, and it was still grounded.

Imagine if we took car safety so seriously.

The thing is, there isn't a huge commercial vested interest in having plane crashes happen.

"but it also prevents your pilot telling your copilot "Shut up!" just as the plane is about to crash into the mountain. "

I am curious? How does regulation prevents that?

(and how does it prevent a suicidal pilot, from locking out the co pilot and crashing in a mountain on purpose?

https://en.m.wikipedia.org/wiki/Suicide_by_pilot

)

https://en.wikipedia.org/wiki/Crew_resource_management

I can't find it now, but I once read a fascinating history of train braking in the US. Before modern air brakes became mandatory, trains had brake men who had to jump from on car to the other in order to fasten brakes. That had a high risk of the brake operator fallng off the moving train - and the whole train becoming uncontrollable. It was an extremely dangerous job and at the time train companies thought it would be too costly to change the system, so they resisted change.

> Bureaucracy is basically formalizing social interactions for a specific topic.

One could even say that bureaucracy is one form of organized collective action. Which in general is quite necessary for humans as a social species.

Sorry, privacy as a personal responsibility has failed outright. For many services there is simply no (online, i.e. practically relevant) alternative, because none of the market players have an incentive to be privacy preserving (think major news outlets) or because the service is not interchangable due to network effects (facebook, twitter etc).

The GDPR is actually sufficiently abstract IMO to make government enforcement possible and practical. And if you look at how tracking evolved, much of it is still the same old cookie-setting (from what, 25 years ago?) and the stuff that isn't (like ultrasonic profile matching and other shady stuff) is pretty clearly illegal. So it just needs political will on the national level where the enforcement agencies reside. Max Schrems' cases against facebook have shown time and again that these enforcement agencies are often simply unwilling to do their job, with the Irish one being a particularly bad example. But it is possible to do this.

EDIT

Also, regarding the personal responsibility aspect: we're being tracked by platforms we don't even have a user/customer relationship or any other contract with. Someone uploads a picture of me on facebook, and they build a profile based on that? Uncool. Is that a problem between me and the uploader? Certainly. Does that take responsibility from facebook to not mine that data? Nope.

>For many services there is simply no (online, i.e. practically relevant) alternative, because none of the market players have an incentive to be privacy preserving (think major news outlets) or because the service is not interchangable due to network effects (facebook, twitter etc).

But here's the big question: would these services have even existed in the first place if these laws had been in place? The internet has gained massive popularity because most of the resources on it are free. Look at porn - all of the known sites and run on ads, all the paid sites are essentially unknown. I don't know anybody who uses the latter. Wouldn't Facebook, Twitter, news sites etc have gone the same way if they required you to pay? Just look at what happens when a paywalled article gets posted. Either somebody posts a way to bypass it or a lot of people will never read the article.

I would go the other way with it -- the problem is we don't have a low overhead system for anonymous micropayments, so ads are the only competitive way to offer a service with a very low cost (and thus price) per use.

If there was an easy way to anonymously pay the site the five cents they get from the advertiser without incurring 500% payment processing overhead then would sites even be using advertising?

But then we get to much the same result. What we need isn't new privacy rules, it's to delete the old banking rules that prevent efficient payment systems from operating.

The payment processing overhead has nothing to do with rules and everything to do with Mastercard and Visa having decided to not compete on fees.

Then why don't you go into competition with them and undercut them on fees, if the rules make it so easy? Why doesn't anybody?

Barriers of entry exist and have nothing to do with rules.

I agree that it would massively help, but I don't think it would solve the entire problem. A lot of my interests online were cultivated as a kid where even a 10 cent charge would've made me click away. I'm sure it wouldn't have been an issue in highly developed countries, but it would've been a limiting factor for me.

So the model that works best for micropayments in most cases is exponentially decreasing prices over time. When the content is new it costs $1, in two months it costs $.50, in two months more it costs $.25, and so on down to zero, at which point it becomes free proof of the quality of your work to get people to pay for the newer stuff.

You can actually make more money using a pricing model like that, because you get to charge $1 to everyone who will pay $1 (everybody wants everything ASAP), but in a few months you still get the quarter from the guy who would only pay a quarter. And having a large volume of free old works to show the world you can produce good material is how you get new customers.

Which also solves the problem for people without money. (This is, incidentally, how copyright was originally intended to work. Screw you again, Mickey Mouse.)

Sure, this pricing model might work, but it'll still turn away people compared to right now. News that happened a few months ago isn't interesting anymore. Most people aren't going to read that. This essentially means that the section of people that can't afford the $1 price tag won't read your articles, unless they're researching some story later.

A lot of what we have online just isn't viable on pricing models like this. The main divide you'll see is likely by country due to wealth differences.

It's too late. You can't start to charge for things you used to give away for free. Plus with the internet, there's always an alternative, you just haven't found it yet. So the moment you run into a paywall you will turn around and start searching for the same thing you were just looking for but for free.

> It's too late.

What do you say we try it and find out?

> So the moment you run into a paywall you will turn around and start searching for the same thing you were just looking for but for free.

Because the existing paywalls are some nonsense where you have to give them your home address and sign up to pay a recurring monthly fee which you know is going to be a bear to cancel and costs dollars rather than cents, whereas what it ought to be is a browser plugin that just pays them automatically when you visit the site as long as the amount is below your threshold (with a circuit breaker that requires you to manually approve if you get charged more than like $5 over the course of an hour).

People have been talking about this idea for maybe 20 years (that I can recall). I'm also pretty sure there've been numerous attempts at implementations because really it's not that complicated a thing to make.

None of them caught on though because when it comes down to it, most sites that successfully make money can probably make more money from advertising than they can from this microtransaction system so there's no incentive for them to adopt it.

None of them caught on because the regulatory environment makes it effectively impossible to implement efficiently and all of the attempts had to make fatal compromises in order to comply which made them useless.

It can easily be argued that a lot of these services are a net negative and it would have been better for everyone if they never got off the ground in the first place.

Most services existed before, with a variety of models. E.g. Both subscription and ad revenue based free news papers existed long before the internet.

Somehow they managed, without the need to track ones every move.

Would the internet look the same, with the same players and behaviours if these laws existed? No probably not. But I also don't think the internet is in a very desirable state.

Maybe, we would have had more invention and uaee acceptance in different ways to pay and consume services instead of this race to the bottom of cheap ads.

>Most services existed before, with a variety of models. E.g. Both subscription and ad revenue based free news papers existed long before the internet.

Yes, but aren't most of those newspapers essentially partisan politics? Every free newspaper I've seen IRL has been backed by somebody trying to push for politics. From my experience they also tend to not be that informative.

>Maybe, we would have had more invention and uaee acceptance in different ways to pay and consume services instead of this race to the bottom of cheap ads.

The problem is that there is no price equilibrium that will work. People from poor countries can't afford to pay what is a reasonable price for people from rich countries. Poor people in general can't afford to pay. Kids/teenagers can't afford to pay. And this gets complicated even more by the fact that we don't even have payment methods available to everyone. Even if you could afford it, you couldn't pay. Ie I've never owned a credit card in my life and as far as I know I'm not eligible for one. They have a minimum income limit that I fall under.

I'm saying that the ad model is what made the internet so commonplace for a lot of information.

I don't know in detail world wide, but Europe has or had several free daily news papers for commuters piled up in train and bus stations. the ones I know used to be fairly neutral because they just printed what came in from news agencies like Reuters, AP, etc with minor changes (license fee is much higher if you want to print 1:1).

As for informational value. They were good enough to keep up to date what is going on, and then use other sources to dig deeper.

I'm not against ads, in fact in small populations like Switzerland where I'm from, fully subscription funded news papers have never been viable to my knowledge. They were always majority advertisment funded. The subscriptions basically pays for having the news paper printed and delivered, not much more.

But the ads that used to pay the peoples bills were those full pagers, clients payed tens to hundreds of thousand of dolars for a single issue. It still worked reasonably well online on desktop with plenty of screen real estate, but with the raise of mobile prices collapsed.

I worked at one of the largest publishers in Switzerland during that time and saw first hand what got cut during re-org: Fact checkers, specialists, investigative departments, international correspondents, etc. News rooms from supposedly independent news papers in the portfolio got merged. More and more pressure to write article to perform on facebook.

All things that a normal reader will not immediately notice, but that severly affect quality and journalistic integrity long term.

While I think having all information available for everyone worldwide would be amazing, I don't see the current situation sustainable quality wise for anyone beyond the few top percent of market leaders.

I don't know how to solve it either, why I said, maybe we would have come up with different models if we didn't go down the path we did. And a lot of these old organisations have to take a lot of the blame of just not reacting to change for years.

But whoever you point fingers at, as it it stands, we are headed for a lose-lose information wise in my opinion.

That's a weird argument to make. Maybe the businesses ("services") would have not existed with these laws in existence already. The question is would the world be a better place without them. I don't think the answer to that question is so straight forward.

We as society implement laws to prevent undesirable behaviour all the time. You can certainly argue that the law against robbing banks for example has prevented business innovation around bank robbery, but I believe this is a desirable outcome, and I think most would argee.

I think the answer is pretty straightforward to me. If the internet hadn't been what it was then I probably couldn't even communicate with you, because I would never have picked up enough English to do so. This is just one effect of so much of the internet being freely accessible. If payment had been required I probably would've stuck to my native language sites, if I had used the internet/computers at all.

I think the internet providing so much information for free is what made it so amazing. I understand that it's not really free, but it's at no monetary cost to the user. The moment you slap a monetary cost on it you create a disincentive for the user to engage with the service.

I do understand though that nothing is free. We are probably going to pay a large price as a society for it.

I'm okay with killing everything currently online (given backups, of course) in exchange for a sensible micropayment/nanopayment architecture.

Ads must die.

If Facebook etc. wouldn't exists if users knew their prices – ad-infested websites require everyone to pay because companies recoup the cost of advertising by charging higher prices – then by the logic of a market economy they shouldn't exist.

They just have to create judicial precedent a few times and the system can easily hand out an impressive amount of warnings and fines.

I have the complete opposite view. Companies provably can't be trusted on anything touching privacy, and individuals don't have any power to act on it. Governmental oversight and bureaucracy is the only tool that works for a problem like this.

It's a proven, efficient, and universally approved way to already enforce food, fire, travel safety and so on. It's only logical that privacy safety follows the same steps. GDPR seems to be a good approach for it, just pending on widespread enforcement of the rogue entities that aren't yet following the law.

But privacy isn't like food, fire or travel safety. Even assuming absolute cynicism it isn't very exploitable for them to use it for bad purposes.

I liken the difference between actors to a housecat and a large dog with a lamb. The cat at worst could give some scratches but at worst would probably just annoy the lamb jumping into its wool and kneading it. The dog ideally would look after tbe lamb but could also inflict serious bites or even rip out its throat if it wants. Both may want the meat but only one has the ability to kill it to get what it wants. When it comes to unknowns as the lamb I would go with the cat as opposed to the dog out of sheer distrust.

I'll actually argue that it very much is.

First, there's the historic precedent of collected information eventually making it into the wrong hands. The Preussian "pink lists" are a classic example, but essentially everything that ended up as PRISM can be taken as a more modern example.

And yes, putting power into government hands so regulate the collection of that data, and then arguing that it's dangerous because of the government might seem a bit contradictory. It's not in my mind. These types of legislation are supposed to disincentivize the collection by private entities after all. Government and intelligence services are (too) close but they are distinct.

And then there's the very real [1] ([2] if you want it more juicy) possibility of corporations targeting individuals for one reason or another directly. Here in the west, this sort of thing would result in your Uber becoming more expensive or unavailable, but imagine being a government critic (or activist against e.g. organized crime) in Brazil right now. All that data going god-knows-where, with the express intent of the collectors to sell it to anynone? Not a great outlook.

[1]: https://en.wikipedia.org/wiki/Greyball [2]: https://news.ycombinator.com/item?id=23529035

I think your allegory falls short: the government isn't in this scenario collecting the data, but rather reining in the data collection of private entities. The end result is less data collected instead of the same data in different hands.

Thank you for expressing so clearly what I was struggling to say. :)

I definitely don't trust private business to fix this. In case you haven't noticed private business efficiency is largely about externalising cost and internalising profits. So private business is completely I'll equipped to fix issues that effect society as a whole.

The Irish DPC is deliberately dragging its feet on GDPR enforcement, which is a huge problem because the majors like Facebook or Google have their European headquarters there, not so coincidentally.

How can a company that violates law in 13 countries just choose which country gets to enforce?

Because the EU is a union of sovereign states. The EU itself is not sovereign and cannot do anything at all without acting through its members. A member can simply decide not to carry out the EU's wishes. Sure there are penalties, but they take a long time to appear and are fairly minor.

GDPR has a section that defines a way for an EU institution to "grab" cases, but that's timely and not used much (or at all, I don't know about the numbers).

Those two are linked fundamentally - even medieval and ancient rulers hardly what we would call enlightened knew that making unenforcible laws only breed contempt.

When they can set up anywhere and access everywhere it is asking to be flouted. Geolocated financial intergration is about the only area they can start to touch with enforcement. Without that they have about as much sway as a backwater dictatorship writing hate mail threatening arrest to every first world newspaper which refers to him as a dictator. Right or wrong morally they just look stupid and delusional.

The law isn't unenforceable. The law is unenforced.

The reason it is unenforced is that the agencies that seem to have the responsibility to do so are understaffed and afraid of the drawn out litigation and political backlash.

A ruling that some of these dark patterns are valid would be a disaster to the people trying to enforce these laws, so undoubtedly they're trying to build a watertight case to prove them invalid - knowing that the companies they're trying to enforce against have ridiculous amounts of funding and entire businesses will fall if the enforcers win.

All this on top of the larger concerns in the GDPR - for example, companies that, once they've collected data for one purpose, proceed to process it for another purpose without any legal basis at all.

they just need to crack down much harder on websites and hand out big fines for dark patterns until the websites switch to sane defaults.

It's just a question of how much the companies in question believe that the EU is going to come after them. Once the cost calculus shifts to being on the safe side it'd quickly turn into a norm, but it requires showing some teeth.

It's already happening, but slowly, slowly. The various agencies need time to get their act together, and have started with the most egregious excesses. It seems rather unlikely at this point that consent forms that apply inappropriate pressure - explicitly called out in the GDPR as invalid - will somehow escape enforcement. I'd expect invalid cookie banners to be on the chopping block sometime fairly soon.

Additionally, the risks to advertisers and websites are quite large, which I'm not sure they fully appreciate (unless I'm misunderstanding something here?) - it's not that the consent form is illegal, after all - perfectly legal to have a confusing consent form. Rather, it's that all the personally identifying information thus collected is illegal acquired and held (and it's hard to argue the violation wasn't intentional, to boot!), and the fines for that can be quite large, and can be applied retroactively to whenever the GDPR came into force. Rules always get stretched, but specifically in this way sounds pretty unwise (unless they're cynically trying to have some subsidiary go bankrupt or otherwise encapsulate the risk).

With any luck, the GDPR norms on this front will become global norms, but it's too early to tell.

I'm pretty sure GDPR states that it must be opt-in in a non deceiving manner.

Exactly; that's the point. An opt in that is coercive is not a valid grounds for holding personal data, ergo, that data is held illegally and subject to enforcement by a data-protection authority. Doesn't matter if everyone clicked yes.

A coercive opt-in isn't so much illegal; it's simply void. Having a coercive opt-in would be fine yet weird (as I understand it) if you then proceeded to only retain and process personal information to the extent you would be permitted without the opt-in. (IANAL, and only as far as the GDPR is concerned, perhaps if it's misleading enough that violates some fraud statutes somewhere, but that's a different issue).

I can only speak for myself, but actually I go to the detailed cookie settings and unselect everything I'm not ok with. In particular, I unselect ga and Fb pixel because I believe the habit of collecting visit data at an all-seeing central site isn't worth it, and actually is the major characteristic of a dystopian future that hacker culture has always been opposed to. If the consent settings are rubbish, I don't bother and leave the site; OTOH, if the settings are reasonable, I usually accept optimization and some analytic cookies.

I can't stress enough how much of a game changer that is, by revealing the amount of third-party trackers on websites (in the order of up to 500 on a single site) alone.

So I guess GDPR works for me. There's a lack of enforcement, though. But that could change; for example, in Germany, bored law firms (eg those not having clients currently), or anybody actually, can print money by starting an "Abmahnwelle" eg. insist on GDPR compliance within a certain period of time, then sue any site for non-GDPR compliance, all the while being entitled for compensation of their expenses if they have a cause.

It may be the German implementation is different in this regard, but IIRC the GDPR did not create a personal right; enforcement is solely at the discretion of the relevant authority. I thought that was intentional; as a way to limit frivolous lawsuits, but I'm no expert by any means - are you sure this is actually possible?

No I'm not very sure, IANAL. I just thought that "Abmahnen", for once, could actually be used for something useful when it was used to bother small sites for violating the German "Impressumspflicht" (duty to include press contact info on sites). I'm also not sure it can be legally excluded for GDPR specifically as it has been a staple of German "Rechtspflege" (procurement of law by private orgs) for a long time. I know there has been a relative recent change in jurisdiction where compensation for "Abmahnen" was denied when it wasn't carried out in good faith, but I don't believe GDPR violators can rely on that one for continuing malpractice. I also believe when GDPR was enacted in 2017, internet companies got an additional two year's period of bringing their sites into compliance.

Sounds like it's actually unclear: https://www.datenschutz.org/dsgvo-abmahnung/

Sounds to me like it's not in general permitted (but with a huge exemption), but is possibly permitted to the extent that failure to comply with the GDPR constitutes unfair competition. So that means you can't simply use the "Abmahnen" procedure to enforce privacy rights, but rather need to demonstrate you're a market competitor and that it's relevant to your competitive position. Edit: no, I think I misread- that may be a possible conclusion but it's just not clear.

IANAL and all that.

> Which is why GDPR, although theoretically a good idea, is pretty much useless in practice.

This is very much not true. GDPR isn't restricted to regulating tracking on websites. It also restricts and regulates what companies can do with the customer data they are in possession of. Through my day job I constantly interact with large enterprises (Fortune XXXX) that have vast amounts of personal data through their regular operations (banks, telcos, car manufacturers, airlines, insurance companies and the likes). Nearly without exception they go to great lengths to ensure the data is managed correctly, not used for purposes the customer hasn't explicitly consented to etc. This is as a direct result of the GDPR.

So apparently we (EU) have the right to rip a new one to any big-ass company that is too mucho and gives zero shit about our Right to Privacy. I think that this got you downvoted.

I also do my best to avoid tracking (Firefox add-ons, Hosts file). But up until now I had no leverage against any companies. Now they ought to be afraid when they play dirty.

Do seem to have a lot of downvotes, yes!

GDPR is about a lot more than the tracking stuff though, it is about the personal data companies hold and are responsible for, your permission to request it, the risk of fines if they don't comply. Whatever dark patterns they use for tracking logic, they are still bound to use best practice security on the personally-identifiable-information they may hold and may be fined if they do not. That is what GDPR is mostly about, as I see it.

All that's required is for the regulators to start holding companies using these dark patterns to account. These things aren't GDPR compliant by any reasonable interpretation, and these companies are basically trying their luck to see what they can get away with. If fines start coming to them they'll change their tune pretty quick.

They are so blatantly non-compliant I wonder if at least some companies are actually trying to discredit the GDPR and the idea of regulation in general by annoying their users while blaming the GDPR.

I am sure that's at least part of the thinking.

And judging from comments here on HN, it seems to be working. Just two post above yours there's a comment stating that any government solution cannot fix the tracking issue, and it can only be addressed by a company or an individual

FWIW, I didn't downvote you for this.

And I just upvoted for this piece of comedy:

> So apparently if you criticize gov/bureaucrats on HN you get downvoted.

> is pretty much useless in practice

It's useless because only a few people care enough to report these violations. If anything we need a campaign to get people to start reporting sites which violate the GDPR requirement of an informed opt-in.

Reply on news.ycombinator.com