I really wish this law had forced websites to respect a toggle in the browser UI instead of being allowed to engage in all their dark pattern shenanigans.
I am one of the few that (most of the time) actually takes the time to click "Reject all" whenever possible. Some websites are EXTREMELY shady when it comes to this though and hides their targeted advertisement and user-profile building into their "legitimate interests" section that IS NOT automatically turned off even if you "reject all". You have to manually go trough them and "object" to each and every one of them. Often no "object to all" button.
Imagine if sex used the same notion of "consent": "Ok so you rejected having intercourse with me, but I have a 'legitimate interest' in fellatio that you didn't specifically say no to, so now you have to!". It is just terrible..
"Legitimate interest" is a broken term in those cookie forms. Legitimate to whom? Of course any company has a legitimate interest in making buckets of money.
Every browser should have a mandatory "cookie preferences" section where you can set your preferences for each of the typical use-cases for cookies. Strictly functional cookies? OK. Targeted advertisement? NO. Tracking between websites? NO. Measure site performance? OK. etc.etc.
Whatever role the current cookie panes now fill, the browser should take over using some standard. The preferences could get sent directly over HTTP with the initial page-load and the server/site would have to comply or face extreme fines.
With the browser approach you could maintain your own allow/blocklist for site-specific settings. All this could be synchronized across your various devices.
Only then would we not be annoyed by those popups again.
All the concerns you raise here are covered by the law. It's illegal for it to take longer to reject tracking than to allow it, which should ban all these web site that try to get you to scroll through several hundred options turning them all off. "Legitimate interest" means that the whatever data they want to process is a necessary step in order to do what the user has asked for - for instance, the web site has to be able to set a login token cookie when you log in, and that's allowed because you literally just asked to log in, and that's the only way the web site can do what you asked.
All these web site are illegally making the cookie experience dire. They are doing it so that they can:
1. Collect data from people who get fed up and click accept, people who accidentally click accept, etc.
2. Annoy everyone and make people think that the laws are broken, which increases the chances that the laws will be changed in the future.
Enforcement would help with this, but there's little sign of it happening.
No one ever used it, and over time it got more and more hidden. It's still there if you look for it.
So cookies aren't the only thing that requires consent - things like browser fingerprinting and even collecting IP addresses for non-essential purposes (aka you can probably claim legitimate interest if you collect them for technical or fraud prevention reasons, but using that data for analytics or marketing would require consent).
This is also why I think clicking "accept all" on the cookie prompts with cookies disabled at the browser level isn't a good idea. You're still giving them permission to stalk you using other means than cookies, and they very well know that. At least use an ad-blocker which blocks the consent prompts completely - technically you never provided permission, so while they might still stalk you at least they don't have a legal basis for doing so.
The GDPR is less about the technical aspect of data collection and more about the intent behind said collection and the planned use for the collected data, something the browser can't really tell.
And in the end, people still just Accept All because it's the fastest way to content.
It kind of seems like a second attempt to the do-not-track switch which was a failure. There must be strong backing in the laws for such feature to be meaningful otherwise nobody will respect it
The cookie debacle has been going on for so long now, and is obviously not going away any time soon - surely there must have been draft RFCs or even W3C proposals along these lines at some point?