The law itself says that the default option should be to opt-out. Any site that doesn't have precisely equally prominent "agree to all" and "deny all" buttons violate the GDPR.
The problem seems to be in the complete lack of enforcement.
Konqueror even had "confirm cookies" as default for a while back then.
I don't know if that was the case before gdrp but we have to centraly clarify if and when we store user data, what we do with it and we have to show that we can delete user data if requested.
Not sure how far small companies go through this thow.
I know of small companies that before GDPR didn't really consider the implications of private data at all. They'd just let their SQL databases grow forever (mark as delete and have "script to actually delete the data" as a TODO that never happened), had random backups lying around on dev machines.
GDPR forced them to actual define policy, start deleting old data that was no longer relevant, strip private data from developer test sets.
It was a bit more work, and adds a small bit of friction, but these are still important things!
Forcing cooks in restaurants to wash their hands after using the bathroom also adds friction to the process but is similarly important.
That is the theory. The reality is that many small businesses don't even know the GDPR exists. Others are not complying because they think they will get away with it, and they are probably right. The rules are so ambiguous in some important ways that even those who do intend to comply might not actually be compliant and won't find out until a regulator intervenes. And all of that together means that a small business that does try hard and become compliant is at a significant competitive disadvantage.
To be clear, I am a firm believer in strong privacy protections, and my own businesses seek to be in the latter category. But the GDPR is flawed in important ways, and future regulation deviating from it is not necessarily a bad thing. Obviously it depends on whether the deviation is of the selling-out or the fixing-problems variety. Though admittedly, with the current UK government, I fear the former is much more likely.
As another example, there is a new subject right to erasure of their data, though again this isn't absolute. Several potential complications were discussed about this right. One is how to handle copies of that data in back-ups, archives or retired equipment. Another is how to deal with data held in deliberately tamper-proof formats, some of which will already have existed before this right to erasure was introduced by the GDPR.
Another important way is the compliance costs, and in particular the disproportionate costs to small businesses. For example, it cost mine many hours and thousands of pounds to understand the new requirements, take advice, and update our documentation to be compliant, yet the actual data processing we did was always very light and so wasn't affected much by the new rules either. In other words, it cost us a significant amount of time and money without really benefitting anyone.
Related to that is the enforcement mechanism and penalty regime. Regulators are all-powerful, and again, while they can impose some heavy fines on big businesses, those are meaningfully capped. In contrast, the rules allow them to impose penalties high enough to literally destroy any SME. The practical safeguards are the limited resources of regulators and the idea that those regulators are supposed to work collaboratively with data controllers and impose proportionate penalties for any compliance violations that can't be resolved, but this is awfully close to relying on personal judgement and good will, not what is actually written in law.
Then there is the reality that the GDPR doesn't actually do that much to protect against some of the biggest threats to personal privacy. For example, I would argue that two of the biggest risks in our modern "big data" world are excessive collection and processing of personal data supplied by third parties and excessive collection and processing of data by governments. The GDPR has done very little to curb either of those things. Every time I go out, I'm still potentially being listened to or photographed by countless other people's devices, which may then be uploading that data to big tech firms along with time and place information. Countless people have probably handed over my phone number or email address to big tech firms by allowing apps to scan their address book. We still see ever more intrusive monitoring of normal people's daily lives by governments, with tech like facial recognition cameras or mass surveillance of communications routinely infringing on personal privacy, and the authorities pushing for these things are entirely unrepentant and rely on the usual vague justifications about security and what a dangerous world we live in.
In short, the GDPR imposes significant burdens on data controllers without being clear about what their obligations or how to interpret key details in practice, introduces a penalty regime that hangs like a sword of Damocles over data controllers and represents an existential threat to smaller controllers, and yet at the same time hasn't actually been very effective at reducing the big risks to data subjects or increasing their control over how data about them is used and by whom.
None of these concerns is new. All were discussed extensively around the time the GDPR was introduced. But, perhaps because it was a law meant to improve individual privacy and that's a cause many of us support in principle, sometimes people get very defensive of it instead of looking at it critically and asking whether it actually achieves what it set out to do and whether any costs it introduces are proportionate to any benefits it offers.
Being filmed in public, having your data handed to third-parties, facial recognition and mass surveillance are precisely some of the issues the GDPR has addressed, and it has already had massive impact; especially on tech companies (I’ve seen it firsthand). You talk about burdens but maybe you’re just angry you wasted money on a consultant? I honestly haven’t seen the bad side of it.
We didn't hire a consultant. Those guys were charging thousands per day, and no business our size has that kind of money to spend. We did take real legal advice from a real lawyer, but the main cost was our time understanding the new rules and updating things to be seen to be compliant. I am irritated that a lot of my own time, as a founder and at that time lead technical person for a business, was wasted on a bureaucratic exercise, and likewise for other key people. That hurt us, and once again, it benefitted no-one. Not our customers. Not our staff. Not our suppliers. Literally no-one was better off because, for example, we rewrote our documents to provide information in some new format that was specified by the GDPR.
Personal irritation aside, even if you just took the cost to us and scaled it by the number of businesses in the country to estimate the economic impact, that would mean billions in lost productivity as a result of the new rules. And that's clearly an underestimate, as the costs were running into millions for a lot of large organisations. A law that is going to cause that kind of economic hit should be justified by a greater benefit to society in some way, but I just don't see that "massive impact" you mentioned. There have been a few incremental changes here and there, but there hasn't been a big change in culture.
The attitude at bigger organisations is still often about how they can tick the required boxes while continuing to do what they want with the data. Just look at Facebook's resistance to even disclosing what personal data it has and how it's been using it, for example, despite data subjects having a clear right to that information under the GDPR.
Tracking is still going on everywhere, and if anything it's getting worse as the technological capabilities increase. Ironically, it's recent actions by Apple, not the GDPR, that have started to make some significant improvements in this area for users on their platform.
Small organisations are still often ignorant of their obligations under the GDPR and not compliant anyway. Governments are still encroaching further into individual privacy all the time. Individual privacy hasn't been improved at all in these kinds of situations.
This will be my last comment on this thread, because HN tends to downvote any comments critical of the GDPR, even if based on direct personal experience of implementing it, and that doesn't encourage open and constructive discussion. But I hope the above helps to explain why I have reached a different conclusion about these issues to you.
If a model box only has "I consent" and "Learn more" buttons, then I don't consider clicking on "I consent" to mean freely given GDPR consent. Since it's the only reasonable way of viewing the website, and the GDPR doesn't permit a consent-wall, it's non-consent, and any use of my personal data following that event remains illegal.
It's not a problem with the GDPR; it's a problem with the ICO failing to put a stop to this.
That way I never gave any consent.
Nowadays I have browser plugins that do that for me, but same idea.
In any case I block cookies on all sites except for a few whitelisted ones so big "ha" to them if they think they can cookie me up. "Functional cookies" my ass. The sites work just fine without them.
Obviously, it comes from the user's machine so it can be modified before being sent to the server. Unless you're doing something custom/fancy like signing that data you shouldn't trust that it hasn't been tampered with.
GDPR regulates, among other things, how information is stored and deleted on servers. I have worked at multiple companies in both Europe and the US who take this very seriously and has definitely altered their practices based on this.
For example, pre-GDPR, we would "mark as deleted" but not delete. Now we delete.
Well that seems untrue, as someone that regularly either outright declines, or goes through and chooses "functional only".
I do occasionally see websites that say "we no longer serve the european market". That's a shame but it's up to them.
GDPR covers way more requirements regarding data management. You need complete control over the lifecycle of sensitive data, exhaustive documentation of data transformations, you have concrete obligations regarding disclosure of incidents, data removal, limitations of for what data is used, user consent management, and the obligation to have people personally liable (which is big, just look at AML regulations to see the effect when not only the fuzzy concept of "the company" is liable).