My worry is we end up w a situation such as cookie notices - users have gotten so used to clicking through content screens they don’t pay attention anymore because a lot of it is meaningless
I suspect the goal is to manufacture consent through inundation of fraudulent and coercive consent agreements.
I had a funny situation in person recently. This place had consent forms - lady checking folks in would offer to sign on your behalf. A few folks asked what it was - a consent form - oh sure, please sign for me.
In gsuite I guess there are some settings that can impact things like location - people want recent locations to pop up etc I learned. So anytime you make 95 percent of users click through stuff they don’t care about - you start losing the battle here
The consumer bears all the risk and the provider absolves themselves of any - unless one afford a lengthy court battle or join a class action. I suppose even more rarely a consumer can get, often fractional, relief through a government or consumer rights agency.
EULAs, consent forms, and similar are a wholesale miscarriage of justice that causes incalculable irreparable harm to a staggering number of people every day. Think about it this way, a liability waiver at a doctors office is not dissimilar, in terms of bargaining ability, to an entry level employee's boss demanding sexual favors to keep their job. I have a broken arm, fix it, if the doctor screws up pay for all resulting costs forever.
Justice, equality, and equity should never be limited to those with the most means.
One last point to hopefully drive my point out of the park. Say I don't want to consent to gmails EULA, so I go and look into hosting my own webserver. Bad news, windows has a eula, okay I'll learn how to use Linux and FOSS software. But wait to need to connect my pc to the internet. I can't escape an internet providers take it or leave it eula. But I need email, I will get fired (lose everything in life) without it. So in effect I am forced, under duress, to 'consent' to a non-negotiable agreement that I reject with every fiber of my being so that I do not lose my home, family, and everything else.
I turned this stuff off at policy level, and instead of praising me, users were pissed at me. They wanted google to track them. Most didn't understand why stuff didn't work (things like saving locations in maps break at least in past, and most use gmaps for work / home commute checks). Seriously - if you run a larger gsuite deploy, put all the privacy features on and watch how folks start trying to work around / do the shadow IT thing.
I get that impression also, and doubly so for the FUD-packed GDPR messages. "Oh sorry, we can't legally serve this webpage to you, EU resident, because of the atrocious GDPR! (because it's full of spyware which the GDPR forbids but we won't say that part out loud)"
For what it's worth, I do think the GDPR messages are raising awareness in a way the cookie warnings were not, in part because some websites use dark patterns to get you to "agree" and others do not, and people are starting to smell the bullshit. If nothing else, the laundry list of trackers the websites are required to tell you about is a real eye-opener to the layperson who doesn't run uMatrix.
But, those companies then have a choice. Option A: Accept that their business model relied on widespread stalking of their users which was never acceptable and is now illegal, and significantly change the business. Option B: Pretend they didn't notice, throw up a pop-up ignore the "freely given" requirement for consent, and hope nobody calls them out on it.
Option B is a lot easier for scummy companies to do, and the prevalence of opt-out banners with assumed consent and dark patterns shows how many companies went that route.