How about we ban ALL targeted ads, dear political representatives, thereby removing one of the primary incentives to collect all that information in the first place?
There's also this gem:
In order to avoid fatiguing recipients who refuse to consent,
terminal equipment settings that signal an objection to processing
of personal data should be respected.
Like always when it comes to politics, these things boil down to "who gave the tribal chief bigger spoils". We as a civic society should eventually learn that corruption is maybe the only way to get to where we want to be.
Most countries distinguish between so called protected classes that deserve to be outside of the marketplace and classes that are not.
I don't really see the problem with ads that discriminate based on profession or income.
For me it's always been about control.
If the surveillance companies (Google, Facebook, Twitter, etc.) used opt-in or honoured the Do Not Track header all this could be avoided.
Those that want tracked and targeted ads could request them and those that don't would be left alone.
Instead, by refusing to not honour, Do Not Track or using Dark UX Patterns to make it hard to opt out[1] they're affectively saying, "tough luck, we're going to do whatever we want regardless".
It's a race to the bottom to see which company can get away with being the most obnoxious.
We're left with legal means as the only curbs their behaviour.
.
1. Why do so many web sites get away with an "Allow All" but no reliable[2] "Reject All"?
2. Why is there a second set of things to opt out of as "Legitimate Purpose"? Why doesn't the "Reject All", when present, not cover these too?
Because you need to name stuff like session ID cookies, loadbalancer backend cookies and other stuff that is necessary for operation ("legitimate interest")... but you do not need consent from the user for these.
No you don't. You don't need to ask for permission for data you collect/store that is strictly required for your business to operate.
Key word: strictly required.
Meanwhile these leeches have latched on on a more nebulously defined "legitimate interest".
For example, if you need fraud protection for your order-processing business, you have a legitimate interest to process and store more data than is strictly required. Since such legitimate interests are innumerable they are not explicitly defined in the law.
So, the parasites clamp things like "siphon your data and sell it to the highest bidder" under "legitimate interest". Which skirts the law, and will fall apart under scrutiny. See the three-part test by UK's data authority, https://ico.org.uk/for-organisations/guide-to-data-protectio... (UK is so far still bound by GDPR)
1. Actual legitimate purposes for core functionality
2. A toggleable "legitimate purposes" under the ads section
Presenting the second option could be construed as malicious compliance or just dishonesty.
On sites where I've seen this, there is no one-click option to disable those, which should make them non-compliant with GDPR.
The problem is: The only way such ads are possible, is by private parties collecting information about the people they want to target with such ads.
As it is, no I don't like any form of targeted ads and I have never responded to them. But mostly I don't like their invasive behavior and unregulated business incentives.
Whether they should be allowed to collect and consider other information is of course a different question.
Ads are a completely legitimate business practice: I make a product or offer a service, so I want people to know about it.
Bans on targeted ads are not about the advertising, they are about the privacy concerns resulting from the data collection that is the prerequisite for targeted ads.
Perhaps specialised 'discovery' services would pop up for people wondering what sorts of new stuff/services was out there?
On the surface of it, I'd assume that if reaching out to customers to 'let them know you exist' via advertisements was prohibited, the amount of innovation and investment into products would decrease. But at the same time, the amount of money allocatable to product development within a given budget would increase, as you wouldn't have to expend so much on marketing (which in some cases, dwarfs the cost of R&D). But maybe the markets would just adapt anyways. Seems a fun thought experiment.
In theory a perfectly targeted ad might produce some value for me, but in practice people who make shit products have more money to throw at ads, making Sturgeons law even worse.
"Targeting" and the associated data collection is much easier to determine and codify into law.
However, if a website I never visited before shows me the same ads, data collection happened, and that should either be banned, or made into strict opt-on-only.
Yes there is: My useraccount.
Ideally, if I am logged in, and if I consented that they may show me videos based on my preferences, I would be okay with them may recommending videos to me and refining these recommendations based on my views.
The consent should of course be opt-in only (eg. a simple switch in the account settings).
Using this information for recommending videos within that pages context only != Targeted advertising.
As long as the information never leaves their page, is used in no other page of their ecosystem, and as long as I can tell them to stop collecting it, delete what they already have, and are guaranteed by law that they keep no connection between that data and any identifying information other than my useraccount, I would be okay with that.
And yes, when I visit youtube without being logged in, I would be perfectly okay with having no/default recommendations, or recommendations based on the context of that page visit only.