...Yes, thats exactly the internet "we" want. I don't get why it so hard to accept that people simply dgaf about privacy, and much prefer free products online paid for by ads. And there is nothing wrong with that, because for those that actually care about privacy, there are plenty of tools.
Because if you say you give a fuck about privacy, and use a modern android phone with OEM rom or an iPhone, you either don't understand what privacy is and shouldn't be talking about it in the first place, or you are a hypocrite.
Modern society enables miracles.
But thanks for proving the part of "not understanding what privacy is" part of my post.
For the sake of not playing an analogy war, let me just say this: if you use a modern device with OS made by Microsoft, Google or Apple (or derivative of), you are implicitly consenting to very large amount of personal data collection, which you have no control over. If you choose to trust those entities for whatever reason, thats totally fine, but your particular selection of trust isn't "correct" in the sense that it should apply to everyone, because it has no concrete objective basis. And therefore, you shouldn't base what you think the law should be on it.
It’s also possible they understand the trade off with privacy wrt, say, google and their isps/mobile providers, versus the trade off with random websites on the internet.
It is absolutely relevant; it is arguably the most relevant question. It lies at the basis of the entire concept of "threat model" in security.
The police wants to track you to investigate you as a suspect in a crime. Facebook wants to track you to know who you are talking to. Amazon wants to track you to learn what you might want to buy. The Chinese government wants to track you to know if you might work for or against it. And so on.
I, like most people, give wildly different amounts of shit about every single one of these agents, and take different levels of precautions as a result.
In case its not clear, because Im really doubting that people have a good grasp of privacy here, when you buy an Iphone, it phones home quite a bit collecting pieces of data about you that Apple can and does use internally for their advertising purposes, and you cannot opt out of it.
Those new regulation will probably increase the price of baby food, and people obvisouly didn't care about the heavy metal content, so why regulate at all?
"They still made money" sure, on top of externalities.
And now they realize, with some help from Apple and Chrome that this business model has a limit
This is not how civilized society works. Taken individually, people don't care about a million things, yet regulators have to take care of those things on behalf of everybody else.
Just because you don't understand the ramifications of something it does not mean nobody else understands it.
When that happens, then we can talk about responsible governance in this regard. GDPR was a direct response to Trump campaign shenanigans, as a tool for politicians to capitalize on appearing to be better than US. It had nothing to do with protecting people. If GDPR outlawed 3d party tracking outright, then you would have half an argument.
I remember it being big news back in 2018, riding off the back of the CA scandal that it could help to prevent in the future.
Regardless, if I am wrong about this, it doesn't change the fact that it doesn't really do anything for the people.
Uninformed consent is the tricky part. Medicine has to constantly deal with that a lot of people that dgaf about what medicine or brand of medicine is given to treat a specific illness. They just want to get better. Is there something wrong with doctors that just don't inform or get consent? Patients that actually care about specific medicines can look it up.
You get a banner on your first visit, with a list "here are all the cookies and ways how we use your data, if you are not fine with it, please leave this website"
This should be an option for small private websites (different rules for FB, Google and alike), because no one forces you to use a site, same as "my house, my rules"
In the end, you can be tracked without cookies using fingerprinting, and AI will make this job easier and easier. So the banner is pretty much irrelevant technologically. You will also see companies that make popular browsers include features in the browsers for advertising purposes that will make cookies irrelevant - i.e you give consent otherwise the browser doesn't work at all or on websites with relevant content.
Best thing to do is really just to let it all go IMO. Its really not a big deal. Between things like VPN and all the privacy tweaking you can do in Firefox, if someone wants privacy they can have it.
Nitpick: none of those dark patterns "get around" the GDPR - they merely get away with it due to a (hopefully temporary) lack of enforcement. GDPR explicitly disallows annoying the user into accepting and tricks such as hiding the decline button, etc.
> So the banner is pretty much irrelevant technologically
That's why the GDPR doesn't explicitly target cookies or a specific means of tracking but rather the collection and processing of personal data, regardless of technical means (a hypothetical crystal ball that actually worked would also fall in scope).
> Between things like VPN and all the privacy tweaking you can do in Firefox, if someone wants privacy they can have it.
Even if let's assume there was a way to truly be anonymous and defeat all fingerprinting, how are you going to do business on the internet? At some point you will need to enter personal data, whether it's to buy something, sign up for real-world thing, etc. No amount of VPNs or plugins will save you if you enter your delivery address because you bought something.
GDPR or similar legislation is the only way around it - you should be able to enter your delivery address without consenting to it being used for malicious purposes such as advertising.
Even with limits on collection/processing of personal data, because the legislation was made by non technical people, there are always ways around it. For example, lets say company has an advertising ml model that they use that essentially identifies visitors by fingerprint and maps them to some advertising targeting. They can train that model and throw away the training data, and then hand that model off to any regulator that is going to have no idea what to do with a bunch of floats in matrices, and claim that there is no user data stored in there, and nobody could prove otherwise.
Maybe in a perfect world where healthy competition is a thing. But (potentially due to under-regulation elsewhere) that's not what we have in practice - for a lot of services, you only really have a choice between a handful of providers, and you're out of luck if they all decide to stalk and spam you.
Competition is not currently an effective solution to data protection, so something else was needed. The GDPR's approach to it is to outlaw personal data and spam as a payment method - you can't make non-functionally-required data processing mandatory for using a given service or product. I think it's a good approach - less spam, tracking and incentives for hoarding personal data is always a good thing.
> They can train that model and throw away the training data, and then hand that model off to any regulator that is going to have no idea what to do with a bunch of floats in matrices, and claim that there is no user data stored in there, and nobody could prove otherwise.
At least in theory, the regulator should be able to see through that scheme. But even if let's assume they actually did train an ML model and got away with it, the GDPR mandates that users should be able to decide how their personal data is processed, so they can just not opt into targeted advertising, and their personal data must not be processed using that model. The model can be there, it'll just sit unused.
There are some instances where this objection does not apply. For example, if:
1. Legal or official authority is being carried out 2. "Legitimate interest", where the organisation needs to process data in order to provide the data subject with a service they signed up for 3. A task being carried out for public interest.
2 is the key here. Make an entire ML model that generates a website layout based on the request, claim its core business logic, oh and btw, it just happens to load advertisements from companies based on this contextual data, but that contextual data has nothing to do with the user. Look, we don't store any advertising cookies or session data, don't request any either, and here is our model. Investigate it as much as you want, and we don't have the training data anymore because we delete that.
A website is in no way "your house".
Essentially, if I build and host a hobby site, it's my digital property. You have the right to see what are the conditions to visit (essentially: fetch) it and if you don't agree, you are free to go.
I'm part of the EU electorate. Are you?
Neither do I, but prove to me that this actually happens. Namely the surveillance part with online trackers.
Some people do gaf. They are free to click on "I don't agree with non-legitimate use of my data."
Those who don't want to submit to these simple rules are free to not do business with EU citizens at all.
Everybody's free. EU is the new land of Freedom it seems.