In theory, website owners could do as GitHub did and remove inessential cookies and get rid of annoying banners: https://github.blog/2020-12-17-no-cookie-for-you/ But in practice, website owners are worried about breaking laws and aren't experts and just follow what they see everyone else doing, and so put up banners. So in practice, the regulations are indeed the ultimate cause of annoying banners, even if in theory those are avoidable in some cases. The people who introduced the regulations were able to look at the ecosystem of website owners and predict that the consequences of the regulations would be the vandalism of the internet by banners that we've seen over the last few years.
It's not the EU that's causing the fear of breaking laws. It's the ad tech industry that is instilling that fear by fostering the "you need a cookie banner on your site now" FUD. If Joe Schmoe thinks he needs a cookie banner for doing nothing and puts one up, then from a user's perspective, all sites are equally bad.
Compare with "Ask App Not to Track" in iOS, which is enforced by the OS and actually means something. The tracking industry hates that one because it shows them for what they are (not all apps need to throw up that screen) and they don't get to blame the EU for it.
That is weird argument. If one genuinely cannot bother to read the law or does not feel capable of fully comprehending the law why don't they simply consult a lawyer? Hiring professional accountants is somehow standard practice.
Sure. Are you offering to pay?
So now every website owner should have to consult a lawyer who his technical enough to understand the intricacies of the law?
Then:
- either it's a simple website for fun... and then, why is tracking users so vital?
- or it's a real business, with real money... and then you should have a lawyer anyway for GDPR and others
And the alternative is to have to pay lawyers every time I want to start a business on the web?
And people wonder why the tech scene in the EU is so far behind…
> And the alternative is to have to pay lawyers every time I want to start a business on the web?
I thought it was pretty commonplace to hire a lawyer to draft various application, bylaws, policies and stuff like that when founding a company, online or not.
> Yes because reading and interpreting an 11 chapter 99 section law is really simple…
GDPR really is very simple at the core: you are not allowed to collect personal information, unless. 99% of it are definitions of those exceptions.
No it’s not. You can go to nolo.com and pay less than $300 to get incorporated
https://www.nolo.com/legal-encyclopedia/forming-corporation
Even if you choose to hire a lawyer to do it, it’s a relatively simple process and it would cost a lot more to hire a lawyer who knows the technicalities of something like the GDPR and whether it’s applicable to your website.
Should I also include the lawyer in my product planning meeting?
> GDPR really is very simple at the core: you are not allowed to collect personal information, unless. 99% of it are definitions of those exceptions.
If it’s so simple, then why is it 99 sections and 11 chapter.
And you really don’t see why all of the ridiculous regulation in the EU might be part of the reason that no meaningful tech company comes out of the EU.
The law itself does not even mention "cookies", afaik.
It aims at regulating ANY kind of detection or storage of PII, regardless of it's technical nature.
"Cookies" are preferred nomenclature partly because non technical users kinda understand what it means, but it's VERY MUCH also part of the very tactics you are writing about: because "do you accept cookies?" is a really really cute obfuscation of "do you consent to us taking your fingerprints and tracking everything you do online?".
That also goes for calling the GDPR the "EU cookie law".
The EU already had a "cookie law" long before GDPR that already mandated informing users about the site's usage of cookies, but it was widely ignored or even unknown to publishers outside of the eu since it: didn't regulate consent & storage, referred to cookies specifically and had thus become easy to kite with modern tracking techniques even if anybody gave a damn, and also didn't impose any kind of substantial sanctions when breached.
The GDPR aimed to fix that and therefore explicitly avoids specifying any technology it should be applied to. It's applicable to cookies, server side tracking, fotos of you or paper forms just the same.
Now it sticks, and'll probably be used forever. But mastodon, the project, has long stopped calling it a toot, removed it from all UI and docs and explained why it changed.
> Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment.
However, it still doesn't require a banner.
> (66) [...] Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. [...]
Hence, so long as the use of cookies or similar is strictly necessary for the specific service requested by the user, a website doesn't have the obligation to obtain their permission.
[1] https://edps.europa.eu/sites/default/files/publication/dir_2...