I think some of it is out of touch (omg, the cookie alerts!), but being able to understand what data a company retains about its users, and making that available to individuals if they ask, is probably one I agree with. Most of us don't need to know, most of the time, but the fact that people will occasionally audit this information is good for both users and the companies.
Google was very new when the EU proposed these laws in 2000. It certainly didn't have a browser.
I think the privacy provisions and disclosures required under GDPR give users more useful information (ie they now actually need a privacy policy), and Cookie popups are just a silly distraction that offer no further value. We open so many web pages, so quickly these days, most users are not making informed rational decisions about the popup - they're just clicking it to make it go away. They both annoy users and give them a false sense of improved privacy protection.
The blocking of third party cookies by browsers, and proper privacy disclosures are a much better solution.
Exactly! And why is that not being implemented? Because Chrome is top dog and they're earning a lot of money with your data, so WHY would they want to stop that data flow? Everything that would make it easier for you to protect your data would lose them money, so they have no incentive to do that.
Instead, we are stuck with these annoying cookie banners, which are easily and wrongfully blamed on the EU instead of on the website owners and the browser vendors.
https://commission.europa.eu/resources/europa-web-guide/desi...
> Use of the cookie consent kit is mandatory on each page of the DGs and executive agencies-owned websites, regardless of the cookies used.
As far as I understand, you're still subject to GDPR even if you're not making money off it. Seems like to me there's massive overreach where the lowest liability way forward is to just ban EU users from using anything you make (which still takes engineering/time to do).
Blanket bans for EU users is quite common, I see it all the time with local US news outlets, they simply block me from accessing it.
Like if you want to build a bridge at your own cost because the state doesn't want to do it. Even if you don't install a toll booth, you still have to follow safety regulations before people other than you can cross it, right?
It completely makes certain engineering patterns like event sourcing/soft deletion almost infeasible, as you cannot have immutable records.
The way it's described is very fuzzy and it's 200 pages long. Certainly it's long enough that I'd rather ban EU residents than open myself up to liability even if I generally want to do the right thing with user data.
Keep your billing information immutable, and separate it from user logs. Honestly following GDPR make your code better.
At least when it passed, it pushed us to rework our DB architecture, which was heavily needed. After that i left and got hired to implement a global RBAC in a big company (took almost two years, but it was a solo project), and once again GDPR rules made the architecture decisions a breeze, because the constraint it brings pushes for good architecture (and it make it easy to sell it to the managers to be honest).
Maybe in countries where KYC and tax laws are different than in europe it might be different, but for european devs who cared about good design, GDPR was a good thing (i have a friend who worked for a French Defense company at the time, he told us that multiple teams including his spent 6 month or more refactoring old code and fixing years old issues)