This is the part I don't understand. I'm actually all for regulations like being able to demand they delete the saved data they have on you, restrictions on transferring data to the control of third parties without disclosure/permission, etc.

But if your definition of "privacy" extends to not wanting cookies to work like they were designed to, why can't it be your responsibility to use a browser (a User-Agent) that carries out your intentions?

With services that are mandatory for all of us to use (e.g. government), I can see how being stringent makes sense because the users have no choice. But I can't understand applying the same burdensome requirements to things that people can simply choose to use or not use, such as a restaurant or some random guy's blog. I could be convinced that large platforms (tough to define properly, but things like Amazon, Uber or Meta) may be subjected to additional rules, but the tough rules being applied to even tiny one-person startups does nothing but advantage the giant platforms who have hundreds of lawyers and can devote entire dev teams to building complicated compliance features.

> Drivers are forced to take lessons and get licensed for the precise reason that we know people can't take the responsibility on their own.

Ok, I see what you mean here, but I'd argue that the licensing requirement is only acceptable because the risk is both grave and impossible to limit to just yourself.

We don't require a license or training to use a table saw at home even though table saws are also dangerous unless used very wisely. That's because the risk is mainly limited to the user and at worst, someone who chooses to be nearby that table saw.

To bring it back to my point, I'm not discussing the licensing part, I'm saying rather that we don't make excuses for people who refuse to learn the rules of the road, or how to safely use a table saw, and we don't say that it's the job of wood manufacturers to somehow secure the table saws of ignorant DIYers. The responsibility is on the user of the car, the table saw, or the browser. If the user chooses to never learn the basic operation of their tool, they might get hurt. And if we do have to regulate something, we should regulate the saw, and give it clearly-labeled safety features. Not regulate all pieces of wood.

And in my opinion, the 'danger' from cookies is so trivial compared to any real dangers (mainly the danger of seeing ads that are "too good"), that I am not convinced anyone needs to be protected from it by a third party.

Not any notable apps used by noobs though. Unsophisticated users don't include Local Storage in their mental model - they simply believe that "When I log into Gmail, Google Docs, or Slack on a fresh computer, my stuff will be as I left it on my other computer." Webapps which subvert this by not persisting things outside of Local Storage would be taking wild and unnecessary data-loss risks with user data.

> people who aren't certain what is "browser data".

This I agree with you on. Everyone including EU legislators are trying to regulate something that none of them actually know or agree on what it even is.

The common person has basically only one single concern that relates to cookies: They don't like retargeting ads. That's it, that's the whole beef. They feel offended that by some mysterious (to them) means, they see ads 'around the Web' for things they've browsed before. Of course, those ads exist because they're incredibly effective. But they are annoyed that it, in their opinion, manipulates them into spending money. These ads are "too good."

This is a technical problem with a technical solution, and if the EU (and US) regulators weren't technically illiterate they would recognize this and issue clear requirements aimed at browsers[1] instead of the stupid ones we have today which are basically just rely on the honor system, meaning compliance will be patchy at best, and it relies on costly enforcement actions and complaints, is subject to litigation, and has so many gray areas - "If the CMP didn't work right and cookies were stored, is MY company liable? We tried!").

There is a second concern, but it has little to do with cookies, it's just that we ideally want to stop companies from keeping and exchanging dossiers on our behavior and preferences (and a dispute on whether anonymized data is ok, or whether it's unethical because if detailed enough it can be deanonymized). That is bigger than cookies, and applies just as much to offline companies.

[1] Here's an imaginary scheme, just for example:

1. Segment cookies storage by the domain in the address bar - the same way the memory/disk cache works today. This is really functionally the same as turning off third-party cookies, but if anything "needs" them, this sandboxing would nerf it so that a Facebook Like Button on a webpage can't be aware of a facebook session you created on a different domain.

2. Big switch in the browser's UI that defaults to "Temporary" - if you leave it alone, all cookies and storage are evicted 2 hours after last tab is closed, or you switch it to "Permanent" (preference stored per top domain) to have the current behavior where expiry can be longer.

Regardless of the specifics, a browser-side solution would solve the problems of "compliance" as it pertains to cookies and other client-side tracking (they can't abuse data the browser simply won't persist for them), and level the playing field between the tech giants and upstart competitors.