I was going to dismiss this because

• we know already
• looking at the rest of the world through US-shaded glasses

but this quote rocks:

Blaming GDPR for the cookie banner is like blaming the health inspector for the roaches. The banner is deliberate vandalism, a dark pattern engineered to exhaust you before you can learn anything about the surveillance apparatus humming behind the “OK.”

Cookie banners are malicious compliance*.

What follows is just as quote-worthy, e.g.:

On May 25th, 2018, GDPR took effect to the sound of American commentary, the way fireworks take effect to the sound of dogs.

* edit: he says that himself later. I like this guy.

I love cookie banners because it lets me see up front what sites I should avoid.

I find it weird how many people actually blame GDPR for cookie banners. I mean, yes. I think they should have probably written the law a little bit better to avoid this situation. But malicious compliance is a thing in many laws.

I also hate how many websites are trying to blackmail me now with “pay or we use your data”

spoiler alert. they will use/sell your data regardless.

Cookie banners have lead me to disposable tabs. On my phone everything is opened by default in a Firefox private tab or Firefox focus. Then it gets scrapped. If it’s something I care to keep open, then I’ll open it in a regular tab. Fuck these garbage companies ruining the internet.

I love the passive aggressive ones that say “we love our European visitors” only to block all access to the site because they’re not allowed to sell our data.

I was honestly sooo incredibly proud when my boss told me: “We’ll do everything to avoid having to present a cookie banner. See that nothing links to Google or Facebook, I want the most information we can get about our visitors while as little as is needed to be GDPR compliant and give nothing to big data.”

The result is we’ll collect data about how visitors use the website without any personal information, completely anonymous until you log in. No ads, no tracking, no Google Analytics and no active social media snippets until the user themself activates them. And we were still able to see what was doing good or doing bad on the site.

I hate cookie banners because UX keep going “We keep getting holes in our analytics!” and blaming me for it. I understand the whole “We want to see at what point people are dropping out of the login process so we can make it easier for them to complete the journey” but it’s still fucking annoying when they complain about analytics drops when our users are naturally very privacy focused and I can’t control whether they deny cookies or not!

As a user I don’t have a problem with analytics until I get tracked after I leave the site.

as a user I have, if it happens before clicking the accept button. even when there was no choice.

I can count on one hand how many times I clicked the accept button.

IANAL but there should be no need to ask consent to know when users quit the signup process. You need to say that you use cookies, yes, but unless you process personally identifiable data there is no need for informed consent.

GDPR is a bit more than cookies banners… it gives rights to European like deletion of one’s data, right to get a copy of one’s data, portability to some extent and a lot of transparency about what processing is happening. And if one of our DPA is taking an interest in a particular sus processing they can forbid it altogether which all companies fear much more than fines. It’s really a beautiful piece of regulation. And I’m not saying only because I make part of my living out of it :)

Then I assume the cookie UX has separate toggles for local analytics vs analytics through Google, et. al.?

That way they can get the data they want without sharing it to any third parties, or through third party services?

If your login flow is so complicated that it’s dropping people, it just means that you’re letting sales and marketing assholes add things to it that don’t need to be there, instead of letting the engineers and designers do their jobs.

It should be a browser option, not per site pop-up

AFAIK there is a proposal to make that browser option a reality. There was a setting once but edge made it default on and then everyone was like “well then we gonna ignore it”.

Despite not trying to fuck over my fellow online users, I do hate the GDPR as well, at least the current implementation. Now every stupid site ask for my ‘consent’. Some are maliciously compliant by taking half my browser view, and there’s nothing in that rule saying they cannot do that; hell, some even take so much space in only leave a sliver of the article just to be petty.

Well everything has nuance.

European Union is generally better for its citizens than the US government, but they’re not immune to having stupid idiots in charge who don’t know anything about the policies they are enforcing.

It doesn’t help that the EU didn’t bother to set up any kind of regulatory body to actually administer any of this, so all of the administration is done by different government departments had already existed and have now got a new job. These departments don’t really have the time to do any proper enforcement, so they kind of just let anything slide. Websites telling you that their spying on you is technically them following the rules, so that’s considered good enough by the overworked departments that don’t really care.

addons.mozilla.org/…/istilldontcareaboutcookies/

The thing is that most of the consent forms are not compliant. The choice should be Consent and don’t consent in equal style and then additionally a choice. Every form that forces you through a secondary screen is not really compliant.

The problem is that we have an enforcement gap. The rules get enforced by each country and they have limited resources for that. It’s an imperfect system.

Interesting read, thanks.