https://www.ndss-symposium.org/ndss-paper/understanding-worl...
Relevant, from their about page:
> noyb is a donation-funded NGO based in Vienna, Austria working to enforce data protection laws, in particular the GDPR and the ePrivacy Directive. At the present, a team of more than 20 legal and IT experts from all over Europe is working to ensure that the fundamental right to privacy is respected by the private sector. More than 5,000 supporting members support our work
I think some of it is out of touch (omg, the cookie alerts!), but being able to understand what data a company retains about its users, and making that available to individuals if they ask, is probably one I agree with. Most of us don't need to know, most of the time, but the fact that people will occasionally audit this information is good for both users and the companies.
Google was very new when the EU proposed these laws in 2000. It certainly didn't have a browser.
I think the privacy provisions and disclosures required under GDPR give users more useful information (ie they now actually need a privacy policy), and Cookie popups are just a silly distraction that offer no further value. We open so many web pages, so quickly these days, most users are not making informed rational decisions about the popup - they're just clicking it to make it go away. They both annoy users and give them a false sense of improved privacy protection.
The blocking of third party cookies by browsers, and proper privacy disclosures are a much better solution.
Exactly! And why is that not being implemented? Because Chrome is top dog and they're earning a lot of money with your data, so WHY would they want to stop that data flow? Everything that would make it easier for you to protect your data would lose them money, so they have no incentive to do that.
Instead, we are stuck with these annoying cookie banners, which are easily and wrongfully blamed on the EU instead of on the website owners and the browser vendors.
https://commission.europa.eu/resources/europa-web-guide/desi...
> Use of the cookie consent kit is mandatory on each page of the DGs and executive agencies-owned websites, regardless of the cookies used.
As far as I understand, you're still subject to GDPR even if you're not making money off it. Seems like to me there's massive overreach where the lowest liability way forward is to just ban EU users from using anything you make (which still takes engineering/time to do).
Blanket bans for EU users is quite common, I see it all the time with local US news outlets, they simply block me from accessing it.
Like if you want to build a bridge at your own cost because the state doesn't want to do it. Even if you don't install a toll booth, you still have to follow safety regulations before people other than you can cross it, right?
It completely makes certain engineering patterns like event sourcing/soft deletion almost infeasible, as you cannot have immutable records.
The way it's described is very fuzzy and it's 200 pages long. Certainly it's long enough that I'd rather ban EU residents than open myself up to liability even if I generally want to do the right thing with user data.
Note: I'm not defending or criticizing the law, just talking about how many people perceive it outside the EU.