Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.
The banner is an artefact of the hostile way most sites choose to try and hoodwink the user into being monetised and ultimately to piss users off so much that they complain about the legislation rather than the lack of online privacy.
Better to just harass them into a habit of dismissing the banner.
They don't seem to call it GPC, but their "ask websites not to track" feature now uses it instead of GPC.
if you write to your reps, they might just change that. The Eu is one of the few democracies left. Slow but powered by the people
The exact definition of "legitimate purpose" is unspecific (which is important to be able to adapt to development of new services) which leads to some lawyers being careful.
I also claim that some lobby groups promote having too many and too big consent banners to move blame from tracking companies to the EU ("stupid EU forcing all those banners!") in order to reverse the policy on tracking, which seems to have some effect.
Generally speaking JS code that makes request to server is covered by ePD while actually processing that request server side is covered by GDPR (there are some nuances to this).
The problem with this view, though, is that even the very agencies propagating these rules do the exact same thing! You can go to any site from an EU arm and get the same banners.
At this point, you can't really blame it on bad-faith actors, you have to accept that it's a bad rule. Which is not to say I know a better one!
Malicious compliance is not the law-maker's fault.
Not to mention the large number of "legitimate interest" exceptions that are absolutely not justifiable.
The main problem with the legislation is its lack of teeth and enforcement.
In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”. And it’s 50/50 to see “reject all” even though it is a requirement that denying must be as easy as accepting.
They should pay a bounty for reporting non-compliance.
That's not entirely true. Websites that don't actively try to fuck over their users (because their purpose is not shoving third party ads at you, it's providing information about/a platform for their company's product) often provide a modal with two buttons:
'Accept' 'Decline'.
This, IMO, meets both the letter and the spirit of the law. The funny thing is, for any website actually doing that, if you click 'Accept', your data will likely only be used to improve it.
> Global Privacy Control detected. Advertising cookies are turned OFF.
Yes, I love this. My browser is already sending "do not track" requests.
If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If anything, the constant cookie banners have just trained her to consent to stuff out of muscle memory. You could probably design a "Are you ok to sign over the deed to your house" question in the rough shape of a cookie banner and get 90%+ agreement.
> We Care About Your Privacy
> We, and our 228 partners use cookies and similar methods to recognize visitors [...]
228 partners should make anybody concious about the fact that something is wrong and you probably should not consent to that at all. Also, nobody cares about your privacy when they think sharing data with 228 parties is okay.
Or alternatively how weak the EU messaging was I guess
1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting 2) gdpr. requires you to ask consent for any kind of user data processing, unless you can find another legal basis
eprivacy was about cookies, but forgot fingerprinting. gdpr was not specifically about cookies. but gdpr (or at least its past interpretation by the dutch privacy authority) didn't require consent for limited first party analytics.
which led to situations where you'd get the impression that you wouldn't need a banner for first party tracking using cookies .. well the gdpr didn't require it, but the older ePrivacy rules still did.
we still have the digital omnibus law package coming up which is supposed to simplify and resolve the overlap between the two above, and reduce banner requirements at least for SMB just analyzing their website visitors
It does. The current version says "storing of information, or the gaining of access to information already stored, in the terminal equipment". Reading e.g. navigator.userAgent is information already stored in the terminal equipment. If you then use that in any way that gets communicated to remote server (e.g. directly or calculating some fingerprint) you read that information in manner ePD describes.
The directive itself has been transposed incorrectly in many jurisdictions. For example from what I understand the Dutch law added an exception (roughly "for obtaining information about the quality or effectiveness of a supplied information-society service, provided this has no or only minor consequences for the user's privacy.") which is not permitted under ePD. ePD exception list is exhaustive and the only other exception can be done via Article 15. The exceptions done via that are related to things like national security and certain criminal prevention/investigation.
Of course that then raises the issue on how you get invalid exception invalidated. I don't know Dutch procedural law well enough to answer that.