True, but I would argue that the idea of cookie notices is good but the execution is poor. This is one of the few situations where a technical solution would h

True, but I would argue that the idea of cookie notices is good but the execution is poor. This is one of the few situations where a technical solution would have been better, e.g. having each cookie come with a specified purpose and letting the browser prompt per issuer and displaying the purpose to the user: * 3 cookies from ads.google.com: "Personalizing the advertisements you see on this page" [Allow] [Deny] * 1 cookie from share.facebook.com: "Social media integration" [Allow] [Deny] * 1 cookie from analytics.example.com: "Anonymized site analytics. For more information see http://example.com/privacy http://example.com/privacy. We value your privacy." [Allow] [Deny] * 1 cookie from www.example.com: "Keeping you logged in as kuschku on www.example.com" [Allow] [Deny] But this would require passing an actual web standard and getting browser vendors on board (and Chrome has a conflict of interest making them unlikely to support it without sufficient pressure). This would have satisfied the legal requirement without creating the obnoxious obligatory "Please click 'okay' or we'll keep showing this message on every page" experience we have now. It would also be less error-prone because the failure state would be "users might deny unjustified cookies" rather than "site will send cookies regardless" when not implemented correctly. Besides, browsers already ask for permissions for things like desktop notifications or geolocation. EDIT: I'm not saying this shouldn't have been passed into law. I'm saying the EU should have involved browser vendors and investigated a technical solution before making the notices mandatory. Compliance would have then be easier ("just add these headers") and adoption would have been faster ("it's easy to fix and it's the law"). EDIT2: Unlike the old Semantic Web problem of websites being liars I don't think deceptive purpose statements for cookies would have been a noteworthy issue because it would be literally against the law in the EU to deceive users. It would also have imposed the burden on the actual cookie issuers and created incentives for EU websites to hold their advertising providers accountable to comply with EU laws (rather than build a kludge around them to make their scripts opt-in).