> - Too many websites place tracking cookies first and then let you disable them Under GDPR, unless the website owner can prove a legitimate interest (which is

> - Too many websites place tracking cookies first and then let you disable them Under GDPR, unless the website owner can prove a legitimate interest (which is pretty hard to do and doesn't work for advertising), this is illegal. > - Too many apps use some kind of analytics without any consent Unfortunately usage analytics can qualify as a legitimate interest, but the actual data used and the purpose matters and you might be able to drop a tracking cookie for improving your service, but AFAIK collecting health data, GPS location or other sensitive information won't fly for analytics without explicit consent. And we are talking about first party analytics only. Having analytics cookies dropped as part of an advertising network without consent will not fly either. > - The GDPR has different mechanisms to give companies a "legitimate interest in collecting data". How this is enforced is kind of unclear. Not sure what you mean by "enforced", but there are rules for establishing a legitimate interest and just because companies claim they have it, doesn't mean that they actually do. It's basically up to the data protection authorities to do their jobs. Give them some time, there are a lot of lawsuits already.