> [RANT] They should never have been implemented that way IMHO -- a different API or IETF-ish agreed HTML meta tag that would inform the browser of the scope, e

> [RANT] They should never have been implemented that way IMHO -- a different API or IETF-ish agreed HTML meta tag that would inform the browser of the scope, entities etc. would have allowed the browser to offer overall policy choices to the user. That would not have been used. The whole reason why all the consent forms are constantly violating the GDPR is because companies want to make it as hard as possible to say no. They'd only accept the browser API if the "No to all" button (which by law has to be default, has to be the option chosen if you click anything except yes, and has to be easier to use than "Yes to all") was hidden behind 3 layers of "are you sure", each of which having a 30 second timer before you could continue. That's the whole reason this consent form disaster exists: because companies are trying to do everything they can go get around the laws. Just look at the Do Not Track header: it's a legally meaningful statement that companies should follow. They don't.