4 ms·

The GDPR already explicitly forbids 95% of the cookie banners out there, but large companies decided to ignore it and simply face the fines if they in some hypo

by belorn 5y ago

The GDPR already explicitly forbids 95% of the cookie banners out there, but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. The rest of the industry followed. Until the law that defined informed consent actually get enforced, a new law can not really fix it unless the regulators start to add the threat of jail time to repeat offenders.

deleted 5y ago
[deleted]
virgilp 5y ago
I mean, a good first step would be to start fining companies 2% of the revenue. Especially Google. And then maybe automate the GDPR fines, because it's definitely possible to identify that a site puts up a non-compliant banner. No need to add the threat of jail time, _especially_ if it isn't enforced.
- delfinom 5y ago
  2% of revenue while stalling the GDPR process and taking it to court for 10 years makes it only 0.2% ;)
  - vntok 5y ago
    That would be 2% each year for ten years of infringement though, and very expensive lawyers to pay for at least that duration.
  - virgilp 5y ago
    Even so, it would be 0.2% per EU country, right? Because the legislation is transposed into member states legislation. I doubt that anybody would really want to fight (& risk losing) in even 5 member states per year...
galgalesh 5y ago
> but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. This is not the case. The fines are up to 2% of annual global turnover. This scares companies. Moreover, some of the worst offending cookie banners are slowly being replaced by better ones as more and more organizations (such as noyb) file official complaints and companies get fined.
- anoncake 5y ago
  It obviously doesn't scare them enough, even if it should in theory.
- krageon 5y ago
  > This is not the case. The fines are up to 2% of annual global turnover. This scares companies. You are wrong. The initial fine is much, much lower and companies have so long to dabble in wilful ignorance that it is at the moment not something that has teeth. Companies are like bullies, they don't respect threats - only harm.
  - JumpCrisscross 5y ago
    > initial fine is much, much lower and companies have so long to dabble in wilful ignorance Another diluent: the maximum fine is practically the lesser of 2% and the NPV of business in that European country, or, expansively, in Europe. If you have little business in Europe, it’s cheaper in some cases to simply close shop.
    - labawi 5y ago
      I'm pretty certain an actual fine (not ceasing operations) has a limit of max(10M€, 2% worldwide revenue of previous year) and double if you're antithetical to GDPR. Also, it's per infringement and isn't a yearly free pass to continue once you're fined. Companies are not doing much because enforcement is lacking, and in case you get caught, most fines are in the neighborhood of reasonable rather than instant liquidation. [0] https://noyb.eu/en/irish-dpc-handles-9993-gdpr-complaints-without-decision https://noyb.eu/en/irish-dpc-handles-9993-gdpr-complaints-wi...
nicoburns 5y ago
An standardised protocol approach might make enforcement easier. It would make it a lot more clear cut whether someone was infringing or not.
- Nextgrid 5y ago
  Automated enforcement is already easy if there was willingness to do it. The majority of non-compliant cookie banners use a handful of libraries and/or third-party services such as TrustArc so detecting these with a web scraper is be trivial.
M2Ys4U 5y ago
Noyb - one of the organisations behind this proposal - have started contacting the operators of non-compliant websites,[0] as the first step in forcing them towards compliance. If they change their ways then good, if not Noyb has a much more solid case when making a complaint to the SAs and/or the courts. [0] https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-issues-more-500-gdpr-complaints https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...

by belorn 5y ago

deleted 5y ago

[deleted]

virgilp 5y ago

I mean, a good first step would be to start fining companies 2% of the revenue. Especially Google. And then maybe automate the GDPR fines, because it's definitely possible to identify that a site puts up a non-compliant banner. No need to add the threat of jail time, _especially_ if it isn't enforced.

delfinom 5y ago
2% of revenue while stalling the GDPR process and taking it to court for 10 years makes it only 0.2% ;)
- vntok 5y ago
  That would be 2% each year for ten years of infringement though, and very expensive lawyers to pay for at least that duration.
- virgilp 5y ago
  Even so, it would be 0.2% per EU country, right? Because the legislation is transposed into member states legislation. I doubt that anybody would really want to fight (& risk losing) in even 5 member states per year...

galgalesh 5y ago

> but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. This is not the case. The fines are up to 2% of annual global turnover. This scares companies. Moreover, some of the worst offending cookie banners are slowly being replaced by better ones as more and more organizations (such as noyb) file official complaints and companies get fined.

anoncake 5y ago
It obviously doesn't scare them enough, even if it should in theory.
krageon 5y ago
> This is not the case. The fines are up to 2% of annual global turnover. This scares companies. You are wrong. The initial fine is much, much lower and companies have so long to dabble in wilful ignorance that it is at the moment not something that has teeth. Companies are like bullies, they don't respect threats - only harm.
- JumpCrisscross 5y ago
  > initial fine is much, much lower and companies have so long to dabble in wilful ignorance Another diluent: the maximum fine is practically the lesser of 2% and the NPV of business in that European country, or, expansively, in Europe. If you have little business in Europe, it’s cheaper in some cases to simply close shop.
  - labawi 5y ago
    I'm pretty certain an actual fine (not ceasing operations) has a limit of max(10M€, 2% worldwide revenue of previous year) and double if you're antithetical to GDPR. Also, it's per infringement and isn't a yearly free pass to continue once you're fined. Companies are not doing much because enforcement is lacking, and in case you get caught, most fines are in the neighborhood of reasonable rather than instant liquidation. [0] https://noyb.eu/en/irish-dpc-handles-9993-gdpr-complaints-without-decision https://noyb.eu/en/irish-dpc-handles-9993-gdpr-complaints-wi...

nicoburns 5y ago

An standardised protocol approach might make enforcement easier. It would make it a lot more clear cut whether someone was infringing or not.

Nextgrid 5y ago
Automated enforcement is already easy if there was willingness to do it. The majority of non-compliant cookie banners use a handful of libraries and/or third-party services such as TrustArc so detecting these with a web scraper is be trivial.

M2Ys4U 5y ago

Noyb - one of the organisations behind this proposal - have started contacting the operators of non-compliant websites,[0] as the first step in forcing them towards compliance. If they change their ways then good, if not Noyb has a much more solid case when making a complaint to the SAs and/or the courts. [0] https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-issues-more-500-gdpr-complaints https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...