As it should be. The G stands for "General", after all. If engineers wrote the law, it would have no effect, because it would specify the means by which tracki

As it should be. The G stands for "General", after all. If engineers wrote the law, it would have no effect, because it would specify the means by which tracking happens (e.g. cookies, HTML5 localstorage) but not the act of tracking itself; and it would be easy to circumvent. Legal documents cannot be precisely specified bundles of English-language-shaped computer code; they need flexibility so that the judge can actually rule things that make sense. For example... why shouldn't server-side logging be treated as in GDPR scope? It does not matter if cookies weren't used to collect it; an IP address and time pair is already enough information to identify an ISP account and that's usually enough for lawyers to sue you with.