I am a lawyer and I have worked on this for the past several years. I have advised on the deployment of cookie pop-ups into multiple EU and UK markets (and som

I am a lawyer and I have worked on this for the past several years. I have advised on the deployment of cookie pop-ups into multiple EU and UK markets (and some that have similar laws, e.g. Turkey). I am a former web developer and back-in-the-day I wrote the cookies / session handling logic for an agency's homebrew framework. I understand the DOM, the data layer, tag management, local storage objects etc. Giving people more control about how their data is used is laudable. In Europe, privacy is considered a human (cf. citizen or consumer) right. Clickstream data can be highly revealing of a person's interests and behaviours. The “invisible processing” of huge datasets of such personal data has the potential to surreptitiously erode privacy and impact on people’s lives. Nevertheless, ‘cookies law’ is bad law: 1. It regulates the technology not the activity. It applies whether the use of cookies is for basic webstats, or to hive data off to data aggregators for profiling for remarketing, fraud prevention etc. Having to explain and control all cookie-based activities from the benign to the potentially intrusive, through the same UX, is difficult. It impedes one’s ability to have a proper discussion with the user about fair value exchange for their data. 2. It is written in out-of-date terminology (“terminal equipment”) and confuses the concept of “cookies” (storing AND retrieving information) with the actual regulated activity (storing OR retrieving information from a device). I recently saw a proposal from a BigTech which fundamentally misunderstood the scope of the regulation – perhaps deliberately – and I see this confusion arise time and time again in practice. 3. Its exemptions and exclusions are narrow and ambiguous. Consent is needed unless the information collection is “strictly necessary in order to provide an information society service explicitly requested by the subscriber or user”. GDPR’s legitimate and public interest grounds are not therefore available for the collection of data, even if they later become available for the use of that data (even that is controversial and lacking in clarity: bifurcating approach to e-PD and GDPR may not find favour with regulators). Then there’s a whole other debate about browser vendors, APIs and the various misaligned interests which conspire to prevent industry-led solutions to this problem. And vendors and consultants who go around recommending widgets, seemingly armed with only an elementary understanding of the underlying law. The result is to push the problem onto individuals through ugly, jarring UX which is often ineffective, both in communicating and delivering its intent. I often still see data collection notwithstanding which buttons I click. Basically, everyone could do better. (I am sure us lawyers are not blameless either!)