I mean, have you ever had to deal with regulators? Departing from industry norms will 100% be used against you in any regulatory proceeding, no matter how minor

I mean, have you ever had to deal with regulators? Departing from industry norms will 100% be used against you in any regulatory proceeding, no matter how minor. It is naive to think otherwise. Regulators go after big pockets and The guidelines you link to are advisory, not legal, and they trace back to the ePrivacy regulations (although the notion of "consent" was modified by the GDPR; it's not clear which interpretation applies -- ePrivacy regulations, which are still in effect, also require consent). "The obligation is on controllers to innovate to find new solutions that operate within the parameters of the law and better support the protection of personal data and the interests of data subjects." This is standard boilerplate shit that says "you have to follow the regulations, not whatever is in this doc". I honestly don't know what to tell you. The cookie popups are an offense in every possible way; they fail to accomplish their intended purposes, they burden users with useless interactions that provide no protection, and they burden website developers with useless busywork to document compliance to hopefully avoid retaliatory punitive fines if you draw the attention of regulators or EU officials. That these policies find supporters on HN of all places is beyond my comprehension.