7 ms·

You Know GDPR Is Good Based on Who Hates It

• seydor 2mo ago
  Cookie banners are already obsolete in the age of AI. Who is wasting time defending it? People don't even care to hate GDPR these days, it's an anacrhonistic regulation from a different era that some EUrocrats like to boast about
  • bgarbiak 2mo ago
    The point of the article is not that banners are good; it’s that they would not be needed at all if websites didn’t share all the possible data about their users with hundreds of vendors. Fun fact: the OP blog doesn’t display a GPDR banner.
    • whatsThisBtn4 2mo ago
      But did it do anything? I get fingerprinted anyway. I'm geolocated anyway. I'm a "deny all cookies" if it's an option, but I won't waste time on "customize". Reminds me of 9/11 security theater
  • dgellow 2mo ago
    > Who is wasting time defending it? I do! It’s one of my favorite regulation ever. I find it very well researched and designed, in a world where it often feels we cannot change the status quo it’s really impressive that a community of countries as messy as the EU has been able to design, pass, and actually implemented such a complex and citizen-centered set of rules
    • IanCal 2mo ago
      Often complaints about it boil down to either not understanding what’s in it, or annoyances that would be solved if sites stopped doing all this shady stuff. “We value your data, our 1644 partners…” yeah you definitely have a value you assign to my data.
• DarmokTanagra 2mo ago
  I hate the banners, and I am a major privacy advocate. The web has gotten so much uglier as a result of GDPR.
  • intothemild 2mo ago
    The cookie banner isn't actually specified in gdpr, it was just how everyone else tried to build the solution to the problem at the last minute. I remember thinking "ok once this hits an actual web spec, we should see this built into browsers, and sent as headers or something" Nope
    • brainwad 2mo ago
      Browsers already had a way to consent to cookies, since the invention of cookies themselves. But the EU didn't consider that _real_ consent.
      • 9dev 2mo ago
        Treating the browser's "disable cookies" feature as a way to reject consent is not real consent. That cripples many legitimate use cases outright; it's neither accessible nor understandable by normal users; it's a technical defence measure, not a way to consciously reject contractual consent. In contrast, the GDPR demands that you properly ask for consent if you want to process somebody's personal information, inform them why that is necessary, and only process the data if they agree to the processing. There is clearly a difference here, and IMHO the EU is quite correct here.
        • intothemild 2mo ago
          Correct.. the gdpr isn't the anti cookie law. It's the data privacy law. If it wasn't cookies it would be something else.
        • DarmokTanagra 2mo ago
          Correct in principle, completely ineffectual and annoying in practice.
• larodi 2mo ago
  GDPR has one single goal - to allow aggregated presumably anonymous data markets. Period. Everything else surrounding it is diversion in a plain sight.
  • 9dev 2mo ago
    Sure buddy. And it's all orchestrated by the Rothschilds, right?
    • larodi 2mo ago
      no tis not, brov. but then it still is there to enable a market, not protect peoples... because you know what - this market predates GDPR and will outlive it for sure. you can list another second-order effects, there are perhaps some. the primary goal of anonymizing users, pushed down the throat of otherwise very oblivious service providers (such as your website selling dick enlargement machinery), is just not never going to work. on the other hand, provider such as telecoms are now, being GDPR-compliant, absolutely in their right to sell the aggregated data. so are rail services, and bus, and everything that touches IDs and alike. even your gov. cheers.
• ChrisSD 2mo ago
  Note that GDPR did not mandate the cookie banners we see everywhere today. Those are a form of malicious compliance. Their goal is not to conform to regulation but to undermine the regulation itself in the eyes of the public.
  • brainwad 2mo ago
    The cookie banners come from the earlier ePrivacy Directive, and while it was possible to comply by not storing cookies at all, if you want to store data on the user's browser you do need to get their consent, hence the cookie banner.
    • maccard 2mo ago
      They do come from the ePrivacy directive but; > if you want to store data on the user's browser you do need to get their consent, hence the cookie banner. No - you need consent for storing cookies that are not “strictly necessary”. I can implement an offline app that stores data in cookies without consent. The current usage of the banner is overly litigious US focused simplification combined with malicious compliance.
      • brainwad 2mo ago
        No cookie is strictly necessary, you can encode it all into request tokens in the URL, so this is a meaningless exception.
        • jampekka 2mo ago
          The law is not about cookies specifically, it's technology neutral. The law doesn't even include the word cookie anywhere. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02002L0058-20091219 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
        • bryanrasmussen 2mo ago
          let me guess: you're some sort of programmer?! For a programmer of some sort this may seem a meaningless exception, for a lawyer it is not. I am not a lawyer, but I have had a few law classes and worked a bunch in the legal services branch. If I am asked legally speaking - is this cookie strictly necessary? I will ask is the cookie used only for the purposes of the service provided to the user and which the user expects to get. If the cookie is used so that when the user logs in and goes to page two of the article they are reading they can read that article without having to log in again we can say it is needed for the service. If the cookie is used to provide recommendations for other articles by using their user history to compare with other user histories and what other users like to read it is not needed for the service. Although from the point of view of the company it sure might be nice to have. If the cookie is used for your state management of the items you have placed in your basket so that you can go to buy those items it is needed, if the cookie is used to look up your past history and give you recommendations for other stuff to put in your basket, things you bought in the past why not buy some more of those, or how often you rated products you bought badly or anything not required for the current transaction you are doing to go smoothly it is not needed. As a general rule lawyers and the courts are good at sorting this stuff out, but as edge cases get complicated so does code, and nobody wants to handle all that stuff themselves, so instead they pay for a company that develops cookie banners and everybody gets asked if they accept cookies or not.
• throw8484949ii 2mo ago
  US companies like Meta or Google __LOVE__ GDPR. It is quagmire of complicated rules, and small startups will get burried under this quick sand. Large corporations can maintain departments of lawyers, and navigate this legal minefield. Small fines are cost of doing business, bribe that goverment would not force monopolies to spkit! Try to do marketing ad campaign as small eshop owner in EU!
  • Barrin92 2mo ago
    >US companies like Meta or Google __LOVE__ GDPR If that were the case they'd have spend money on supporting GDPR rather than sending armies of lobbyists to Brussels in an attempt to prevent it, or attempting to turn the US president in an attack dog on their behalf. This generic libertarian talking point "companies love regulations!" is routinely disproved by how companies behave. As the article points out, you know what is good by who hates it.
    • throw8484949ii 2mo ago
      Microsoft also hated windows piracy and "fought" against it, later they admitted it helped their business. As for "libertarian talking point", it is survivor bios. There are very little tech compenies left in EU. Heavy regulation burden is one of the reasons. All EU companies that could hate GSPR are gone, and their would be owners are just random people on internet.
  • scott_w 2mo ago
    As someone who worked on GDPR compliance just last year, in a company that is deeply affected by it, no, it’s not that complicated.
    • tzs 2mo ago
      How about if someone asks for copies of all their data? I thought that was not complicated, but then there was that post here a while back where someone asked McDonald's for their data. It included a vast amount of things that the company had inferred from the data. I hadn't realized that would be in scope, and did some Googling on just what has to be included. According to a few sites I found, and Google's LLM concurred, it is basically everything I have about them, regardless of if I got it from them, a third party, or produced it internally. Customer service rep sends an email to their supervisor saying the customer won't take reasonable advice and then gets abusive and asking the supervisor how to deal with future calls from them? That should be in the GDPR response (I can redact the names of the rep and supervisor). I make a list on my computer of customers that I think are exploiting a bug in our billing system to get a lower price, print out that list and assign it to someone to investigate and fix the bug if it exists. That's supposed to be in the GDPR data, if the sites I found are to be believed. Heck...if some customer calls to update their credit card and calls the wrong number, and leaves a voice mail where they include "my new credit card number is <xxx> with security code <yyy> and expiration date <zzz>", that's supposed to show up in their GDPR data. (If they call customer support and leave such a message it would go to a number handled by the expensive outsourced customer service system, which has voice transcription software that looks for things like that and deals with it, but the internal phone system used by other departments doesn't so if the wrong number went to some random person in some other department it won't have that automated handling of this). If that's right than handling a GDPR data request 100% according to the rules would require having some way to search nearly every computer we've got looking for anything concerning any particular customer. I'm hoping the sites I found and the LLM were wrong and it is not this bad.
• jampekka 2mo ago
  GDPR itself is quite a good law. It's implementation and enforcement are not. E.g. the nag problem would have been solved simply and effectively with something like do-not-track header (probably as OS setting, as apps are often even worse than websites with tracking). Also enforcement of obvious violations taking years and years, especially against large corporations, means it's just violated all the time. EU also failed to give good interpretation guidelines early on, causing massive piles of overjealous lawyer CYA red tape and just silly stuff like removing names from apartment buzzers.
  • foldr 2mo ago
    The do-not-track header is a nice idea but could never have worked. The GDPR is based on the idea that you can only store certain data about users if you have their consent to do so. Bearing in mind that most users have no idea what a header is and no idea how to configure their browsers, a user simply not sending a particular header does not imply consent to store information beyond that which is absolutely necessary for use of the site.
    • jampekka 2mo ago
      Lack of do-not-track header is not a consent to track of course. It's just signaling non-consent.
      • foldr 2mo ago
        I take your point. It would be nice to have a header that effectively just automatically canceled all the consent pop ups for you. But there are still some issues. 1) You'd have to find a way of writing the regulations without baking in particular technical assumptions about the web. The current GDPR talks about general principles of consent and data processing, not the specifics of cookies, headers, etc. 2) People can change their minds or override their general preferences in specific instances. Just because someone has a default setting in their browser indicating that they don't want to accept tracking cookies doesn't necessarily mean that they won't want to allow your site to store more data about them. So it is still legitimate for sites to ask them the question – and then you're back to the pop ups.
• scott_w 2mo ago
  As someone who, until recently, worked in a company heavily impacted by GDPR, it’s a good thing. It forced the mindset away from “just do whatever is easiest,” to considering how it affects where our customer’s data is stored. Was it a PITA? Sometimes, yes. Was it stressful having a conversation with Legal to determine whether we had a PII leak under the GDPR terms that would mean we had to reach out to customers? Definitely. But you know what? That’s the cost of doing business. The outcome for EU citizens was that their data is in a better place than it otherwise would have been. And that’s a good thing.
  • deleted 2mo ago
    [deleted]
  • nraynaud 2mo ago
    Well, it's the cost of collecting data. A lot of businesses don't really need to collect data. It's only the cost of doing business if you are in the personal data business. For example, a newspaper or a blog have absolutely no reason to produce a cookie banner.
• Razengan 2mo ago
  Same as with Apple's In App Purchases and low-friction refund process, that scummy companies like Match.com (the parent of Tinder etc) loudly opposed.
• roenxi 2mo ago
  Given the relatively recent European experience (Nazis and Communists, among others) there is a reasonable argument for data privacy even if it hampers economic growth. However... > If the rules are so terrible, why did nobody choose market exit? Because major players don't particularly mind such rules; the public doesn't care about their data all that much and everything will tick on as usual with some nag banners and compliance officers. The problem is the major players aren't going to be European because it is no longer legal for EU companies to get started by doing what the US companies did to get started. There is a reason the EU is backseat driving US software companies - EU industrial policy killed off the EU ones in the crib (to be fair that wasn't the GDPR, the GDPR is just part of the same anti-growth regulatory pattern). They died so young we've never really even learned what their names would have been. EDIT I'll point at companies like Uber. It looked pretty illegal for most of its early years, until it could afford enough lobbyists to legalise its business model. Never would have worked in the EU.
  • bryanrasmussen 2mo ago
    >The problem is the major players aren't going to be European because it is no longer legal for EU companies to get started by doing what the US companies did to get started essentially finding ways around the law and its spirit to screw people over and degrade the quality of life for the citizens to one's own benefit. Your edit pointing to Uber never working is pretty much making the case here.
• blfr 2mo ago
  Banner gets a lot of attention because of the never-ending annoyance it's causing. It's like being surprised that someone would care about something so small as a little rock in their shoe. Yeah, you care about these little things. It is also definitely true that the regulations are largely written by people who do not understand the tech they're regulating and its potential. Again, not some weird controversial point. With every next leak where my full name, PESEL (that's like SSN here in Poland), email, phone number become semi-public and... nothing happens, I am becoming more convinced that we are annoying ourselves for nothing. Just degrading our digital lives and generating tons of legal digital text no one reads for no benefit of anyone involved. At the same time, the very people who pretend to defend my privacy, oppose Tor, Signal, anonymity online, and other tools that definitely benefit me.
  • ezst 2mo ago
    > It is also definitely true that the regulations are largely written by people who do not understand the tech I kind of switched side on this after the silicon valley made it clear that they are in the king making business, and the kings they want are of the fascistic and not benevolent kind. Also, a big aspect of the "tech culture" (beyond the silicon valley itself) has been about focussing on what could be done rather than whether it should, and this "restraint" must come from "outside the tech bubble".
  • varispeed 2mo ago
    The purpose of GDPR was never data protection or privacy. It was designed to legitimise data trade and give corporations legal basis for selling and processing the data where before that it was a grey area. If you look at it through that lens, it will make sense. Regulators are just a potemkin village thing to make it look like the law is serving ordinary person.
    • discreteevent 2mo ago
      You're lying.
  • Semaphor 2mo ago
    [flagged]
• sourcecodeplz 2mo ago
  there is a whole campaign online about hating on the EU & its regulations.
  • whatsThisBtn4 2mo ago
    I made a physical product and upon learning European regulations, I quickly decided I was going to spend 0 time designing it for Europe. If I made millions, sure, pay someone to figure it out. But I was not going to waste design time early on. I can't imagine how much this affects small business in Europe.
    • foldr 2mo ago
      These are just general barriers to international trade, though. Small manufacturers in Europe may likewise decide not to design for US regulations.
      • mft_ 2mo ago
        No (what I’m fairly sure is being referred to is that) there are (very recent) significant additional barriers to trade between EU member states, which disproportionately impact small businesses.
        • foldr 2mo ago
          I don't think so. The most natural reading of OP's post is that they are outside Europe. You wouldn't say "I can't imagine how much this affects small business in Europe" if you were yourself running a small business in Europe.
          • setsewerd 2mo ago
            Unless you were in Europe and didn't run a small business
            • 2mo ago
• sajithdilshan 2mo ago
  I worked in a small startup in Berlin and I remember we used to have a person dedicated to handle GDPR stuff. She had to go to Berlin data authority periodically and report status. I was really surprised given how small the company was, why we needed a dedicated person to handle all the bureaucracy. Apparently it was the law. Also with the new package law in EU. I believe all these laws are how EU creates employment for their citizens. With almost every law they introduce, another new position is created in private as well as government offices and in a slowly aging continent that’s a good way to keep people employed when there isn’t much of a prospect
  • em-bee 2mo ago
    except the package law as it stands is going to force many small businesses to close because they can't afford the cost.
    • sajithdilshan 2mo ago
      I think there will be more small businesses that would be created to handle all the package regulations and they will provide it as a service to all those businesses. I agree that it’s another unnecessary layer of bureaucracy, but maybe that was the intention of the lawmakers
  • johneth 2mo ago
    > She had to go to Berlin data authority periodically and report status. That seems more of a German bureaucracy thing rather than GDPR specifically. The UK, which does still implement GDPR from its time as a member state, does not require this level of officiousness.
  • Anamon 2mo ago
    That's not true. The Data Protection Officer doesn't need to be a dedicated person, an employee can simply be given that role in addition to their regular roles. There are rules to prevent a conflict of interest. But I don't think many small corporations have a dedicated DPO.
• bryanrasmussen 2mo ago
  I feel that this must be logical error related to ad hominem and fallacy of composition, instead of this is bad because bad people like it, this is good because bad people dislike it. That said I am generally happy with GDPR.
  • nonethewiser 2mo ago
    It might have sounded clever but if you aren't concluding GDPR is good/bad based on what it is you are not reasonable.
• marcle 2mo ago
  Tobacco control advocates sometimes referred to a "scream test": the more vigorously the industry opposed a measure, the more likely that the measure was effective.
  • nonethewiser 2mo ago
    Yeah but don't tobacco control advocates want to kill the tobacco industry? We don't want to kill the tech industry - surely the tech industry's pain is widely felt sometimes.
    • samrus 2mo ago
      They dont want to kill the industry, they want consumers to be informed of the risks and stakes. If that makes consumers not want to consume tobacco then tough luck but the tobacco industry cant be allowed to operate based on lies and misdirection Same goes for data harvesting in tech
      • maleldil 2mo ago
        The UK is banning the sale of tobacco to people born on or after 1 January 2009 entirely. That will eventually kill the industry (which is good).
      • SR2Z 2mo ago
        I think they do want to kill the industry, and I think that's fine. One of the greatest achievements of America was killing smoking as a pastime even if that trend is reversing.
    • yencabulator 2mo ago
      Surveillance capitalism is not all of tech. Surveillance capitalism might die or become unprofitable -- that sounds great.
• stephantul 2mo ago
  Cookie banners are made annoying on purpose. This has nothing to do with GDPR itself. The entities forced to show them would rather not, and thus make it as annoying as possible for you. They then use this to weaken support for the GDPR. Shame on the people making stuff like this.
• varispeed 2mo ago
  GDPR is good for corporations because it legitimises data trade. Population trained to agree to cookies now also agree to data processing just to get the banner go away and corporations have legal basis to process and sell the data. It is all working as intended. The tell tale is bodies like ICO being powerless when it comes to enforcing it. You've been screwed by big corporation? ICO will shrug.
• amriksohata 2mo ago
  If someone hates something doesnt mean that the other thing is good, thats a bizarre assumption. Im all for GDPR but has it helped stopped our data truly getting out? No just look at social media companies using subversive tactics.
  • Timon3 2mo ago
    I have relevant personal experience here: At a previous job, I didn't have a company phone when I got set up, so when I signed up for a tool we all used, I used my real phone number. Unfortunately it was an American company, and from that day FOR YEARS I got spam calls, which I never got before. I can't prove it was them, but it feels like I got too naive because there was never trouble giving my real number to services...
• blainm 2mo ago
  The reasoning treats a correlated characteristic as a causal mechanism. successful person → unusual trait And infer: unusual trait → success The most popular example of this in tech (that never seems to die) is when people notice moments where Steve Jobs was an asshole, or he said no directly to customers, and infer they need to be more like this because it's the unusual trait they're missing and need to emulate. FDR's hatred was a byproduct of his consequential actions. But consequential actions are not the only things that produce hatred. In fact, rather petty actions can cause someone to feel hatred. If you use hatred as a proxy for importance, you are effectively saying: "All impactful people are hated, therefore all hated people are impactful." This is logically equivalent to saying "All dogs are animals, therefore all animals are dogs." The metric has zero predictive power because the set of "hated people" is vastly larger than the set of "impactful people." Friction is also terrible metric for progress. I would argue privacy has actually gotten worse due to the banners because if you decide you're not going to sign in to do something like a Google search (so it's not tied to your account), then you're immediately punished with a nag box. So you actually decide you'd rather stay signed in so you don't get nagged. Even if you're in favour of using the government, you should be using friction as a counter-signal. For example, switching to the Euro, reduced friction. Standardising to USB-C, you could argue this reduces friction for consumers.
  • ahartmetz 2mo ago
    TFA talks exclusively about being hated by the right people. If you are only hated by the right people (yes, I made an adjustment there), it's probalby not because you are a jerk. Come on.
    • deleted 2mo ago
      [deleted]
    • blainm 2mo ago
      Steve Jobs was against the "status quo" of Windows users, hated by "the right people", people that wanted to keep the OS monopoly. So why are you against his management style, do you not want people to succeed? Do you see how the caveat actually does nothing? I steered away from it because "the right people" is highly subjective, especially in a political context.
• bsian 2mo ago
  "You know x is good based on who hates it" is too generic an argument to be useful. It applies to so many things.
  • summermusic 2mo ago
    It’s more specific than that: “You know x is good based on if the worst people hate it” which I agree with the author is an extremely useful argument.
  • xboxnolifes 2mo ago
    It does apply to many things. That doesn't make it a bad argument, it means its a very useful argument in many contexts.
• apexalpha 2mo ago
  Watching the US go from laughing at "silly EU bureaucrats making regulations" to "oh shit there's a national, privately owned AI surveillance network already" in two years is interesting.
• mstaoru 2mo ago
  I don't quite understand GDPR though as it theoretically let's me remove my personal data from benign websites, but doesn't let me remove my data where I would really want it removed, e.g. (my personal nemesis) SCHUFA, CRIF, Boniversum - which are all private companies. SCHUFA is especially bad. They gather some strange data, and then "based on statistical analysis" give you a rating that is completely disconnected from reality. It's borderline necessary to rent an apartment, but if you're a new expat, have 2 credit cards, NOT (!) paying a mortgage, or you like to move apartments often, or try buying something with installments and get rejected (...via SCHUFA check...), then you're in a shitlist without any recourse.
  • scott_w 2mo ago
    While you might hate them, you don’t want your data to be removed from their systems. If you’re having a hard time accessing credit with them, imagine what happens when you try to access credit as a ghost.
    • mstaoru 2mo ago
      Right. The problem is, I do not need credit, but in Germany most landlords ask for this SCHUFA report to consider a rental application. They get 100s of applications (there is housing shortage), so not having any report is not working. And if you are a new expat without a permanent address, or you didn't know and tried to check how much something would be with installments (which triggers the application procedure and the rejection - all in one click often), or you just didn't like your first apartment and moved, or you didn't like your first bank, didn't close your credit card, and opened another bank with another credit card - your score is going to go down the drain. Thankfully now at least they have a report on "why" you have a low score. Before Sep 2025 it was just "low" and no explanation. You can check here https://www.schufa.de/en/scoring-data/new-score/index.jsp https://www.schufa.de/en/scoring-data/new-score/index.jsp
      • scott_w 2mo ago
        I’m not here to defend credit agencies but I will point out that the GDPR does put the onus on them to make sure the information is accurate. This is a net positive. The power to delete your data with them would actually result in exactly the situation you described, likely without the requester knowing that’s what’ll happen!
• grebc 2mo ago
  [flagged]
  • gls2ro 2mo ago
    Cookie banner is not required. It is not even mentioned in GDPR law => EU did not require anyone to implement any cookie banner. You can implement the consent in multiple other ways probably and GDPR does not mandate any specific technical or UX flows. It talks about what consent means for example.
• 1vuio0pswjnm7 2mo ago
  "The banner is deliberate vandalism, a dark pattern engineered to exhaust you before you can learn anything about the surveillance apparatus humming behind the "OK."" Create a problem, the "dark pattern", and then offer a "solution" The source for the "solution" is also the source of the original problem This is one of the various tactics in the SillyCon Valley playbook Use the "solution" or else suffer the problem Consent immediately or suffer the cookie banner Lowbrow, mafia-style persuasion but with cowardly annoyance in place of direct confrontation I never see any cookie banners when there is no Javascript interpreter. No cookies get through the local forward proxy anyway. But that's not SillyCon Valley's "solution" to the annoyance, it's mine