[saagarjha]

No: the law wants you to not have to do this. The law wants you to stop collecting data for things that are not core to your business. The issue is that companies are trying to maintain the status quo as much as possible, and annoying users with these does that.

[taysic]

Personalized, targeted advertising is how many services make money. So what is meant by 'the law wants you to not have to do this'. The law wants these services to not make money to cover their expenses? Or scale back their operations?

[mrweasel]

The problem only arise when you out-source the tracking and personalization of the ads. You could do the profiling, aggregation AND anonymisation on your end.

You're still allowed to have personalization and targetted ads, but now you actually have a responsibility for the data you collect and I don't view that as unreasonable.

[taysic]

You can only have targeted ads if you ask users for their consent which is why these pop ups etc are necessary - going back to the original question.

[mrweasel]

No... I mean I see your point, but that depends on what data you use to target the customers. Staying with in the boundaries of your own site, tracking what a person is browsing isn't necessarily personally identifiable, so no need to ask.

If you use data that the user actually enter, or their IP for some reason, then yes, you do need to ask, but you could just ask when they are entering the data.

If you want to target based on activities across website, then you'll most likely need to ask, but that's already the case with the cookie law.

You do have me wondering if I'm correct, but I would still claim that if you noticed that browser with the "cookie XYZ1234" read five article related to child and then ask your ad partner for an ad for "people with children" would allow you to be GDPR complaint without any pop ups. It does flip the current ad tech model upside down though.

[zerostar07]

You need (separate) consent to process their personal data for targeted in-house advertising. Thats what facebook/reddit do. If you pass user personalization data to others (such as that they are interested in children) it's the same thing as having personalized tracking ads, you need consent again (and an agreement with that third party).

[darkkindness]

Sometimes personalized advertising makes money at the cost of privacy, e.g. selling of personal data. In the EU, data privacy is a right. So the law isn't maliciously making life hard for these 'services', but if your entire monetization strategy is breaching data privacy, then good riddance to you.

[taysic]

Commonly the data is used for targeted advertising which is why they need the pop ups and consent forms. Their appearance is not because the companies want GDPR to look bad.