[withinboredom]

> But why ask for consent right away when someone just visits your website for the first time? Imagine that you walk into a shop and the owner starts harassing you right away

You do implicitly give consent to "be tracked" when you walk into a shop. A savvy shop-keeper will look at the clothes (brand, style, etc.), hair, facial features, etc. and internally compare you to other's who have made purchases and either approach you or not.

The closest thing we have to that is our (pretty terrible, in the privacy kind of way) ad networks to tell us what kind of people visit our online shop. Without that information, it's hard to (nay, impossible) to guess what demographics come to our store and position the store to cater to the demographic that actually makes a purchase vs. those that don't. If I see a whole bunch of boomers coming to the site, but they don't convert, I can figure out why they're not making a purchase and do something about it, just like I could in a brick-and-mortar store.

I really don't like the amount of personal data gathered or the dark patterns surrounding them. But there's got to be a way to surface some kind of aggregate information without sacrificing privacy.

[jlokier]

They can do the tracking you've described. We all have a brain and will process at a personal level.

But they aren't allowed to make it systematic by, for example, writing a file of paper notes describing each person's recognizable characteristics to share among the staff, or doing the same with photos. Those records would be covered by the GDPR, which corrects an omission in previous laws that only covered electronic records.