[theptip]

I think consent has proven to be a flawed mechanism on its own. GDPR’s requirements around legitimate/required processing show a way forward.

1. A site can’t require me to consent to unnecessary permissions just to use the site.

2. I can always revoke/delete my data grants and that must be transitive (the site has to delete all downstream data it shared with subprocessors, and have contractual guarantees that they can honor that before sharing any data with them).

[eek2121]

I have to disagree with your comment regarding the GDPR. I like the concept, but the legalities could have been better. I do hope a treaty can be struck between the EU and the US, however.