Well, I am trying to inform myself because I did understand the cookie popups to be connected to GDPR. As far as I can tell from my reading, your assertion that "cookie popups have nothing to do with GDPR" is not true.
From my reading, it seems that while cookie permissions first became an explicit EU law concept in a 2009 amendment to ePrivacy Directive (not GDPR), companies were able to get away with passive consent banners (not popups).
It was GDPR's new definition of consent which then retroactively strengthened the existing ePrivacy Directive cookie consent to explicitly require user action to give consent (i.e. popups, banners large enough to push users to interact with them, etc.).
Unless your point is that GDPR has nothing to do with popups because the companies could just not use non-strictly-necessary cookies and therefore not need a popup, but I think that's a stretch to jump from there to "nothing to do with GDPR".
> (i.e. popups, banners large enough to push users to interact with them, etc.).
"i.e." doing a lot of work there.
GDPR doesn't require pop-ups or banners for providing consent. It mentions "ticking a box when visiting an internet website" as an example implementation. But it's just there as an example.
the mechanism for gathering consent is an implementation detail left to the site to handle because GDPR applies to far more than websites. i've had to provide consent for things completely unrelated to websites.
you could add a line of text saying "please write us a letter with the following information (user account, blah, blah) if you are willing to provide consent for optional tracking like blah blah" and this is perfectly in line with GDPR.
sure, it's more expensive and you'll get fewer people who you can track. but make no mistake, sites make a decision and choose pop-ups/banners as their implementation for gathering consent because they don't want to lose out. they're happy inflicting pop-ups/banners on their users instead so they can keep their precious tracking cookies going.
i.e. GDPR doesn't require pop-ups/banners, sites choose pop-ups/banners.
GDPR (and ePrivacy before that) requires valid prior consent where optional tracking is used. A site using only technically necessary storage can simply have no consent banner. A business wanting advertising and analytics trackers generally needs some consent interface.
"Not a requirement under GDPR", yes, but certainly not "nothing to do with GDPR". It directly has to do with GDPR, in conjunction with business' decisions and how to comply with the law.
And of course, we can then argue our faces off about what's good and necessary in the world, in businesses and data protection, but saying it has nothing to do with it is just wrong.
It’s insane how that misinformation doesn’t want to die. In 100y we will still have people repeating that we get popup because of gdpr, and nobody will know what a popup or gdpr is
Is it really misinformation? The popups may largely be a result of misunderstandings or malicious compliance, but GDPR has a causal relationship regardless of the intent.
I would however blame them if they wrote an ordinance that was widely misunderstood to mean that someone had to knock on my door each day to make sure I knew the local chemical factory had a fire alarm.
If the chemical factory sets themselves on fire every day to set off the fire alarm to annoy me to pressure me into removing the fire alarm law, I still blame them.
Moments ago it was "misunderstandings or malicious compliance". Did you misplace one on your apologetic quest?
I'm really trying not to assume the worst about you. Is there any reason you insist so much on giving the benefit of the doubt to every law breaker out there? Especially when we're sometimes talking about very deep pockets who can afford lawyers?
> a result of misunderstandings or malicious compliance, but GDPR has a causal relationship regardless of the intent.
You can extend causality as far as you want if you're willing to sound like this in the open. If there were no cookies, there'd be no banners. There, found you a new target.
So on one side you have decent regulation that tries to balance the interest of the user without over regulating and becoming too prescriptive, and on the other side you have abusers who most of the times are actually in malicious non-compliance... and you find a way to blame the regulation.
Good thing it's in the rules that HN is not Reddit.
Cookie popups were once issued by browsers in response to a Set-Cookie header. 25 years ago, it was fairly common to open the login page, type in your creds and _then_ hit "accept cookies from domain.com".
Some time after IE6 and Firefox and before Chrome, the default policy switched from "prompt" to "accept".
GDPR was an attempt to restore that default behavior, however no browser did so. I'd've guessed Mozilla could be convinced to revert, but Google presumably paid them enough to look the other way.
GDPR is more than that. Consent or not, there are things bad actors can do in the USA that in the EU they just can't. Specially to children and vulnerable people. GDPR is an integral part of it. This is a small but significant first step in the right direction. Long way ahead still.
Maybe but it feels like 1 step forward and 2 steps back. It feels like in the end they’re (companies) still getting 99% of what they had before and the user experience of everything is much worse.
The blah user experience isn't the whole picture for GDPR. It's just been the most visible part of it.
My personal GDPR hot take: it's actually been 2 steps forward and 1 super clumsy super loud and obnoxious step back.
I agree with the spirit of comment above. The common sense part of it (if there is one) might just end up eclipsed by wonky UX absurdity. Someone will find a way to paint this picture that our EU reality is a Kafkaesque dystopia.
Yes I used it when Confluence had a bug and an account with got stuck and there was no way to delete my account of finish the registration. So I issued a GDPR delete request and re-created the account. tada.wav