Brendan Eich Writes to the US Senate: We Need a GDPR for the United States

Hopefully you'll choose not to use those sites.

For the first couple of months, I clicked all the "manage my choices" buttons. I felt the pain, but decided it was worth it. Then I discovered that for many sites, I would have had to enable 3rd party cookies in order for the choices to stick. That made me realise that I simply didn't want the marketers to even know that I didn't want them to track me; that I didn't want to enable the malpractice of companies that hadn't offered me the choice to disable their options; that I wasn't prepared to rely on the devs behind those dialogs to implement the design implied.

So now, I just close the tab and read something else. My hope is that others make similar choices.

1. It was "poorly drafted legislation"

2. The authors had "no idea what they were doing"

Whether it was poorly drafted legislation remains to be seen. The "unintended consequences" people are talking about here are minor, what matters are the intended consequences such as the augmented rights europeans have over their data, their privacy, etc. I personally don't give a shit about the annoying cookie popups, I'm just glad I can finally delete my account and email address from various websites when I want them gone.

GDPR has given me a ton of rights over my data that I should have, and everybody should have. It has given me access to my own data. It has given me the power to delete it. This shit is important, and now it's law. That there's cookie popups because the companies in question suck? I don't care. If it makes you close the page, that's a positive side effect IMO. This shit must be bad for conversion in order for businesses to start getting a clue. It's a version of the "tax on privacy" that a lot of people on HN like talking about.

Regarding #2, I dispute that for the same reasons. GDPR is achieving its goals of securing user data in europe. Companies are scared straight into following it so far.

There are issues with it (especially a lack of compliance material). None of them point to "the authors had no idea what they were doing".

In other words, no, GP isn't "right" just because you have to click off some annoying popups. That's not the only thing GDPR does.

Edit: Lacking replies, I'm going to assume those downvoting this comment are the usual no-privacy-apologists who are annoyed they now have to put legalese in front of users and don't ask themselves why they have to.

Right, but then Eternal September happened.

Nowadays, the vast, vast, vast majority of Internet users don't have the necessary background knowledge to understand how to protect their privacy online, and the people who do have that knowledge tend to concentrate into organizations that have a lot of financial incentive not to respect others' privacy.

A GDPR in the US should have the power to audit companies and ensure compliance, just like the FDA does with health-tech companies.

On the user side you might only see the effects of GDPR in the form of cookies that were added as a quick-and-dirty solution for companies that have built an infrastructure whose revenue model requires collecting user information. On the other side, law also gives a vector for the government to step in and demand changes to companies that are fast and loose with user data.

If we'd had an effective GDPR in the US, the Equifax breach that lost everyone's social security number may have been prevented and they might have faced some kind of real repercussion when it did happen. Instead, data companies still get to privatize gains and externalize losses.

[1] https://news.ycombinator.com/item?id=18117322