Grindr €6.5M fined for not collecting users’ valid consent for sharing data

Why can't organs be considered as a means of payment?

Not sarcasm - I think that while it's obviously a different scale, the reasons are similar and boil down to "we don't want that as a society" and "the environment this creates is not conductive to a free and informed rational decision". Many people don't understand the value of their data and the risk it poses, there is an information imbalance, there is a power imbalance (the company sets the terms, and you only get to take it or leave it).

The pre-GDPR situation also showed that the market doesn't really work, because everyone was collecting your data, people have limited energy and incentive to care because it doesn't cause immediately visible pain. It's similar to workplace safety - we don't allow employers to create easily avoidable dangerous situation in exchange for extra pay either, for similar reasons.

Most importantly, data grabbing is not necessary for advertising, it's just slightly more profitable and thus everyone does it, eventually pushing the "good" (privacy-friendly) players out of the market. If we want to change that, we need a de-facto ban (which a properly implemented GDPR would be, because so many people will click "No" if given a truly free choice that showing the popup won't be worth it).

Think of it as the law catching up with technology.

> No business is interested in having to suddenly comply with such regulations and essentially no longer being able to utilize the data of individuals however they please.

Indeed, hence the need for regulation.

> Ergo, corporate interests will probably lead to lots of lobbying in this regard, just look at what happened with net neutrality and the advertising around it.

Sure. But since EU citizens will be enjoying those protections and US citizens will not eventually this will translate into an advantage for companies doing business from the EU and into the US. For that reason alone there will be a big incentive for the US to make a law that is symmetrical to remove this advantage.

> I think that all of this boils down to profit margins and viewing people as just numbers on a sheet somewhere, to extract wealth from.

This is a big factor, but not the only factor: data that is in isolation worthless can become very valuable or even dangerous when combined with other worthless or innocent data. There are plenty of examples of this. The balance clearly lies in protecting consumers from the fall-out of these and the more purposeful abuses. This is a matter of raising consciousness about what rights you already have, not necessarily of giving you new ones.

> Just look at how scummy many of the cookie banner implementations are, designers being paid to implement as many dark patterns as possible, at least up until lawsuits started.

Agreed. The EU did the right thing with the GDPR, it laid bare how many companies were outright scandalous in how they were dealing with the data that they were entrusted with, they were bad stewards and it is good to see this level of enforcement because that means that companies will wise up to it and find better - and cleaner - ways of monetizing their products and services. Once they have those they will realize that regulatory capture can be theirs if they lobby for these rights to be extended to everybody.

The EU is too large a market to miss out on.

We're also deep in a pandemic where olden times means of socialization are pretty restricted. I'm not gonna walk into a bar in 2021 to be assaulted by smoke, sound, and covid. Just the smoke and sound has been enough to keep me out of them for over a decade now.

As far as the average person is concerned, EEA members like Norway are practically in the EU. You've got free movement, open borders due to the Schengen area, and so on. Meanwhile all the exemptions from EU law mostly concern comparatively niche areas like fishing.

> No business is interested in having to suddenly comply with such regulations

Just to pick up on this clause - it really needn't have been sudden. The regulation was adopted just over 2 years before enforcement kicked in[0], and of course it was written and debated for a while prior to that. In the UK the ICO researched the implications (for what were then just proposals) back in 2013[1]

[0] https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

[1] https://ico.org.uk/media/1042341/implications-european-commi... (PDF)