Automating cookie consent and GDPR violation detection

And if the issue is that they're under-funded, I agree with increasing resources to proportionate to the need to properly enforce the law. Coupled with proper proportionate penalties (including warnings for good-faith efforts to compliance, making the law a bit more like online speeding tickets than the 20-million-euro minimum penalty suggests it should be), it may be able to adjust behavior.

On the other hand, I'd expect the resulting behavior adjustment magnitude to be in the realm of speeding tickets (with the occasional reckless-driving for, say, a FAANG mass-harvesting data). Maybe that's good enough for the goals though.

The other two are trickier to judge, but contain (user?) identifiers, which could certainly be used for tracking, so I'll have to concede your point.

Edit: I had to recheck some of the sites I'd previously checked, as your examples helped me realize that my browser does a lot of blocking. It turns out that just one of my examples was actually a good one: https://finlex.fi/en/

Edit2: Found others: https://www.suomi.fi/frontpage and https://vnk.fi/en/frontpage

Both actually do set cookies, but apparently nothing requiring consent.

But yeah, the result is too complicated to be effectively enforced, sadly. So further reform is needed.

I'm not sure how helpful this criterion is; there exists a large gray area in what people consider to be "abuse". For instance, suppose that an EU-based business hotlinks an image from a U.S.-based website (or a website hosted on a U.S. CDN, or a website operated by a business owned by a U.S. corporation). Then that business is at risk of being fined, since it has no way of proving that the target website does not log IP addresses (e.g., for some DoS-protection suite), and if it does, the U.S. government could gain access to those IP addresses, which are defined as protected personal information.

In this scenario, the EU-based business isn't necessarily doing anything nefarious like selling data to advertisers, and it could even be refraining from storing any data at all. Likewise, a U.S.-based website that stores only connection logs isn't necessarily doing nefarious things with those. But the former business is still at risk of being fined, since IP addresses have been placed under the umbrella of protected personal information.

In the discussion a while back of the Google IP-address fine, I saw two talking points come up repeatedly: that there would have been no issue if Google weren't doing nefarious tracking of IP addresses, and that the EU operator must have known that IP addresses are radioactive to store or transmit but chose to do so anyway. AFAICT, the first is inaccurate, since any persistent storage of IP addresses by U.S. operators is problematic. And the second, I think, illustrates the real tension here: between privacy maximalists who prefer the least possible amount of data to be stored in all circumstances, regardless of the cost, and everyday server operators who fear that using the default settings on their software or using seemingly-trivial functionality could be introducing legal liability.

I'm still not sure myself about the relative merits of the two viewpoints, but much more could be done to assist the latter group in following best practices, instead of immediately demonizing them as nefarious loophole finders. (Not to say that nefarious operators don't exist, of course, but I suspect that their prevelance is very easily overstated.)

The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies. And since IP-detection was not allowed, we did it for all website visitors. And because we have to remember your settings, we had to create a seperate anonymized database outside of our normal website.

And the website broke ALL THE TIME. Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies. And for several months the web team had a constant nightmare of customer complaints about broken stuff.

In the first year we ended up spending close to $250k on legal advice from European lawyers, and most of the advice boiled down to "you're not going to get in trouble if you just do what everyone else is doing". Seriously.

Since then it's gotten better - most third party vendors have done a better job of offering anonymized cookie versions of their products. Or there is just more industry guidance available on what kind of cookies can be considered sufficiently anonymous.

For people who claim GDPR compliance is clear and straightforward - I can't believe they actually have much experience working in Privacy. Actual implementation gets... very opaque. Especially when the law says it's illegal to deny service based on their cookie preference, but some services are literally impossible to provide without a cookie of some form.