Analysis of economic and productivity losses caused by cookie banners in Europe

The first step is data minimization. The second step is informed and revokable consent. Everything else follows from there.

Do targeted ads increase the amount of personal data that needs to be stored and processed and the number of entities that will access it? Yes they do. Are they required for the site to serve its stated purpose? No, unless the site is marketing itself as literally a curated stream of targeted ads. So they require informed and revokable consent (i.e. opt-in). Even if you think they're beneficial to the user.

It's not about what's beneficial. It's about what's required. That's why most sites try to group services by categories like "functional", "analytics", etc. If you want to embed a Google Maps view to help people find your physical store, that's beneficial but still requires consent because it shares their data with a third party (i.e. Google) when the browser loads that map. Of course in this case you don't even need a banner, you could just have a placeholder (often called "content blocker") instead of the map with the option to consent to loading the map and storing that decision so the user doesn't have to see the placeholder again.

> But if you are going to run a website with any services on it (video content, eCommerce, member management, etc) you are going to have partners.

No? At least not in the scale that would require these consent services. Services like member management are literally required to operate the website so those can go into the privacy policy (as would e.g. hosting on AWS or using a CDN).

The reason these consent services exist is that a lot of websites are just content mills that operate entire on behavioral advertising, whether it's the web version of a newspaper or just SEO blog spam. These often use hundreds of "partners" for analytics, ads, targeting, re-targeting, etc. And they desperately try to trick visitors into opting into those.

For your run of the mill Wordpress website you can just get a plugin like https://devowl.io/wordpress-real-cookie-banner/ - and in many cases the free version is good enough.

You're framing website use as transactional but for financial transactions we literally require informed consent.

Also you seem to be operating under the assumption that your personal data is something that can be used as payment. The GDPR literally does not allow that just as human rights don't allow committing yourself to indentured servitude. You can't sign away your rights. If you share personal data you continue to have rights to that data and can revoke your consent. It doesn't stop being your data just because you handed it over, even if you did so willingly.

If your business model can't work without exploiting your users' personal data, your business model no longer works and it's your job to find a new business model that does. There are plenty of business models that only worked when indentured servitude was legal (let's not have the debate about prison labor in the US) and I'm sure you would agree that it's fine for those business models to no longer work. It's part of the risk of doing business. Innovate. Disrupt. Or perish.

You The Point

No "cookie banner" is required UNLESS you are using cookies to track me or personally idetify me.... in which case, you must ask my explicit consent to do so.

Blame the parasitic adtech industry wanting trade your personal data. Not the EU for providing you with consumer protection.

The law isn't about cookies - it's about obtaining consent to process personal data.

You need to ask permission to track people and to do other things with their personal data.

Cookies are one method to do that, but any other method (like local storage or storing session state in a URL parameter) also counts.

Hence, it is not possible to have a system where a browser can tell a site what kinds of processing the user thinks are OK, as it would be too complicated.