GDPR enforcer rules that IAB Europe’s consent popups are unlawful

> I wish there was an HTTP header that meant "I don't give a shit about what you do with my data, just let me get the information I want from this website".

I'm OK with that as long as there is an equivalent HTTP header which means "NO! Do not track anything, do not profile, do not collect any information besides the bare minimum PROVEN to be essential for the site to function at all. Either something's truly essential or it isn't, there is NO Legitimate Interest category".

Unlike the failed Do Not Track header, this one should actually have legal teeth (well, at least in EU) and sites which refuse any service to visitors carrying this header should be fined (after a grace period to implement any needed changes). And why not, add provisions to pierce the corporate veil so they can't set up a hollow company to take the fall for noncompliance.

Remember, you can still show ads and profit from them, you can't just violate my privacy and vacuum all my data to Feed The Beast.

earlier discussion here: https://news.ycombinator.com/item?id=29121848

This comment is being downvoted but I’m also wondering: how will this be enforced? Will authorities go and audit the data? How will they know where to look? Etc. “Hey did you delete the data?” “Yes, we deleted it” would, indeed, be laughable. This is not to mention the problem of identifying “the data” which has certainly now been processed ad nauseum. I think the reason companies don’t take these things seriously is because they know they’ll get away with it, one way or another. You can’t expect to enforce any of this if you don’t also legislate the technical specifics of how data must be collected, stored and processed so that its provenance is maintained.

This ruling should not be a surprise.

The writing has been on the wall for a long time that GDPR informed consent is to be interpreted in a narrow sense (i.e. actually being informed, not just clicking). And we know EU legal measures often take a long time but can bite hard. So here we are now!

[Edit]: Note that the decision can be appealed - so it's going to be a long while before we get a final verdict.

The industry should really get together and set up something like P3PP but good. These settings should be set in the browser, not in the client.

Of course the ad and web stalking people don't want that, because that means users can easily opt out. With Google's misguided attempt to force FLOC down everyone's throats we may see them join forces with Apple, Microsoft and Mozilla at some point to develop a consent protocol that can be configured easily without the stupid popups.

For example, the browser could hide all the requested consent in a little button in the top right that opens into a menu to let the user pick what they do or do not consent to for what parties (with UI to show the necessary reasons for processing), with defaults configurable in the settings. The defaults would differ per browser of course (probably opt-in on Firefox and Safari, opt-out in Chrome and Edge) but it'd still work out for users because they could change the defaults.

Hell, with the rate HTTP is evolving (bodies in GET requests, QUERY, etc.) I can see a HTTP CONSENT verb coming to http4 eventually.

There are definitively other concerns with such a protocol, like the ability for malicious actors to use it for fingerprinting, but I think it's the only way forward for browsers. Big tech has ignored legislation for a while now, but if they don't show initiative the law will only get worse for them.

I bet the EU would happily list such a protocol as a requirement for most websites. People like you could just blanket allow everything, people like me could blanket block everything, and we'd all get rid of these stupid popups forever.