> I'm pretty unclear from your post how GPDR is different from any other compliance standard
I never said it was different, I said it is a dumpster fire. Most regulation being dumpster fires does not somehow absolve the GDPR from being a dumpster fire.
> I would expect a bank vs a retailer vs a startup to have significantly different implementations of GDPR.
Maybe we are using different definitions of the word interpretation, but if nobody knows how to comply with your regulation because they don't understand what it means, it is bad regulation. Regulation that is entirely open to interpretation is a massive "do not invest" red flag to businesses, which incidentally, is one of the reasons why innovation in the EU is so bad.
> I also recognize that making such an interface a hard requirement would lead to excessive rigidity.
If compliance is uncertain it makes business more expensive and wasteful. If nobody knows whether they are complying with regulation and the only way to find out is litigation, it is bad regulation.
> Ex - GCP: I would think a bank better understand how its cloud data processor is working enough to answer basics like where customer data is flowing
There is much more to GDPR than to what country data is flowing. Again, I don't know how to express this more clearly: National agencies neglected their responsiblity in setting out certification processes. As useless as they were at their job, at the very least they could see this is needed, they just did not do their job because they had no incentive to do it.
> I'm not sure what the problem with the cookie thing is.
It could have been implemented by browsers as a header in HTTP requests. Having a popup on every site is not a clever strategy.
