Analysis of economic and productivity losses caused by cookie banners in Europe

And by hitting that ”deny” button, you have ”consented” to hundreds if not thousands of data brokers around the world processing all your personal data gathered throughout your life across all your devices. They can now freely buy your data from other brokers to enrich their profile of you.

Should have unchecked those 973 legitimate interest checkboxes they hid under the ”affiliates” or ”vendors” or ”providers” or whatever.

Next, they will resell that profile to political campaigns, advertisers, law enforcement, private dicks and security providers, the military, foreign intelligence services and drug cartel hit squads, to name a few. You could buy it too! Or your friends, enemies, neighbors, colleagues, bosses…

If they're doing that after you clicked Deny, the government can come down hard on them. Sadly, only the government - individuals can't sue companies for GDPR violations.

Legitimate interest checkboxes are technically not asking for consent, they are considered informational. OneTrust popups are especially inflammatory in this regard.

Yeah right, legalized bribery means the elected leaders have priorities other than citizens.

Article 79 [1] gives individuals a right to sue for GDPR violations.

[1] https://gdpr-info.eu/art-79-gdpr/

That’s inspiring.

Let’s team up the pissed off individuals and raid-sue one of the obviously abusing. One is nothing, but that could at least make more visibility of the borderline legality. And at best we win and go to the next one.

Any law-worker?

One of my favourite HN threads is Confiks exercising his GDPR rights under the threat of litigation against Spotify: https://news.ycombinator.com/item?id=24764371

Legitimate interest can absolutely be opted-out of:

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

https://eur-lex.europa.eu/eli/reg/2016/679/oj#006.001

Yes, by unchecking the 973 hidden checkboxes.

That doesn't say you can opt out. It says sometimes legitimate interests aren't enough. For example, as a hypothetical service provider I have a legitimate interest in tracking your GPS location everywhere you go, because it helps me predict what kind of service my customers like based on where they live and work. However, your right to not be tracked is more important, so I can't use my legitimate interest to justify the tracking in this case.

So effectively, they're in the clear. The law also say not opting in should be as clear and asy as opting in, yet that is the case approximately 0% of the time.