Analysis of economic and productivity losses caused by cookie banners in Europe

Laws are best when they are abstract, so that there is no need for frequent updates and they adapt to changing realities. The European "cookie law" does not mandate cookie banners, it mandates informed consent. Companies choose to implement that as a banner.

There is no doubt that the goals set by the law are sensible. It is also not evident that losing time over privacy is so horrible. In fact, when designing a law that enhances consumer rights through informed consent, it is inevitable that this imposes additional time spent on thinking, considering and acting.

It's the whole point, folks! You cannot have an informed case-by-case decision without spending time.

Forcing me to make an informed decision where I don't care about the result is the one of the major ways of wasting my time.

If you wanted to create a good law about this you should make it so I only have to make a case-by-case decision if I care about my privacy (as it's currently exploited) and do nothing if I don't.

The laws do not force that. Informed consent before tracking could be implemented other ways, perhaps even more easily.

The companies choose to force you to make the decision, rather than making it something you could choose to click or choose to ignore, because forcing that increases the chance that people who do care will accidentally opt-in and people who don't care will get irritated and (as is evident in places in this thread) incorrectly blame the law.

The companies make a point of inconveniencing people like you who don't care, so they can weaponise you against those of us who do. The companies are doing this to you, not the law.

So what's the source of the friction if not law itself or its direct consequences?

I think other parties try to force me to care when I don't by introducing all that friction.

There's a talk about DNT. What's the reason no browser has "Please do track me and do whatever you wish with the data you manage to gather."?

I think it would be quite popular. So it's probably prevented by the law itself.

If you actively _want_ companies to track you, then you take an unusual position.

> So what's the source of the friction

The right to privacy if you want it. Someone wanting to let people to follow you around should not override the preference of those who would prefer not. The "why should I care that other people care" argument is very similar to those who argue against smoking restrictions (or seatbelt requirements, and so on) because "it should be our choice" without thinking about the potential consequences to others.

> if not law itself or its direct consequences?

The source of friction is how the complaints have chosen to interpret the law. They have chosen to do this in a way that causes maximum inconvenience to anyone who want is protections (many are actually in direct contravention of the rules, despite their claims otherwise, but let's for a moment ignore that companies are actively breaking the law). That it also inconveniences people who want to be tracked is a desired sideeffect as it means those people are weaponised in ad-tech's favour in discussions about such matters.

> I think other parties try to force me to care when I don't by introducing all that friction.

As well as the binary "your choice" vs "my choice" that completely ignores those who have not yet stated there preference, have not yet decided, or do not yet even know there is a choice, or are just passing by. This is why active consent should be the default requirement.

> There's a talk about DNT. What's the reason no browser has…

Your premise is incorrect: Some browsers do. It doesn't work because companies ignore it. It is not in the laws that they shouldn't ignore it because ad-tech and their lobbyists successfully campaigned against that being in the legislation. Again: ad-tech is the reason for your inconvenience, not other people's preference not to be tracked.

Part of the issue is that there is a conflict of interests in done quarters, with makers of browsers also being part of the ad-tech stalking business, another place the effects of this are seen is in changes that prevent us choosing to actively block being tracked because we can't express it choice more passively because DNT is ignored.

> I think it would be quite popular.

We very much agree there.

> So it's probably prevented by the law itself

It is not. Show me anywhere in the current legislation where UAs implementing a DNT flag (which, I say again, some do) or ad-hoc tech respecting such a flag is prevented (either directly, or by accidental interaction between rules).

How about an alternative: have a one-click "track me if you want" flag? (Of course it would be terribly naive to think companies would not also just ignore that and track when it isn't set at thier convenience).

Which browsers?

> How about an alternative: have a one-click "track me if you want" flag?

That's exactly what I was asking for. It should exist. My theory why it doesn't is that it wouldn't constitute informed case by case consent. So it's illegal.

> Of course it would be terribly naive to think companies would not also just ignore that and track when it isn't set at their convenience

I don't care about that because I want to be tracked, just silently.

If I were to design law I wouldn't ban tracking. I would make sites that do track make the information they have on "me" available to me for viewing and possibly editing at my request.

It wouldn't be even "cookie law" because whatever information you tie and store to whatever identity should be available to this identity.

Quite a few: https://caniuse.com/do-not-track

Unfortunately the spec is official deprecated, rather than just ignored by sites, because without any regulatory weight it, well, would forever just be ignored by those who want to ignore it.

> I would make sites that do track make the information they have on "me" available to me for viewing and possibly editing at my request.

So, GDPR? That is not a cookie law but governs the tracking of PII, including the right to be given a report of what is stored about you and the right to be forgotten¹. Though it isn't finer grained than that: you can have yourself removed entirely and request corrections, but it does not prescribe any option for more selective deleting.

----

[1] except where that would impinge on other regulation, for instance in industries my day job services companies have to keep certain details of people for certain lengths of time (indefinitely for those associated with selling pensions, for instance) for dealing with complaints and other regulator matters in the long term.