Internet's biggest annoyance: Cookie laws should target browsers, not websites

The problem is exactly the law then because it was written so incompetently that it left the loopholes to allow websites to try and trick accepting.

Should have been written in the law that it’s a one toggle in browser settings.

If government is going to impose on the internet the least they could do is be competent in what they impose. Not writing laws that waste lifetimes in collective hours a day as every person in Europe deals with multiple of these dialogs a day and thousands a year.

> it left the loopholes to allow websites to try and trick accepting.

It did not. These practices are illegal under the GDPR, the problem is a chronic lack of enforcement by most national enforcement agencies in all but the most severe cases.

Some are just ineffective but others have gone completely rogue. Swedish Data Protection Authority (DPA) for example takes the position that commercial data brokers like Mrkoll are allowed to publish and sell people's personal information (including your current home address, hello stalkers!) [1] and that this is somehow protected under the pretense of "journalism" [2].

[1] https://mrkoll.se/resultat?n=Otto&c=&min=16&max=120&sex=a&c_...

[2] https://noyb.eu/en/swedish-data-brokers-claim-journalists-le...

> Should have been written in the law that it’s a one toggle in browser settings.

No!

For crying out loud..... The law says if you want to track me (advertisers take a bow) then in each case, you must have my explicit opt-in permission to do so. And so you should!

Having a browser toggle setting isn't explicit opt-in consent.

Maybe not a single browser toggle, but it really should be handled at the browser level. There are browser APIs for opt-ins like your current location, using the camera and microphone - why not one for tracking consent?

Ideally opt-in would be explicit, but a browser toggle could bypass even showing the opt-in button if the Do-Not-Track header is sent.

There was Do-Not-Track which is a header that could be set at the browser level: https://en.wikipedia.org/wiki/Do_not_track

And way before that (before spyware became common on the web) there was P3P: https://en.wikipedia.org/wiki/P3P

Now there is Global Privacy Control: https://en.wikipedia.org/wiki/Global_Privacy_Control

The problem isn't technical - the problem is that ultimately spyware operators want to track people so it isn't in their interest to support these solutions and won't do so unless they are forced to. Since enforcement is significantly lacking, operators adopt the pragmatic strategy of non-compliance or pseudo-compliance with the current banners.

[2] Doesn't fully capture the negligence of the Swedish DPA ("IMY"), here's a better source:

> IMY’s practice of simply “forwarding” complaints.

> The IMY’s way of dealing with complaints since the Supreme Administrative Court ruling is to attach an “appeal form” to their (non-)decisions. But it still doesn’t investigate the complaints. Instead, the authority simply forwards the complaint to the entity that illegally processes personal data and then immediately closes the case. This also happened in the case preceding noyb’s current legal action against the IMY. After a data subject filed a complaint regarding a recorded phone call, the authority forwarded it to the respondent without investigating.

[3] https://noyb.eu/en/noyb-takes-swedish-dpa-court-refusing-pro...