No it won't. Unless you ban EU citizens visiting your website and your website doesn't make business with other businesses in EU.
>Britain will attempt to move away from European data protection regulations as it overhauls its privacy rules after Brexit, the government has announced.
Other countries like Canada implemented GDPR directive. EU required this from Canada, Japan and other countries to make some custom/tariff -free deals. Looks like UK wants to break away from dealing with EU at all?
You can simply break the law and ignore the EU. The cookie popup sanctions are not criminal and unless you are very high profile business, nobody cares about you. Nobody is going to come after you.
The only regulator that international developers need to worry is the SEC from United States, because they pursue for US victims cross border. But the get on the bad side of the SEC you need to do something really stupid.
You should doubt this.
I filed several complaints with unauthorized newsletters and failing to comply to my GDPR requests. German officials went after the companies and asked them to provide the necessary information. For sure it took its time but it worked and for the companies it's been a warning shot.
[0] https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...
You might be interested to follow the EU's ePrivacy Regulation proposals, described here: https://digital-strategy.ec.europa.eu/en/policies/eprivacy-r... (and in particular, the top-level item related to cookies).
I strongly dislike the move too but this is true. The popups are often based on geolocation by ip. Jurisdictions with GDPR get the pop up and those without don’t. If you want to test this go to the Washington Post on an EU/UK ip and an American ip, clearing cookies in between visits and see the difference for yourself.
Anything to do with the EU has become toxic to the governing party.
"Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies that improve internet experience, such as cookies to remember shopping-cart history or to count the number of website visitors."
[1] - https://ec.europa.eu/digital-single-market/en/proposal-epriv...
You should have the options to agree or disagree to non-essential cookies presented equally, and then can offer the granular box ticking for people who really care that Google Analytics can use their data but Google Ads cannot.
People complain that the EU's own website have cookie banners, but if you compare the banner on europa.eu, to say, IB times which is another link on the front page currently. The europa.eu one has two equal options, no BSing about legitimate interest claims for tracking that wouldn't hold up. The IB times one on the other hand has a totally unneeded splash screen, you then need to click manage settings, and for each purpose you need to enter it and disable extra toggles for "objecting" that are basically another layer of opt out consent since they know consent is opt in (but to my understanding if you don't go to manage settings at all and just click the go away option, they will treat that as affirmative consent).
The ePrivacy Regulation is working to clarify the interaction with the ePrivacy Directive which leads to people asking consent for "essential"/non tracking cookies like shopping carts or the "Remember I didn't consent to tracking" cookie.
In theory one could preemptively block all consent popups and requests and continue to surf the website without being tracked, if the GDPR had any teeth.
I run my own /etc/hosts file based on : https://github.com/StevenBlack/hosts
This should block the popular ad-ware companies.
I also browse with Brave, and use their inbuilt "shields" feature to block 3rd party/cross-site cookies. I don't install any additional browser plugins.
Would be nice to kill all the consent-popups, as you say.
All the annoyances that seem caused by the GDPR such as the annoying and misleading consent popups are explicitly forbidden by the GDPR and do not count as compliance.
If the ICO was doing their job and was using the powers the regulation is granting it (such as the fines everyone was fear-mongering about) it would've quickly forced those websites to comply and stop the annoyances.
I don't think it is clear that GDPR has failed. Companies actually think about data privacy now, to a much greater extent than they previously have. For example shady practices by the likes of google and facebook have come under the spotlight and companies do face significant GDPR fines when they mess up e.g. this 890 million euro whopper for amazon [1].
[1] https://www.bloomberg.com/news/articles/2021-07-30/amazon-gi...
Of all the legislation that has come out of Brussels I would count it up next to the successes, similar to the roaming charge law and the one about phone chargers.
So, I can see the political point in "setting fire to the cookie law" whilst basically being GDPR in all but name.
however, given the power of the present government to cock things up, I suspect they are going to make some stupid changes that threaten our equivalence with the EU. The EU will happily remove it, thus making it harder to trade in the EU.
I notice some murmuring about science. I suspect that means they'll try and make it simpler to wholesale sell off the fetid datamine that is NHS medical history. However if we are lucky, they'll also undermine the concept of informed consent for anything to do with research/data, which will be fun.
Because it is not. [1] It was part of the ePrivacy directive, it has been amended since. The TL;DR is: today, if you don't use cookies for tracking and/or ads, you're fine. Just put a cookie consent checkbox on the user login form, and your website will have a much nicer user experience.
If you show a cookies consent modal before your visitors can access anything, either:
* you have personalised ads with global tracking. (~= criteo, amazon ads, or google adsense)
* you're using a globalised analytic tool. (~= Google Analytics)
* you're following an outdated version of the ePrivacy/GDPR directives.
But it's easier to blame it on the EU.
It isn't, the DCMS is being deliberately misleading to justify gutting UK privacy law.
Just to be clear, the GDPR requires opt-*in* for any data for which you do not have a legitimate interest - that you means you need consent before you start collecting.
So it's one thing to point fingers and say 'the law doesn't require it' it's another to recognize that's where the equilibrium landed and that at least some kind of problem still exists.
I personally think there's actually a win-win and that we can have our cake and eat it as well, but these popups are a good indication that the laws as designed are not that.
I actually choose my newsletter service based on the fact they were in the UK and therefore compliant with GDPR due to the fact I seen Mailchimp wasn't.
'For the first time, the adequacy decisions include a so-called ‘sunset clause', which strictly limits their duration. This means that the decisions will automatically expire four years after their entry into force. After that period, the adequacy findings might be renewed, however, only if the UK continues to ensure an adequate level of data protection. During these four years, the Commission will continue to monitor the legal situation in the UK and could intervene at any point, if the UK deviates from the level of protection currently in place. Should the Commission decide to renew the adequacy finding, the adoption process would start again.'.
The impact of a loss of adequacy will be significant on UK service providers, as it will become significantly easier from a regulatory perspective to just host within the EU for both UK and EU customers than to deal with the hassle of using UK datacenters.
[0] - https://ec.europa.eu/commission/presscorner/detail/en/ip_21_...
You can probably "thank" the EU for not having to carry around individual LG, Samsung, Anker, Sony, Apple, whoever charging bricks:
It is more costly to maintain separate product lines than to comply.
Most things in Canada are dictated (or influenced) by US standards.
Also, the EU is not quite big enough to force those manufacturers into 'same standard' on a global basis. The US actually might no be either alone. It's entirely feasible they could make $ by using different chargers in 'the remaining 80% of the world'. They don't do it partly for the reg, but mostly for other reasons.
Apple breaks other industry norms all the time for other product features, they do it for hardware revenues, and they can do it because they have market power which nobody else quite has, though maybe Samsung could try.
Why not start with re-reading existing consumer data protection law? I bet there's stuff in there that can be applied and reworked.
We need it to be appropriately scary for companies to abuse data.
The EU basically doesn't enforce the regulation against the US because we're too big a software partner for the rules to apply. I wouldn't bet the UK is going to get the same realpolitik exception.
Edit: Why is this downvoted? What exactly did GDPR accomplish except for making our web experience a mess, both for businesses and users.
1. Marketing consent has now to be explicitly asked for when signing up for any service. Companies cannot enrol you to one if you didn't ask for it.
2. Right to be forgotten. You can request a company to erase all your private data they hold on you.
3. Companies have to legally report data breaches within 72 hours after becoming aware of it.
4. Penalties for companies who do not take privacy seriously.
5. Companies can no longer just hoard sensitive/private data unless they have a reason for it.
6. Selling private data from company to company now requires original consent from the user (this stopped a lot of businesses selling lists for lead gen, call centres, etc)
7. Companies treat private data as a liability now, making them ask themselves additional questions whether it needs to be stored or processed at all, and if so, put additional security fences around it.
This list can go on for ages. I don't see these benefits and additional rights for hundreds of millions people out there as a failure. It's a win win for consumers.
One example is data retention. Previously, data could and and was just keep around forever. With the GDPR, when you delete stuff, you can now expect it to actually be deleted from backend storage, usually within 30 days or less (yes, there are exceptions). This is nice, since it does limit your exposure in case of a breach. Speaking of breaches, they also have to be reported in a timely manner. Without the GDPR or equivalent, companies are free to suppress that as long as they want, and have done so.
Of course, these kind of nuances tend to get forgotten by those who think they can secure better trade deals by spending £200M on a boat [1].
[0] https://www.theguardian.com/technology/2021/jun/28/eu-rules-...
[1] https://www.ft.com/content/c77b7aa1-cebc-47c6-a04a-d21eef2d1...
