My best solution so far is using two Chrome extensions. "I don't care about cookies" and "Vanilla Cookie Manager".

The first one will accept GDPR consent, the second one auto delete cookies from non-whitelisted domain after a certain period (eg. 30 minutes).

Additionally, I have uBlock Origin blocking tracking domains.

But it turns out that 100% OK is still not good enough. This whole thing should really be managed either by the browsers or by an extension and the consent request should come in a standard, machine digestable way (XML, json, what not). You could then just set your preferences once, that should work for most sites and every now and then (but less and less frequently) you'd be asked about what to do with unknown cookies on unknown sites.

In short, just because part of the industry is trying to circumvent regulation and because the current implementation is not the most efficient, we should not give up on the whole idea.

Also, it isn't the law that has been terribly implemented, although that could be argued as well, but rather the fault lies with the companies that do not want to abide by the law.

There are a few easy ways to check if a website is breaking the law:

- Is it as easy to say "no" to the consent as it is to say "yes"? If not, it's not legal, as the consent is not freely given.

- Is the website setting tracking cookies, or tracking you in some other way, before you have made your choice about the consent? If it is, it's not legal, as the consent must be opt-in not opt-out.

- Is it confusing? Then it's probably not legal, as the consent must be informed.

- Is there a button to "accept all" with no clear list of what you're accepting? Then it's not legal, as the consent must be specific and unambiguous.

It's not rocket science, anyone can read it up for example here https://gdpr-info.eu/issues/consent/

You don’t get served any tracking cookies until you agree.

This fulfills the explicit consent requirement of GDPR as well as the requirement for people to be able to use your site even if they don’t accept cookies.

We get much less analytics then we used to - many people just ignore the cookies bar, either knowingly or just because they don’t notice it. But it’s totally worth it.

I hope the EU starts fining non-compliant (i.e. 99% of) sites aggressively, specifically those that pretend to care about your privacy, but don’t really (“Agree” button only).

[1] https://www.soundradix.com/

(you can, of course, serve generic ads instead, if they opt out, or serve generic ads by default and not show a popup at all)

Websites that want to make it easy for me give me a “reject all cookies” button. It is not the fault of GDPR that most websites want to trick you into just clicking “accept all.”

The unfortunate result is that the goddamn GDPR warnings keep popping up, because ironically, the way those websites remember that you either "accepted" or "denied" the tracking request is to leave a cookie, and I don't allow or want to allow that cookie.

EDIT: Separately, there are many websites that only have an "accept" button and no "decline" button. By blocking the modal dialog boxes, I never actually "accepted", and therefore they never got my permission to track. Ha!

"Here's how the GDPR options of an European website looks like: https://imgur.com/a/ckOivi7 "

False, the EU website has an ugly cookie bar with a button called "I accept" that everyone has been trained to click yes on.

"That "Analytics Advertising Feature" MUST be unchecked by default. Only users that actually want to be tracked are tracked."

False, users can be presented with an accept / reject button on a standard cookie bar, clicking accept can opt them into tracking - please LOOK at the EU website example I provided.

"Every "tracking feature" (cookies, fingerprinting, IP tracking, whatever) must be hard opt-in."

This can be done though an accept button on a website that users have been trained to click yes on. My earlier suggestion that folks do a study on how many users navigate into these policies for every website they visit to make fine grained selections if such options are even available stands as well.

"If a website only use functional cookies (colours, session, login, cart, language) they don't need consent, just disclosure (and it doesn't have to be an ugly cookie bar)."

I gave you an example of an ugly cookie bar on an EU website subject to GPDR - I can find many more.

This is the problem with these folks messing the net up. Everyone should do this / shouldn't do that, but no attention to what is actually happening.

I want to be clear, billion of pages are showing I accept buttons, some without reject buttons if they are disclosure only, some with reject buttons that kick you off the site, and some with reject buttons that opt you out of tracking, and users are being / have been trained by the EU alert notices / disclosure only notices (which generally DO have an I accept button) etc to waste their time clicking I accept everywhere.

This is bad for actual user choice, actual privacy.

Failing all three conditions for acquiring consent, my conclusion is that the site is blatantly violating the GDPR.

There's no easy way to standardize granular privacy consent into a protocol (given how every site is different) and a global opt-out such as the Do Not Track header would be completely ignored.

Here's how the GDPR options of an European website looks like: https://imgur.com/a/ckOivi7

That "Analytics Advertising Feature" MUST be unchecked by default. Only users that actually want to be tracked are tracked.

Every "tracking feature" (cookies, fingerprinting, IP tracking, whatever) must be hard opt-in, and the website has to provide an option for the user to opt-out if they change their mind.

If a website only use functional cookies (colours, session, login, cart, language) they don't need consent, just disclosure (and it doesn't have to be an ugly cookie bar).

So cookies aren't the only thing that requires consent - things like browser fingerprinting and even collecting IP addresses for non-essential purposes (aka you can probably claim legitimate interest if you collect them for technical or fraud prevention reasons, but using that data for analytics or marketing would require consent).

This is also why I think clicking "accept all" on the cookie prompts with cookies disabled at the browser level isn't a good idea. You're still giving them permission to stalk you using other means than cookies, and they very well know that. At least use an ad-blocker which blocks the consent prompts completely - technically you never provided permission, so while they might still stalk you at least they don't have a legal basis for doing so.

The GDPR is less about the technical aspect of data collection and more about the intent behind said collection and the planned use for the collected data, something the browser can't really tell.

I'm semi-seriously considering launching an EU citizens' initiative to fix this. Here's how it can work: The EU directive responsible for the cookie popups is (afaict) 2009/136/EC, par. (66). It says cookie acceptance can be a browser setting but does not give details. The EU initiative could extend this to say web operators must respect the "Do Not Track" header.

Do Not Track is a special header that browsers can send to say "I don't want to be tracked" or "I agree to being tracked". It already exists in some browsers - but hardly any web site honors it. If the EU directive would mention that DNT must be honored, then web sites would have no further need to display their consent popups when the header is set.

My problem is that such an initiative would likely require a huge time investment. It needs 1M signatures. That would likely be very hard work.

If the response here is overwhelmingly positive, I might be more inclined to throw myself at this problem. Please upvote or comment if you think this might be worthwhile.

[1] You can read the text: https://eur-lex.europa.eu/eli/reg/2016/679/oj there is a single instance of "cookie" (in the preamble) and no instance of "banner".