Belgian Data Protection Agency Fines IAB Europe Over Cookie Consent Banners ⇥ gizmodo.com

Shoshana Wodinsky, Gizmodo:

This week, European authorities struck a massive blow to the digital data-mining industrial complex with a new ruling stating that, quite simply, most of those annoying cookie alert banners that sites were forced to onboard en masse after GDPR was passed haven’t… actually been compliant with GDPR. Sorry.

[…]

While the ruling showed that GDPR is very much still in effect, it doesn’t do a lot to explain how blatant some of these infringements were, or how loudly critics inside the industry had been raising red flags. Simply put, when the GDPR asked the adtech industry to get consent from users before tracking them, the IAB responded with a set of guidelines with loopholes large enough that data could still get through, anyway, without consent. And now that these practices are out in the public, nobody seems sure how to make them stop.

Bulk cookie consent banners so obviously violate the spirit and letter of the GDPR, it is no wonder authorities are taking action against them. Unfortunately, the offices in charge of investigating problems and administering fines are so under-resourced I am not surprised it took this long.