An exageration, but in aggregate, the time wasted on this by users having to close yet another pop-up (and being more reluctant to browse new websites), and providers implementing the functionality on their websites is not negligible.
I hate the consent popups, but to me they signal something different to me than I think perhaps they do you or the parent commenter.
Bear in mind:
- Extra data collection or processing must be opt in.
- Not opting in must be as easy as opting in.
- The content must be available if the user chooses not to opt in.
Then:
For instance, you go to a site, tumblr.com for example. Why is not important. You get a consent popup. Opting in to extra data collection is easy but you don't want to. Navigating this consent popup is almost impossible. within a few clicks you are lost, you find a list of several hundred "partners" tumblr wants to share your data with. All are checked and need to be individually unchecked. You still can't work out how to opt out.
To me it's like someone's trying to scam you out of your data. They are so desperate to get your information that they are jumping through all sorts of hoops to try to trick you into giving it.
Do I really want to give my data so an entity that is acting so creepily? Nope. I close the window.
Both these time wasters are on website providers. If they stuck to collecting only what they need to provide the service, they wouldn't need to ask for consent. Alas, they're greedy, but then they don't get to complain.
How much time and effort have gone into compliance, it's insane. That's measurable. The real cost is the delay to new projects, uncertainty, increased costs - its what we wont have...
But the flip side is we get back control of our data. Having to treat users data and privacy with respect seems like a completely reasonable thing to ask, and it takes you longer to create something because you're now having to do that then that's good right?
It being inconvenient to you to treat people's data and privacy with respect seems like something it's hard to feel sorry for.
It's not about treating it correctly, it's about worrying about vageries in the law and complying with them.
Of course information should be protected, but there are all sorts of compliance procedures and processes that significantly increase complexity and cost.
Asking for consent doesn't significantly increase complexity and cost. The required level of audits to support a world without asking for consent - now that would increase complexity and cost.
And no, not asking for consent and collecting data without supervision is not an option, neither legally nor ethically.
The cost of compliance is directly proportional to the amount of personal data you're processing.
GDPR compliance is usually expensive because people ignore Art. 5.1.(c):
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)
If you choose to collect personal data, you're responsible for handling it with due care. If you don't want that responsibility, don't collect the data. If your business model is predicated on doing shady things with personal data, find a different business model.
I know some people in adtech, and the time they spend on "compliance" isn't really a very big chunk of the total time spent on why they need compliance in the first place.
But I'm eagerly awaiting your measurements ...
Truly. Even if it shows the really big numbers you seem to imply. Because that shows something about their choice. How much trouble they're willing to go through to track you regardless.
