GDPR Aftermath

I wanted to write a quick follow up post to what I wrote about our company going through the process of implementing GDPR. While my personal experience of working with this legislation remains the same. It has obviously had an appalling effect on the experience of the web.

I still believe what I wrote last year. The spirit of that legislation is good. It’s trying to do the right thing. And the time is long past where we can actually believe that the human tracking industry can manage itself in any meaningful fashion. Companies that make money by tracking everything you do will not stop, and cannot be trusted to be honest about their activities.

But boy oh boy. What a mess it’s made of the web so far. And the dark UX patterns that these bad actors have engaged in to avoid the spirit of the law while (maybe?) staying inside the letter of it are absolute garbage.

Quantcast is actually doing the right thing here, you can one click REJECT ALL, but they weren’t doing this a few months ago

It has made the scale of the problem evident. Try actually clicking through and individually disable tracking by the 300 or so companies that are watching what you do on any given website. Exhausted yet? I guess that’s the point. These companies have decided that they’ll try and exhaust consumers. Make it hard work to opt out. Except that doesn’t even fall into the letter of the law as I read and understood it.

It’s going to take some massive fines and the settings of precedent to really clean this up. And in fact, that’s exactly what’s happening. What I appreciate about the EU regulators is that they’re not out to try and bankrupt small companies trying to do the right thing. They’re instead firing big shots across the bows of the big players who can absorb these fines. But who still won’t like it. And if you’re a smaller company in this same business then a fine of that size sends a message to the management and board that they need to pay attention and stop pretending people actually want this.

So, what are my thoughts 12 months after this piece of legislation came into force?

• That legislating the internet is hard.
• That bad actors will continue to be bad actors until they’re financially penalised for it.
• That action is going to require policy iteration.
• That we need more legislators with a deep understanding of the technology they’re legislating.