HN Reader

I get that too many regulations is a bad thing. But when we talk privacy and personal data there should be no gray zone. It has to be black and white. When I see a stupid cookie banner I search for "Reject all". There's no some data that companies can collect and process without my consent, they just shouldn't be able to collect anything without me actively opting in. Business never respects anything, but profits. Seeing news about relaxing these laws with the "AI" going after this leaves a bitter taste. And with them also trying to push the Chat Control thing, it gets even worse.

I wish there was a link to the source of this information in the article! I'd like to read the updated version of these laws (if they're public).

How about this as a privacy law: if you collect data about people without their EXPLICIT permission[1] you can be charged with digital stalking. Same principle as stalking; escalating penalties for repeat offenses and for doing so in bulk or en masse.

EDIT: And you cannot share information gained by permitted collection unless EXPLICIT permission to share is granted.

[1] Eg: it's not sufficient to disclose this in equivocal text buried in 25k lines of EULA text.

So they've missed the innovation train due to regulation, and now they are likely to axe the side-effect benefit of said regulation.

What data are cookies providing that browser fingerprinting can't?

From what I can tell, we have to click all these pop ups for no reason at all.

Too late , and it's not just because of the regulations but the whole mentality. This will probably lead to a series of committees about how to scale back the laws which will create new rules which will be put in place, and then the career eurocrats will move on to their next job, without anyone ever being held accountable for the mistakes of the past. Without such accountability every regulation will be excessive, even the scaling-back regulation. Such a process oriented, and feels-over-reals environment is not attractive to competitive business

Does anyone have a link to the proposal, preferably on the EU website?

I'd like to see for myself, as I don't consider moving the consent method from the webpage to the browser settings "watering down" — it's the opposite.

I know the HN rules say the title should not be changed, so its the article's fault, but the EU is NOT Europe.

AI seems like the real deal. I have never seen a technology so quickly and aggressively adopted in corporate america -- every ceo is horny to adopt ai, thinking it will cut costs (read that to mean: "replace you").

They did not have the same fervor for SaaS or cloud, if you recall. You needed sales people for that tech and they were compensated well bc its hard closing a multi year, potentially multi million dollar deal.

But AI needs no sales people to sell its value prop. CEOs have fully bought in. And now, even European bureaucrats, the most bureaucratic of bureaucrats, are loosing regulations. And these are the same group of people who thought cookie banners would help with privacy. Strange times.

> Under the new proposal, some “non-risk” cookies won’t trigger pop-ups at all, and users would be able to control others from central browser controls that apply to websites broadly.

For 'central browser control', what is technically mechanism behind this? Is it something like an entirely new request header sent by the browser? Or re-using some existing RFC? Also curious if the regulation will compel browsers to implement this or something.

Managing cookie permissions at the browser level always made the most sense, but implementing it with regulation is what seems hard.

Now we are fucked too as EU citizens. I hate AI more and more! MY DATA IS MINE. I hate the future. I just hope this gets sacked by the parliament or the judges. If not I need to find ways to keep as much personal data to myself as possible. The internet has become a very hostile environment for real humans and we need to learn to tread very carefully and avoid giving anything to the data poachers. My life is not a resource like crude oil ffs!

Is this related to the upcoming EU-Inc initiatives next year?

Previously:

European Commission plans “digital omnibus” package to simplify its tech laws

https://news.ycombinator.com/item?id=45878311

EU introduces Chat Control, then scales back GDPR, what's left? Digital ID and digital currency (with no possibility of paying by cash)?

Imagine the useful, user friendly, well designed features when business had a big incentive to push privacy

There are lots of principled arguments about privacy versus growth versus monopoly here. But the reality is: for 95% of people in the EU (or the UK), their only direct experience of GDPR is the cookie banner. They aren't going to understand your subtle arguments about whose fault it is; they know that GDPR came along and they had to click on cookie banners. And they (and I) absolutely hate it.

Companies made cookie banners as obnoxious as possible, because they knew that by making people hate the banners, the population would turn against the GDRP

...the companies will be very pleased.

> The changes, proposed by the European Commission, the bloc’s executive branch, changes core elements of the GDPR, making it easier for companies to share anonymized and pseudonymized personal datasets. They would allow AI companies to legally use personal data to train AI models, so long as that training complies with other GDPR requirements.

Put together and those two basically undo the entire concept of privacy as it’s trivially easy to target someone from a large enough “anonymous” set (there is no anonymous data, there only exists data that’s not labeled with an ID yet)

I work right at the junction of marketing tech -- eCommerce, marketing sites, account management systems. Theoretically I should be living in compliance hell, but here's the dirty secret:

To "follow" every rule, all you really need is another layer of UX friction. Another modal. Another "consent wizard." A few toggles buried under Manage Settings → Advanced → Optional → Something You'll Never Click → Opt Me Out.

If you want to be sneaky, add a dark pattern. Make "yes" mean "no." Delay the buttons loading behind some animation, while showing other buttons from the start. (Users will always mash the first one that looks vaguely like "close" without reading anything.)

Or just bribe them, "Get 200 extra points for opting in! Only 45,000 more to redeem a free small drink!" Congratulations -- you're now "compliant.

In practice, GDPR mostly results in one more click. That's the whole impact. A seemingly smart privacy law reduced to just an annoyance tax.

(This is a big reason I run Firefox with uBlock Origin, and NextDNS on my router and phone, with Steven Black's block list. Ha. I do value my privacy, and the more ads and trackers you can block the better shot you'll have at keeping some of it. At least until you go and do something stupid like join a social network or messenger app, or start clicking accept to get 200 extra points.)

* StevenBlack/hosts: Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories. // https://github.com/StevenBlack/hosts

* NextDNS - The new firewall for the modern Internet // https://nextdns.io/

* uBlock Origin – Get this Extension for Firefox (en-US) // https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...

EU's citizens are ripe for the taking. GAFAM, Palantir & co are going for the kill (we hope not like in Gaza)

If the EU passed GDPR despite knowing it would be offensive to the US and big tech, why would they now care that it's offensive to the US and big tech?

The article claims this is because of big tech and Donald Trump. It just states that they have applied pressure. I would love to see more information on how those forces specifically are precipitating the change.

Meanwhile the EU commission claims that this is for the benefit the European tech sector.

>our companies, especially our start-ups and small businesses, are often held back by layers of rigid rules

The latter seems like the more obvious explanation and what critics said about GDPR all along.

That is too bad, I had hope in this case regular people would win and get privacy we deserve. But as always big money wins, it just takes time.

The changes to the GDPR are completely irrelevant compared to what the EU is planning with chat control.

The Commission is completely out of control, pushing through (or at least trying to) vast amounts of awful legislation, while the democratic processes are totally failing.

What this bloc desperately needs is leadership, which represents collective economic interests on a global stage, not some more pieces of legislation trying to control the Internet or putting the entirety of EU citizens under suspicion of raping children.

Shameful decision, caving to foreign capital interests.

Do better, EU.

I see the tech bros finally figured out who they needed to bribe.

Yet again, European countries are showing who their leaders are: US Big Tech

No wonder we default to Google Chrome on Microsoft/Apple systems, and American social platforms, to debate issues affecting EU citizens

I used to live and work in EU, get out of EU before it is too late.

The fundamental problem in Europe is the perception that companies are inherently ill-intentioned, requiring micro-management through massive bureaucracy. It is a moralising and irresponsible attitude that older people can afford to adopt, but like so many other things, it hits younger generations mercilessly hard.

That's a pity, the government fails to capitalize on its own policies because they fail to set up long term investment. First environmental and e-Mobility and now AI.

Sure, there's way too much bureaucracy. But I see there things like taxes, regulations about the cucumber radius etc.

Incredible to see the 180 both from EU and also from the HN sentiment. HN was cheering on as EU went after Big Tech companies, especially Meta. Meta is no perfect company, but the amount of 'please stick it to them' was strong (I reckon that is still a bridge too far for a lot of folks here).

Even extreme proponents of big tech villanery in the US (Lina Khan's FTC) is also facing losses (They just lost their monumental case against Meta yesterday).

What I really want to see is Meta getting irrelevant ON MERIT. People stop using Meta products, and then I want to see it die. But not by forcing the hand - that's bad for everyone, especially the enterpreuer / hacker types on this site

I have mixed feelings about this one. While I was never too excited about some of the unintended consequences of GDPR. That said, I do see benefit of the EU being the world's regulator on these types of things. I don't have confidence that anyone else would do it if the EU didn't. Even for those of us that don't live in the EU (I am in the US myself), I do feel like the EU plays the role of keeping things in check for the rest of us even if we are directly impacted by their regulations.

It's perhaps worth linking to the official EC page on this proposal: https://digital-strategy.ec.europa.eu/en/faqs/digital-packag...

Europe is also introducing Chat Control so that might be why they are moving back.

I wonder if Apple holding back features helped the EU realize that hey, maybe the regulations are getting too onerous. I like to think so.

Anonymization unfortunately is completely broken under GDPR. In principle it providesa clean path for personal data to become usable outside of the restrictions of GDPR, but in practice it turns out to be impossible based on current definitions.

The key issue is that anonymization under GDPR requires that a link to a real person can never be re-established even considering the person doing the anonymization. Consider a clincial study on 100 patients and their some diagnostic parameter such as creatinine or H1bc which was legally collected using consent and everything. Lets assume we would like to share only the 100 values of the diagnostic without any personal data. It would seem quite anonymous, but GDPR would put a simple test if anybody using reasonable efforts could re-establish an identity. And sure the original researcher can because s/he has a master file containing the mapping. So the data isn't anonymous and actually can never be anonymous.

Protecting users in the bargains we strike with big tech is a worthwhile and noble effort, but privacy law has generally woefully failed to do this.

Millions upon millions have been spent on cookie banners -- people are still arguing about them in this thread -- but there is almost zero benefit to this expense.

The main thing that's good about this, IMO, is that fundamentally training a large language model and privacy law as it's written today cannot coexist. They are incompatible. And allowing someone to break the law forever (as is happening today) is not a good long-term solution.

I'm not understanding, as an European who's been part of multiple startups how's that supposed to boost growth.

There's literally 0 startups I've been part of where data protection laws or even the infamous cookie banners have been anywhere near relevant (unless your business was literally profiling).

In fact the actors that most opposed those laws have always been non Europeans.

Sure, there is an attached cost in having your terms reviewed by a proper lawyer and documenting the entire list of cookie providers, but that's basically where it ends. It's really minimal effort and cost, we talking in the low single digits for the review, and few hours of engineering time.

The biggest issues in European growth are others:

- focus on being an export economy while neglecting the internal market.

- bureaucracy to fight at European level so we still don't have a real unified market, neither in physical goods (our economy's backbone) nor services which doesn't allow national startups to scale at European level

- very conservative and risk-adverse mentality. Young people in college can't wait to graduate and find the best paying lowest effort stable job. That's not a problem if it involves a majority of graduates, I imagine all world is like that, but you do have an immense problem if you have 1% or 3% or 10% of wannabe entrepreneurs.

Here's a story about how the mere perception of "regulations exist and are strict" is dragging down my european AI start-up:

Our product makes it easy to capture and share knowledge on the factory floor, which is very important when many of your workers about to retire. Interest is enormous. It is a simple SaaS. You'd think selling would be easy. And it is: In the USA. In Europe the mere existence of the regulations (not what's in them) delays us by 6 months at least per deal.

No european executive really understands what is in the GDPR, and eventhough we are 100% compliant, there is nothing we can do to take away this fear. This means that when we talk to European companies, IT and Legal departments always have to be closely involved, leading to all sorts of political games; each department conjures up non-existing risk by talking vaguely about data privacy, just so they appear important. Half a year later when the dust has settled, the executive buys the product, or their mind has moved to other things.

My point is this: What is in the laws is not important to me. What is important is that current perception of laws turn companies into slugs. I want us to mentally move back to 2018 where we could "just buy SaaS" without worrying endlessly about data privacy. I understand hesitency when it comes to cyber security, but that is not what is slowing us down.

One of our workarounds currently is simply never to mention we use AI.

The news feels bittersweet. With 10+ of experience in healthcare AI, I have seen enough shitty products to genuinely welcome strict regulation for critical sectors; however, this shift threatens to dilute the sense of urgency that was growing in the sector.

We recently built a platform specifically to navigate the complex intersection of MDR (Medical Device Regulation) and the AI Act, relying on the pressure of hard deadlines. By introducing flexible timelines linked to technical standards, the EU risks signaling that compliance is a secondary concern, potentially stalling the momentum... and at this point patient safety is my biggest concern, not our platform

This introduces chaos rather than relief. Companies do not need lower standards; they need clarity.

We can compete effectively against high standards as long as the rules are clear. EU AI Act was clear. This proposal substitutes the certainty of a high bar with the confusion of a sliding scale, which may hinder the industry more than it helps :/

> users would be able to control others from central browser controls that apply to websites broadly.

Great to see this finally. It’s obviously the way it should have been implemented from the beginning.

We still see this technically myopic approach with things like age verification; it’s insane to ask websites to collect Gov ID to age verify kids (or prove adulthood for porn), rather than having an OS feature that can do so in a privacy-preserving way. Now these sites have a copy of your ID! You know they are going to get hacked and leak it!

(Parents should opt their kids phones into “kid mode” and this would block age-sensitive content. The law just needs to mandate that this mode is respected by sites/apps.)

I don't get why people conclude from the cookie hell that "regulations are bad". If those goddamn websites got actual fines for those dark patterns, they wouldn't do it. The EU should just be stricter with the regulations.

They had enough time to push browser vendors to implement an API which allows the user to specify the preferences, so that the page queries the API, instead of the user.

This is a step back. All these years of clicking those banners is now for nothing.

So no more cookie banners taking up half the screen of every website I load?! Great!

From Europe, I agree with big tech getting it. But i dont agree with random flower shop somewhere getting fined because they dont know how to deal with a fcking complicated, ever-changing law that is designed for megacorps who have the cash to just keep paying the fine and abusing everyone. I also dont agree with dealing with fcking cookie banners on every other website either.

The law got SO convoluted over 9 years of interpretation by the European courts that its now impossible to be 100% compliant. It now requires you to give an easy 'Accept' button to accept the listed cookies at the first pop up, but penalizes you if the user actually uses it to accept cookies because the user has to manually go through all the listed cookies and approve them by hand one by one.

So:

- If you dont provide the easy 'accept' button, you are in violation.

- If you do and the user actually clicks it, you are still in violation because you didnt make the user approve each cookie one by one

- If you give a list of cookies to the users and force the user to manually approve what he wants in the first pop up, you are still in violation because its not easy and your easy 'Accept' button is meaningless as a result

And this is just one of its contradictions. The more you dive, the more convoluted it gets. Its a sh*tty law that got more complicated over time and only helped megacorps.

People need to understand that the early days of the Pirate Party are gone and the current crop of tech-savvy politicians that remain from those days are those who made a career out of it. And like every politician who made a career out of something, the only way for those politicians to keep getting elected is by doing 'more' of what they have been doing. So they just keep bloating tech regulation to keep their career, making it difficult for everyone but the large corporations. It must also be noted that some of them sold out and are basically the tech lobbies' henchmen, pushing for American-style legislation to build regulatory moats for big corporations.

We're in post-growth-times, please understand that we need to get all your names and data, so that the Elysium-Cloud can reach, and help you all, the full 8-Billion surrogates ...

Is this one of the initiatives to start syncing with the new 28th regime?

https://en.wikipedia.org/wiki/28th_regime

It's gonna take a decade to roll down all those cookie banners.

I sympathize with the startup argument: heavy compliance costs can stifle early innovation. But the solution shouldn’t be “weaker rules.” It should be smarter rules, clearer safe harbors for small actors, browser-level consent primitives for users, and stronger enforcement against dark-pattern CMPs. That keeps privacy meaningful without killing small businesses.

Related:

Europe's cookie nightmare is crumbling. EC wants preference at browser level

https://news.ycombinator.com/item?id=45979527

Of all the things to yield on, the GDPR really isn't it. The cookie banner problem is one caused by site owners consistently preferring using dark patterns over just not doing the stuff that makes you need a banner. If anything, the EU should have put the hammer down and enforced its regulations on those cookie banners consistently having 'accept all' being the default option and the alternative be more difficult to access.

The central browser controls they mention will hopefully be a more sucessful version of the 'do-not-track' header. An equivalent of that will be fine (although an opt-in version would be better), but it still needs to have legal enforcement behind it to work, which the old one didn't, and the cookie banners aren't feeling.

> One change that’s likely to please almost everyone is a reduction in Europe’s ubiquitous cookie banners and pop-ups. Under the new proposal, some “non-risk” cookies won’t trigger pop-ups at all, and users would be able to control others from central browser controls that apply to websites broadly.

Finally!

I love how you can think about any of these ideas in a really basic way like a 5 year old and you'll know intuitively that it'll all fail, particularly if you invert it:

for example:

- bureaucracy creates less bureaucracy

- price controls create more supply

- adding more rules creates more freedom

- government is good at understanding technology

- the more people you have the better your decisions will be

- the further someone is from a problem, the better they can solve it

etc

It's crazy how many adults think regulation is free, especially here. All consuming vague regulations like GDPR increase the cost of a startup by 500%. Europe should have just banned startups entirely. It would have the same effect.

Imagine being a college student with 240 hours and $1,000 to release an MVP over the summer. How long would it take to read GDPR yourself, 100 hours? How much would it cost to hire a lawyer verify that your startup meets GDPR guidelines, $5,000? It would be almost impossible for any young person to start a business. GDPR was obviously a failure from the start. Anyone who couldn't see that has a child's understanding of business. Grow up.

About time. Startups and innovative business simply cannot get investment when there's the constant risk of a new AI Act massively increasing compliance and legal costs.

But it's not enough - they need to completely repeal the DSA, AI Act, ePrivacy Directive, and Cybersecurity Act at least. And also focus on unifying the environment throughout the EU - no more exit taxes, no need for notaries and in-person verbal agreements, etc.

There's just so much red tape and bureaucracy it's incredible. You can't hire or pay payroll taxes across the EU (without the hire relocating) - that's a huge disadvantage compared to the USA before you even get into the different language requirements.

Europe should make business registration a single one page one step operation first.

There are dozens of stories how registering a business alone can take several months and tons of paperwork.

This is such an important change for Europe. I've worked with 100+ start-ups as a consultant, and I've talked to EU ones who have been strangled by some of the regulations.

Europe has no chance to compete with the USA and China. I'm European and I can only see ineptitude and corruption everywhere.

Poor Europe - lobbyists make sure that Europe stays weak.

That statement includes Ursula by the way.

> The proposal now heads to the European Parliament and the EU’s 27 member states — where it will need a qualified majority — for approval...

Not a done deal.

People here act as if GDPR was some kind of big reason why all the digital tech is from US. But come on it's not like the game hasn't been rigged forever. To be more specific it's been part of the deal with europe being close US ally. None of the european digital tech is ever supposed to be relevant. And in case some european digital tech is relevant it has to be absorbed by US or at least made to look irrelevant so nobody sees or cares about it.

If anything this recent lobby and political pressure to remove GDPR/AI laws is there to help US in time when it needs it. To allow some US big tech software to sweep in exploit what they can and help to keep the line up as much as possible.

But if you really look at digital tech in europe... it's doing fine. Why? Because making software and compute is cheaper every year to a point of nothing. It's hard keep insane growth in that environment. Sure if you make some unique breakthrough (like AGI) then tech keep going again. But what if not? Then you just have to squeeze everyone more including your allies, especially your allies.

Good, GDPR is useless for the consumer as 99% of the people click "Accept everything". It's only a few of us who care about this kind of thing and we shouldn't have policy made for the 1%.

I hope the changes they implement will actually benefit small startups instead of relaxing regulations for large data hoarders.

Does this mean fewer less-annoying cookie pop ups?

Remember that at its core GDPR was to harmonize privacy laws around the EU to ease the transfer of data between those countries.

But that extra click to read any webpage was keeping me safe

In comparison with healthcare information systems the GDPR is really not that hard to follow. You can get guides for business owners which can be read and understood in under an hour.

If you design your system according to the guidelines you usually end up with a product where it's easier to service your customer (eg. with full account exports). Deleting inactive accounts is great because it means less migration headaches in the future.

This is also why our privacy statement starts with "We […] don’t really want your personal data."

>One change that’s likely to please almost everyone is a reduction in Europe’s ubiquitous cookie banners and pop-ups. Under the new proposal, some “non-risk” cookies won’t trigger pop-ups at all, and users would be able to control others from central browser controls that apply to websites broadly.

Wait, what? So they are now mandating browsers implement this? Also, something bothers me about the conflation of regulators changing the regulation (accurate) with regulators changing the thing that resulted from the previous version of the regulation (inaccurate). They arent getting rid of the cookie banners. They are changing the underlying rules that gave rise to them. It remains to be seen what the effects of the new rules will be.

What about GDPR is "scaling back"?

This sounds interesting and all but I'd like a more technically informed source than The Verge to judge whether the headline is accurate:

> One change that’s likely to please almost everyone is a reduction in Europe’s ubiquitous cookie banners and pop-ups. Under the new proposal, some “non-risk” cookies won’t trigger pop-ups at all, and users would be able to control others from central browser controls that apply to websites broadly.

That's nonsensical. The GDPR doesn't require "cookie banners and pop-ups". Obtaining consent for things you can't do without consent does - if you insist on handling it that way. And "'non-risk' cookies", i.e. technical cookies required to fulfil the functionality requested by the user (e.g. maintain a login session) definitionally don't require consent and thus no "pop-up" or "banner". So what is the actual change here?

The AI bubble is so big at this point that this just feels like coercion/bribery induced.

Come on, AI needs data, relaxing GDPR brings more data.

The question is what AI will do with these data and whether giving away privacy is good.

There is no transparency or trust and for this reason I want to keep my privacy.

But now, I am robbed out of this based on majority votes and not common sense.

While this is being done to boost corporations, it also must be said that GDPR just did not work. It became impossible due to constant reinterpretations and decisions of the Eu courts over time. Big corps just violate it by counting the eventual fines as a cost of doing business. Small corps and individuals get shafted. It ended up like the 'regulatory moat building' that so frequently happens in the US.

Cowards.

A mostly philosophical comment:

I would say something like "the issue is that 'people' are underestimating how many ugly characters there are, in the private as well in the corporate spheres" but that doesn't mean much anymore because people adapt against their interest just to display competence. "Ugly business practices" have become the norm.

It even trickled down into culture via funny little behavioral nudges like "nett is das neue Scheisse" (German for something like “Being ‘nice’ is the new way to be awful.” or "Nice is the new toxic." but mostly meant to say "Politeness is the new bullshit."). I'm quite certain it was a clever mid-term Machiavellian marketing play which paved the high speed Autobahn for the Right Wing and faux-cause refugee aid and further downstream also the acceptance of misinformation about the escalated and long ignored civil conflict in Ukraine. But that's a long stretch and beside the point.

Regulations serve to keep the balance. Rules can be broken. Linguistics and just being a horny fucking human create more loopholes and blind spots than anyone can count and this dynamic evolves and becomes more complex.

When it seems like you have to choose between a police state and a state which allows "AI companies to legally use personal data to train AI models", meaning unrestricted, unhinged economical practices that will have it even easier to get into teen heads and all the minds who just don't have the time and energy to evolve after a 9-5 day to raise their kids with abilities to defend against all the ugly bullshit that ugly business practices use to advance their proprietary propaganda(s) while the civil weight that is supposed to balance and positively offset the resulting negatives--the counter-movement, the counter force--is reduced to a motherfucking s k e l e t o n that our current civil society is, which can barely hold it's own few pounds, because too many people are busy being more productive and efficient or are numbing their brains with some drugs or meds and doom-scrolling or something with the content-creator economy or something else "with media", meaning when they are literally working for the other side against their own interest because it's cooler, then we all will get both, a police state with a subscription model for tickets out of jail, court as well as an economy that doesn't have to nudge and prime and co-evolve with customers, workers, employees, citizens, people anymore, because the law permits reverse lobotomies, marketing campaigns that create new needs and new desires via straight injection into your brains, including all the good PR that turns the bad PR into nothing but showmastership.

Our intelligence agencies, police and judicial representatives of the people are constantly looking away because citizens don't point the spear at what the tip already knows. Our law and the maintainers of justice should have evolved to investigate way more than they have done and they continue to disappoint.

The people have been misinformed, deceived, nudged, primed, exhausted for decades and with inter-generational effects, where the old don't defend and protect the minds of the young and the young then hijack the minds of the old or tire them out additionally and vice versa. Everybody just thinks or feels and perceives that "this the world", "this is the way" when it's the opposite, the absence of critical thought in your own interest. "They" (whatever that means to you), are selfish against all your interests while selling you their interests and how they want you to be.

Dramatic emphasis: THERE MUST BE BALANCE. And shoving the people back on the right side, not by moving them directly, which would be "fiddling with them" as much as ugly corporate and smaller business people do, but by offsetting and countering, HACKING corporate "dark patterns", ugly business practices (and I don't mean shiny buttons and countdowns), for HACKINGS sake.

If I hadn't been fucking poisoned and spiked god fucking how many times and had my brain been capable of recovering from that shit a bit fucking quicker, I'd be on the fucking frontlines of all that obvious, ridiculous fucking shit. I don't believe so many of you just roll with this shit because you are ok with it. How is all that not exactly the hacking challenge, the systems design challenge you are looking for? So many are doing so much on small scales and with tiny projects. Where is the hell is the weight. It has nothing to do with behavioral locks. You can remain in that lock, the world has chosen. BUT THAT IS NOT IT.

There are a lot of you who know and see and who were not poisoned and whose feet were not fucking poured into concrete bullshit and walled in by a jealous wannabe-fathist-coping-with-inferiority-instead-of-actively-evolving-others-to-evolve-their-offspring pthycho-thothial environment ...

"I don't care, I'm just doing my thing, you know ..." (which is not his thing but it got him that marshmallow and there's this thing previous generations, who believe that "history repeats" while the people writing it advance their interests, can't teach you because it's covered in new language, memetics, symbols, which are hidden behind misinformation enough other, slightly younger people are perfectly aware of but keep lying to themselves want their abilities enable them to do, but they are just doing their thing, which is not their thing but it gets them that marshmallow ...) only leads to the propagation of proprietary agendas, the results of which, if not offset properly, will be disliked adequately, way way way too late. I don't know what means exactly, but I know that enough of you have those conversations all the time and a lot of it was spelled out in various books; in fiction, science-fiction and more than enough of it in historical and current non-fiction.

I'm just wondering.

I could have said something about constraints, self-organizing systems and organic emergence of cultural phenomena via the non-linear propagation of imperative regulations between co-evolving colonies that are reaching for a state that maximizes the architectural potential of all areas of civilization for the sake of the minimum amount of conflict necessary to ensure survival and thriving in a changing world, which requires just enough friction and oil to keep the temperature down, but you all know that.

Someone smart, published, internationally recognized, and with humble origins in a current or former war zone, I believe, once noted that the middle class/ middle working class needs be heard so that their perspective can be accounted for when dealing with and for a world--and future, full of uncertainty, colorful swans, emerging and re-emerging constraints, calculated probabilities of instability in the various areas affected by climate change (the fact, not the debate), and so on ... well, above are some bits to start with.

The sentences "What the fuck are you serious? Give my kind time and the peace of mind to raise my children in a way that offsets some of the bullshit systematically taught in schools off-curriculum and they will help you. You need help. This is wrong, pathetic, only funny if you are drunk or drugged and in a particularly sassy mood that makes even the help- and hopeless feel cool and powerful. If we did our jobs like you do yours, everything would burn." kind of sum up some more bits ...

While they are at it, the EU should also correct another sh*tty law: The Digital 'Resilience' Act (or whatever it was) that holds the Open Source developers responsible for unlimited fines for security issues in their projects.

The Open Source community fought it, and thought that it won a concession, but it really was not a concession: The Eu commission will 'interpret' the law. So it will be interpreted politically - or worse, lobby-driven - with every other Eu commission that takes office.

The law does not allow you to make any kind of income from your open source project in ANY way, and basically forces you to be free labor for megacorps. Charging for support? Responsible for fines that can go up to millions of Euros. Charging for 'downloads'. Same. Licenses? Same.

It looks like this was another law pushed by Eu big software lobbies: Cripple any small player that may be a competitor by building a moat against small players and those pesky Open Source startups that may challenge your online service, but still keep Open Source developers as the free labor for your company's infrastructure.

The tech legislation landscape in the Eu has been co-opted by Eu megacorps. Like I said in another comment, we arent in the early days of the Pirate Party anymore. Now career politicians and sold-out lobbyists make laws to protect megacorps. Therefore Im against any new tech legislation from the Eu, despite having been an early Pirate Party advocate back when even using the word 'pirate' put you in legal trouble.

Does this mean that whois information can come back? The destruction of the whois databases by GDPR really made the internet a more closed, proprietary place. No more could one just contact the people behind any domain and communicate... pretty much impossible after GDPR came into effect. Especially if you don't use twitter/corporate crap.

The GDPR somehow had the power to make (almost) everyone comply with it, even outside of the EU. If only they had specified that instead of banners, companies had to actually respect the Do Not Track header, even if set by default on a browser, and everything that could be rejected would be rejected if that were sent.

The cookie banner is the superficial part. The meat of it is how user data is collected or not and stored or not. Rolling this back would be a catastrophic defeat. Perhaps if there were an automatic cookie preference browser API that could automate the user experience it would be better for users.

Let me steelman the new proposal a little bit:

You run a merch store. You want to share with your suppliers order data so that you can get the right number of sizes/colors/etc. Is this PII under GDPR rules? Technically, yes! Not only is there information on gender, but also people's height and weight and maybe even family makeup. Does it make sense to call this data sub-processing? Eh? Maybe? (To my knowledge, I don't know if any examples like this actually caught any enforcement.)

Under the new proposal, sharing this data is okay, so long as you use pseudo-anonymous identifiers (customer-1234, customer-1235). You still can't share sensitive identifiers (name, address, email, login, etc).

Obviously the elephant in the room is AI and training data. But this also simplifies a lot of the ticky-tacky areas in GDPR where PII rules are opaque and not-consistently enforced anyway.

The EU is a great example of a spineless paper tiger to Big Tech and is the reason why AI startups run to the US.

Promoting degrowth is the best way to lose the race and the EU have finally admitted that they got it completely wrong.

It would have been nice if we instead had actually enforced these rules and given the world an alternative digital regime. I suspect it would eventually seem quite attractive to most.

"Well, you can say what you like but it doesn't change anything 'Cause the corridors of power, they're an ocean away"

https://www.youtube.com/watch?v=Xpo2-nVc27I

The issue isn’t too much regulation. It’s that an organization such as eu cannot adapt

> if the development of the GDPR and AI Act are anything to go by, a political and lobbying firestorm is on its way.

No doubt that now the flood gates are open, powerful interests will do everything they can to water down the protections even more. This is already bad enough as it is.

Big mistake

I'm sure capitulation will teach the surveillance racket a strong lesson.

Hold the line. Don't make the same mistake we did in the US. Your data is your data.

the consequences of their laws is pushing their hands

Well, that's a bummer.

Despite the sentiment on this forum that EU regulations are hindering tech progress, Europe is one of the few places in the world that actually tries to keep tech companies on a leash. We need much more of that, not less. The GDPR and the AI Act are far too weak, IMO. We've seen that fines when companies step out of line are simply the cost of doing business for them. Tech oligarchs should be getting jail time for every infraction instead.

I'm not too concerned for myself, since I don't trust any of these companies with my data anyway. But this is bad news for the majority of people who aren't tech savvy, or simply have "nothing to hide".

We know what happens when we let CEOs run a country. The last thing Europe needs is to follow USA's lead.

Given that they were largely ignored anyways, who cares? Laws have become almost meaningless, in a world where power lies within companies and not governments or the public, which anyways has been trained to either act against their own interest or disillusioned enough to largely don't care.

The only space where there's still laws from people is in the social media world, where the outcome are laws that don't change the life of anything but make you feel good. Eg. minorities, women, etc. still have low income, bad life outlook, etc., but hey now you need to clearly state that the programmer job is also for women and trans people. Assholes can be assholes as long as they use the right pronoun, whole industries thriving on lowering the baseline (delivery, etc.) of what humane treatment at a workplace is celebrate and pinkwashing. Everyone is "happy".

Also on the ecological side. Laws that that would change something fail, but everything that can be exploited in terms of taxation passes - seriously look at summaries on voting on directives. It's completely split at this line, and all the "liberals" celebrate how great they are for driving essentially tax funded electric cars.

It's no surprise that companies reacted by making the most obnoxious cookie banners instead of removing the need to having those in first place (fun fact: you do NOT need those for cookies at all). Whenever you read a "We care about your privacy" that is an outright lie. If they even remotely did there would be no need to have such banners. Even for much of the more shady stuff you don't need to. And still most companies don't even adhere to the GDPR. They just have a meeting do pick some pieces and forget about it.

Democracies sadly have become a real farce. I think the world has over-optimized for it, companies have "min-maxed" for the current set of laws and now well intended laws are effectively meaningless, cause smart people came up with nice hacks to not really have to care about it. It's just like a video game, where people realize that your skill set is nice, but you can just max out DPS and bring along a tank, where you realize and realize that the debuff on your armor doesn't matter if it doesn't hit you and where the penalty on item costs is meaningless because you don't know where to put your money anyways.

And honestly, finding such strategies to optimize for "just not breaking the law" or getting around it entirely is extremely fun, compared to all the boring work at a job.

What people used to call "honest work" just doesn't work outside of very localized and small scale setting, and even there it's hard. To compare with video games again, it's like all the "soloing is possible" and yeah sure, sometimes it works, but if the big guys decide to crush you they will. So best to join up with them which is exactly what is happening.

We also see that in other laws. Monopolies are forbidden? Well either keep at least one competitor alive (iOS vs Android, AMD and Intel, etc.) or make a cartel, even a completely passive one where you just do "market analysis" to have a similar price. If your competitor raises prices, it is your job to adapt your prices to increase profits. If your competitors use cheaper materials, etc. it's the same. You never ever need to interact with your competitors.

Working together in one way or another is what made humans really productive, it works well for companies, yet somehow there is that believe that magically this won't happen and instead it's all fierce competition, which is ridiculous when the biggest threat to large successful companies is literally the market changing. So they just take safe bets and buy all the smaller largely already working products and call it innovation on their side.

It's a good, smart, reasonable strategy. But it's also very obviously not as intended.

The thing is that big surprise, it's the same for privacy protection laws. Companies don't care about your privacy at all and most people are in fact ordered to store data just to have it. They make sure it's annoying so both to make you accept them and to complain about the law. It's a real farce to think that somehow people, governments, etc. think that companies (at large) are nice and just want you, the world and everyone to be good and happy. It is baffling that people really believe that and somehow always think their favorite brand is magically different, because they met a nice lad working there in marketing.

Is EU suffering from FOMO?

As an EU citizen, this is shameful and even kind of pathetic to read.

Will we start outsourcing all our IT needs to USA again?

> The EU folds under Big Tech’s pressure.

This is a very odd framing, because the actual reason from quotes in the article is that the EU is acutely feeling the pain of having no big tech companies, due in part to burdensome privacy regulations.

The pressure isn't really from big tech, it's from feeling poor and setting themselves up as irrelevant consumers of an economy permeated by AI.

@complaintvc on X has been doing amazing work in this area.

The EU, especially the EU post 2008, seems to be infatuated with regulation it has likely bitten them with their lackluster GDP growth and their very lackluster AI developments.

I suspect that this is too little too late, and more importantly I highly doubt it signals a shift in the biases/incentives of the EU regulators. The second the scrutiny is off of them they will go back to their ways. It is their nature.

(I look forward to the loss of karma. I hope that the link to @complaintvc at least makes a few people chuckle).

Are cookie banners going away anytime soon? There is no law more ‘European’ than this one.

Europe learn the hard way that you cant have a cake and eat it too

GDPR was never about privacy, but to legitimise data trade. It was two step process - first train people to Agree to anything by introducing "harmless" Cookie Law, then once people just click Agree to anything, create legal basis for data trade, where it is no longer a grey area as most users give consent. With Chat Controls coming back, never assume EU is doing anything for the benefit of general public. What is particularly bad, is that they are not honest about it, just keep gaslighting.

This is criminal.