The Cost of Unused Data: GDPR, AI, and Europe’s Privacy Bargain
GDPR may be Europe’s most recognisable regulatory export, and one of its most irritating inventions. It changed how companies describe personal data, forced organisations to justify what they collect and gave legal force to the idea that information about people is not free industrial residue. It also became associated with the cookie banner: the repetitive interruption that asks for a choice few people understand and many interfaces are designed to steer. That association is only partly fair. Most cookie-consent banners arise from the interaction between EU rules governing tracking cookies and GDPR standards for valid consent. Strictly necessary cookies do not require consent, and GDPR permits several legal bases for processing besides consent. Even so, the banner captures a real failure of implementation. A system intended to give people control often reaches them as paperwork, while the organisations processing their data acquire another record showing that a box was clicked. A...