But did you actually try to find a better bank not sending your data to Facebook? In EU, these should exist.

I see, its better than nothing indeed. The only grief you can cause them that actually matters is moving your money though, but I'm not sure there's any bank that doesn't do similar tracking.

> My gut says that practice (or at least its breadth) stems from a misunderstanding of the legislated requirements.

Sorta yes. The "cookie law" is the EU ePrivacy Directive (not the same as the GDPR, it predates the GDPR by around a decade) and doesn't directly talk about cookies. Rather, it talks about any means in which a remote server can store data on your PC (which includes cookies, but also things like LocalStorage - the law is resilient to innovation).

Basically if you want to store data for things that aren't obviously necessary to provide service, you need to ask for consent to store this information (getting consent for using and sharing information obtained by using these cookies is a separate matter, that's what the GDPR is for). So a shopping cart or a session cookie don't need consent banners, since those get filled out in accordance with things users expect (if you login, it's expected that the site knows who you are in future requests, if you add an item to a shopping cart, it's expected to be kept somewhere and to be cross referenced. Rejecting a cookie consent banner can also place a cookie for this same reason; users expect to not be shown that popup again if they said no.)

Cookie banners are effectively an attempt to maliciously comply with this directive combined with legal paranoia. The second one is easier to explain; if you need consent to store some cookies, then legal is just gonna tell you that you need consent to store any cookies, no matter how trivial. This is standard legal paranoia, which leads to sites that don't place tracking cookies getting consent banners.

The first is more malicious; browsers can send indicators to servers that they don't want to be tracked at all. That's the DNT header or the GPC header. They are basically the same thing, except the GPC header allegedly has more legal backing - to my knowledge there's no evidence that DNT doesn't work for this purpose and in fact, GPC is worse at protecting against tracking. GPC only opts out against selling data, DNT opts out against tracking for any purpose whatsoever.

Advertisers habitually ignore/use these headers for fingerprinting, but a German court has decided that the DNT header has full legal backing as a "I don't want to be tracked" indicator in a case against LinkedIn and that spamming users with consent popups if these headers are present is essentially pestering them to relinquish consent that isn't going to be given. The GPC Header has no such protections, but might be more amenable to the (worse) Californian privacy laws. Advertisers and other companies like to pretend that the DNT header has no legal backing, but it does. Cookie banners could entirely be handled on the browser side, but browsers and advertisers refuse to take this idea seriously because it'd lead to mass rejection of tracking. (Due to perverse incentives at this point; both Mozilla and Google own/are ad companies respectively. This is why Mozilla quietly killed the DNT header at the start of the year, in favor of the GPC header.)

With GDPR it matters how countries incorporate it in their law and that doesn't work in practice.

>>GDPR actually says that it’s illegal to condition content or services on the acceptance of tracking

Good intentions, doesn't work. You call a bank, they read a contract to you for 5 minutes you spot some sharing with partners (who knows who they are) there, you try to protest saying "ok but let's make sure it's not for advertisement" and the answer is "I can't do anything that's the contract you either accept or we can't open an account for you".

>>This is very easy for a layman to understand when reading GDPR.

What matters are laws of specific countries that implement it and what results are in practice. That's why I wrote about good intentions and real effects.

>>What your bank is doing is clearly illegal.

And there is nothing I can do about it.

Please re-read what you’ve written in these two comments with a critical eye. You’re speaking from a lack of knowledge without very much care and reaching incorrect conclusions that agree with your initial bias. When someone else does the work of helping nudge you towards reality you seem to be doing a poor job correcting. Sorry if this comes across as rude, it’s said with the kindest of intentions.

> big tech it does not own

If a company does business in the EU, it's dealing with EU citizens, giving the EU jurisdiction over how that business is conducted.

The EU absolutely has full legal standing for this; if big tech doesn't want to abide by it, they can always leave the EU.

American companies get fined more often for the simple reason that they break the GDPR more often since the US lacks the same legal privacy framework, which means they don't have the same incentive to comply with it and instead try to rules lawyer around it.

> Still fits the theme that EU is using GDPR to shake down big tech it does not own.

It's not a shake down, it's the fucking law which they don't follow and have to pay fines accordingly. Every single business in the EU has to follow these laws, if the US-based ones are not taking proper measures to not act illegally that's on them, not on the legislation, this shake down narrative is quite tired by now.

> Again just a rough feeling from the list but I would speculate that over 50 percent of fines in total were towards US or non-EU based companies.

Perhaps because the US companies are more eager in breaking laws and figuring it out later? Isn't that the whole take on EU vs US business approach, the US ones are big risk takers (including in acting illegally) vs EU ones being risk-averse?

I feel disheartened that this narrative is still spewed on HN, it's just vitriol, the US companies are breaking the law of EU members, if they do business here they need to follow the law, it's absurdly simple.

"Still fits the theme that EU is using GDPR to shake down big tech it does not own."

No, the EU is trying to protect the rights of its citizens.

If they wanted to "shake down big tech" they'd just do a Turkey or India and pressure them to do their bidding in terms of censorship and information exchange.

I've done it twice and was paid the compensation, but both times were normal airlines, not budget carriers.

I used to fly out out GBG which only has few flights to the intercontinental hubs per day. So it happened to me quite frequently that my incoming intercontinental flight was late by 1.5h which resulted in a 5-7h delay because I missed the connection. That entitles you to 600 euros. After my first 2 trips I quickly learned that for flights into Europe it's only European airlines that have to pay those fines (outbound flights it's everyone). I probably collected around between 4k-6k euros because it happened so often.

I never used one of the "collection agencies", because it's an incredibly easy process to do yourself. Yes some airlines try to wiggle out of it, but you just threaten them with going to arbitration (I think that's what it was? I've moved away from Europe several years ago), and show that you know the rules and they quickly let up, because IIRC they get fined (not just your compensation) if they get found to be in the wrong.

Lufthansa surprisingly directly issued 250 euros to my mom for a delayed flight after filling out the passenger name and flight number on a site provided by their chatbot, which also explained how to use a 20 Euro food voucher they provided directly. It was very well made imo.

The EU has really put their foot down when it comes to these claims. There is no legit delay or cancellation. Either I'm there on time or not. And if I'm late or the flight is cancelled then the carrier will reimburse. This seems o work pretty well these days is my experience.