@gemlog

No, really, it's the law. Under #GDPR, an organisation must rely on one of seven legal bases for handling personal data. Since no other basis applies to most of what a typical Web site does, it must rely on consent. Since no reasonable person would consent to what most Web sites do, they respond in two ways:

• By being as opaque as possible about the way they (ab)use your data;
• Until a recent clampdown, by using intrusive popups that made it more difficult to deny consent than to provide it.

IANAL, so I'll let you judge whether #consent extracted in this way is valid.

If you click OK to a cookie popup — which would better be termed a consent popup — you are giving legal consent for your data to be abused. It's better, surely, to deny consent at every opportunity. That way, when technical measures fail, you (usually) have legal measures to back you up.

#privacy