@pluralistic
You are promoting their propaganda.

No, they are not required to get your consent. They just aren't allowed to do anything with your data you didn't consent to.

The former tries to imply that the user is required to give consent, while the latter makes it clear that not grabbing the users data is always an option.

And yes, I've seen plenty of cookie popups and emails where the former wording was used to insist that the user must consent.

@pluralistic No, they are not. Said consent is only required for data that goes beyond data necessary for the website to function (and extensive interpretations of that include first-party analytics). And this is not a GDPR-requirement, but an ePrivacy requirement with a reference to the predecessor of the GDPR for what 'consent' means. It is malicious and performative not-quite-compliance.

The obvious way that websites should respond to this is by not collecting your data unless there's a damned good reason for it, but the *actual* response is to repeatedly shove cookie-consent dialogs in your face before letting you use the site.

These are absolutely unnecessary. Your browser can be configured to transmit a "global privacy control signal" by default that tells websites you don't consent to be spied on while you look at their pages:

https://support.mozilla.org/en-US/kb/global-privacy-control

4/