GDPR

The campaign says tracking is already prohibited by default, yet deliberately misleading consent dialogs push as many as 90% of visitors to accept while only about 3% want tracking. Its proposed fix is an automated browser signal.

HN’s catch is historical: Do Not Track also let browsers state a preference, and websites could ignore it. The hard problem is not sending the signal; it is making the recipient honor it.

From 7 July, every new car sold in the EU must ship an infrared camera aimed at the driver's face: the Advanced Driver Distraction Warning system. It arms above 20 km/h, tracks your gaze, and beeps when your eyes leave the road for 3.5 seconds. You can mute it, but never permanently.

The thread filled with cars that get it wrong: a Volvo that reads singing as yawning, then nags you for looking at the screen it just lit up. One Ford owner disagreed, saying his system only pings him when he's genuinely distracted, and might save lives.

Cory Doctorow's argument is mechanical, not moral: to verify a user is a child you must identify every user, so age verification is mass surveillance wearing a hall pass. He maps the escalation — checks push kids to VPNs, then governments move to ban VPNs.

The thread tried to engineer its way out with zero-knowledge attestations and device-level parent mode. But a commenter who says he built such systems for the US cut it short: when they say it's for the kids, it was never their idea.

Elkjop's loyalty club made accepting marketing a condition of membership — no standalone opt-out. When Hanff complained, the retailer put it in writing: receiving offers 'is a condition to be a member of the customer club.' That one sentence became the whole case.

On June 1, 2026, Norway's Datatilsynet fined the Elkjop group NOK 20M (~€1.8M), ruling the consent forced, non-specific, and uninformed. Hanff — a 30-year privacy advisor who helped shape GDPR — learned of the ruling via the GDPRhub wiki, almost five years after filing.

The recovery wall offered $5/month or $50/year to 'save $10'. He paid, the bucket was empty, and the cancellation came too late for a refund.

The thread's lawyers had a cheaper answer than the subscription: in the EU a GDPR request forces them to hand over your data for free. And since the site itself claimed to be holding his photos, several readers called it textbook chargeback territory — refund or dispute the charge.

The carve-outs — 30-day retention, exceptions for safety investigations and legal requirements — read as reasonable in isolation, until you remember teams send proprietary code and customer data through these systems.

Two EU practitioners flatly disagreed in the same thread: 'This is not going to fly in EU' versus 'Yes it will — clear purpose, customer agrees.'