> This is FUD, proportionality is used when calculating penalties
Can you point to where in the law that guarantee is given? Furthermore, given the previous penalty was "none," any penalty can probably be considered significant for website operators who were previously assuming nearly zero risk in running their sites.
Paragraph 1.
> Each supervisory authority shall ensure... in each individual case be effective, proportionate and dissuasive.
Paragraph 2. a)
> the nature, gravity and duration of the infringement... as well as the number of data subjects affected and the level of damage suffered by them
Also, as we are discussing this, a lot of this will now apply to CCPA and (in some cases) COPPA
> Also, as we are discussing this, a lot of this will now apply to CCPA and (in some cases) COPPA
Yes, and COPPA has terrified YouTube content creators.
Wiggle language like "proportionate" (especially when paired with "dissuasive") doesn't assuage the fears of website admins, because it isn't a dollars-and-cents (or, in this case, euros) amount. It's at the behest of a judge, which is not a risk space an admin (particularly one running a site as a secondary function, not as core to their business model) wants to take on. So the law, as structured, encourages those popups everywhere forever. Annoying, to say the least.
I don't think I'm spreading the FUD; I think the FUD comes from the ambiguity in the penalties described in the law itself.
I'll just add that: if they're so worried about the "huge penalties" why are they taking the cheapest way out and using the first non-compliant popup they came across instead of trying to understand the law and come up with an actual solution?
Probably because nobody's gotten sued for using the same banner yet. At the end of the day, this law has added a burden very few web site admins wanted; they don't want to understand a law to provide content on the Internet (especially when that was unnecessary only a few years ago, and especially when it isn't perceived as adding value to the user experience). I'm not surprised if people try and do the minimum legally necessary to comply with its ambiguity and pray they don't become the test case to resolve that ambiguity.
The GDPR does not require continuous confirmation of consent, only that they're allowed to withdraw consent at any time
> The GDPR does not indicate a shelf life for consent. Theoretically, a person’s consent is indefinite,
https://gdpr.eu/gdpr-consent-requirements/
> since the penalties are significant if small sites
This is FUD, proportionality is used when calculating penalties