Well yes I would say they are doing an admeriable job and fines websites that breaks the GDPR rules regarding providing a clear yes or no answer regarding the question of collecting cookies.
What would you do differently? Outside of banning cookies overall
You are not going to like my answer, which is to basically outsource data collection to the entities best suited to them - Meta, Google, maybe even Apple. IE: The exact opposite of what the EU is trying to accomplish.
I also doubt that the majority of users have the discipline, time and motivation to read through every single privacy policy or data declaration and jump through the hoops necessary to buy a ticket or reserve a table while figuring out the precise set of options necessary to do so without losing control of said data. More often than not, they just hit “Accept” to everything and buy the damn ticket.
So the unfortunate downside to all those countless pop-ups is that they have pretty much desensitised users to just blindly clicking the “Accept” or “Okay” tab in a bad to quickly dismiss everything so they can get on with whatever task they set out to do.
Honestly speaking, much of this data is largely useless to the majority of websites, since they simply don’t collect enough for it to be worth anything, and the reality is that much of that information tends to be necessary for a normal website to operate anyways. But at the same time, you don’t want them holding on to it.
So if you want to avoid a scenario where the email address that you keyed in to create a new account on a website just to be able to order something from them ends up getting leaked as a result of a database breach or you being subject to an endless barrage of email circulars, wouldn’t the best scenario then to be to fall back on “gatekeepers” which basically aggregate all these services and abstract away all of these processes?
The problem I feel with EU regulation in this regard is that while they may have identified a legitimate problem (excessive data collection), their solution often just locks in the status quo, and it may not even result in a better world when all is said and done.
Contrast this with the US tech companies, which often win because they address a problem by offering a genuinely better experience both for customers and businesses. The problem seems to stem from an assumption that users are being locked in against their will, and that given a choice, they would want to make a decision that the EU wants them to make, whereas in reality, we are where we are today because aggregators do offer a legitimately superior user experience, and people simply don’t want to change.
For example, instead of creating a new account on a website so I can purchase an e-book, I instead use sign-in-with Google or (ideally) they let me make payment with Apple Pay directly and I skip the account creation process and never have to hand out my data (I can even create a dummy email account using sign-in-with-Apple so my actual one never gets compromised). It’s similar to how (I am sure) many of you have a dummy gmail account that you use to create accounts with and is basically overflowing with spam.
The same can be said for apps. You want a central marketplace that’s actively being screened, where developers never get your payment details and subscriptions can be tracked and managed centrally, that’s the iOS App Store for you.
Likewise, Amazon lets me purchase anything online without having to deal with individual websites. Want to book a ticket or reserve a table at a restaurant, isn’t there an app called OpenTable for something? How do you avoid having to register for multiple online forums or worry that you may not find enough members to sustain interest? You post on Reddit.
Regulation can only go so far in these situations, especially when you are dealing with human nature in these scenarios.