transigence

I think there’s a difference here where there’s a reasonable expectation of privacy, and where there is not. Out on the sidewalk, you don’t have one. Selling someone’s CC is a violation of contract law because you do have an expectation of privacy there. So, we have to be very clear, what kind of data are we talking about? “Sharon Thomas visited this site, looked at these items, spent 14.2 seconds looking at that item, then clicked on this link,” I think, is not something you can expect privacy from.
However, there are some things I do think you have an expectation of privacy from, which is the collation and sale of personal information that the customer enters into the site for the purposes of business with that site, like the collation names with addresses, driver’s license numbers, social security numbers (or whatever local equivalents), etc. Another thing is that, and I don’t know if I’m 100% right here, but I believe that when you visit a site, even by typing an address into the address bar, the site you’re visiting is told, by your browser, what site you’re coming from. That doesn’t make sense to me, and that’s not a thing that should exist.

Nonetheless, I don’t think the GDPR is a good fit for addressing any of these issues.

Why? I’m allowed to stand at a street corner and watch people walk by. I’m allowed to count them, and observe the direction they’re going. I don’t need any of their permission to do this. I’m allowed to know who they are, and I’m allowed to tell anyone I want what I saw. I’m allowed to charge money for it, and none of the people I observe are a party to this at all, so why should I need to either not do this, or tell them what I’m doing or ask for their permission to remember what I saw? How is internet tracking different?

You don’t have to give up your rights to privacy to get rid of the GDPR. The GDPR isn’t the reason you have any rights to privacy, nor does it actually effect any. What it effects is an entitlement to be forgotten and to move in anonymity when your identity is clearly observable and memorable. It’s an overreach, and some people don’t feel like dealing with it.

The thing is, if someone makes observations about you, and save that in the form of data, that’s not your data. It’s their data. It might be about you, but people are allowed to observe and sell their observations.

Why do you need a GDPR to protect you? If you don’t want tracking cookies then don’t let web sites write them to your computer. You are in charge of your computer.

Fix your governance and get rid of the GDPR, and the problem will be solved.