Fixing data privacy consent: the GDPR seven years after

The General Data Protection Regulation (GDPR), the "constitution" of EU data market regulations, sets legal standards for the definition and handling of personal data. Seven years after it entered into force, researchers have accumulated considerable empirical evidence on the economic costs. In particular, data subjects consider data access consent banners, that pop up relentlessly when surfing the web, a nuisance rather than a useful tool. Enforcement of GDPR consent standards is very weak. Private intermediaries exploited this gap to launch tools to facilitate handling banners and nudge users towards agreeing to share their personal data with vendors. The European Commission's Digital Omnibus proposes changes to the GDPR to reduce the cost of consent. This panel discussed market and regulatory failures in GDPR consent procedures and examine a variety of alternative tools available.