The annoying popups are not “oops” of the legislation, but rather an act of malicious compliance from data harvesting companies. The tracking industry wants people to associate the right to privacy with stupid annoyance, so that people will stop demanding privacy.

The legislation does not say anything about cookies. It’s about rights and responsibilities in data collection (no matter how it’s done technically). The “consent” part of it exists as a compromise, because there has been heavy lobbying against the legislation from the ad industry. This is not a technical problem — we’ve had many technologies for it, and the industry has sabotaged all of them.

There was P3P spec already in 2002! It has been implemented in IE that had 90%+ market share back then. And Google has been actively exploiting a loophole in IE’s implementation to bypass it and have unlimited tracking. Then Google has paid fines for subverting Safari’s anti-tracking measures. Then browsers tried DNT spec as the simplest possible compromise, and even that has been totally rejected by the data harvesting industry. There are easy technical solutions, but there are also literally trillions of dollars at stake, and ad companies will viciously sabotage all of it.