To add to that now every other website has an annoying and useless cookie dialog I have to dismiss, as if that's forward progress in privacy protection.
That is the website owners implementing the rules in the worst way possible, either through incompetence or through deliberately trying to annoy (or fool) you into accepting everything.
Can I be angry at both? Legislation is only required to regulate bad behavior by some set of entities. As such, legislation should be written assuming that those entities will exploit any loopholes. Malicious compliance is exactly what the EU should have expected and planned for.
Well, not quite. They are forced to stop hiding what they were doing. They could make everything opt-in, and it could be simple single checkbox or button, they are not forced to do any of what they are currently doing.
And if it makes people angry at the legislation, the lying back-stabbing “your privacy matters to us” arseholes in marketing are successfully making that goal backfire.
> Malicious compliance is exactly what the EU should have expected and planned for.
It usually isn't compliance, malicious or otherwise.
It is malicious “we know we are breaking both the letter and the intent, but we know they don't have resources to properly enforce against everyone, so we are going to chance it for as long as we can”. The vast majority of these consent systems are not compliant with any of the relevant regulations (ePrivacy Directive, GDPR, CCPA, …). They will fix it when they get a slap on the wrist. If they get anything it will be a slap or a warning because while anyone in their right mind is pretty sure that the non-compliance is deliberate, that is nigh-on impossible to conclusively prove.
