I think you're right that many (most?) CMPs are broken, though usually not deliberately. Most try to gate analytics and ad tracking on consent, just often misconfigured. The common exception is companies that deliberately hide Reject All, which is not complaint

My company scanned 209 European regulated sites in June, and roughly 7 in 10 had tracking that wasn't correctly gated by consent. It's rarely indifference, though. DPOs in the EU hold too much weight for that. It's usually a tag added that was never wired into the CMP or something added by a dev or LLM without going through proper review

Full disclosure: I run https://consentmark.com, which measures what tags actually fire under each consent state to create evidence packs companies can show regulators

I don't buy it. 70% of the CMPs being "misconfigured" tells us that even if these panels were broken by design, the companies using them must all conveniently not notice this. Strange, given that even a small risk of large fines or prolonged legal process with public entities would warrant someone paying at least a moment of attention to this. I suspect they are, and the choice of leaving things misconfigured is deliberate.

> something added by a dev or LLM without going through proper review

FWIW, this was a problem long before LLMs were a thing, and it didn't get worse with LLMs. If anything, I'd expect LLMs to get it right by default, because ones ~everyone is using are all trained straight, they won't just silently read between the lines and write code/configs to facilitate one's illegal business model.

> I suspect they are, and the choice of leaving things misconfigured is deliberate.

That honestly doesn't fit our data or my experience. In our scanning, about 60% of the misconfigured sites had a CMP with blocking active but one or two tags bypassing consent controls

Generally those misconfigurations aren't valuable to the business. We don't see for example lots of ad targeting and conversion tracking firing without consent on an otherwise compliant site.

What we do see is things like sites with CMPs generally working, but one or two analytics events tags firing because consent wasn't properly added to a trigger, or embedded Youtube cookies set without consent, or unexpected data from a URL or query param being accidentally ingested by tracking, or devs adding performance monitoring or observability tools to applications without realising the compliance implications

There's not much business logic in paying for a CMP, blocking your own ad stack, but then letting three analytics events pass through

> FWIW, this was a problem long before LLMs were a thing, and it didn't get worse with LLMs.

This isn't supported by our experience. In the last 18 months, we've seen a big increase in ungated tracking that we catch in CI (albeit with overall much higher velocity in general). LLMs will happily add non-compliant tracking to sites, often following defaults that might be acceptable in the US but not EU. If you push back, they'll also happily implement compliant tracking, but it's definitely not the natural default you can rely on

But your comment left me curious, so I just ran an experiment via Codex -p (gpt-5.6-sol) and Opus 5 via Bedrock

Codex returned the vendor quickstart on 5 of 5 neutral prompts. It gated properly when told the company is Irish, with full Consent Mode v2 defaults denied, GA4 only mounting after consent, with a reject button

So models can produce compliant/non-compliant code based on the context you give them, which reflects what we've seen in industry

Our business is giving devs and increasingly LLMs efficient tests to check the tracking they add is as expected for the EU and then providing signed evidence packs that prove that behaviour at a given time

Another tiny data point example: A previous company used Stripe for a very niche feature (most companies who used our product didn't ever enable it) but having the SDK in the bundle drops their "anti-fraud" cookies, whatever they are). That is exactly the kind of thing that a CMP won't be able to fix without deeper engineering work, and which doesn't actually matter anyway because no one is profiting from that -- but that's the kind of thing that a company could be sued or fined for. A complete distraction from what actually matters.

They can become a lot more expensive than $100, but the difference between a Littman Cardiology and the $15 EMT student stethoscope is night and day.

> Currently, the stethoscope resulting from this project functions as well as the market gold standard, the Littmann Cardiology III

If this is true, it's a major achievement.

Part of it is that webcams are nearly impossible to buy since the pandemic arose, but apart from that, webcam image quality is terrible - even expensive webcams in the price range of ~100's of Euro.

A recent iPhone will wipe the floor with any webcam I've come across, short of an SLR or mirrorless camera.

How do you track the number of Kms driven? Is it possible to do so while maintaining the privacy of individuals?

Every car has an odometer... one could think of a relatively convenient scheme where you can get your car inspected once a year at any refueling station, and tampering with the odometer is a crime. Won't stop everyone, but does it matter?

How do you distribute the money to places where people drive but don't live? Gas tax handles this to an extent, but milage tax wouldn't; not without border checkpoints or mass surveillance.

The government has stats on how busy easy road is. Just pool all of the money and distribute it based on those stats.

To give an example - in my hometown in a few places there are small wires on the road surface that measure the number of cars that drive over it. Private by default!

They're probably accurate to within less than 10%. How many kilometers would you have to drive to save a dollar from slightly bigger tyres?

I was being slightly facetious in referencing tyre size, although people regularly have to adjust speedo/odometers by 10% or more when fitting large tyres on off-roaders.

Odometers can have their values changed at will, at least in ICE vehicles, often for valid reasons.

Fudging do numbers illicitly is already a huge no-no in the US.

It also is in Ireland, but there are valid reasons, such as as replacing an ECU or dash cluster.

Unless auto manufacturers are required to fit much more secure odometers, I can't see them in their current incarnation used as the basis for a tax.

New Zealand collects road tax on diesel vehicles using odometer readings. It generally works for heavy commercial vehicles where the owners have more to lose risking fraud but I know private vehicle owners who would wind back or disconnect their odometer to avoid the tax.

It's more difficult than that: How do you track the number of Kms driven on public roads. As claimed purpose of tax was to cover the wear on these.

Only five US States don't have Sales Tax, and most counties and cities have their own, too.

Similarly, in Ireland where we run 230VAC single phase, three phase 400VAC allows up to 22kW to be delivered, which is about to become extremely useful as we migrate to electric transportation.

Also, on safety, I don't know the statistics, but subjectively, electricity feels much more dangerous in the US because of the plug and socket design.

And more safely, as there is no possibility of superheating the water.

And the famine was the big hunger (an Gorta Mór).

Interesting. In Ireland, they're referred to as RTCs (collisions), although still referred to as accidents in law. Never come across RTI before.

.

Not saying that surveillance is right, but I've lived in London for a year and a half and never felt this way, I don't think I've ever talked to someone who felt this way there, you must be a very paranoid individual.

I will say this though: having lived in both Beijing and London, I've always felt ultra safe (and I lived in London during some terrorist attacks). On the other hand, I lived in SF for the same time and I never felt safe there, avoiding walks at night, avoiding public transport for the most part, avoiding some streets, etc. I also lived in Chicago and I felt much worse there (at least in SF I could still take walks).

On the other hand, although I find driving in SF much more stressful and confusing than London(despite being a native RHT driver), I never managed to get a ticket in SF. Every time I visit London I keep getting letters with some bullshit traffic violation captured by a camera for months after I am back.

Also having lived in London for 7 years, I can't say I felt safe walking at night other than in the very central places. Try visiting Elephant and Castle or Seven Sisters alone during the night.

Edit: spelling

> although I find driving in SF much more stressful and confusing than London(despite being a native RHT driver), I never managed to get a ticket in SF.

Did you ever park outside a parking garage?

> Try visiting Elephant and Castle or Seven Sisters alone during the night.

Did that many times, it was fine? Only place I've ever felt unsafe was Brentford after I got hassled there.

Did you enter the congestion zone without paying?

That's fined pretty swiftly.

Would London or Beijing turn into a Chicago or SF if it weren’t for CCTV?

Would Chi or SF become a London or Beijing with CCTV?

Doubtful to both. But a lot can be explained by social determinants of wealth and what that turns people into.

I assume they took offence with the "you must be very paranoid" just because someone feels odd about surveillance. It certainly seems pretty rude to me.

I think non-CCTV plastered European cities is probably a more apt comparison than Chicago and San Francisco, two cities that have a reputation for being unsafe in the US (which has major problems with violent crime across the board).

.

> I also lived in Chicago and I felt much worse there (at least in SF I could still take walks).

Depends where you are and what times.

3am on the redline in the northside.. Be ready to move at a moments notice.

Not to discount your feelings completely, but I’m always a little skeptical when someone says a place “feels” safe or unsafe. Do you have reason to believe you actually were less safe in San Francisco compared to London?

My first two weeks in SF I took the bus twice, the first time a group of kids started slapping random people, I was prepared to fight and protect my SO but they didn't get to me; the second time some guy just ran and took a girl's phone, she grabbed to it for what seemed like a full minute, screaming and shit, then finally let go... I was paralyzed, especially after the event of the previous week, after that I vouched not to ever take the bus again in SF.

After that some homeless people screamed at me, some tried to punch me slowly (easy to avoid), I got used to it with time but it's still not a nice feeling to take walks. I wouldn't let my SO walk alone at 3AM through the streets for example (while I would have no problems with that in London or Beijing).

Murder rate in London, including terrorism: 1.6 per 100,000.

Murder rate in San Francisco: 5.17 per 100,000.