In the EU, the General Data Protection Regulation and the ePrivacy Directive mandate consent for the use of personal data for the purpose of behavioural advertising and tracking technologies. However, the ubiquity of consent banners has led to widespread consent fatigue and questions about the effectiveness of these mechanisms in protecting data subjects' data. To simplify digital laws and make the EU more competitive, the EU Commission recently proposed the Digital Omnibus, introducing a new Article 88b GDPR to express data subjects' choices in a technical way. While the Digital Omnibus is under legislative negotiation, California residents and residents of other US states can already exercise their rights via Global Privacy Control (GPC), a privacy signal to automatically broadcast a legally binding opt-out request to websites. In light of the Digital Omnibus, we evaluate to which extent GPC can be adapted to the EU legal framework to reduce consent banners, mitigate consent fatigue, and improve data protection for EU users. GPC is based on a technical specification, currently being standardised at the World Wide Web Consortium. By sending a GPC signal, data subjects can express their refusal or withdrawal of consent under the GDPR to the use of their personal data for cross-context ad targeting and, in some cases, to express their objection under the GDPR against the use of their data for such purposes. Our evaluation identifies friction between the GPC specification and current EU data protection law. In the longer term, it would be possible for the EU legislator to amend EU laws, as proposed in the current Digital Omnibus, in such a way that internet users can use automated signals to express choices about personal data use and online tracking. In the shorter term, websites and companies who conduct online tracking can already honour GPC.

翻译：在欧盟，《通用数据保护条例》与《电子隐私指令》规定，基于行为广告目的使用个人数据及跟踪技术须征得用户同意。然而，同意横幅的泛滥已导致普遍的同意疲劳，并对这些机制保护数据主体数据的有效性提出质疑。为简化数字法规并提升欧盟竞争力，欧盟委员会近期提出《数字综合法案》，引入新的《通用数据保护条例》第88b条，旨在以技术化方式表达数据主体的选择。在《数字综合法案》处于立法谈判阶段的同时，加利福尼亚州及其他美国州居民已可通过“全球隐私控制（GPC）”行使权利——这是一种自动向网站广播具有法律约束力的选择退出请求的隐私信号。基于《数字综合法案》，我们评估GPC在何种程度上可适配欧盟法律框架，以减少同意横幅、缓解同意疲劳并改善欧盟用户的数据保护。GPC基于一项技术规范（目前正由万维网联盟进行标准化）。通过发送GPC信号，数据主体可根据《通用数据保护条例》表达拒绝或撤回对跨场景广告定向使用个人数据的同意，并在某些情形下以此表达反对将数据用于此类目的。我们的评估揭示了GPC规范与现行欧盟数据保护法之间的冲突。长期来看，欧盟立法者可按当前《数字综合法案》提案修改欧盟法律，使互联网用户能够通过自动化信号就个人数据使用与在线跟踪表达选择；短期而言，开展在线跟踪的网站及公司已可遵守GPC。