The problem with GDPR and cookie banners is that GDPR allows the cookie banners to be worded so indirectly. "To improve our service we share collected information with 5723 partners..."
If the law would force them to say "Do you want Larry Ellison to get richer by looking through your webcam? [Yes] [No]" it would be a good law.
Ideally it would just be like the Do Not Track flag, with one flag for each category of opt-out tracking, but actually enforced (even if on by default) so no popups would be needed at all.
Imagine you have an AI button. When you click it, the locally running LLM gets a copy of the web site in the context window, and you get to ask it a prompt, e.g. "summarize this".
Imagine the browser asks you at some point, whether you want to hear about new features. The buttons offered to you are "FUCK OFF AND NEVER, EVER BOTHER ME AGAIN", "Please show me a summary once a month", "Show timely, non-modal notifications at appropriate times".
Imagine you choose the second option, and at some point, it offers you a feature described as follows: "On search engine result pages and social media sites, use a local LLM to identify headlines, classify them as clickbait-or-not, and for clickbait headlines, automatically fetch the article in an incognito session, and add a small overlay with a non-clickbait version of the title". Would you enable it?
Ideally the user interface for any tool I use should never change unless I actively prompt it to change, and the only notifications I should get would be from my friends and family contacting me or calendars/alarms that I set myself.