Sometimes, you’re trundling along through the digital forest, trying to navigate terms of service longer than Dostoevsky’s back catalogue, when suddenly… there’s a Larch.

Unexpected. Tall. Mildly majestic. And utterly irrelevant to the rest of what’s about to happen.

The Google fonts fiasco: Helvetica, but make it litigious

In a plot twist worthy of Kafka, a German court (Landgericht München, civil chamber number three, for those playing Regulation Bingo at home) ruled that simply including a Google-hosted font on your website amounts to illegally handing over users’ IP addresses to Google. No consent. No justification. No shady disclaimer hidden in 6pt grey-on-grey legalese.

You wanted a pretty header in Roboto. What you got was a GDPR violation and possibly a strongly-worded letter from someone’s lawyer. Congratulations.

The lesson? Host your fonts locally. Or face the wrath of The Font Police. (Which sounds silly, until you realise they wear suits and work in regulatory bodies.)

Ah yes, the CNIL—the ever-watchful French data protection regulator—finally had enough of the “click here to accept cookies” scam masquerading as user choice. In a move that shocked absolutely no one but enraged tech lobbyists everywhere, CNIL fined Google and Facebook for making it absurdly easier to say “yes, track me” than “no, kindly piss off”.

Apparently, if you want to accept cookies, it’s a single click. If you want to refuse them, it’s like playing Minesweeper in the dark with a blindfold on—seven clicks, two hidden menus, and a small chance of triggering a newsletter subscription.

Who knew “freely given, specific, informed and unambiguous” was supposed to be more than just regulatory poetry?

The transparency & consent framework: Gaslight, gatekeep, GDPR violate

Imagine a pop-up appears on your screen. It says, “We respect your privacy.” Then it proceeds to ask you whether 853 ad vendors can gently harvest your data unless you manually untick each box.

That, dear reader, is the Transparency & Consent Framework (TCF) in action—a consent system built by the online ad industry for… well, the online ad industry.

The Belgian Data Protection Authority (APD) wasn’t having it. In a moment of rare clarity, they determined that IAB Europe—the folks behind this charming digital labyrinth—is in fact a data controller. And, wouldn’t you know it, their pop-up carnival ride of checkboxes violates the GDPR. All those delightful little “consent strings” that follow you across the internet? Yeah, those are illegal now. Delete everything and start again.

(One suspects the real offence here was making regulators use the system themselves.)

Google Analytics: Big Brother is watching your bounce rate

Meanwhile, over in France, the CNIL took aim at yet another household data vampire—Google Analytics. It turns out that quietly shipping European website traffic data off to the US, where privacy laws have the structural integrity of wet cardboard, might not be entirely compliant with the GDPR.

Following complaints from NOYB (None of Your Business—yes, really), the CNIL came to the radical conclusion that websites using Google Analytics without proper safeguards are breaking the law. Gasp.

The solution? Well, you can try asking Google nicely. Or switch to something with a smidge less surveillance capitalism baked in, like Burst. No, it’s not as shiny. Yes, it works. And it won’t sell your users’ browsing habits to the highest bidder.

The Larch was a warning

All of this—the fonts, the cookies, the “transparent” consent, the analytics—is a digital ecosystem designed around not giving you control. The irony is that the GDPR isn’t even particularly radical. It just asks companies not to treat your personal data like it’s part of a supermarket loyalty scheme.

And yet, the tech giants cling to every dark pattern and loophole like a toddler refusing to eat vegetables.

So yes, sometimes in this mess, you’ll stumble across a Larch. A sudden act of enforcement. A judgment. A fine. A slap on the wrist.

But unless we start asking harder questions about the system—the ad-funded, attention-maximising, data-mining default setting of the internet—there’ll always be another Larch. And another lawsuit.

And you’ll still be clicking “refuse all cookies” with the precision of a bomb defusal expert.